U.S. banking regulators have ordered American Express to overhaul its anti-money laundering controls after finding that its national bank failed to timely identify, evaluate and sufficiently report approximately $13 billion in suspected trade-based money laundering activity processed over nearly 11 years.
The Office of the Comptroller of the Currency imposed a $350 million civil penalty on American Express National Bank and issued a consent cease-and-desist order. In a coordinated action, the Federal Reserve issued a separate cease-and-desist order against parent companies American Express Company and American Express Travel Related Services Company. The Federal Reserve action did not impose an additional monetary penalty.
The OCC said the affected activity ran from approximately June 2014 to May 2025 and included suspicious card charges and repayments of those charges. In some instances, the activity passed through accounts associated with bank insiders. The regulator did not find that the entire $13 billion was proven money laundering or a loss to customers; it described the amount as suspected trade-based money laundering activity that the bank failed to identify and report fully and on time.
Card risk was not matched by the AML program
The enforcement orders identify a basic mismatch between American Express National Bank’s business and its risk controls. According to the OCC, the bank’s AML risk assessment concentrated on its relatively narrow demand-deposit business while giving insufficient attention to its much larger credit- and charge-card operations.
That gap spread across the control chain. The OCC found weaknesses in customer due diligence, customer identification, transaction monitoring, investigations and suspicious activity reporting. It also cited insufficient staffing and expertise, weak employee and director training, and independent testing that was not appropriately scoped or effective for the bank’s risk profile.
The resulting monitoring failures were systemic, according to the OCC. Suspicious activity reports were missed, incomplete or filed late. Although the bank periodically reported suspicious activity during the period, the regulator said its controls could not detect and report the full scope. The OCC concluded that the deficiencies produced violations of Bank Secrecy Act program, suspicious-activity-reporting, customer-due-diligence and customer-identification requirements.
The Federal Reserve reached a related enterprise-wide conclusion. Its order cites weaknesses in transaction monitoring, fraud-referral processes, third-party risk assessment and financial-crimes risk management across the American Express organization. It also requires American Express Travel Related Services to strengthen its sanctions-risk assessment, training and Office of Foreign Assets Control screening procedures.
Why the failures matter for payment providers
The case shows why a card issuer’s AML framework cannot be designed as if deposit accounts were the main exposure. Trade-based laundering can use legitimate-looking commerce and repayment flows to move value. Monitoring therefore has to connect card charges, repayments, customer profiles, geography, merchant and third-party information, and behavior across business lines.
The orders also put responsibility beyond the transaction-monitoring system itself. Front-line referrals, customer identification, due diligence, audit coverage, staffing and escalation to directors all contributed to the regulatory findings. For issuers and payment processors, a monitoring model cannot compensate for incomplete customer data, poorly selected thresholds or business units that do not refer suspicious behavior.
The OCC said the failures deprived law enforcement of timely and complete information. It also found that the violations formed part of a pattern of misconduct and caused more than a minimal loss to the bank, although the public orders do not quantify that loss or identify customer losses.
Independent look-back and board accountability
American Express National Bank must appoint a compliance committee, create a regulator-approved action plan and rebuild its institution-wide AML risk assessment. The OCC order requires stronger customer due diligence, customer identification, monitoring, independent testing, staffing, training and controls for insider activity.
A central requirement is an independent look-back. A third-party consultant must review earlier monitoring, investigations and suspicious activity reports to determine whether the bank should file reports for previously unreported activity or correct existing filings. The OCC may expand the review’s subjects or time period if it finds the work incomplete.
The Federal Reserve separately requires the American Express board, within 90 days, to submit plans for overseeing remediation and improving the group’s enterprise-wide AML program. Those plans must address monitoring rules and thresholds, suspicious activity reporting, customer due diligence, third-party oversight and escalation of AML and sanctions risks. Quarterly progress reports are also required.
The bank neither admitted nor denied the OCC’s findings, while consenting to the orders and waiving its right to challenge them. The regulatory documents say American Express has begun corrective action and cooperated with the agencies. The orders remain effective until regulators modify or terminate them, and both agencies reserve the ability to take further action if deficiencies continue or are not corrected.