The news
The Office of the Comptroller of the Currency (OCC) on October 8, 2026 assessed a $350 million civil money penalty against American Express National Bank, the Sandy, Utah-based bank subsidiary of American Express (AXP), over a deficient Bank Secrecy Act and anti-money laundering (BSA/AML) program. The Federal Reserve announced a concurrent enforcement action against American Express Company the same day.
According to the OCC, the bank failed to identify and report approximately $13 billion in suspected trade-based money laundering over the past decade. Trade-based money laundering disguises illicit funds as payments for goods, for example by over- or under-invoicing shipments.
The OCC listed a broad set of failures: inadequate staffing and expertise, systemic internal control gaps, weak independent testing, insufficient BSA/AML training for employees and directors, deficient customer due diligence and identification, and systemic failures in monitoring and reporting suspicious activity. It also said the bank's risk assessment focused narrowly on deposit accounts rather than its dominant credit and charge card products. The OCC and the Fed issued concurrent cease-and-desist orders, which name American Express Company and American Express Travel Related Services Company as well as the bank.
The penalty is payable to the U.S. Treasury. Comptroller Jonathan Gould said the agency expects banks of American Express's size and complexity to devote sufficient resources to anti-money laundering compliance.
The Fed said the parent company failed to sufficiently detect and report certain suspicious activity, and found significant deficiencies in how its enterprise-wide AML program was carried out, in particular at the national bank. The Fed's release did not state a separate monetary penalty.
The numbers
- OCC civil money penalty
- $350 million
- Suspected trade-based laundering not identified or reported (OCC)
- About $13 billion over the past decade
Why CEOs should care
For boards and chief risk officers, the message is that a lighter regulatory climate has not removed AML enforcement. The OCC under Gould still imposed a nine-figure penalty, and the findings are about basics: staffing, testing, training and reporting. Ask your compliance chief when the AML program was last independently tested, whether findings were closed and whether the team is staffed for current volumes.
For CFOs and product leaders at card issuers and fintechs, the most transferable finding is the risk-assessment gap. The OCC said American Express assessed risk around deposits when its business is cards. Any firm whose revenue has shifted, toward cards, payments, B2B or cross-border flows, should check that its risk assessment and monitoring scenarios follow the money, not the original charter.
For partners and corporate card clients, cease-and-desist orders typically mean remediation work, including tighter due diligence on merchants and commercial customers. Treasury and procurement teams that rely on American Express commercial products should expect more requests for documentation and plan for them.
The bigger picture
Trade-based money laundering is hard to spot because it hides in ordinary commercial payments, which makes large card and B2B payment networks a natural target. The OCC's emphasis on that category, and on a decade-long gap, signals that examiners expect monitoring to cover commercial card and merchant activity, not just retail deposits.
What’s next
The cease-and-desist orders require remediation that examiners will track over time. Watch for any disclosure from American Express on the cost of the fix, and whether other agencies such as FinCEN act; none had announced action in the releases reviewed.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
