Federal Reserve Board announces enforcement action against American Express Company to address, among other things, the firm’s failure to sufficiently detect and report certain suspicious activity related to money laundering
AI Analysis
On October 8, 2026, the Federal Reserve issued a cease-and-desist enforcement action against American Express Company and American Express Travel Related Services Company, Inc., citing insufficient enterprise-wide AML implementation and failures to detect and report suspicious activity, particularly at American Express National Bank. The coordinated OCC action imposed a $350 million civil money penalty on the bank and found that approximately $13 billion of suspected trade-based money laundering activity over the past decade was not timely identified, evaluated, or sufficiently reported.
Key dates
- 2026-10-08
- Federal Reserve and OCC announced coordinated enforcement actions; the OCC imposed a $350 million civil money penalty on American Express National Bank and issued a cease-and-desist order. The Federal Reserve action applied to American Express Company and American Express Travel Related Services Company, Inc.
- 2027-01-06 Deadline
- Approximate deadline for American Express National Bank to submit the OCC-required written Action Plan within 90 days of the October 8, 2026 order, subject to the order's day-counting conventions.
Suggested considerations
- Compliance teams may wish to reassess whether the institution's BSA/AML risk assessment adequately covers its largest and most economically significant products, customer segments, transaction channels, and trade-related activity.
- Firms should consider testing whether customer identification, customer due diligence, beneficial-ownership information, and transaction-monitoring scenarios are appropriately calibrated to credit-card, charge-card, merchant, cross-border, and trade-based money-laundering risks.
- Management may wish to inventory staffing, subject-matter expertise, escalation capacity, data quality, model and rules governance, internal controls, independent testing, and BSA/AML training for employees and directors against the deficiencies identified in the coordinated orders.
- Compliance teams may wish to conduct a lookback of previously generated alerts and transactions to assess whether suspicious activity was timely investigated, escalated, documented, and reported through SARs, including whether systemic monitoring gaps affected historical activity.
- Boards and senior management should consider obtaining documented evidence that enterprise AML oversight is operating effectively at subsidiaries and that parent-level governance does not rely solely on narrow subsidiary or product risk assessments.
- Affected American Express entities should track the 90-day Action Plan submission requirement and prepare supporting remediation evidence, governance reporting, milestone tracking, and supervisory communications.
- Other regulated firms should consider treating the action as a supervisory signal that risk assessments, transaction monitoring, and SAR controls must be aligned to actual business volume and risk rather than to the products that are easiest to administer.
What changed
This is an enforcement action rather than a generally applicable new rule, but it establishes concrete remediation expectations for a large, complex card issuer. The coordinated OCC order requires American Express National Bank to submit, within 90 days of the October 8, 2026 order, an acceptable written Action Plan addressing all BSA/AML deficiencies and incorporating the order's substantive requirements; the OCC must provide prior written supervisory non-objection. The findings indicate that AML risk assessments must reflect the firm's actual dominant products and services, including credit and charge cards, rather than concentrating on narrower deposit products. The orders also require remediation of inadequate staffing and expertise, internal controls, independent testing, employee and
Compliance impact
The action is high-severity because regulators characterized the deficiencies as systemic and linked them to approximately $13 billion of suspected trade-based money laundering activity that was not timely identified, evaluated, and sufficiently reported. The $350 million penalty, coordinated parent-and-bank orders, required remediation plan, and independent commentary describing the penalty as on
Who is affected
Related regulations
References
AI-generated analysis. May contain errors or omissions — verify with the original Federal Reserve source before acting. Full disclaimer.
What the Federal Reserve said
Federal Reserve Board announces enforcement action against American Express Company to address, among other things, the firm’s failure to sufficiently detect and report certain suspicious activity related to money laundering
Published by Federal Reserve . Read the full notice at the source for the authoritative text.