OCC Fines American Express National Bank $350 Million Over AML Failures

The enforcement action, announced most recently, follows findings that the bank failed to maintain effective controls to identify, investigate, and report suspicious financial activity. The OCC also issued a cease-and-desist order requiring the bank to address the deficiencies.

According to the OCC, monitoring and reporting failures affected approximately $13 billion in suspected trade-based money laundering activity over the past decade. This refers to suspected activity that was not adequately addressed, not a finding that the entire amount was confirmed to be money laundering.

What went wrong?

The OCC identified several weaknesses in American Express National Bank’s AML program:

• Improper risk assessments: The bank focused too heavily on deposit products and did not sufficiently account for risks associated with its larger credit and charge card businesses.
• Weak transaction monitoring system: Systemic breakdowns affected the identification, evaluation, and reporting of suspicious activity.
• Staffing and training gaps: The regulator identified insufficient resources, gaps in staff expertise and training, and weaknesses in internal controls and independent testing.

The Federal Reserve also announced a separate enforcement action against American Express Company and related entities for deficiencies in suspicious activity reporting and in implementing the company’s broader AML program.

American Express said it is addressing the regulators’ concerns and strengthening its compliance capabilities.

Implications for Compliance Teams

The case highlights important lessons for financial institutions:

• Assess risks across the business: Risk assessments should reflect actual products, customer activity and transaction volumes.
• Review monitoring coverage: Systems must identify suspicious patterns across relevant payment and card products.
• Invest in people and controls: Skilled staff, effective refresher training and independent testing help identify weaknesses before they lead to prolonged reporting failures.

The enforcement action reinforces a key lesson: an AML program must work in practice, not just exist on paper. Risk assessments, customer due diligence, transaction monitoring and suspicious activity reporting must work in collaboration and reflect the institution’s actual risk exposure.