American Express fined $350m after AML controls failed to capture $13bn in suspected trade-based laundering

On 8 October 2026, the Office of the Comptroller of the Currency issued a cease-and-desist order and imposed a $350 million civil monetary penalty on American Express National Bank over deficiencies in its Bank Secrecy Act and anti-money laundering compliance programme.

The central problem was a mismatch between the bank’s risk assessment and its actual business. According to the OCC, the assessment concentrated on risks in a relatively narrow demand-deposit business while giving insufficient attention to the bank’s much larger credit and charge-card products. The regulator also identified inadequate specialist resources, systemic internal-control gaps, weak independent testing and insufficient risk-based training.

The consent order connects that strategic mismatch to weaknesses in customer controls. It says the bank lacked an effective framework for ongoing customer due diligence and for understanding the nature and purpose of customer relationships. Customer-identification procedures did not consistently support a reasonable belief that the bank knew each customer’s true identity, while incomplete customer information affected risk ratings, monitoring and suspicious-activity investigations.

From approximately June 2014 to May 2025, the bank processed about $13 billion in suspected trade-based money-laundering activity, including suspicious card charges and related repayments. Some activity involved accounts associated with bank insiders. The OCC says the bank periodically reported suspicious activity, but its controls and monitoring did not identify, evaluate and report the full scope in a timely and sufficient way. The figure describes suspected activity requiring analysis and reporting; it is not a finding that the entire amount was proven to have been laundered.

The OCC acted alongside a Federal Reserve enforcement action concerning American Express Company and American Express Travel Related Services Company. In consenting to the OCC order, the bank neither admitted nor denied the findings. The order also notes that it had begun corrective action.

The required remediation is extensive. It includes a board-level compliance committee, a formal action plan, a refreshed institution-wide risk assessment, stronger CDD and customer-identification controls, monitoring across all business lines, documented testing of thresholds and models, improved audit and training, and an independent look-back to determine whether earlier suspicious-activity reports need to be filed, corrected or amended.

This action shows that an AML risk assessment can be formally documented and still fail operationally if it does not reflect where the institution’s real transaction volume and exposure sit. Control design needs to follow the business model, including dominant products, customer types, transaction routes, geographies and methods of interaction.

For KYB teams, the connection between customer evidence and transaction monitoring is especially important. Establishing that a company exists is not enough. Teams also need to understand why the relationship exists, how the business expects to use a product, the likely scale and pattern of activity, and how charges or other obligations will be funded and repaid. Those expectations should influence the customer risk profile and the monitoring applied after onboarding.

The case also illustrates why customer and activity data cannot remain separated by product or business unit. Card activity, repayments, deposit movements, associated accounts, counterparties and insider relationships may each look incomplete in isolation. Effective data coverage depends on resolving those records to the same customer or connected network so investigators can see the combined pattern.

Monitoring logic must then remain proportionate to that profile. The OCC order requires rules, thresholds and filters to be tested against the actual customer base, products, services and geographies, with changes approved and documented. This makes continuous monitoring a feedback loop: changes in customer activity should affect risk, while changes in risk should affect monitoring and review.

Finally, the order treats evidence and governance as part of control effectiveness. Alert decisions, threshold changes, overrides, backlogs, testing results and remediation progress must remain visible to management, independent reviewers and the board. A control that cannot be reconstructed later is difficult to challenge, validate or improve.