OCC and Federal Reserve Levy Parallel BSA/AML Enforcement Actions Against American Express
The OCC and Federal Reserve Board have issued parallel enforcement actions against American Express, including a $350 million penalty and a mandatory SAR look-back, citing systemic BSA/AML failures and $13 billion in unreported suspected trade-based money laundering.
Executive Summary
On October 8, 2026, the Office of the Comptroller of the Currency (OCC) and the Federal Reserve Board issued coordinated enforcement actions against American Express regarding enterprise-wide Bank Secrecy Act and Anti-Money Laundering (BSA/AML) deficiencies. The OCC issued a cease-and-desist order and assessed a $350 million civil money penalty against American Express National Bank, citing systemic breakdowns in suspicious activity monitoring and approximately $13 billion in unreported suspected trade-based money laundering. Concurrently, the Federal Reserve issued a consent order demanding enhanced board oversight and comprehensive compliance plans from the parent company and its travel-related services subsidiary. For Chief Anti-Money Laundering Officers (CAMLOs) and bank regulatory counsel, this enforcement action serves as a severe warning about the consequences of misaligning risk assessments with actual product dominance and failing to adequately monitor third-party network partnerships.
Want weekly regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.
What Happened
On October 8, 2026, federal banking regulators announced parallel enforcement actions against American Express entities over systemic BSA/AML compliance failures.
The OCC issued a cease-and-desist order against American Express National Bank, assessing a $350 million civil money penalty. The agency cited the bank for failing to establish and maintain a compliance program reasonably designed to meet BSA requirements. The OCC specifically noted that the bank's risk assessment was fundamentally flawed: it focused heavily on the bank's narrower deposit account products while paying insufficient attention to its dominant credit and charge card products. Because of these systemic control gaps and inadequate staffing expertise, the OCC found the bank failed to timely identify, evaluate, and report approximately $13 billion in suspected trade-based money laundering (TBML) activity between June 2014 and May 2025. The order requires the bank to engage a third-party reviewer to conduct a Suspicious Activity Report (SAR) look-back.
Concurrently, the Federal Reserve Board issued a cease-and-desist consent order against American Express Company and American Express Travel Related Services Company, Inc. (TRS). The order requires the Amex board to submit, within 90 days, a plan to hold senior management accountable and an enterprise-wide BSA/AML compliance plan covering transaction monitoring across all lines of business, network partnerships, and ATM partners. TRS must submit a separate OFAC compliance plan. The Federal Reserve's order does not carry an additional monetary penalty.
Why It Matters for Legal & Compliance
This enforcement action illustrates the severe financial and reputational consequences of operating an AML program that fails to scale with an institution's complexity and actual transaction volume.
- Product Misalignment: The OCC's findings highlight a critical failure in risk assessment weighting. By focusing compliance resources on legacy demand deposit accounts instead of the firm's core credit and charge card operations, the bank created blind spots that allowed massive volumes of suspected illicit activity to go undetected.
- Third-Party and Network Risk: The Federal Reserve's explicit focus on network partnerships, ATM partners, and other third parties signals that regulators expect comprehensive oversight extending beyond direct customer relationships to the intermediaries processing transactions on the network.
- SAR Look-Back Burden: Mandating a third-party SAR look-back is one of the most operationally disruptive and costly enforcement remedies available, requiring institutions to reconstruct years of transaction data to retroactively evaluate and report suspicious activity.
Want weekly regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.
Compliance & Risk Insight: The "Dominant Product" Blind Spot
The central strategic lesson from this penalty is the regulatory intolerance for static, misaligned risk assessments. Compliance departments frequently copy legacy risk weighting models year-over-year without adjusting for shifts in business strategy or product dominance. If an institution generates the vast majority of its revenue and transaction volume from card products, commercial lending, or payment rails, but allocates the bulk of its AML monitoring resources to traditional retail deposits, it is operating a program structurally destined to fail an examination. CAMLOs must ensure that transaction monitoring thresholds and personnel expertise are dynamically matched to the areas generating the greatest volume and inherent risk.
D. Action Items for Organizations
Institutions operating complex payment networks or multiple business lines should consider the following steps:
- Recalibrate Enterprise Risk Assessments: Audit existing BSA/AML risk assessments to ensure that scoring methodologies accurately weight the institution's dominant product lines and transaction volumes appropriately.
- Audit Third-Party Network Controls: Review third-party risk management protocols specifically focusing on network partners, ATM operators, and payment intermediaries to ensure their transaction flows are subjected to rigorous AML screening and SAR evaluation.
- Enhance Trade-Based Money Laundering (TBML) Typologies: Update automated transaction monitoring scenarios to better detect complex trade-based laundering patterns within commercial credit and charge card portfolios.
- Evaluate Staffing and Expertise: Assess whether the compliance department possesses the requisite headcount and specialized expertise necessary to monitor the specific products driving the institution's growth.
Want weekly regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.
Disclaimer: This article does not constitute legal advice. Readers should seek legal or tax advice from their professional advisers regarding their specific regulatory and legal obligations.
