American Express Fined $350 Million Over Anti-Money Laundering Failures Linked to $13 Billion in Suspected Activity

American Express National Bank has been hit with a $350 million penalty after U.S. regulators found systemic weaknesses in its anti-money laundering controls, including failures to adequately identify, evaluate, and report approximately $13 billion in suspected trade-based money laundering activity over more than a decade.

The enforcement action, announced on October 8, 2026, by the Office of the Comptroller of the Currency (OCC), places renewed attention on a fundamental challenge for financial institutions: compliance systems must reflect the risks of the businesses they actually operate, not simply the products that are easiest to monitor.

The OCC said American Express National Bank failed to maintain an anti-money laundering and Bank Secrecy Act compliance program capable of adequately detecting and reporting suspicious activity. Regulators identified weaknesses in staffing, employee expertise, internal controls, independent testing, training, customer identification, and due diligence.

The Federal Reserve separately announced an enforcement action against American Express Company and American Express Travel Related Services Company. Together, the actions require the company and relevant entities to address deficiencies in their financial-crimes compliance programs. <Cite refs={[“turn987379view0″,”turn987379view1”]}/>

The findings are significant not only because of the size of the penalty but also because of the duration and scale of the monitoring failures. According to the OCC, the suspected activity covered the period from June 2014 through May 2025.

The regulator did not say that the entire $13 billion had been proven to represent money laundering. Rather, it found that the bank failed to identify, evaluate, and sufficiently report the full scope of suspected activity in a timely manner.

American Express Faces $350 Million AML Penalty

The OCC announced a $350 million civil money penalty against American Express National Bank, based in Sandy, Utah, alongside a cease-and-desist order.

The regulator said the bank failed to establish and maintain a compliance program reasonably designed to ensure and monitor adherence to the Bank Secrecy Act and its implementing regulations.

The Bank Secrecy Act requires financial institutions to maintain controls that help identify and report suspicious financial activity. Anti-money laundering programs support those obligations by helping institutions understand customer risks, monitor transactions, and provide relevant information to law enforcement.

In the American Express case, the OCC identified systemic weaknesses across several parts of the compliance framework. The issues included insufficient resources, employees who lacked adequate expertise, gaps in internal controls, weak independent testing, and inadequate anti-money laundering training for employees and directors.

The OCC also concluded that the bank’s customer due diligence and customer identification procedures contributed to its monitoring and reporting failures.

These are connected responsibilities. A bank needs to understand who its customers are, assess the risks associated with their activity, and ensure its monitoring systems can identify transactions that warrant further investigation. If one part of that process is ineffective, the weaknesses can affect the entire compliance framework.

What the $13 Billion in Suspected Activity Means

The figure at the center of the enforcement action is approximately $13 billion in suspected trade-based money laundering activity that the bank failed to identify, evaluate, and sufficiently report in a timely manner.

That figure requires careful interpretation.

It is not a statement that regulators proved $13 billion had been laundered, nor does it establish that every transaction involved criminal conduct. Instead, it describes the scale of suspected activity associated with the bank’s monitoring and reporting failures, as set out in the OCC’s findings.

Trade-based money laundering generally involves disguising the proceeds of crime through commercial transactions. Criminals may exploit the movement, pricing, or payment of goods and services to make illicit funds appear connected to legitimate economic activity.

Such schemes can be difficult to detect because transactions may resemble ordinary business activity. Effective controls, therefore, need to consider patterns, counterparties, transaction behavior, and the broader context of customer activity rather than treating each payment as an isolated event.

For a financial institution, suspicious activity monitoring is not simply about identifying a single unusually large transaction. It also requires systems and trained personnel capable of evaluating whether activity makes sense for a particular customer and whether a wider pattern warrants investigation.

The OCC’s findings underline the consequences when those processes do not operate effectively: potentially important information may not reach law enforcement in a timely manner.

Why Regulators Focused on Credit and Charge Cards

One of the most notable findings concerned the way American Express National Bank assessed its own money laundering risks.

According to the OCC, the bank focused too heavily on its relatively narrow demand deposit account products and services while insufficiently accounting for risks associated with its more dominant credit and charge card businesses. <Cite refs={[“turn987379view0”]}/>

That mismatch matters because a financial institution’s risk profile is shaped by the products it offers, how customers use them, and the transactions those products support.

A compliance framework that focuses disproportionately on one segment of a business may overlook risks arising elsewhere. The OCC found that American Express’s risk assessments did not adequately reflect the scale and nature of its card operations.

The finding illustrates a broader lesson for banks, card issuers, and payment providers: AML risk assessments need to evolve alongside the business.

As products, customer segments, and transaction patterns change, financial institutions must reassess whether their monitoring systems, customer information, and reporting procedures remain appropriate. A control framework that is adequate for one set of products may be insufficient for another.

The case also highlights the importance of connecting compliance oversight to business strategy. Risk teams need visibility into how products are used, while senior management and boards need reliable information about whether the institution’s controls match its exposure.

Staffing, Training, and Internal Controls Under Scrutiny

The OCC identified several weaknesses that extended beyond transaction-monitoring technology.

The bank had inadequate resources, including personnel without sufficient expertise. The regulator also cited systemic internal control gaps, weak independent testing, and insufficient training for employees and directors. <Cite refs={[“turn987379view0”]}/>

These findings demonstrate why financial-crime compliance cannot be reduced to purchasing a monitoring platform or deploying automated alerts.

Technology can help identify patterns and flag transactions, but institutions still need qualified personnel to assess alerts, investigate unusual activity, determine whether reports are required, and maintain defensible records of their decisions.

Training also matters because employees need to understand the risks relevant to their roles. Directors and senior leaders must be able to oversee the program and recognize when its staffing, procedures, or performance are inadequate.

Independent testing provides another layer of assurance. It can help determine whether controls work as intended, whether monitoring rules capture relevant risks, and whether weaknesses have been addressed effectively.

When these elements fail together, problems can persist across the institution rather than remaining isolated operational errors.

The OCC’s action therefore raises questions about how the bank assessed compliance performance, allocated resources, and ensured that oversight reflected the risks of its full business.

Federal Reserve Issues a Separate Enforcement Action

The OCC’s penalty was not the only regulatory action announced on October 8.

The Federal Reserve issued a separate enforcement action against American Express Company and American Express Travel Related Services Company. The central bank said it had identified significant deficiencies in the implementation of the company’s enterprise-wide anti-money laundering program, particularly at its subsidiary national bank. <Cite refs={[“turn987379view1”]}/>

The distinction between the two actions is important. The OCC’s announcement specifies the $350 million civil money penalty against American Express National Bank. The Federal Reserve’s action addresses the parent company and the named subsidiary and is a separate enforcement measure.

The actions are coordinated, but they should not be described as two separate $350 million fines. The $350 million figure is the penalty announced by the OCC.

The combined regulatory response signals that supervisors expect the company to address both deficiencies within the bank and weaknesses in the wider compliance program.

For financial groups with multiple entities, this is an important governance issue. A subsidiary may carry out particular financial activities, but parent-level oversight, risk management, and compliance governance can influence how effectively controls operate across the organization.

American Express Says It Will Strengthen Financial-Crime Controls

American Express said it takes its responsibility to combat financial crime seriously and is committed to addressing the concerns outlined by the OCC and Federal Reserve.

In its October 8 statement, the company said internal and external reviews had identified areas for improvement in its Financial Crimes Compliance program. It also said it had investigated transactions in which individuals misused its products to purchase goods and services, reported information to law enforcement, and taken other appropriate action. <Cite refs={[“turn272189search1”]}/>

The company said a portion of the civil money penalty had been reserved in prior periods, meaning the penalty would not affect its full-year 2026 financial guidance.

American Express also said the consent orders do not impose an asset cap and that costs associated with addressing the requirements were not expected to affect its 2027 guidance.

Those statements address the company’s expected financial impact. They do not remove the operational work required to remedy the deficiencies identified by regulators.

The company will still need to strengthen its controls, demonstrate that its monitoring and reporting systems are effective and address the concerns raised in the enforcement actions.

American Express agreed to the consent orders without admitting or denying the regulators’ findings, according to the reported enforcement terms. The regulatory findings should therefore be described as findings under the consent orders, rather than as a separate criminal conviction.

What the Enforcement Action Means for Banks and Payment Providers

The American Express case has implications beyond one card issuer.

Banks, payment processors, card networks and other financial institutions operate across products and channels that can create different forms of financial-crime exposure. Their compliance programmes need to account for those differences.

The first lesson is that risk assessments must reflect actual business activity. Institutions cannot rely on an AML framework designed mainly around deposit accounts if other products represent a substantial part of their operations or introduce different transaction risks.

The second lesson is that monitoring systems must be supported by strong customer information. Identification and due diligence processes help institutions understand who is using their products and whether observed activity is consistent with the expected customer profile.

The third lesson concerns staffing and accountability. Effective compliance depends on people with appropriate expertise, clear escalation procedures, sufficient resources and oversight that can identify persistent weaknesses.

Finally, independent testing and remediation are essential. Institutions need to determine not only whether controls exist on paper, but also whether those controls detect and report suspicious activity effectively in practice.

For payment providers, these requirements are particularly relevant as transaction volumes grow and customers use a wider range of products to move money. Faster or more convenient payments do not remove the need to understand the risks associated with the transactions being processed.

Why the Case Matters for Financial Crime Compliance

The $350 million penalty is a substantial enforcement action, but the wider issue is the regulator’s assessment of the compliance framework behind it.

The OCC described failures involving risk assessment, customer due diligence, identification procedures, transaction monitoring, reporting, training, staffing and internal controls. Those elements are interdependent: weaknesses in one area can reduce the effectiveness of the others.

The approximately $13 billion figure gives the case additional significance because it illustrates the scale of suspected activity associated with the identified monitoring and reporting failures. It should not, however, be treated as a verified measure of criminal proceeds.

The Federal Reserve’s separate action also highlights the importance of enterprise-wide oversight. Financial-crime controls must operate effectively within individual businesses and receive appropriate attention from the wider corporate group.

For regulators, the objective is to ensure that financial institutions maintain systems capable of identifying suspicious activity and providing useful information to law enforcement. For institutions, that means compliance programmes must be properly resourced, regularly tested and aligned with the risks of their products and customers.

What Happens Next for American Express?

American Express now faces the task of addressing the deficiencies identified in the OCC and Federal Reserve enforcement actions.

The company’s stated position is that it is committed to strengthening its Financial Crimes Compliance programme and that the penalty will not change its 2026 financial guidance. It also does not expect compliance-related costs to affect its 2027 guidance.

The more consequential test will be whether the company can demonstrate that its risk assessments, customer controls, transaction monitoring, reporting procedures, training and oversight are operating effectively.

For the wider financial sector, the case is a reminder that anti-money laundering compliance must keep pace with the scale and complexity of a business. Institutions need to ensure that their controls cover the products customers actually use, not just the areas that appear easiest to supervise.

American Express’s $350 million penalty ultimately highlights a central principle of financial-crime compliance: institutions must be able to recognise suspicious activity, investigate it appropriately and report it in time for law enforcement to act.

American ExpressAmerican Express $350 Million FineAmerican Express AML FineAmerican Express National BankAML complianceAML ControlsAnti-Money LaunderingBank Secrecy Actbanking compliancebanking regulationCharge CardsCompliance Failurescredit cardsCustomer Due DiligenceFederal ReserveFinancial Crimefinancial crime compliancefinancial servicesfinancial technologyfintechMoney Laundering PreventionOCCOffice of the Comptroller of the Currencypayment cardsregulatory enforcementRisk ManagementSuspicious Transaction MonitoringTrade-Based Money LaunderingU.S. banking