The Office of the Comptroller of the Currency (OCC) has issued a cease-and-desist order and imposed a $350 million civil money penalty against American Express National Bank, headquartered in Sandy, Utah, over significant deficiencies in its Bank Secrecy Act/anti-money laundering (BSA/AML) compliance programme.
The enforcement action follows the regulator’s determination that the bank failed to establish and maintain a compliance programme reasonably designed to ensure adherence to the Bank Secrecy Act (BSA) and its implementing regulations. The deficiencies affected multiple components of the bank’s financial crime controls, including risk assessment, customer due diligence, internal controls, independent testing, employee training and suspicious activity monitoring.
Of particular concern was the bank’s failure to timely identify, evaluate and sufficiently report approximately $13 billion in suspected trade-based money laundering activity over the past decade. According to the OCC, systemic breakdowns in suspicious activity monitoring and reporting prevented the bank from providing law enforcement with important information about potentially illicit financial activity in a timely manner.
The regulator said the action was intended to focus the bank on addressing risks associated with its operations and ensuring that its compliance programme is appropriately aligned with the nature and complexity of its business.
Risk assessment failed to reflect the bank’s core business
A central finding concerned the bank’s approach to assessing money laundering risks across its products and services.
The OCC determined that American Express National Bank did not adequately tailor its BSA/AML risk assessment to its actual business activities. Instead, the bank focused disproportionately on the risks associated with its relatively narrow demand deposit account offerings, while insufficiently assessing the risks arising from its more dominant credit and charge card products.
This mismatch between the bank’s business profile and its risk assessment had significant implications for the effectiveness of its broader compliance framework.
A risk assessment is intended to help a financial institution understand where its products, customers, transaction patterns and business relationships may be vulnerable to money laundering. That assessment should then inform the design of internal controls, monitoring scenarios, investigative procedures and resource allocation.
When a bank underestimates risks associated with its principal products, its monitoring systems may not adequately reflect the activity taking place across its business. Controls designed around an incomplete understanding of the institution’s exposure can leave important financial crime risks insufficiently addressed.
The OCC’s findings highlight the importance of evaluating risk across the full range of a bank’s operations rather than concentrating on selected products or business lines.
Customer due diligence and identification weaknesses compounded monitoring failures
The regulator also identified deficiencies in customer due diligence (CDD) processes and the bank’s customer identification programme (CIP).
CDD helps financial institutions understand who their customers are, the nature and purpose of their relationships and the risks associated with those relationships. A customer identification programme establishes procedures for verifying customer identities when accounts are opened, in accordance with applicable requirements.
These processes provide essential information for subsequent risk classification and transaction monitoring. If customer information is incomplete, risk assessments are inadequately tailored or customer activity is not evaluated in the context of the relationship, suspicious patterns may be more difficult to recognise.
According to the OCC, deficiencies in American Express National Bank’s CDD and CIP procedures contributed to its monitoring and reporting failures.
The findings illustrate how weaknesses at the customer onboarding stage can affect the entire compliance lifecycle. Customer identification and due diligence are not isolated administrative requirements; they help establish the information foundation on which effective monitoring and investigation depend.
For compliance teams, the implication is clear: customer information must be sufficiently reliable and relevant to support meaningful risk assessments and ongoing reviews.
Systemic failures left approximately $13 billion in suspected activity insufficiently reported
The most significant finding involved systemic breakdowns in the bank’s suspicious activity monitoring and reporting processes.
The OCC determined that these failures resulted in the bank not timely identifying, evaluating and sufficiently reporting approximately $13 billion in suspected trade-based money laundering activity over a period of ten years.
Trade-based money laundering involves the use of trade transactions and related financial arrangements to disguise the origins or movement of illicit funds. Such schemes can exploit the complexity of commercial transactions, discrepancies in trade documentation, intermediaries and cross-border business relationships to obscure the true nature of financial activity.
Detecting these risks can require more than reviewing individual transactions against predefined thresholds. Investigators may need to assess transaction patterns, understand the customer’s commercial activities, examine relationships between counterparties and identify inconsistencies that warrant further investigation.
The OCC’s findings demonstrate the importance of connecting risk assessments, customer information and transaction monitoring to effective investigative and reporting procedures.
Generating alerts is only one stage of the process. Financial institutions must also have the resources, expertise and controls needed to evaluate alerts, determine whether activity is suspicious and submit appropriate reports within the required timeframes.
The case also highlights the importance of ensuring that monitoring arrangements reflect the institution’s actual products, customers and exposure to financial crime risks.
OCC identifies gaps in staffing, internal controls and training
Beyond risk assessment and monitoring, the OCC identified broader weaknesses in the bank’s compliance infrastructure.
The deficiencies included inadequate resources, staff without sufficient expertise, systemic gaps in internal controls, weak independent testing and insufficient BSA/AML training for employees and directors.
These findings point to the importance of effective governance in maintaining a functioning financial crime compliance programme.
Appropriate staffing and expertise are necessary to ensure that monitoring alerts are investigated thoroughly and that complex cases receive the attention they require. Internal controls help establish consistent procedures and accountability, while independent testing provides an assessment of whether those controls are operating as intended.
Training is equally important. Employees and directors need to understand their respective responsibilities, the institution’s risk exposure and the procedures required to identify and escalate potentially suspicious activity.
Weaknesses across these areas can reinforce one another. An inadequately resourced team may struggle to investigate alerts promptly, while weak internal controls can allow inconsistencies to persist. Insufficient independent testing may then fail to identify these shortcomings before they produce broader compliance failures.
The OCC’s action underscores that effective AML compliance depends on a coordinated framework of people, processes, technology and oversight.
OCC emphasises the connection between compliance and national security
Commenting on the enforcement action, Comptroller of the Currency Jonathan Gould stressed that banks of American Express’s size and complexity must devote sufficient resources to complying with laws designed to detect and prevent money laundering.
Gould described these obligations as critical to both economic and national security, adding that the bank had failed to maintain a BSA/AML programme properly aligned with the money laundering risks of its operations.
He also noted that the failures resulted in significant missed suspicious activity and prevented important information from reaching law enforcement in a timely manner.
The regulator’s statement reinforces the wider role of financial institutions in the financial crime prevention system. Banks are expected not only to comply with internal control requirements but also to identify and report potentially suspicious activity that may assist authorities in investigating criminal networks and tracing illicit proceeds.
Federal Reserve takes concurrent action against related entities
The OCC’s enforcement measures are being taken in coordination with a separate cease-and-desist order issued by the Board of Governors of the Federal Reserve System against American Express Company and American Express Travel Related Services Company, Inc.
The coordinated actions demonstrate regulatory scrutiny extending beyond the national bank to related entities within the wider American Express organisation.
The $350 million civil money penalty assessed by the OCC will be directed to the U.S. Treasury.
The OCC’s order and penalty are intended to compel the bank to address the identified deficiencies and bring its compliance arrangements into alignment with applicable regulatory requirements.
Lessons for financial crime compliance teams
The American Express National Bank case offers several important lessons for financial institutions reviewing the effectiveness of their own AML programmes.
Risk assessments must reflect actual business exposure. Institutions should evaluate the money laundering risks associated with their principal products, customer segments, transaction types and business relationships. A risk assessment that overlooks a dominant business line can undermine the controls built around it.
Customer due diligence must support ongoing monitoring. Accurate customer identification and relevant information about the nature and purpose of a relationship help investigators determine whether transactions are consistent with expected activity.
Monitoring must lead to timely investigation and reporting. Alerts alone do not demonstrate an effective AML programme. Institutions need adequate resources, clear escalation procedures and documented decision-making to ensure that potentially suspicious activity is appropriately evaluated and reported.
Governance and independent testing must identify weaknesses. Effective oversight, qualified personnel and robust testing can help institutions identify gaps before they develop into systemic failures.
Training must reach both operational teams and leadership. Compliance obligations require informed decision-making across the organisation, supported by a clear understanding of risks and individual responsibilities.
A reminder that AML effectiveness depends on the entire compliance lifecycle
The OCC’s $350 million penalty against American Express National Bank highlights the consequences of a compliance programme that fails to reflect a bank’s actual risk exposure and does not adequately support the identification and reporting of suspicious activity.
The approximately $13 billion in suspected trade-based money laundering activity cited by the regulator underscores the importance of effective risk assessment, customer information, monitoring and investigation working together.
For financial institutions, the challenge is not simply to establish AML policies or deploy monitoring systems. It is to ensure that those systems are appropriately calibrated, supported by reliable customer information, operated by qualified personnel and subject to effective oversight.
Ultimately, an effective AML programme must connect the risks an institution faces with the information it collects, the activity it monitors and the decisions it makes. Where those connections fail, potentially significant financial crime risks may remain unidentified or unreported for extended periods.
By FCCT Editorial Team
, an independent military force, and allied militias in Sudan raped several dozen women and girls in West Darfur’s capital, El Geneina, and those fleeing to Chad between late April and late June 2023, Human Rights Watch said today. The assailants appear to have targeted people because of their Massalit ethnicity and, in some cases, because they were known activists.){kind=link}