Free tools Windows power users keep installed
One-click scans. No signup required.
On October 8, 2026, the Office of the Comptroller of the Currency (OCC) announced a cease-and-desist order and a $350 million civil money penalty against American Express National Bank, based in Sandy, Utah. The OCC said the bank’s Bank Secrecy Act (BSA) and anti-money laundering (AML) compliance program had serious deficiencies. The penalty is imposed on the bank, not on cardholders, and the OCC said the money will be directed to the U.S. Treasury.
The action is about how the bank’s compliance program was designed and run. The OCC’s findings center on monitoring and reporting of suspicious activity, including roughly $13 billion in suspected trade-based money laundering activity that the regulator says the bank failed to identify and report in time.
What the penalty does and does not mean
The $350 million civil money penalty and the cease-and-desist order both apply to American Express National Bank. They do not apply to American Express Company, the parent, and the OCC did not describe the amount as a combined total for the corporate group.
Two qualifications matter for how the case is described:
#1 Best Overall
- It is a consent order, not a criminal conviction. The bank “neither admits nor denies” the Comptroller’s findings. The matters described below are therefore the OCC’s findings and allegations, not conclusions a court has reached.
- The penalty goes to the Treasury. The OCC said the civil money penalty will be directed to the U.S. Treasury.
What the OCC said went wrong
The OCC’s central finding is that the bank’s BSA/AML compliance program was not reasonably designed to assure and monitor compliance with the law. The regulator identified several weaknesses that it said worked together.
A risk assessment built around the wrong business
The OCC said the bank’s risk assessment concentrated on its relatively narrow demand-deposit products. It did not adequately account for the bank’s more dominant business, its credit- and charge-card products. For a card issuer, that gap means the risks in the largest part of the business were not the main focus of the program’s risk map, and monitoring was not calibrated to match.
Customer due diligence and identification
Weak customer due diligence and customer identification procedures contributed to the monitoring and reporting failures. In practice, when the bank did not know its customers and the parties behind their activity well enough, it became harder to recognize unusual transactions and to explain why they were or were not reported.
Resources, staff expertise and internal controls
The OCC cited inadequate resources and insufficient staff expertise, along with systemic internal-control gaps. These are the operational side of the failure: the program existed on paper, but the people and systems to run it were not sized or skilled for the bank’s volume and risk.
Independent testing and training
The regulator also found weak independent testing, which is the check meant to catch these problems before an examiner does, and weak training for employees and directors.
The roughly $13 billion in suspected activity
The OCC said systemic breakdowns in suspicious-activity monitoring and reporting led the bank to fail to timely identify, evaluate and sufficiently report approximately $13 billion in suspected trade-based money laundering activity. The word “suspected” is important. The figure describes activity the regulator identified as suspicious and says was not handled properly. It is not a finding that $13 billion was proven to be laundered proceeds.
The consent order places this activity between approximately June 2014 and approximately May 2025. The OCC’s own announcement described the problem in rounded terms as spanning the past decade. The order’s dates give the precise window, and both dates are approximate.
According to the order, the suspected activity included suspicious card charges and associated repayments. In some instances it involved accounts associated with bank insiders, which is why the order requires specific controls over insider activity.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The Federal Reserve action is a separate matter
In a separate announcement, the Federal Reserve took enforcement action against American Express Company and American Express Travel Related Services Company, Inc. The Federal Reserve said it addressed failures to sufficiently detect and report certain suspicious activity, and significant deficiencies in how the company’s enterprise-wide AML program was implemented, particularly at its subsidiary national bank.
The two actions should not be merged. The table below compares them on the points the public announcements address.
| Point of comparison | OCC action | Federal Reserve action |
|---|---|---|
| Regulated entity | American Express National Bank (Sandy, Utah) | American Express Company and American Express Travel Related Services Company, Inc. |
| Regulator | Office of the Comptroller of the Currency | Federal Reserve |
| Publicized relief | $350 million civil money penalty and cease-and-desist order | Enforcement action; penalty amount not stated in the Federal Reserve announcement |
| Stated findings | BSA/AML program not reasonably designed; failure to timely identify and report suspicious activity, including approximately $13 billion in suspected trade-based money laundering activity | Failures to sufficiently detect and report certain suspicious activity; significant deficiencies in implementation of the enterprise-wide AML program, particularly at the subsidiary national bank |
Because the Federal Reserve announcement does not state a penalty amount, no dollar figure should be attached to that action from the public summary alone. Readers who need its terms should check the Federal Reserve’s published order directly.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the consent order requires
The order requires the bank to submit a written action plan, subject to OCC review, that addresses the identified deficiencies. The plan must set out corrective steps, timelines and the people responsible for each one. The work it covers includes:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Best Value
- An institution-wide risk-assessment process that reflects all of the bank’s business lines, including credit and charge cards
- Stronger customer due diligence and customer identification
- Financial-crimes risk management, including third-party risk
- Effective identification, review and reporting of suspicious activity
- An independent look-back of suspicious activity reports (SARs)
- An effective independent testing program
- Staffing and skills assessments
- Job-specific BSA/AML training
- Controls over insider activity
The board of directors must oversee the corrective actions and review the effectiveness of multiple programs at least annually. That governance requirement continues after the immediate remediation work, so it is the part of the order most likely to outlast the penalty.
The OCC’s own summary
OCC Comptroller Jonathan Gould said: “American Express failed to maintain a BSA/AML compliance program properly aligned with the money laundering risks of its operations, which resulted in the bank’s failures to timely identify and report significant missed suspicious activity and to provide important information to law enforcement.”
What remains unclear
The public OCC materials describe the program failures, the penalty and the remediation requirements. They do not say whether cardholder fees, account access or consumer protections changed as a result. Cardholders who want to know whether anything affecting their own account has changed should check their card agreement and any notices from American Express directly.
Quick Recap
*
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
