American Express AML penalty: how US bank supervisors act

American Express National Bank has agreed to pay $350 million after the OCC, the US agency known as the Comptroller of the Currency, found its anti-money-laundering program was not effective, Protos reported. The case is a useful window into a part of banking most customers never see: the compliance machinery that is supposed to spot dirty money before it moves.

What did the regulators find?

According to Protos, the bank and the OCC signed a consent order. The OCC found that roughly $13 billion of suspected laundering, of the trade-based kind, passed through the bank between about June 2014 and May 2025.

The OCC said the suspicious activity combined card charges with the repayments of those same charges. In some instances it ran through accounts linked to bank insiders. Protos said the activity appears tied to how American Express credit cards were used.

The Federal Reserve brought a separate enforcement action for similar shortcomings. That action stops American Express from keeping people who took part in the misconduct, as identified in the firm's own investigation from 2024 onward. The ban reaches officers, employees, agents, consultants and contractors across the firm, its subsidiaries and affiliates.

How does a BSA/AML program work?

The Bank Secrecy Act is the US law that makes banks part of the fight against financial crime. In practice it means every bank must run an anti-money-laundering program, usually shortened to AML. Regulators do not only punish laundering itself. They also punish a bank whose controls are too weak to catch it, which is what this order is about.

• Know the customer: check who opens an account and what activity is normal for them.
• Monitor transactions: systems flag patterns that do not fit, such as charges and repayments that look staged.
• Investigate and report: staff review alerts and report suspicious activity to the authorities.
• Govern the program: senior managers must fund it, test it and fix gaps when examiners find them.

When one of these layers fails for years, the problem is treated as a failure of the whole program, not of a single alert.

What is trade-based money laundering?

Protos describes trade-based money laundering, or TBML, as moving illicit money by manipulating trade transactions, for example with altered invoices, so the funds look like ordinary business income. The trick is that the payment itself is real; what is false is the story behind it.

Card networks can be used in a similar way. A charge and its repayment create a clean-looking paper trail between two parties. If the goods or services behind the charge never existed, the trail becomes a way to move value. That is why monitoring looks at patterns over time, not only at single payments.

What is a consent order, and why do two regulators act?

A consent order is an agreement between a supervisor and a bank. The bank accepts the order and its penalty, and the supervisor sets out what must change. It settles the matter without a court fight, but the obligations in it are binding.

Large US banking groups often answer to more than one supervisor. The OCC oversees nationally chartered banks such as American Express National Bank, while the Federal Reserve supervises the wider group. That is why the same weakness can lead to two separate actions with different remedies: a fine from one, and a ban on keeping involved staff from the other.

What changes, and for whom?

For the company, the change is mainly financial and about who it can employ. In a Form 8-K filed with the SEC, American Express said part of the civil money penalty had already been reserved for in earlier periods. The company said the penalty does not change its full-year 2026 guidance and is not expected to affect its 2027 guidance.

For people inside the firm, the Federal Reserve action means anyone identified as involved in the misconduct cannot be kept on, whether as an officer, an employee or an outside contractor. The reports do not describe any direct change for ordinary cardholders.

What questions remain open?

Protos noted that the penalty is not the largest the OCC has imposed, but it sits close to the $450 million TD Bank order from 2024.

The reports do not say who was behind the suspicious charges or how the activity was first detected. They also do not say what changes the OCC order requires the bank to make to its program, or by when.

Sources

• Protos, 9 Oct 2026

How this post was made: an AI model drafted it from the sources listed above, and software checks ran before it went live without a human edit. Every figure has to match a listed source and no sentence is copied. It explains how the mechanism works; it is not investment advice.