Federal regulators found years of inadequate financial crime monitoring, including suspicious transactions involving accounts associated with bank insiders. An independent review must determine whether more suspicious activity went unreported.
WASHINGTON, Oct. 9, 2026 — American Express National Bank faces a $350 million federal penalty after regulators identified approximately $13 billion in suspected trade-based money laundering activity inadequately detected, investigated, or reported over nearly eleven years.
The Office of the Comptroller of the Currency announced its action October 8 alongside a Federal Reserve cease-and-desist order against American Express Company and American Express Travel Related Services Company. Together the actions address weaknesses in transaction monitoring, suspicious activity reporting, fraud referrals, third-party oversight, and management accountability.
A particularly consequential OCC finding concerns suspicious transactions involving accounts associated with bank insiders. The Federal Reserve also restricted future retention of certain former employees implicated in the misconduct and required cooperation with investigations of individuals.
Nearly Eleven Years of Suspected Activity
The OCC identified approximately $13 billion in suspected trade-based money laundering activity during a period reported as June 2014 through May 2025. Trade-based laundering can use commercial transactions, manipulated values, or misrepresented goods and services to disguise illicit funds.
The $13 billion is not a finding that $13 billion was proven laundered or stolen. It describes suspected activity that regulators found was not adequately identified, evaluated, or reported. The orders do not quantify proven criminal proceeds. The OCC said reporting failures deprived law enforcement of important information in a timely manner.
A Compliance Program Focused on the Wrong Risks
According to the OCC, American Express National Bank concentrated its financial crime risk assessment on relatively limited demand-deposit operations while inadequately accounting for its much larger credit and charge card business. The regulator identified weaknesses in staffing, expertise, independent testing, training, and monitoring.
The Federal Reserve enforcement action identified significant enterprise-wide deficiencies in transaction monitoring, fraud referrals, third-party risk assessments, and escalation of financial crime concerns. It also required sanctions compliance improvements at American Express Travel Related Services, including screening, risk assessment, and training.
The Insider Question
The OCC consent order addresses suspicious card charges and repayments, including certain transactions involving accounts associated with bank insiders. The OCC also described a pattern of misconduct and more than minimal loss to the bank.
The public order does not identify the individuals associated with those accounts, their positions, or whether each engaged in criminal conduct. Nor does it establish that they are the same individuals covered by the Federal Reserve’s employee misconduct provisions.
Paragraph 4 of the Federal Reserve order bars American Express and its Travel Related Services subsidiary from retaining or rehiring certain individuals who participated in the underlying misconduct, received formal discipline, and separated or were terminated in connection with that misconduct. It refers to an investigative record compiled from 2024 onward.
Paragraph 5 requires cooperation in investigations of current and former institution-affiliated individuals, including production of evidence, identification of witnesses, interviews, and testimony under administrative subpoena. These requirements preserve individual accountability avenues without establishing that criminal charges are pending.
The Third-Party Problem
The Federal Reserve identified deficiencies in third-party risk assessments and demanded stronger oversight involving network partnerships, ATM partners, and outside anti-money-laundering service providers. The OCC separately required improvements addressing automated clearinghouse activity, transaction-monitoring alert prioritization, suppression, deduplication, and trade-based laundering indicators.
The orders do not identify particular payment networks, ATM operators, processors, or compliance contractors as participants in suspected laundering. They establish deficiencies in oversight, not culpability of a named third party.
An Independent Review Could Reveal More
Article IX of the OCC order requires an independent consultant to review historical monitoring, investigations, and suspicious activity reporting decisions. The review must assess whether additional Suspicious Activity Reports should have been filed, whether existing reports need amendment, and whether more accounts or transactions warrant investigation.
The consultant must also identify instances where it recommended a filing or amendment but the bank declined, including the reasons. That means the historical accounting may not be closed. The review could identify additional deficiencies, although SAR confidentiality and supervisory restrictions may limit public access to its findings.
American Express Had Already Warned Investors
American Express discussed regulatory engagement concerning financial crime compliance in its 2025 annual report and anticipated possible enforcement action and monetary penalties in its July 2026 quarterly filing.
In its October 8 statement, the company described internal and external reviews and improvements to monitoring, investigative capabilities, expertise, and governance. It said it investigated transactions involving individuals misusing American Express products, reported information to law enforcement, and took appropriate action.
The disclosures do not specify when leadership first knew the full scope of the suspected activity, how many people were disciplined, or whether internal investigations led to prosecutions.
A Separate History of Enforcement Trouble
In January 2025, American Express agreed to pay approximately $108.7 million to resolve separate federal allegations concerning deceptive marketing and fabricated employer identification information connected to certain business-card accounts. That settlement involved different allegations; the reviewed records do not establish that it arose from the same transactions, employees, or failures as the October 2026 case.
Regulators Put the Board on Notice
The Federal Reserve requires the American Express board to submit an oversight plan within 90 days addressing management accountability, remediation resources, enterprise-wide compliance, and escalation of material issues. The firm must submit an anti-money-laundering remediation plan, while Travel Related Services must submit a sanctions compliance plan.
Approved plans must be adopted within ten days of regulatory approval, with implementation following approved schedules. The board must submit quarterly progress reports, including reports required under the OCC action. The Federal Reserve order imposes no additional monetary penalty; the $350 million penalty comes from the OCC’s separate penalty order.
The Questions Regulators Have Not Answered
The enforcement record does not disclose when the earliest problems were identified internally, how warnings moved through management, who controlled the insider-associated accounts, how much activity was ultimately criminal, or the outcome of potential law enforcement investigations.
The $350 million penalty is settled. The accounting of what happened, who knew, and whether additional suspicious activity escaped adequate scrutiny is not. The AmEx case fits a broader pattern in which financial misconduct runs for years before regulators catch up: the OCC found failures spanning June 2014 through May 2025, eleven years during which required Suspicious Activity Reports were not filed and law enforcement was deprived of information it should have had. On the question of how financial wrongdoing gets surfaced in the first place, the DOJ’s recent rewriting of its whistleblower dismissal rules is relevant context — the department that would investigate any individual misconduct here is the same one that has been dismissing qui tam suits at four times the historical rate. And the compliance program that missed $13 billion in suspected activity is a case study in what happens when monitoring is focused on the wrong risks — a dynamic the delegated regulatory structure around financial markets can make harder to catch from the outside.
