Regulatory Crackdown: American Express Hit with $350M Penalty Over Anti-Money Laundering Failures
By Banking Dive Staff
Updated: October 8, 2026
In a sweeping regulatory action that underscores the growing intensity of federal oversight regarding financial crime compliance, American Express (Amex) has been slapped with a $350 million civil money penalty and dual cease-and-desist orders. The enforcement actions, issued concurrently on Thursday by the Office of the Comptroller of the Currency (OCC) and the Federal Reserve Board, represent a significant blow to one of the world’s most prominent financial institutions.
Regulators have identified what they describe as "significant deficiencies" in the company’s enterprise-wide anti-money laundering (AML) program. The findings suggest that for nearly a decade, the financial giant’s internal safeguards were insufficient to detect and report illicit financial flows, leading to billions of dollars in suspicious activity slipping through its digital and traditional transaction networks.
The Core Findings: A Systemic Breakdown
The regulatory scrutiny focused heavily on American Express National Bank, the firm’s primary banking subsidiary. According to the OCC, the bank failed to adequately tailor its Bank Secrecy Act (BSA) and anti-money laundering risk assessments to the specific nature of its business activities.
The OCC’s investigation revealed a fundamental misalignment in risk management: Amex’s internal controls were overly concentrated on its "relatively narrow" demand deposit account products. Meanwhile, the firm failed to apply the same level of rigorous oversight to its "more dominant" credit and charge card products. Because these card products represent the bulk of the company’s revenue and transaction volume, this gap created a massive blind spot in their compliance infrastructure.
The consequences of this oversight were severe. The OCC noted "systemic breakdowns" in suspicious activity monitoring and reporting processes. Over the past decade, these failures facilitated approximately $13 billion in suspected money laundering activity. This figure represents not just a regulatory failing, but a significant lapse in the firm’s duty to act as a gatekeeper against criminal financial activity.
A Chronology of Compliance Challenges
The enforcement actions on October 8, 2026, did not emerge in a vacuum. Industry analysts point to a multi-year period of escalating pressure on major financial institutions to modernize their AML protocols in the face of increasingly sophisticated digital fraud.
- 2023–2024: During this period, Amex began engaging in preliminary discussions with regulators regarding the strengthening of its internal controls. Sources close to the company suggest that while the firm acknowledged the need for updates, the pace of implementation was deemed insufficient by federal examiners.
- Early 2025: Internal audits at American Express reportedly flagged potential weaknesses in automated transaction monitoring systems, though the extent of the $13 billion figure had not yet been fully quantified by regulators.
- Late 2025: Examiners from the Fed and the OCC intensified their on-site inspections, focusing on the integration of data between the parent company and the national bank subsidiary.
- October 8, 2026: The OCC and Federal Reserve formally issue the cease-and-desist orders. The OCC imposes a $350 million civil penalty, marking one of the most substantial fines levied against a credit card issuer in recent memory for AML deficiencies.
Supporting Data and Technical Failures
The scale of the "systemic breakdowns" cited by the OCC suggests that the issue was not a one-time error but a persistent failure of the bank’s technological and procedural framework.
Financial institutions of Amex’s size and complexity are required to maintain sophisticated, risk-based AML programs that evolve alongside their product offerings. The OCC emphasized that Amex’s failure to properly assess the risk profile of its credit and charge card portfolio meant that automated systems were likely tuned to flag "low-risk" account behaviors while ignoring high-velocity, high-risk transactions occurring within the card ecosystem.
The $13 billion estimate of suspected money laundering activity provides a sobering metric of the failure’s scale. In the context of global anti-money laundering compliance, this figure represents a significant volume of transactions that should have triggered Suspicious Activity Reports (SARs) but instead bypassed the firm’s defensive perimeter.
Official Responses: Amex’s Strategy for Remediation
In the wake of the announcement, American Express leadership moved quickly to project stability and a commitment to regulatory compliance. CEO Stephen Squeri, in a prepared statement, acknowledged that while the company has made "meaningful progress" in recent years, it falls short of the standards expected by federal overseers.
"We take our responsibility to combat financial crimes seriously," Squeri stated. "Over the last few years, we have engaged closely with regulators as we have strengthened our controls and with law enforcement to provide information. While we have made meaningful progress, we know there is more work to do."
The company’s management sought to insulate investors from the shock of the news. Squeri noted that a portion of the $350 million fine had been "reserved for in prior periods," effectively blunting the immediate financial impact on the company’s balance sheet. Furthermore, Amex indicated that the penalty would not impact its full-year 2026 financial guidance, nor would the ongoing consent orders affect their projections for 2027.
Implications for the Banking Sector
The severity of the action taken against American Express serves as a bellwether for the rest of the banking industry. Comptroller of the Currency Jonathan Gould provided a stern warning in his statement: "The OCC expects banks of American Express’s size and complexity to devote sufficient resources to ensure compliance with laws and regulations designed to detect and prevent money laundering, which are critical to both economic and national security."
1. Increased Compliance Costs
For the broader financial sector, this enforcement action likely signals a new era of heightened compliance spending. Banks that have prioritized growth and product innovation over the robustness of their AML infrastructure are now on notice that federal regulators are prioritizing the "quality" of compliance over the "speed" of service.
2. Regulatory Tech Overhaul
Expect a surge in investment in "RegTech." The failure of Amex’s automated systems to distinguish between low-risk deposit accounts and high-risk charge card transactions highlights the need for more nuanced, AI-driven monitoring systems. Banks will likely be forced to audit their transaction monitoring algorithms more frequently and with greater transparency to avoid similar cease-and-desist mandates.
3. Increased Scrutiny on "Non-Traditional" Banking
While American Express is a titan of the credit card world, its national bank subsidiary is the vehicle through which it interfaces with federal regulators. The case demonstrates that regulators are no longer satisfied with firms that compartmentalize their risk; they expect an "enterprise-wide" culture of compliance. This puts pressure on holding companies to ensure that their banking subsidiaries are not treated as secondary entities in the context of risk management.
4. The Future of Institutional Trust
For the consumer, the impact of these findings is nuanced. While there is no indication that customer funds were at risk, the reputational cost to American Express is not insignificant. As a brand that prides itself on "premium" service and trust, the revelation that it failed to detect $13 billion in suspicious activity poses a challenge to its image as a secure global financial institution.
Conclusion
As American Express navigates the requirements of its new consent orders, the path forward will involve extensive investment in personnel, technology, and governance structures. The company is currently building a new 55-story global headquarters in New York City, a symbol of its enduring presence in the financial center of the world. However, the events of October 8, 2026, serve as a potent reminder that the strength of a financial institution is measured not by the height of its buildings, but by the integrity and efficacy of its defenses against the tide of global financial crime.
This story is developing. Banking Dive will continue to track updates regarding the progress of Amex’s compliance remediation and any further regulatory actions.
