Answer by Randy Carey:
Ask the third party vendor for the citation to support their claim. They won't have one.
Answer by Ken Golliher:
The vendor will not be able to cite a law or regulation that says the question is required on a loan application. Its response may be that the new due diligence regulation, combined with the fact that non U.S. persons are "subject to expanded examination overview," suggests that banks should identify NRAs at account inception.