The Office of the Comptroller of the Currency (OCC) on Thursday, October 8, 2026, issued a cease-and-desist order and a $350 million civil money penalty against American Express National Bank, of Sandy, Utah, the bank arm of American Express AMEX, over deficiencies in its Bank Secrecy Act and anti-money laundering (BSA/AML) compliance program. The OCC found that from about June 2014 to about May 2025 the bank processed some $13 billion in suspected trade-based money laundering that it did not identify and report in time or in full. The Federal Reserve Board took a separate action the same day against the parent, American Express Company, and its subsidiary American Express Travel Related Services Company (TRS).
The bank’s risk assessment “focused on the risks in its relatively narrow demand deposit account products and services and insufficiently on the risks in its more dominant credit and charge card products,” the OCC said. The consent order calls the bank “one of the largest credit and charge card issuers in the United States by transaction volume.” The bank neither admits nor denies the findings.
Card charges and their repayments carried the suspected laundering
The $13 billion included “a combination of suspicious card charges and associated repayments of those card charges,” in some cases through accounts associated with bank insiders, according to the consent order. The bank periodically reported suspicious activity but lacked the controls and monitoring to report its full scope in time. The OCC describes a pattern or practice of noncompliance with suspicious activity report (SAR) filing requirements, with untimely, missed, or incomplete reports.
Among the OCC’s other findings:
- No effective framework for ongoing customer due diligence, which kept the bank from assigning appropriate risk ratings
- Substantial gaps in customer identification procedures
- Weak independent testing, staff without commensurate skills and expertise, and training that did not address job-specific duties
“American Express failed to maintain a BSA/AML compliance program properly aligned with the money laundering risks of its operations, which resulted in the bank’s failures to timely identify and report significant missed suspicious activity and to provide important information to law enforcement,” Comptroller Jonathan Gould said.
An independent look-back at past suspicious activity reports
Under the OCC order, the bank’s board has 15 days to name a compliance committee, and the bank 90 days to submit an action plan. The bank must extend its risk assessment to products “inclusive of accessories and extensions (e.g., supplemental cardholders),” set risk-based transaction limits, fix its alert de-duplication and suppression practices, and add controls for trade-based laundering red flags. An independent consultant will run a SAR look-back to decide whether previously unreported activity requires filings. The bank must also set up an insider activity program.
The Fed’s order reaches the parent and TRS, without a fine
The Fed said its action addresses, among other things, the firm’s failure to sufficiently detect and report certain suspicious activity related to money laundering, and found significant deficiencies in how American Express Company implemented its enterprise-wide AML program, “in particular at the firm’s subsidiary national bank.” The order, which carries no penalty, cites New York Fed findings of weaknesses in transaction monitoring, fraud referral processes, and third-party risk assessment.
Within 90 days, the parent must submit plans on board oversight and on its group AML program, including processes that use information from “network partnerships, ATM partners, and third parties engaged to support BSA/AML compliance.” TRS must submit a plan to comply with Office of Foreign Assets Control (OFAC) sanctions regulations. Amex and TRS may not retain anyone who, based on the firm’s investigative record since 2024, took part in the misconduct behind the order, was formally disciplined for it, and left or was fired over it.
Amex says part of the penalty was already reserved
American Express said in a Form 8-K that the orders resolve “previously disclosed reviews” by banking regulators of certain aspects of its financial crimes compliance program. A portion of the penalty was reserved for in prior periods, and it does not affect the company’s full-year 2026 guidance. The orders impose no asset cap, and the cost of meeting them is not expected to affect 2027 guidance, the company said. Its second-quarter 10-Q, filed July 24, 2026, had said it expected an enforcement action that could include civil money penalties.
“While we have made meaningful progress, we know there is more work to do,” Chairman and CEO Stephen J. Squeri said in a statement reported by PYMNTS, pledging to keep working cooperatively with regulators and law enforcement.