The Office of the Comptroller of the Currency (OCC) announced a cease-and-desist order together with a $350 million civil money penalty against American Express National Bank, based in Sandy, Utah. The action stems from longstanding weaknesses in the institution’s Bank Secrecy Act and anti-money laundering compliance framework.
Regulators concluded that the bank had not built or sustained a BSA/AML program capable of reasonably ensuring ongoing adherence to the statute and related rules.
Core problems included insufficient staffing and expertise, broad gaps in internal controls, inadequate independent testing, and deficient training for both employees and directors.
The risk assessment process was not properly calibrated to the bank’s actual operations: it concentrated heavily on the limited risks associated with its demand-deposit products while giving inadequate attention to the far larger credit- and charge-card businesses that dominate its activities.
Shortcomings in customer due diligence and customer identification procedures further compounded the monitoring and reporting failures.
These deficiencies produced systemic breakdowns in the detection and reporting of suspicious activity.
Over roughly a decade—from about June 2014 through May 2025—the bank processed approximately $13 billion in suspected trade-based money laundering activity, involving suspicious card charges and related repayments. In some cases the activity flowed through accounts linked to bank insiders.
The institution failed to identify, evaluate, and file timely or complete suspicious activity reports for a substantial portion of this volume, leaving law enforcement without critical information.
The OCC’s measures were coordinated with a simultaneous cease-and-desist order issued by the Board of Governors of the Federal Reserve System against American Express Company and American Express Travel Related Services Company, Inc.
That order addresses enterprise-wide financial crimes risk-management deficiencies, including weaknesses in transaction monitoring, fraud referrals, third-party risk assessment, and overall program governance, though it does not impose a separate monetary penalty.
The $350 million OCC penalty will be paid to the U.S. Treasury.
Comptroller of the Currency Jonathan Gould emphasized that institutions of American Express’s scale and complexity must allocate adequate resources to AML compliance because effective detection and prevention of money laundering are ess
ential to both economic and national security.
He noted that the bank’s program was not aligned with the actual risks of its operations, producing missed suspicious activity and incomplete reporting to authorities.
The orders, he said, are intended to concentrate the institution’s attention on remedying those risks while it continues to serve customers.
American Express did not admit or deny the regulators’ findings.
In a statement, Chairman and CEO Stephen J. Squeri said the company takes its responsibility to combat financial crime seriously and is fully committed to addressing the concerns while continuing to strengthen its financial-crimes compliance program.
He noted that the firm has already made substantial investments in people, technology, training, governance, and oversight, and has worked with regulators and law enforcement in recent years, yet acknowledges that further work remains.
The company stated that a portion of the penalty had been reserved in earlier periods, that the orders impose no asset cap, and that neither the fine nor the costs of remediation are expected to affect previously issued full-year 2026 guidance or 2027 guidance.
Under the OCC consent order, the bank must form a board-level compliance committee, submit a comprehensive action plan within 90 days, develop an effective risk assessment process and customer due-diligence program, and engage an independent third party to conduct a look-back review of suspicious activity reporting.
The Federal Reserve order similarly requires the parent companies to submit remediation plans covering enterprise-wide controls and related areas.
These steps are designed to close the identified gaps and restore robust monitoring and reporting capabilities. The enforcement actions underscore regulators’ continuing focus on ensuring that large, complex institutions maintain AML programs proportionate to the volume and nature of their payment and card activities.