American Express’s $350 Million AML Penalty: What Regulators Found and What Compliance Teams Should Do Next

A $350 million signal about card-product risk

Anti-money laundering penalties against large banks are no longer rare, but the American Express action stands out for one reason: the product at the center of it. Most AML enforcement stories involve correspondent banking, cash-intensive deposit accounts or crypto on-ramps. This one concerns a franchise built on credit and charge cards, a line of business that many compliance programs still treat as lower risk than wires or deposit accounts.

On October 8, 2026, the OCC announced a cease-and-desist order and a $350 million civil money penalty against American Express National Bank. The Federal Reserve announced a concurrent cease-and-desist order against American Express Company and American Express Travel Related Services. Coverage from Reuters, the Financial Times, Barron’s, American Banker, Banking Dive and ACAMS appeared within hours, and the story was still circulating in trade press on October 11.

For law, compliance and risk teams, the headline number matters less than the reasoning behind it. This article walks through what regulators said they found, why trade-based money laundering is the thread tying the case together, how the market and trade press framed it, and a practical checklist for the next 30 days.

What the regulators found

According to the public findings summarized across the major outlets, the OCC concluded that the bank did not maintain a BSA/AML compliance program reasonably designed to assure and monitor compliance with the Bank Secrecy Act. The deficiencies were not described as a single missed alert. They were described as structural:

• Inadequate resources and expertise. The compliance function was not staffed or skilled in proportion to the size and complexity of the business.
• Systemic internal-control gaps. Monitoring and escalation processes did not reliably catch and report suspicious activity.
• Weak independent testing. The audit and testing layer did not find, or did not force correction of, the underlying problems.
• Weak training. BSA/AML training for employees and directors fell short of what the program required.
• A risk assessment that looked at the wrong place. The bank’s assessment concentrated on its relatively narrow demand-deposit products and gave too little weight to the risks in its dominant credit and charge card products.
• Customer due diligence and identification weaknesses that fed the monitoring and reporting failures.

The result, in the OCC’s framing, was that the bank was unable to timely identify, evaluate and sufficiently report approximately $13 billion of suspected trade-based money laundering activity over roughly the past decade.

Why trade-based money laundering is the key phrase

Trade-based money laundering (TBML) moves value through the appearance of legitimate commerce: over- and under-invoicing, multiple invoicing of the same shipment, phantom shipments, or payments routed through unrelated third parties. It is notoriously hard to detect because the individual transactions look like ordinary business payments.

Card programs, especially commercial and corporate cards, can become a channel for exactly this pattern. A merchant or cardholder base that includes import-export businesses can generate high-volume, high-value spending that looks normal in isolation. Detecting abuse requires models that look at counterparties, merchant categories, geographic corridors and the relationship between what a customer says it does and how its card is used.

The regulatory message embedded in this case is that supervisors expect monitoring to be built around the typologies of the products you actually sell. If most of your dollars flow through cards, a surveillance scenario library built mainly for deposit accounts and wires will be judged inadequate, however sophisticated it is for those products.

Two regulators, one message

The parallel structure of the action deserves attention. The OCC supervises the national bank; the Federal Reserve supervises the holding company and affiliates. When both act in coordination, it signals that the weaknesses were seen as enterprise-wide governance problems rather than a narrow operational lapse in one subsidiary.

For boards, the practical implication is direct. Directors are named in the findings through the training deficiency, and holding-company orders typically require board-level oversight of remediation. Corporate governance teams should expect to see questions about how often the board receives BSA/AML reporting, whether that reporting contains metrics on card-based typologies, and who is accountable when remediation milestones slip.

How the market and press framed the story

Trade publications such as ACAMS, The Banker and American Banker focused on the program failures and the remediation burden. Financial outlets, including Yahoo Finance and Barron’s, covered the share-price reaction and the size of the penalty relative to the company’s earnings. PYMNTS and Payments Industry Intelligence emphasized the payments-industry angle: what this means for card issuers, processors and fintech partners that rely on bank sponsors.

A few themes recur across that coverage:

1. Decade-long scope. The period under review is long enough that regulators can characterize the problem as persistent, not episodic.
2. Remediation as the real cost. A $350 million penalty is a one-time hit. Rebuilding monitoring, staffing and governance is a multi-year spend that does not show up in the headline.
3. Counterparty ripple effects. Processors, program managers, co-brand partners and merchants that depend on American Express may face more due-diligence questions from their own banks.

One note on search interest: Google’s daily trending searches in the United States on October 12 were dominated by sports and entertainment, and this story was not among them. That is typical for enforcement news. Interest comes from a professional audience searching for specifics (consent order text, SAR obligations, TBML typologies) rather than from a broad consumer spike. Content and internal briefings should therefore be precise and practical, not sensational.

What this means for financial institutions

Re-weight the risk assessment

Pull your most recent enterprise BSA/AML risk assessment and compare the weighting of each product line against its share of transaction volume and dollar value. If cards, prepaid or commercial payments are a large share of volume but a small share of the assessment narrative, that mismatch is the exact pattern regulators criticized here.

Test your TBML scenarios

Ask your monitoring team which scenarios specifically target trade-based typologies in card and merchant-acquiring flows, when they were last tuned, and what the alert-to-SAR conversion looks like. A scenario library that has not been refreshed in several years is a finding waiting to happen.

Check independent testing

Independent testing is supposed to be the backstop. Confirm that your audit or third-party testing covers product-level monitoring coverage, not only policy documentation, and that its findings reach the board with owners and dates attached.

Review SAR look-back procedures

If a look-back is ever required, you need to know how quickly you could reconstruct historical activity, data lineage included. Test that capability before a regulator asks you to.

Resource the function honestly

Inadequate resources and expertise sit first on the list of findings. Benchmark headcount, tenure and specialist skills (trade finance, sanctions, data science) against your volume, and document the reasoning for the staffing level you choose.

What this means for counterparties

Firms that process, partner on or accept American Express products are not parties to the orders, and nothing in the public findings suggests wrongdoing on their part. Still, prudent counterparties will:

• Note existing American Express commercial relationships in their own third-party risk inventory.
• Confirm whether contracts contain regulatory-change or notification clauses that the orders could trigger.
• Prepare for questions from their own banking partners about how card volumes are monitored.
• Avoid assuming that remediation requirements will leave service levels or onboarding timelines unchanged.

What to watch next

Several questions will determine how much this case matters beyond one company:

• Remediation milestones. Orders of this type usually require a compliance program plan, independent reviews and periodic reports to regulators. Look for how public any of that becomes.
• Copycat scrutiny. Examiners often follow a high-profile case with targeted reviews of peers. Issuers with large card portfolios should assume card-product AML will get more attention.
• Guidance and speeches. Watch for OCC and Federal Reserve remarks tying this action to expectations about product-level risk assessment.
• Litigation or disclosures. Securities filings and any follow-on civil claims may add detail on the scope and cost of remediation.

Frequently asked questions

Who issued the penalty? The OCC fined American Express National Bank $350 million; the Federal Reserve issued a coordinated cease-and-desist order against American Express Company and American Express Travel Related Services.

What was the core allegation? That the bank’s BSA/AML program was deficient and that it failed to identify, evaluate and sufficiently report about $13 billion of suspected trade-based money laundering over roughly a decade.

Does this mean American Express facilitated money laundering? The public findings are about program failures, namely not detecting and reporting suspicious activity, not a finding that the company intended to launder funds.

Why does the card product matter? Because the risk assessment focused on deposit products while the bank’s dominant business was credit and charge cards.

What should smaller institutions take from it? That proportionality works in both directions: a smaller program can be simpler, but it still has to map to the products and customers you actually have.

Bottom line

The American Express penalty is a reminder that regulators judge AML programs by fit, not by polish. A program can have policies, systems and staff and still be found deficient if it points at the wrong risks. The most useful response is unglamorous: re-weight your risk assessment to your real volume, refresh trade-based scenarios, verify that independent testing reaches the product level, and make sure the board sees the evidence.

This article summarizes public regulatory actions and press coverage and is not legal advice. Confirm the status and terms of any order with the issuing agencies and consult counsel for obligations that apply to your institution.

Sources consulted: Reuters, Financial Times, Barron’s, American Banker, Banking Dive, ACAMS, The Banker, Quartz, PYMNTS.com, Yahoo Finance and Google Trends (US daily trending searches, October 12, 2026).