Daily Compliance Brief — OCC Penalises American Express $350 Million Over AML Failures

October 9, 2026

Signal

The U.S. Office of the Comptroller of the Currency (OCC) announced on October 8, 2026, a $350 million civil money penalty and a cease-and-desist order against American Express National Bank for deficiencies in its Bank Secrecy Act and anti-money laundering programme. According to the OCC's enforcement announcement, the bank failed to identify and sufficiently report approximately $13 billion in suspected trade-based money laundering activity over the past decade.

The OCC identified systemic weaknesses across risk assessment, customer due diligence, customer identification, suspicious activity monitoring, independent testing, staffing, and training. The bank's risk assessment did not adequately reflect its credit and charge card activities, instead focusing disproportionately on demand deposit products. The action was coordinated with a concurrent Federal Reserve cease-and-desist order against American Express Company and American Express Travel Related Services Company.

Why it matters

The enforcement action demonstrates how an AML programme can fail when its risk assessment does not reflect the institution's actual products, transaction flows, and exposure. Banks should validate that monitoring scenarios cover material business lines, including card activity and trade-related flows where relevant, and that customer due diligence supports meaningful risk differentiation.

Control owners should also test whether alerts are investigated and escalated promptly, suspicious activity reports are filed when required, and independent testing identifies systemic weaknesses rather than isolated procedural errors. Senior management oversight should connect risk assessments, staffing, training, monitoring performance, and reporting outcomes to the institution's full operating model.