American Express Faces $350 Million Penalty Over Anti-Money Laundering Failures

American Express National Bank has been ordered to pay a $350 million civil money penalty after US banking regulators identified significant weaknesses in its anti-money laundering (AML) compliance programme, including failures to identify, investigate and report approximately $13 billion in suspected trade-based money laundering activity over roughly a decade.

The Office of the Comptroller of the Currency (OCC) announced the penalty on October 8, 2026, alongside a cease-and-desist order requiring the bank to address deficiencies in its compliance framework. On the same day, the Federal Reserve Board issued a separate enforcement order against American Express Company and American Express Travel Related Services Company, requiring improvements to group-wide financial crime controls and oversight.

The OCC found that American Express National Bank had failed to maintain an AML programme adequately aligned with the risks of its business. Identified weaknesses included insufficient resources, staff lacking appropriate expertise, inadequate employee and director training, systemic internal control gaps and ineffective independent testing.

According to the regulator, these shortcomings contributed to failures in the bank's suspicious activity monitoring and reporting processes. The bank did submit some suspicious activity reports, but its systems did not identify, evaluate and sufficiently report the full extent of the activity in a timely manner.

The approximately $13 billion figure relates to suspected trade-based money laundering activity processed between around June 2014 and May 2025. The figure includes suspicious credit and charge card transactions and associated repayments. It represents activity identified by the regulator as potentially suspicious, not a judicially established amount of criminal proceeds.

The OCC also found that the bank's risk assessment placed disproportionate emphasis on its relatively limited demand deposit products while giving insufficient attention to its substantially larger credit and charge card businesses. Deficiencies in customer identification and customer due diligence further weakened the bank's ability to understand customer relationships, assign appropriate risk ratings and detect suspicious activity.

The case highlights the importance of assessing money laundering exposure across an institution's actual products and transaction flows rather than concentrating primarily on traditional deposit accounts. For American Express, the regulator's findings concerned a mismatch between the scale and nature of its card operations and the controls used to identify suspicious financial activity.

The Federal Reserve's separate order addresses deficiencies at the wider corporate level. It requires American Express Company and its travel-related services subsidiary to strengthen enterprise-wide AML oversight, improve transaction monitoring and ensure that relevant information reaches the appropriate compliance and management functions.

The Federal Reserve also identified shortcomings involving fraud referrals, third-party risk assessment and financial crime risk management. Its order requires the group to establish stronger board oversight and demonstrate that management has the resources and accountability necessary to implement effective controls across business lines and legal entities.

Under the Federal Reserve order, the board must submit an oversight plan within 90 days. The plan must explain how directors will oversee remediation, hold senior management accountable, ensure adequate resources and receive sufficient information about the implementation of corrective measures.

The group must also submit a written plan to improve its consolidated Bank Secrecy Act and AML risk management framework. The requirements are intended to address the underlying weaknesses identified by regulators rather than merely correct individual reporting errors.

The order imposes additional requirements on American Express Travel Related Services concerning sanctions compliance. The subsidiary must submit a plan addressing its assessment of exposure to sanctions risks, staff training, internal policies and screening procedures. The Federal Reserve's order does not identify a specific sanctions violation or impose a separate monetary penalty for sanctions-related conduct.

The enforcement action also includes provisions concerning individuals connected to the misconduct described in the regulators' findings. The restrictions apply to individuals meeting specified conditions involving participation in the underlying misconduct, formal disciplinary action and separation linked to that conduct. The order also requires cooperation with continuing regulatory investigations.

American Express must provide progress reports describing the measures implemented, outstanding corrective actions, implementation schedules and results. These reporting requirements allow regulators to monitor whether the group's plans translate into effective operational changes.

The OCC's $350 million penalty is separate from the Federal Reserve's order, which focuses on corrective action and governance requirements rather than imposing an additional monetary fine. Both actions were issued through consent orders. American Express National Bank neither admitted nor denied the OCC's findings, while the parent companies consented to the Federal Reserve's order without admitting or denying its allegations.

American Express said it was committed to addressing the regulators' concerns and continuing to strengthen its financial crime controls. Chief Executive Officer Stephen Squeri acknowledged that further work was necessary and said the penalty and associated compliance costs were not expected to affect the company's financial guidance for 2026 or 2027.

The case adds to regulatory scrutiny of how large financial institutions manage money laundering risks across complex card and payment businesses. It also illustrates the consequences of weaknesses that persist across customer due diligence, transaction monitoring, suspicious activity reporting, independent testing and senior management oversight.

The remediation process will continue under regulatory supervision, with American Express required to demonstrate that the identified deficiencies have been addressed and that its AML and sanctions compliance arrangements operate effectively across the group.

By fLEXI tEAM