American Express fined $350 million over anti-money laundering deficiencies
Key Facts
The U.S. Office of the Comptroller of the Currency imposed a $350 million civil penalty on American Express National Bank over deficiencies in its anti-money laundering program. The OCC announced the action on October 8, 2026, alongside a cease-and-desist order requiring the bank to address the failures. The regulator linked monitoring and reporting deficiencies to nearly $13 billion in suspected trade-based money laundering activity. The Federal Reserve announced a separate action against the parent company to address its failure to adequately detect and report certain suspicious activities. The bank consented to the findings in the penalty order without admitting or denying them, according to the order.
The activity covered by the regulatory findings extended roughly from June 2014 to May 2025, according to the OCC's remediation order. The amount included card charges and related payments within the suspected trade-based money laundering activity. The bank filed periodic suspicious activity reports during the period in question. But those reports did not cover the full scope of the activity, and the regulator found deficiencies in identifying, assessing and reporting it adequately and promptly. In some cases, the activity involved accounts linked to bank insiders, according to the findings in the remediation order.
The OCC identified insufficient resources among the factors that weakened the anti-money laundering program, including the use of staff with inadequate experience. The regulator described independent testing of the program as "weak" in its statement outlining the deficiencies. It also found that the risk assessment focused on demand deposit products, despite their relatively limited role in the bank's business. By contrast, the assessment paid insufficient attention to the risks associated with credit and charge cards, which dominate its operations. The OCC's assessment thus combined shortcomings in resources, expertise and independent testing with a failure to align the risk assessment with the core card business.
In its dealings with customers, the bank failed to maintain an effective framework for ongoing due diligence, the regulator found, according to the remediation order. The deficiencies included understanding the nature and purpose of customer relationships, weakening risk classification and activity monitoring. The order also concluded that customer identification procedures contained "material gaps." Those gaps resulted in inconsistent collection and verification of identity information based on customer risk. The failures identified by the OCC extended from customer identification and identity verification procedures to ongoing monitoring of customers' relationships with the bank and classification of their risks.
In a filing with the U.S. Securities and Exchange Commission, American Express said it had already provisioned for part of the penalty in prior periods. It said the penalty did not affect its previously issued financial outlook for the full year 2026. It added that the consent orders did not impose a cap on the company's assets, according to the filing. On remediation requirements, it said it did not expect the costs of implementing the orders to affect its outlook for 2027. The filing addressed the financial impact of the penalty and future compliance costs, alongside the company's confirmation that the orders did not restrict the size of its assets.
Under the Federal Reserve's order, American Express's board must submit a written plan to strengthen its oversight within 90 days of the order taking effect. Within the same deadline, the company must submit an acceptable plan to improve group-wide management of anti-money laundering compliance risk. The requirements also cover its travel services subsidiary, which the Federal Reserve ordered to improve its sanctions risk assessment. It must also enhance training and screening procedures related to the Office of Foreign Assets Control. The order also requires the company and its travel services subsidiary to continue cooperating fully and providing substantial assistance to investigations involving individuals who participated in the conduct covered by the action. The oversight and risk management plans are among the obligations following the action announced on October 8, 2026.