On October 8, 2026, the Office of the Comptroller of the Currency (OCC) and the Federal Reserve Board issued concurrent enforcement actions against American Express and its subsidiaries over significant deficiencies in their anti-money laundering (AML) programs.
The OCC imposed a cease-and-desist order and a $350 million civil money penalty on American Express National Bank (based in Sandy, Utah). The Federal Reserve issued a cease-and-desist order against American Express Company and its travel-related services arm. Regulators found that Amex’s bank subsidiary failed to maintain a Bank Secrecy Act (BSA)/AML compliance program reasonably designed for its business. Key shortcomings included inadequate resources and staff expertise, systemic internal control gaps, weak independent testing, and insufficient training. The bank’s risk assessment also focused too heavily on its narrower demand deposit products and not enough on the higher-volume risks in its dominant credit and charge card business.
Most notably, “systemic breakdowns” in suspicious activity monitoring and reporting meant the bank failed to timely identify, evaluate, and sufficiently report approximately $13 billion in suspected trade-based money laundering activity between June 2014 and May 2025; including, in some cases, through accounts tied to bank insiders.
Amex CEO Stephen Squeri stated that the company takes its responsibility to combat financial crimes seriously and has been working with regulators and law enforcement, while acknowledging more work remains. A portion of the penalty had already been reserved, and the orders are not expected to affect the company’s guidance.
Michael Padula, founder of Padula Law and a former trial attorney in the Department of Justice’s Money Laundering Section, was quoted in Banking Dive on the enforcement actions. He emphasized that the headline penalty is only part of the story:
“I know $350 million penalty gets the headline, but I think the bigger question is how $13 billion went inadequately reported for so long.”
Padula further observed that Amex’s compliance program was wholly inadequate, noting that front-line personnel appeared to lack the basics. “A compliance program is only as effective as the people, resources and oversight behind it,” he said.
He views the actions as a clear signal that filing Suspicious Activity Reports (SARs) is non-negotiable. SARs matter not only to regulators but also to law enforcement:
“A lot of times, they’re the first line for law enforcement to pick up on trends or illegal conduct occurring in a certain geographic area or certain business area.”
This case underscores enduring lessons for financial institutions and other regulated entities: risk assessments must match actual business activities, monitoring systems must be robust and properly resourced, and SAR processes must function effectively. Failures in these areas can allow substantial suspicious activity to go unreported for years and draw significant regulatory scrutiny.
Padula Law advises banks, financial institutions, and businesses on BSA/AML compliance programs, risk assessments, SAR processes, and responses to regulatory examinations or investigations. Michael Padula’s experience investigating financial institutions for BSA/AML deficiencies while at the DOJ provides practical insight into how these matters are evaluated and resolved.
If your organization has questions about AML compliance, a regulatory inquiry, or related issues, contact Padula Law for a confidential consultation.