On October 8, 2026, the Office of the Comptroller of the Currency announced a cease-and-desist order and a $350 million civil money penalty against American Express National Bank, Sandy, Utah, for deficiencies in its Bank Secrecy Act and anti-money laundering compliance program. The American Express AML fine rests on the OCC's finding that the bank processed approximately $13 billion in suspected trade-based money laundering between approximately June 2014 and approximately May 2025, and did not timely identify, evaluate, and sufficiently report that activity.
The bank neither admits nor denies the OCC's findings. The OCC found that the bank's risk assessment focused on its demand deposit account products and insufficiently on its more dominant credit and charge card products.
What the OCC Found
The consent order states that American Express National Bank is one of the largest credit and charge card issuers in the United States by transaction volume. The OCC found that the bank had not established and maintained a reasonably designed BSA/AML compliance program. It cited violations of four requirements: the AML program rule (12 C.F.R. § 21.21), the SAR rules (12 C.F.R. § 21.11), the customer due diligence rule (31 C.F.R. § 1020.210(a)(2)(v)), and the customer identification program rule (31 C.F.R. § 1020.220(a)(2)).
Risk Assessment
The order states that the bank's risk assessment was not appropriately tailored to its business activities. It focused on the risks in the bank's relatively narrow demand deposit account products and services and insufficiently on the risks in its more dominant credit and charge card products.
Customer Due Diligence and Identification
The OCC found that the bank did not establish an effective framework for ongoing customer due diligence and for understanding the nature and purpose of customer relationships. According to the order, this prevented the bank from assigning appropriate risk ratings and conducting effective ongoing monitoring to identify and report suspicious activity. The OCC also found that the bank's customer identification procedures had substantial gaps and did not enable the bank to form a reasonable belief that it knew the true identity of each customer. These gaps resulted in inconsistent collection and risk-based verification of identification information.
Monitoring and Reporting
The order describes systemic breakdowns in the bank's suspicious activity monitoring, investigation, and reporting processes, resulting in a pattern or practice of noncompliance with the SAR filing requirements. The OCC found untimely, missed, or incomplete SARs relating to suspected trade-based money laundering and to other suspicious activity.
Independent Testing, Staffing, and Training
The OCC found that the bank's internal audit group did not effectively monitor compliance with BSA/AML requirements, and that independent testing was not appropriate in scope or effective relative to the bank's BSA/AML risk profile. It found that the bank had not historically supported the program with appropriate resources, including staff with commensurate skills, expertise, and training. It also found that the training program lacked risk-based content addressing employees' job-specific responsibilities and duties.
"American Express failed to maintain a BSA/AML compliance program properly aligned with the money laundering risks of its operations, which resulted in the bank's failures to timely identify and report significant missed suspicious activity and to provide important information to law enforcement."
Jonathan Gould, Comptroller of the Currency, October 8, 2026
The $13 Billion in Suspected Trade-Based Money Laundering
The order identifies the missed TBML activity as a significant result of the program deficiencies. From approximately June 2014 to approximately May 2025, the bank processed approximately $13 billion in suspected TBML activity. The OCC describes this as a combination of suspicious card charges and the associated repayments of those charges, including in certain instances through accounts associated with bank insiders.
According to the order, the bank periodically reported suspicious activity but lacked the internal controls and monitoring capabilities to timely identify and report the full scope of the activity. The OCC also found that the violations were part of a pattern of misconduct and caused more than a minimal loss to the bank.
What the Order Requires
The consent order sets out the program elements American Express National Bank must put in place.
Governance. The Board must appoint a compliance committee of at least three members, a majority of them directors who are not employees or officers, within 15 days. The committee meets at least quarterly and submits a written progress report each quarter. A written action plan with timelines and responsible persons is due within 90 days.
Risk assessment. The bank must develop an institution-wide BSA/AML risk assessment covering products and services, customer types and insiders, transaction types, geographic locations, and delivery methods. It must be refreshed at least every 12 months, approved by the Board, and independently tested annually.
Customer due diligence. The Board must adopt a written CDD program with defined customer risk categories, enhanced due diligence for higher-risk customers, controls to identify and remediate missing or inaccurate CDD information, and procedures to incorporate customer risk ratings into the risk assessment.
Suspicious activity review. The program must include periodic testing of monitoring thresholds with senior management approval of changes, an action plan addressing alert de-duplication, prioritization, and suppression practices, monitoring controls for TBML red flags, controls for front-line referral of suspicious activity, and procedures for monitoring insider activity.
SAR look-back. An independent third-party consultant must review the bank's past suspicious activity monitoring, investigation, decisioning, and reporting, determine whether additional SARs should be filed, and review whether previous filings need correction or amendment. The OCC may require additional or expanded work.
Testing, staffing, and training. The bank must adopt an independent testing program that evaluates whether the risk assessment adequately captures its risk profile, perform a staffing level and skills assessment with a staff augmentation plan, and deliver periodic job-specific BSA/AML training to the Board and relevant personnel.
Findings and Corresponding Requirements
Each of the OCC's principal findings has a matching requirement in the order.
Risk assessment
Finding: The assessment was not tailored to the bank's business and focused on demand deposit products rather than its dominant card products. Requirement: Article V calls for an institution-wide assessment that covers all products and services, including accessories such as supplemental cardholders, and is assessed both within each business unit and in aggregate across all activities and product lines.
Customer due diligence
Finding: The bank lacked an effective framework for ongoing CDD and for understanding the nature and purpose of customer relationships, which the OCC said prevented appropriate risk ratings and effective monitoring. Requirement: Article VI calls for defined risk categories, enhanced due diligence, and a process that incorporates customer risk ratings into the institution-wide risk assessment.
Suspicious activity reporting
Finding: The bank periodically reported suspicious activity but lacked the controls and monitoring capabilities to timely identify and report the full scope of the suspected TBML activity. Requirement: Articles VIII and IX call for a redesigned suspicious activity review program and an independent look-back to determine whether additional SARs are required.
Testing, staffing, and training
Finding: Independent testing was not appropriate in scope for the bank's risk profile, and the OCC found it contributed to the failure to timely detect and remediate the deficiencies. Staffing and training were also found deficient. Requirement: Articles X, XI, and XII call for a new testing program, a staffing and skills assessment, and job-specific training.
The two actions landed within five days of each other and rest on different findings. The OCC's American Express findings centered on a risk assessment that gave insufficient weight to the bank's card products. FinCEN's Bank of America findings centered on monitoring thresholds and risk factor weights that were not grounded in empirical analysis.
Frequently Asked Questions
Why was American Express fined $350 million?
Did American Express admit wrongdoing?
What was wrong with American Express's AML risk assessment?
What does the American Express consent order require?
Which regulators took action against American Express?
The Sentinel Perspective
Article VI of the order addresses customer due diligence: defined risk categories, enhanced due diligence for higher-risk customers, ongoing monitoring, and customer risk ratings that feed the institution-wide risk assessment.
Sentinel provides KYC onboarding and customer risk assessment, enhanced due diligence, and continuous customer monitoring that re-screens existing customers against PEP, sanctions, and adverse media data and generates alerts when something changes. Each decision is recorded in an audit trail.
See How Sentinel Supports CDD, Risk Profiling, and Ongoing Customer Monitoring
Request a demonstration tailored to your institution's BSA/AML program and customer due diligence requirements.
Official References
Truth Technologies provides AML, KYC, OFAC, and sanctions screening compliance solutions through the Sentinel platform. This post is published for informational purposes only and does not constitute legal advice. The findings described are those of the OCC, which the bank neither admitted nor denied. All facts are sourced exclusively from the OCC news release and consent order linked above.
