The OCC Just Hit American Express With a $350 Million AML Fine. $13 Billion in Suspected Trade-Based Money Laundering. Here's What Every Bank's BSA Officer Needs to See.

TL;DR

• On October 8, 2026, the OCC assessed a $350 million civil money penalty against American Express National Bank for BSA/AML program failures — the biggest bank AML headline since TD Bank’s October 2024 resolution (FinCEN’s $1.3 billion share alone; about $3.09 billion across all US agencies)
• The Federal Reserve simultaneously issued a parallel consent order against the holding company covering enterprisewide financial crimes risk management
• The OCC traced approximately $13 billion in suspected trade-based money laundering activity through card charges and repayments over an 11-year period from 2014 to 2025
• Core failures: insufficient staffing and expertise, failure to tailor risk assessments to actual business activity, systemic breakdowns in transaction monitoring and SAR filing
• An independent look-back was ordered — a signal the OCC believes the SAR filing gaps were large enough to require retrospective review

American Express just got hit with a $350 million OCC penalty for AML failures. That’s the second multi-hundred-million-dollar BSA enforcement action against a major financial institution in two years, and the pattern is exactly what BSA officers have been warned about: not a single catastrophic failure, but years of accumulated deficiencies in the fundamentals — staffing, risk assessment tailoring, transaction monitoring, and independent testing.

If you run compliance for a bank, this one deserves a close read.

What the OCC Found

The OCC’s October 8, 2026 enforcement action against American Express National Bank identified a failure at the program design level. The bank did not establish and maintain an adequate BSA/AML compliance program — which under 31 USC 5318(h) requires written internal policies and controls, a designated compliance officer, ongoing employee training, and independent testing.

The OCC cited four interconnected deficiencies:

1. Inadequate staffing and expertise

The AML program was under-resourced for the complexity and volume of the activity it was supposed to monitor. Personnel lacked sufficient BSA/AML expertise to perform the monitoring, escalation, and SAR-filing functions their roles required. This is a recurrent OCC finding — not a novel one — but it appears here at a scale significant enough to generate a nine-figure penalty.

2. Failure to tailor the risk assessment to actual business activities

A BSA/AML risk assessment is not a generic document. It has to reflect the specific products, customers, geographies, and transaction patterns of the particular institution running it. The OCC found that American Express National Bank’s risk assessment did not reflect the risks actually present in its business — meaning the program’s controls were not calibrated to the actual exposure.

This is the gap that underlies most of the SAR filing failures: if your risk assessment doesn’t correctly map your highest-risk activity, your monitoring rules and escalation thresholds won’t either.

3. Systemic weaknesses in independent testing

The BSA statute requires independent testing of the AML program. In practice, that means internal audit or a qualified outside firm reviewing whether the program’s controls are actually functioning — not just whether they exist on paper. The OCC found systemic weaknesses in American Express’s independent testing function, which means that even when gaps existed, the oversight mechanism designed to surface them wasn’t working.

4. Systemic breakdowns in suspicious activity monitoring and reporting

The most concrete manifestation of the above: transaction monitoring that wasn’t surfacing the activity it should have, and SAR-filing processes that weren’t producing the reports the law requires. This is where the $13 billion figure enters the picture.

$13 Billion in Suspected Trade-Based Money Laundering

The OCC and Federal Reserve identified approximately $13 billion in suspected trade-based money laundering activity processed through American Express card charges and repayments over the period from 2014 to 2025. The activity involved bank insiders in some instances, according to agency reports.

Trade-based money laundering is one of the hardest detection problems in BSA compliance. It works by running money through commercial transactions — typically using the volume and complexity of business-to-business payments to obscure the movement of illicit funds. For a card issuer processing large volumes of commercial account activity, TBML can look like routine business spending: vendors, invoices, repayments.

What makes it detectable — and what the OCC expected here — is a risk assessment that specifically identifies commercial account TBML as a threat, monitoring rules tuned to TBML patterns (such as rapid repayment of large balances, unusual merchant categories, counterparty geography), and human review capacity sufficient to investigate alerts that automated systems surface.

The gap between what the program was designed to catch and what it actually missed is reflected in that $13 billion figure. Eleven years of suspected activity in a product line that the program wasn’t adequately monitoring for TBML risk.

The Federal Reserve Order: Holding Company Accountability

The Federal Reserve’s consent cease-and-desist order covers American Express Company and American Express Travel Related Services Company — not the national bank, but the holding company and its primary operating subsidiary.

The Fed’s findings through the Federal Reserve Bank of New York identified significant deficiencies in the enterprisewide financial crimes risk management program, specifically:

• Weaknesses in transaction monitoring
• Gaps in fraud referral processes
• Third-party risk assessment deficiencies
• Broad weaknesses in financial crimes risk governance

The holding company order matters because it signals that the Fed views this as more than a bank-level operational failure. It’s a governance issue — the kind that implicates board oversight, senior management accountability, and the firm’s enterprise risk management framework.

When both the OCC and the Fed move simultaneously, the message is: this wasn’t a compliance team problem. It was a management priority problem.

The Independent Look-Back Order

The OCC ordered an independent look-back as part of the enforcement action. This requires American Express to hire an outside consultant to review historical transactions and determine whether additional SARs should have been filed.

Independent look-backs are expensive. They can run into eight figures depending on the scope and volume of activity being reviewed. They create operational disruption. And they produce a new set of SAR filings — which means the suspicious activity that went unreported for years is now going to get reported, often in formats that regulators can cross-reference with other investigations.

The look-back order is also a signal. The OCC imposes it when the SAR filing gaps are significant enough that the agency isn’t confident the historical record is complete. It’s not standard in every enforcement action — it shows up when the examiner concludes that the backlog is large enough to warrant a systematic retrospective review.

What This Means for Your AML Program

The American Express case maps directly onto four categories of AML program risk that examiners use when they assess your institution:

1. Is your risk assessment actually tailored to your business?

The OCC didn’t cite American Express for failing to have a risk assessment — they cited the bank for having one that wasn’t calibrated to its actual activity. A risk assessment that lists generic risk factors without reflecting the specific products, transaction flows, customer segments, and geographies of your institution isn’t meeting the regulatory standard.

If your risk assessment was last updated before your highest-risk product line launched, or before you added a significant commercial client segment, or before you expanded into a new geography — it’s stale, and it’s potentially miscalibrating your entire control framework.

2. Is your monitoring program aligned with your highest-risk activity?

Monitoring rules designed for retail customers won’t catch TBML in commercial accounts. Rules designed for wire-based money movement won’t catch TBML in card repayment patterns. The architecture of your transaction monitoring needs to reflect the specific typologies associated with your highest-risk products.

This is harder than it sounds. Most monitoring platforms ship with default rule libraries. Customizing those rules to your specific risk profile requires knowing what the typologies actually look like for your business — and that knowledge has to come from your risk assessment.

3. Is your AML team resourced to close the loop?

Automated monitoring generates alerts. Alerts require human review. Human review generates SAR decisions. Each step in that chain has to be adequately staffed and trained.

The Canaccord Genuity case from March 2026 showed what happens when alerts pile up without adequate review capacity — surveillance backlogs, missed SAR filings, and ultimately falsified records to conceal the gap. The American Express case shows the same failure at a much larger institution: a program that generated alerts without the staffing infrastructure to turn them into appropriate regulatory filings.

If your AML team is logging overtime to keep up with alert volume, or if case aging reports show reviews taking more than 30 days on a regular basis, you have a staffing problem — and your next exam cycle will find it.

4. Is your independent testing actually testing the right things?

Independent testing that reviews policy documentation and confirms that processes exist isn’t the same as testing that evaluates whether those processes are producing the outputs they should. The OCC expects testing that evaluates the effectiveness of the AML program — not just its existence.

A robust independent testing program should be sampling SAR filing decisions (both to file and not to file), reviewing the end-to-end functioning of the monitoring system, assessing whether alert thresholds are generating appropriate alert volumes for the risk level of each activity, and evaluating whether the risk assessment is current. If your last internal audit cycle reviewed the AML policy and called it done, that’s not independent testing of program effectiveness.

The Broader Picture

American Express’s $350 million penalty follows TD Bank’s 2024 resolution (about $3.09 billion across US agencies, including FinCEN’s $1.3 billion), Canaccord Genuity’s $80 million penalty in March 2026, and the UBS Financial Services $125 million action in August 2026. Examiners are not accepting “we had an AML program” as a defense. They are evaluating whether the program was adequate for the specific risks of the institution.

Comptroller Jonathan Gould’s statement in the OCC’s press release put it directly: “The OCC expects banks of American Express’s size and complexity to devote sufficient resources to ensure compliance with laws and regulations designed to detect and prevent money laundering, which are critical to both economic and national security.”

That standard isn’t limited to institutions of American Express’s size. It applies to every bank with a BSA program — proportionate to size and complexity, but present, documented, tested, and adequate.

So What?

If you run BSA/AML compliance, the American Express enforcement action is a calibration event. Not because your institution is comparable to a major card network, but because the failures identified are exactly the ones that examiners are trained to find at institutions of every size:

• A risk assessment that doesn’t reflect your actual business
• Monitoring that isn’t tuned to your highest-risk activity
• Staffing that can’t close the loop from alert to decision to SAR
• Independent testing that documents rather than evaluates

The OCC ordered an independent look-back because it concluded those gaps were material and longstanding. Your next exam cycle will assess whether your program has any of the same gaps. The better time to find them is now, not then.

If your current BSA/AML risk assessment was written before your last significant product launch or customer segment expansion — or if it hasn’t been externally reviewed in more than two years — it may not be reflecting the risks it’s supposed to cover.

Resources:

• OCC News Release NR 2026-87: OCC Assesses $350 Million Civil Money Penalty Against American Express
• American Express Form 8-K, October 8, 2026: Company disclosure of consent orders and penalty
• PYMNTS: OCC and Fed Fine American Express $350 Million Over AML Deficiencies
• American Banker: Fed, OCC order Amex to overhaul AML controls
• FinCrime Central: American Express Bank Fined $350 Million as Fed Orders AML Overhaul

Related reading on this site:

• Two Employees Falsified Compliance Records. 160 SARs Went Unfiled. FinCEN’s $80 Million Fine Against Canaccord Genuity Shows Exactly How an AML Program Collapses.
• FinCEN’s AML Program Rewrite Left Comment in June. Here’s the Gap Assessment Your Compliance Team Should Be Running Now.
• Your AML Transaction Monitoring Runs on AI. Your Examiner Is About to Treat It Like a Model Under SR 26-2.