OCC fines American Express National Bank $350 million over AML failures

What happened

On 8 October 2026, the Office of the Comptroller of the Currency (OCC) issued a cease-and-desist order and a $350 million civil money penalty against American Express National Bank, Sandy, Utah. According to OCC News Release 2026-87, the penalty will be directed to the U.S. Treasury.

The OCC said the bank did not establish and maintain a Bank Secrecy Act (BSA) and anti-money laundering (AML) program “reasonably designed to assure and monitor compliance” with the BSA. It cited inadequate resources, including staff without sufficient expertise, systemic internal control gaps, weak independent testing, weak training, and customer due diligence and identification processes that contributed to monitoring and reporting failures.

The risk assessment was not tailored to the business. It focused on relatively narrow demand deposit products and paid insufficient attention to the bank’s more dominant credit and charge card products. The OCC also said the bank failed to timely identify, evaluate, and sufficiently report approximately $13 billion of suspected trade-based money laundering (TBML) activity over the past decade. Comptroller Jonathan Gould said the OCC “expects banks of American Express’s size and complexity to devote sufficient resources to ensure compliance.”

The OCC acted alongside a concurrent Federal Reserve consent order against American Express Company (Amex) and American Express Travel Related Services Company, Inc. (TRS), both registered bank holding companies. It was entered without either firm admitting or denying any allegation and carries no monetary penalty. Within 90 days of the effective date, the Amex board must submit a plan on holding senior management accountable for remediation. Amex must submit a plan covering transaction monitoring rules and thresholds by customer type, product, and geography, suspicious activity reporting across all lines of business, and oversight of network partnerships, ATM partners, and other third parties. TRS must submit a plan for compliance with the US Office of Foreign Assets Control (OFAC). Neither firm may retain anyone who, on its investigative record from 2024 to the present, took part in the misconduct, was formally disciplined, and was separated or terminated over it. Progress reports go to the Reserve Bank quarterly.

Why it matters

This section is analysis. The risk assessment finding is the most transferable part of the action. The OCC’s description suggests the assessment was weighted toward the narrower products and gave less depth to the dominant ones. Examiners may now test whether assessment depth tracks business mix.

The OCC release does not describe its own order’s requirements. The Federal Reserve text is therefore the only public guide here to what remediation looks like. Its explicit mention of network partnerships and ATM partners suggests third-party reliance will draw scrutiny.

Treat the $13 billion as the OCC’s finding about suspected activity that was not reported in time, not as adjudicated laundering.

Practitioner angle

These are questions for your own controls, not findings about any other firm.

• Risk assessment: check whether it gives the most space to your largest products by volume, not the narrowest or easiest to assess.
• TBML and monitoring: check your TBML detection coverage. Confirm you can show how rules and thresholds are set, tested, and documented against customer type, product, and geography.
• Third parties: check oversight of network partners, ATM partners, and any vendor used in BSA/AML work. Confirm how their information reaches your monitoring.
• SARs and escalation: check that suspicious activity reports (SARs) cover every line of business, and that material BSA/AML and sanctions issues reach the board on an evidenced timeline.
• Accountability: check whether your policies would stop you rehiring someone who was disciplined and separated over misconduct.

Start with the risk assessment. Put product volumes beside assessment depth this month, and close any mismatch before an examiner finds it.