On 8 October 2026, the Office of the Comptroller of the Currency (OCC) fined American Express National Bank (AMEX) $350M for systemic weaknesses in its Anti-Money Laundering (AML) program. These weaknesses led to approximately $13B in suspected money laundering activity going insufficiently identified, evaluated, and reported.
These AML failures included risk assessments, Customer Due Diligence (CDD), and suspicious activity monitoring. Most notably, these failures persisted for approximately a decade. This enforcement action against AMEX raises concerns over how the bank overlooked significant financial crime risks. What happens when an institution’s AML controls struggle to keep up with the risks of its own business?
How Did American Express’s AML Controls Fail?
The OCC found several shortcomings in how American Express found, assessed, and managed financial crime risks across its operations. Yet, the most alarming finding was the allocation of the bank’s compliance resources. While AMEX operated extensive credit-card and charge-card businesses, its AML risk assessments focused disproportionately on its smaller deposit-taking activities.
AMEX did not adequately address weaknesses in its main business activities. The regulators became aware of a number of shortcomings, such as a lack of staff expertise, inadequate employee training, and gaps in independent testing. These flaws in the bank’s Programma di identificazione del cliente (CIP) and CDD procedures led to major failures in the monitoring of any suspicious activity and caused disruptions in reporting.
From June 2014 to May 2025, AMEX also did not identify, assess, and report about $13 billion of suspected trade-based money laundering activities on time. The fact that the institution did not properly evaluate its exposure to financial crime instead relied on compliance policies that existed. It is therefore necessary that the policies be designed, maintained, and consistently applied throughout the institution’s operations if financial crime risk is to be managed.
Regulators Demand Stronger AML Oversight for AMEX
Moreover, the $350 million penalty was followed by a cease-and-desist order. The order asked AMEX to address deficiencies in its Bank Secrecy Act (BSA) and AML compliance program. The Federal Reserve also issued an enforcement action against American Express Company and American Express Travel Related Services Company. It cited huge issues in the implementation of the group’s overall AML framework.
The OCC expects banks of American Express’s size and complexity to devote sufficient resources.
Comptroller of the Currency Jonathan Gould also said that these resources should ensure compliance with laws and regulations designed to detect and prevent money laundering. This is essential to both economic and national security.
Furthermore, Stephen Squeri, who is the CEO of American Express, admitted that further improvements were necessary and said that the company was determined to deal with the regulators’ concerns. American Express has indicated that it has achieved progress in strengthening its compliance controls. This situation shows that AML programs must be constructed according to an institution’s real exposure rather than just on its size or regulatory classification.
Why Suspicious Activity Reporting Matters
This AMEX case shows the increasing pressure US financial institutions face to spot and report possible financial crime. The Financial Crimes Enforcement Network’s FY2025 Year in Review states that 4.8 million Suspicious Activity Reports (SARs) were submitted throughout the US in 2025, as compared with 4.3 million in 2022; this amounts to an increase of about 11.6% over the three-year period.
Yet the enormous amount of reporting only gives us a partial view of the situation. The degree to which these reports are effective has a direct impact on the results of law enforcement investigations. The same FinCEN publication showed that 38.8 percent of the active investigations in the Federal Bureau of Investigation (FBI)’s Complex Financial Crime Program were linked to SARs or Currency Transaction Reports (CTRs) in FY2025.
The FBI stated that it made 5,957 arrests of individuals who were the subject of investigations in its various case programs as a result of BSA reports over that period. These figures show how important it is to have financial intelligence that is both timely and accurate when carrying out investigations into possible illegal activity.
The duties of a large number of regulated institutions go beyond that of identifying suspicious transactions; effective compliance with anti-money laundering rules also demands strong investigation, escalation, documentation, and reporting procedures. Warning signs will be more likely to go unnoticed when monitoring systems and customer risk evaluations work separately.
The Growing Challenge of Trade-Based Money Laundering
A major part of the AMEX enforcement action was concerned with issues regarding trade-based money laundering (TBML). TBML consists of using international trade transactions to hide the movement or source of illegal funds. The Financial Action Task Force (FATF) states that TBML usually includes the use of manipulated invoices, the misrepresentation of goods and services, and complicated commercial arrangements designed to conceal financial activity.
While many suspicious transactions are direct and obvious, the TBML scheme can mix real business activity with illegal financial flow. For many banks and payment providers similar to AMEX, this leads to extra issues when customer data, business relationships, and transaction behavior are evaluated separately.
The AMEX example shows the necessity for financial companies to make sure that their risk assessments take into account the products, services, customer types, and financial activities which result in the highest level of exposure.
Three Lessons from AMEX
The AMEX enforcement action is a strong reminder that AML compliance requires more than keeping regulatory documentation. For financial firms reviewing their own controls, three very important questions stand out:
- Are risk assessments aligned with the institution’s business? AML programs must consider the risks associated with every significant product, service, customer segment, and jurisdiction. A narrow assessment can leave whole business lines exposed to a lot of risk.
- Does customer risk influence ongoing due diligence? Customer identification, Know Your Customer (KYC) checks, Enhanced Due Diligence (EDD), and ongoing screening must inform decisions throughout the customer lifecycle.
- Can suspicious activity be identified, investigated, and escalated effectively? Financial institutions need clear escalation procedures, sufficiently trained teams, effective monitoring controls, and auditable records that demonstrate how potential risks were reviewed and addressed.
These ideas go well beyond traditional banking to payment providers, fintechs, and other regulated organizations operating across complicated financial ecosystems. The main lesson from the AMEX case is that an AML program should be evaluated against the risks it is intended to manage continuously.
Find out more AML updates in ComplyCube’s Newsletter Trust Edition. We explore the latest developments across identity verification and AML globally.
