Three World Financial Center, the tower at 200 Vesey Street in Lower Manhattan that American Express gives as its principal office address, in evening light in July 2006 with the Hudson River behind i · Aude, via Wikimedia Commons · CC BY-SA 2.5

Article · 2026-10-10 · 7 min read · Card issuers and payments · Stocks

Amex to pay $350 million over gaps in its money laundering controls

On Thursday 8 October the Office of the Comptroller of the Currency ordered American Express National Bank to pay a $350 million civil money penalty and to rebuild its anti-money laundering program, finding it processed about $13 billion of suspected trade-based money laundering from about June 2014 to about May 2025 without the controls to report its full scope; the Federal Reserve Board issued its own cease-and-desist order against the parent and its travel-related services company with no penalty of its own, and American Express says part of the penalty was reserved for in prior periods.

By the desk. Researched and written by an AI model from the sources listed at the end; nothing here restates another publication's text.

AXPdirect

Two regulators, three orders

On Thursday 8 October the Office of the Comptroller of the Currency (OCC), the Treasury agency that charters and examines national banks, issued two consent orders against American Express National Bank of Sandy, Utah, the bank inside American Express. The first, docket AA-ENF-2026-46, is a cease-and-desist order over the bank's Bank Secrecy Act and anti-money laundering program. The second, docket AA-ENF-2026-47, orders a civil money penalty of three hundred fifty million dollars ($350,000,000), to be paid upon the execution of the order. The OCC's release says the penalty goes to the US Treasury. The bank's board signed both orders, and the bank neither admits nor denies the Comptroller's findings. ^{[1, 2, 3]}

The same afternoon the Federal Reserve Board announced its own enforcement action against American Express Company and American Express Travel Related Services Company, the two bank holding companies above the bank, citing the firm's failure to sufficiently detect and report certain suspicious activity related to money laundering and 'significant deficiencies' in how the enterprise-wide program was implemented, in particular at the national bank. The Fed's document, docket 26-052-B-HC, is an Order to Cease and Desist issued upon consent, entered without the companies admitting or denying any allegation. It sets no penalty: it orders written plans, cooperation and progress reports, and it notes that the OCC has issued 'a consent cease-and-desist order and civil money penalty against the Bank'. ^{[4, 5]}

American Express reported the orders to the SEC the same day in a current report under Item 7.01. It says the parent and the travel company consented to the Fed's order and the bank consented to the OCC's, 'to resolve previously disclosed reviews by the banking regulators of certain aspects of the Company's financial crimes compliance program', and that the bank agreed to pay the $350 million penalty to the OCC. The filing names no penalty from the Fed. ^[6]

What the OCC found

The Comptroller's findings, the same in both OCC orders, say the bank is one of the largest credit and charge card issuers in the United States by transaction volume but has not kept up a reasonably designed program. Its risk assessment, the map of where illicit money could enter, focused on its relatively narrow deposit accounts and insufficiently on its more dominant card products. Its customer due diligence, the work of learning who a customer is and what an account is for, and its customer identification procedures had substantial gaps. Its monitoring and reporting suffered systemic breakdowns that produced late, missed or incomplete suspicious activity reports (SARs), the confidential reports a bank must file with the Treasury when it sees possible crime. Internal audit, staffing and training also fell short. ^{[1, 2]}

The central finding is a figure. From approximately June 2014 to approximately May 2025, the order says, the bank processed approximately $13 billion in suspected trade-based money laundering activity, including suspicious card charges and the repayments of those charges, in certain instances through accounts associated with bank insiders. Over that time the bank periodically reported suspicious activity but lacked the controls and monitoring to identify and report the full scope of it. The OCC also found the violations were part of a pattern of misconduct and caused more than a minimal loss to the bank. ^{[1, 2]}

Trade-based money laundering is the use of trade to hide where money came from. The Financial Action Task Force, the intergovernmental body that sets anti-money laundering standards, defined it in its 2006 study as disguising the proceeds of crime and moving value through trade transactions to make their origin look legitimate, typically by misstating the price, quantity or quality of imports or exports. A card account can serve the scheme when charges for goods are paid and repaid in a pattern that moves value without real trade behind it; the OCC's order describes the activity only as suspicious card charges and their repayments. ^{[1, 12]}

What a cease-and-desist order requires

A cease-and-desist order is a regulator's binding instruction to stop an unsafe practice or a violation of law and to take named steps to fix it, issued here under section 8(b) of the Federal Deposit Insurance Act; a consent order is one the institution agrees to rather than contest at a hearing, and both American Express entities waived their rights to a hearing and to judicial review. The OCC's order gives the bank's board 15 days to appoint a compliance committee of at least three members, a majority of them directors who are not officers or employees, and 90 days to submit an Action Plan with dated corrective steps for every article of the order. The plan must cover a new risk assessment, a customer due diligence program, a financial crimes risk program, suspicious activity review, independent testing, staffing, training and a program for insider activity. ^{[1, 5]}

The OCC order also requires a look-back: an independent consultant approved by the OCC reviews past monitoring to decide whether SARs should now be filed for activity never reported and whether earlier ones need correcting, and must report to the board within 60 days of finishing. The OCC may widen its scope or period. The Fed's order gives the parent's board 90 days to submit a plan for its oversight of the remediation, the parent 90 days for a plan to improve the enterprise-wide program, and the travel company 90 days for a plan on compliance with the sanctions rules of the Treasury's Office of Foreign Assets Control. It bars the firm from rehiring anyone who, on the firm's own investigative record since 2024, took part in the misconduct, was disciplined for it and left the firm over it. ^{[1, 5]}

What the company had said, and where accounts differ

The filings show the matter building. In its annual report filed Friday 6 February, American Express said it had been engaging with its federal regulators about certain aspects of its financial crimes compliance program and was working to identify and remediate deficiencies. Its quarterly report filed Friday 24 July went further: it said it had been engaging with regulators about its anti-money laundering programs and 'as a result, we expect to be subject to enforcement action, which could include civil money penalties and lead to further regulatory inquiries'. The current report of 8 October says a portion of the penalty was reserved for in prior periods, that the penalty does not change the full-year 2026 guidance the company gave, that the orders impose no asset cap, a regulator's ceiling on a bank's size, and that the costs of meeting them are not anticipated to affect its 2027 guidance. ^{[6, 7, 8]}

Press accounts read the money differently. Reuters reported that 'US bank regulators fined American Express $350 million', and Bloomberg's headline says American Express was fined $350 million, wording that leaves open whether both agencies charged a penalty. The orders settle it: the $350 million is the OCC's alone, assessed against the bank, and the Fed's order against the parent sets none, as Banking Dive also reported. Banking Dive, citing OCC data, said it was the first civil money penalty the OCC has imposed on a bank since the $450 million it levied against TD in October 2024. The chief executive, Stephen Squeri, said in a statement reported by Banking Dive that the company 'takes its responsibility to combat financial crimes seriously' and will address both regulators' concerns. ^{[2, 5, 9, 10, 11]}

What settles it next

Friday 23 October is the fifteenth day under the OCC order, by which the bank's board must name its compliance committee; the order counts calendar days and does not count the day it was issued. The same day American Express is scheduled to hold its third-quarter 2026 earnings call at 8:30 a.m. Eastern time, the first results since the orders. By the desk's count of 90 calendar days from Thursday 8 October, the OCC's Action Plan and the three plans the Fed's order requires are due by Wednesday 6 January 2027, subject to the extensions each regulator may grant in writing. The Fed's first quarterly progress report is due within 45 days after the end of the first full calendar quarter after the order. None of the orders sets an end date: each stays in force until the regulator ends it in writing. ^{[1, 5, 13]}

Who it reaches

American Express (AXP) is the company the orders reach directly: its bank pays the $350 million penalty and carries the OCC's cease-and-desist order, while the parent and its travel-related services company carry the Fed's order and its plans. The sources name no other listed company as a party, and no other company is tagged here. ^{[2, 5, 6]}

Sources

Every stock is a company; the desk grades the company behind the stock. This article describes; it does not recommend. Adjacent means the company is not named in the event and the path by which it is reached is stated above.

All news →