American Express Hit With $350m Penalty Over AML Failures

American Express National Bank has been fined $350m by the Office of the Comptroller of the Currency after regulators identified significant weaknesses in its anti-money laundering and Bank Secrecy Act controls.

American Express Hit With $350m Penalty 

The OCC also issued a cease-and-desist order, while the Federal Reserve separately imposed enforcement action on American Express and related entities over broader enterprise-wide compliance shortcomings.

Regulators said the bank failed to maintain a BSA/AML programme appropriate to the scale and risk profile of its business.

Card Business Risks Were Underestimated

One of the most serious findings was that American Express National Bank did not adequately tailor its risk assessments to its actual activities.

According to the OCC, the bank concentrated too heavily on its relatively limited deposit business while failing to give sufficient weight to the risks associated with its much larger credit and charge card operations.

The regulator also identified weaknesses in staffing, expertise, internal controls, independent testing and employee training.

More seriously, it found systemic failures in customer due diligence and suspicious activity monitoring.

Those deficiencies contributed to the bank failing to identify, assess and sufficiently report around $13bn of suspected trade-based money laundering activity between June 2014 and May 2025.

Remediation Requirements Now Take Centre Stage

American Express has been ordered to produce an action plan within 90 days and overhaul its BSA/AML risk assessment, customer due diligence and risk identification processes.

The bank must also appoint an independent third party to conduct a retrospective review of suspicious activity.

Chief executive Stephen Squeri said American Express had already strengthened controls in recent years but acknowledged that further work was required.

The case is a reminder that payments scale creates corresponding compliance obligations.

For card issuers and payment providers, sophisticated transaction monitoring is not enough if governance, staffing and risk assessments fail to reflect the underlying business model.

The $350m fine is significant, but the more important regulatory message is that AML frameworks must be built around where transaction risk actually sits — not around legacy assumptions about how a bank operates.