What happened

On 8 October 2026 the OCC issued a cease-and-desist order and a $350 million civil money penalty against American Express National Bank for deficiencies in its Bank Secrecy Act and anti-money laundering programme[1]. The Federal Reserve issued a parallel order against American Express Company and American Express Travel Related Services, citing weaknesses in transaction monitoring, fraud referral, third-party risk assessment and financial crimes risk management across the group[2].

The OCC's list is long: too few staff with the right expertise, systemic control gaps, weak independent testing and training, and breakdowns in suspicious activity monitoring. The result, it said, was that about $13 billion of suspected trade-based money laundering over the past decade was not identified, evaluated or sufficiently reported in time[1].

American Express said part of the penalty was already reserved, that it does not change full-year 2026 guidance, and that the orders impose no asset cap[3]. Its chief executive, Stephen Squeri, said: "While we have made meaningful progress, we know there is more work to do"[4].

Why it matters

The finding I would put in front of every bank board is the one about the risk assessment. The OCC said it was not tailored to the bank's business: it concentrated on the narrower deposit products and paid too little attention to the much larger credit and charge card businesses[1].

That is not a failure of one alert or one analyst. It is a programme pointed at the wrong place. And it is a pattern I see often. AML frameworks in most banks grew up around the account: onboarding, KYC, wires and cash. Card, merchant and commercial payment flows were added later and inherited thresholds built for a different risk.

What most people are missing

First, scale hides laundering rather than exposing it. American Express processed $455.8 billion of billed business in the second quarter of 2026 alone[5]. The $13 billion the OCC flagged, spread over ten years, is less than 3% of that one quarter. Trade-based laundering through cards looks like ordinary spending at a merchant that happens to be overpriced or fictitious. Monitoring tuned to catch outliers in a high-volume card book will not see it unless someone has designed for that typology.

Second, the perimeter is wider than the bank. The Fed's order requires oversight of BSA/AML systems that use information from "network partnerships, ATM partners, and third parties"[2]. Any bank that issues on a partner network, sponsors fintech card programmes or relies on a processor for monitoring should read that as aimed at it too.

Third, accountability is now personal. The Amex board must submit, within 90 days, a plan setting out how it will hold senior management accountable for remediation, and the firm may not rehire people who left after being disciplined for the underlying misconduct[2].

Fourth, deregulation has a boundary. US capital rules are being eased (see my note on the Basel re-proposal), but the day before this order the Comptroller launched a channel for community banks to report suspected payments fraud directly to an OCC task force[6]. Financial crime is where this OCC is spending its enforcement effort.

What to do on Monday

  • Weight the risk assessment by flow. Rank products by value and counterparties moving through them, not by number of accounts. If cards, acquiring or commercial payments rank below deposits, challenge the method.
  • Test card monitoring against trade typologies. Ask the financial crimes team to show which scenarios would catch over-invoicing or fictitious merchants in card and commercial card data. If the answer is "the same rules as retail", that is the gap.
  • Map every third party in the AML chain. Network partners, processors, programme managers. For each, know whose monitoring runs and who files the report.
  • Give the board AML reporting by product line. A single group-wide AML dashboard cannot show the board that the biggest business is the least covered.