Financial institutions should “identify, measure, monitor and control these risks” in a way that that assesses “a borrower’s willingness and capacity to repay,” regulators said.