What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
On October 8, 2026, the Office of the Comptroller of the Currency (OCC) announced a $350 million civil money penalty and a cease-and-desist order against American Express National Bank, the Sandy, Utah institution that issues American Express credit and charge cards. The OCC says the bank’s Bank Secrecy Act (BSA) and anti-money laundering (AML) compliance program had serious deficiencies, including failures to identify and report suspicious activity that the regulator links to roughly $13 billion in suspected trade-based money laundering activity.
The penalty falls on the bank, not on individual cardholders. The bank has neither admitted nor denied the OCC’s findings.
As an Amazon Associate I earn from qualifying purchases.
What the OCC found
The OCC’s core finding is that the bank’s compliance program was not reasonably designed to assure and monitor compliance with BSA and AML requirements. The regulator did not describe a single missed transaction or one isolated lapse. It described gaps across the program’s structure.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesRisk assessment that did not match the business
According to the OCC, the bank’s risk assessment concentrated on its relatively narrow demand-deposit products. It did not adequately account for its more dominant business, which is credit and charge cards. A risk assessment built around the wrong product mix can leave the highest-risk activity under-monitored even when controls exist on paper.
#1 Best Overall
Customer identification and due diligence
The OCC cited weak customer due diligence and customer identification procedures. It said these weaknesses contributed to failures in monitoring and reporting, because the bank’s systems depend on knowing who its customers are and what normal activity looks like for them.
Resources, testing, and training
The regulator identified inadequate resources and staff expertise, systemic internal-control gaps, weak independent testing, and weak training for employees and directors. Taken together, these are the findings that go to whether a compliance program can work in practice, not only whether written policies exist.
Suspicious-activity monitoring and reporting
The OCC said systemic breakdowns in suspicious-activity monitoring and reporting led the bank to fail to identify, evaluate, and sufficiently report significant suspected activity in time. The OCC’s Comptroller, Jonathan Gould, put it this way: “American Express failed to maintain a BSA/AML compliance program properly aligned with the money laundering risks of its operations, which resulted in the bank’s failures to timely identify and report significant missed suspicious activity and to provide important information to law enforcement.”
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The $13 billion figure, and what it does not mean
The OCC says the bank failed to timely identify, evaluate, and sufficiently report approximately $13 billion in suspected trade-based money laundering activity. According to the consent order, the bank processed this suspected activity from approximately June 2014 to approximately May 2025. The activity included suspicious card charges and associated repayments, and in some instances involved accounts associated with bank insiders.
Two qualifications matter here. First, the $13 billion is the regulator’s figure for suspected activity. It is not a finding that the funds were proven to be criminal proceeds. Second, the OCC’s announcement describes the period as the past decade, while the consent order gives the approximate June 2014 to May 2025 window. Both descriptions refer to the same activity; the consent order’s dates are the more precise version.
What the consent order requires
The order does not only impose a fine. It requires the bank to submit a written action plan, subject to OCC review, that addresses each deficiency and sets out corrective steps, timelines, and the people responsible for them. The required work includes:
- An institution-wide risk-assessment process that covers all of the bank’s products, including credit and charge cards.
- Stronger customer due diligence and customer identification.
- Financial-crimes risk management, including oversight of third-party risk.
- Effective identification, review, and reporting of suspicious activity.
- An independent look-back review of suspicious activity reports (SARs).
- An effective independent testing program.
- Staffing and skills assessments for compliance functions.
- Job-specific BSA/AML training.
- Controls over insider activity.
The board of directors must oversee the corrective actions and review the effectiveness of several of these programs at least annually. That makes the board, not only the compliance department, accountable for whether the remediation works.
The separate Federal Reserve action
The Federal Reserve announced its own enforcement action against American Express Company and American Express Travel Related Services Company, Inc. It addressed failures to sufficiently detect and report certain suspicious activity, and significant deficiencies in how the company’s enterprise-wide AML program was implemented, particularly at its subsidiary national bank. The Federal Reserve’s public announcement describes the OCC action as separate from its own.
Best Value
The two actions should not be merged. The table below sets out how they differ on the points the public announcements cover.
| Item | OCC action | Federal Reserve action |
|---|---|---|
| Regulated entity | American Express National Bank, Sandy, Utah | American Express Company and American Express Travel Related Services Company, Inc. |
| Regulator | Office of the Comptroller of the Currency | Federal Reserve |
| Publicized monetary relief | $350 million civil money penalty, directed to the U.S. Treasury | Not stated in the public announcement |
| Type of order | Consent cease-and-desist order; bank neither admits nor denies the findings | Enforcement action; terms of the attached order are not covered in this article |
| Stated findings | BSA/AML program deficiencies, including risk assessment, customer due diligence, monitoring and reporting, independent testing, staffing, and training | Failures to sufficiently detect and report certain suspicious activity; significant deficiencies in implementing the enterprise-wide AML program |
The $350 million figure belongs only to the OCC action against the national bank. It should not be read as a penalty against the parent company or as a combined total across both regulators.
What is not established
The public announcements do not establish whether cardholder fees, account access, or consumer protections changed as a result of the order. Readers who hold an American Express card should watch for account notices from the bank rather than assume changes from the enforcement action alone.
The OCC’s findings are also the regulator’s view. The bank has neither admitted nor denied them, and the order is a civil consent order rather than a criminal conviction.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
