Thirteen billion dollars, inadequately reported

The Office of the Comptroller of the Currency fined American Express National Bank $350m on Thursday and ordered it to overhaul its anti-money laundering programme, and the Federal Reserve Board separately issued a cease-and-desist order against the parent company. The OCC assessed a cease-and-desist order and the civil money penalty against the bank, which is based in Sandy, Utah, Banking Dive reported. The Fed's order applies to American Express and its travel-related services arm.

The central finding is about reporting. The bank "experienced systemic breakdowns in its suspicious activity monitoring and reporting processes," the OCC said in its announcement, which left it failing to "timely identify, evaluate, and sufficiently report" about $13bn of suspected trade-based money laundering. The activity ran from June 2014 to May 2025, according to Banking Dive and Yahoo Finance, citing the OCC's order. Yahoo Finance reported that the activity included suspicious card charges and repayments, and that some transactions involved accounts associated with bank insiders. The order did not identify the individuals or their roles, Yahoo said. By our arithmetic, the penalty is about 2.7 per cent of the suspected activity.

The regulator also said the bank's risk assessment looked in the wrong place. It focused on the bank's "relatively narrow" demand deposit account products and "insufficiently" on its "more dominant" credit and charge card products, the OCC said. It also cited inadequate resources, including staff without sufficient expertise, systemic internal control gaps, weak independent testing and weak anti-money laundering training for employees and directors.

The Fed described the problem as wider. It said it had identified "significant deficiencies" in how the enterprise-wide anti-money laundering programme was implemented, in particular at the national bank subsidiary, in its announcement at 4:30 p.m. on Thursday. Banking Dive said the Fed called the programme issues "enterprise wide" for the firm, which has $308bn in assets. Under the Fed order, American Express must submit a plan to improve its enterprise-wide compliance risk management, and the travel-related services arm must submit a plan to address compliance with the Treasury's Office of Foreign Assets Control, Banking Dive reported.

The bank's own order has deadlines. It must produce an action plan within 90 days, develop an effective risk assessment process and a customer due diligence and risk identification programme, and hire a third party to carry out a look-back review of suspicious activity, according to Banking Dive. "The OCC expects banks of American Express's size and complexity to devote sufficient resources to ensure compliance with laws and regulations designed to detect and prevent money laundering, which are critical to both economic and national security," said Comptroller of the Currency Jonathan Gould.

American Express agreed to the OCC's orders without admitting or denying the findings, Yahoo reported. Stephen Squeri, its chief executive, said the company "takes its responsibility to combat financial crimes seriously." He added: "While we have made meaningful progress, we know there is more work to do." A portion of the penalty was reserved in earlier periods and the orders do not change guidance for the full year 2026, and the company does not expect them to affect 2027 guidance, Banking Dive said. The orders do not cap the company's assets, Yahoo reported.

The size of the penalty looks modest by comparison with the Canadian bank that preceded it. This is the OCC's first civil money penalty on a bank since the $450m it imposed on TD in October 2024, Banking Dive said, citing OCC data. TD's total penalties were more than $3.5bn, and it also received a $434bn asset cap on its US retail business. Michael Padula, a former Justice Department trial attorney in its money laundering section, told Banking Dive that "I know $350 million penalty gets the headline, but I think the bigger question is how $13 billion went inadequately reported for so long."

The shares barely moved. Yahoo said they were down 0.3 per cent in premarket trading on Friday and more than 16 per cent for the year. The penalty falls on a company that is also a target for new rivals: Revolut's founder said this week that his firm would bring US credit cards and loans that match Amex's and JPMorgan's once it holds a full banking charter. The orders target the credit and charge card side that the OCC says the bank's risk assessment under-weighted. Another enforcement action landed the same week: Treasury fined Amidi, the parent of Plug and Play, $200,000 over an unreported stake, its first outbound-investment penalty.