Large civil money penalties in anti–money laundering aren’t about catching a single bad transaction; they are about proving a bank’s defenses weren’t built to do the job. That is the core of the American Express case: regulators concluded the bank’s controls were structurally unfit to identify and report years of high‑risk activity at scale, and they imposed a sanction sized to force a redesign, not a tweak.
At a Glance
- Regulators levied a $350 million civil money penalty and a cease-and-desist order on American Express National Bank for systemic BSA/AML program deficiencies.
- Authorities say the bank failed to identify, evaluate, and report roughly $13 billion in suspected trade-based money laundering over nearly a decade.
- The Federal Reserve separately ordered the parent company to strengthen enterprise-wide AML controls, aligning with the OCC’s findings.
- This action fits a broader pattern: U.S. AML enforcement targets program failures—risk assessment, monitoring, SAR filing—more than proof that every flagged dollar was illicit.
What Regulators Found—and Why the Penalty Is So Large
The Office of the Comptroller of the Currency assessed a $350 million civil money penalty against American Express National Bank and issued a cease-and-desist order mandating sweeping corrective action. The OCC’s public order describes systemic weaknesses in the bank’s Bank Secrecy Act/anti–money laundering program—defects in risk assessment, customer diligence, transaction monitoring, and escalation—that, in combination, left the bank unable to reasonably identify and report suspicious activity at the scale and speed its business demanded. In parallel, the Federal Reserve directed the parent company and affiliates to bolster governance and controls, an escalation that underscores the breadth of the issues observed across the organization’s control stack.
The headline figure—approximately $13 billion in suspected trade-based money laundering that went undetected or underreported—is an aggregation of transactions exhibiting high-risk typologies, not a forensic verdict that every dollar was criminal. That distinction matters for understanding AML enforcement: U.S. regulators impose remedies and penalties when a bank fails to maintain a program “reasonably designed” to detect and report risk, irrespective of whether prosecutors could prove the criminal provenance of each transaction in court.
How Trade-Based Money Laundering Evades Weak Controls
Trade-based money laundering (TBML) exploits the complexity of commerce—over- and under-invoicing, phantom shipments, and value misclassification—to move illicit value under cover of legitimate trade flows. These schemes are notoriously data-hungry to detect: effective surveillance must reconcile payment data, shipping documents, counterparties, and geography, then measure anomalies relative to peer norms and historical baselines. Institutions that underinvest in risk assessment and monitoring calibration tend to miss TBML because their systems were tuned for card fraud or basic KYC checks, not cross-border trade valuation games and layered intermediaries.
When supervisors describe failures as “systemic,” they are signaling that multiple control layers broke at once—risk-rating methodologies did not account for actual product and geography risks, monitoring rules were misaligned to known typologies, alert volumes outstripped investigative capacity, and escalation to file suspicious activity reports (SARs) lagged. The OCC’s consent order language—requiring a comprehensive BSA/AML risk assessment methodology, improved monitoring, timely reporting, and independent testing—tracks this pattern precisely.
The Enforcement Playbook: Program Design, Not Perfect Policing
For decades, OCC and FinCEN enforcement actions have targeted the same recurrent weaknesses: incomplete enterprise risk assessments, inadequate customer due diligence and beneficial ownership verification, ineffective transaction monitoring and alert triage, poor-quality SARs, thin independent testing, and weak board oversight. Banks do not get penalized because a novel scheme existed; they get penalized because their program wasn’t reasonably risk-based to surface it and report it in time. Similar actions—in both scale and rationale—have hit other large institutions, including a $450 million OCC penalty against TD Bank in 2024 for significant, systemic monitoring breakdowns. The AmEx matter sits squarely in this lineage.
Process matters as much as technology. OCC policy outlines how exam findings escalate into consent orders and monetary penalties when remediation lags or when control gaps are material to the bank’s risk profile. Corrective actions typically mandate board-approved risk assessments, model validation and tuning, case management upgrades, staffing and training increases for investigations, and measurable governance—metrics on alert quality, investigation timeliness, and SAR throughput—reviewed at the board level.
Why TBML and Scale Push Banks Beyond Legacy AML Models
Modern AML operations contend with a paradox: more data should mean better detection, yet poorly tuned systems produce alert floods that swamp investigators and degrade signal-to-noise. TBML magnifies this because anomalies are subtle and contextual—price deviations, trade routes, and counterparties matter more than raw transaction counts. Supervisors have increasingly encouraged banks to adopt analytics and machine learning that improve precision rather than simply generate more alerts, alongside documentation, explainability, and human oversight to keep models aligned with regulatory expectations.
The best-run programs start with a credible, living risk assessment—tied to actual customers, products, and geographies—and then calibrate monitoring, staffing, and escalation pathways accordingly. Independent testing validates the program’s design and outcomes; governance compels course corrections when metrics reveal drift. That sequence is the antidote to the types of systemic failures regulators cited here, and it is what recent orders require institutions to implement and evidence.
🇺🇸 BREAKING: OCC fines American Express $350 MILLION over systemic anti-money laundering failures.
The regulator says Amex failed to properly detect and report approximately $13 BILLION in suspected trade-based money laundering over the past decade. pic.twitter.com/inLqyvoDpO
— Lory Reports | Authentic (@loryreport_01) October 11, 2026
What This Means for Banks, Customers, and Shareholders
For AmEx and peers, the implication is straightforward: supervisory tolerance for control lag is low, particularly where cross-border commerce and complex value transfer are in play. Expect multi-year remediation with material investments in data integration, monitoring models, investigative capacity, and board-level oversight. For customers, stronger controls translate into more rigorous onboarding and periodic reviews, especially for higher-risk sectors and trade corridors; the inconvenience is the cost of protecting the financial system from exploitation.
For shareholders, the lesson is structural. AML penalties at this scale are not one-off “operational losses”; they are governance signals that the institution must replatform critical risk functions. While enforcement orders do not allege that every suspicious dollar is criminal, they do assert—persuasively in this case—that the program failed its statutory test. The financial hit is visible in the penalty; the longer, less visible cost is the capital and management attention required to rebuild controls to a standard that stands up in the next exam cycle.
How This Case Fits the Long Arc of AML Enforcement
The AmEx action reflects a durable regulatory philosophy: banks are stewards of the gate, obligated to maintain programs that are proportionate to their risks and effective in practice. When those programs fall short—especially across multiple control layers over many years—regulators use consent orders and large civil money penalties to reset incentives and timelines. Other institutions have walked this path and emerged with stronger programs; the blueprint is well known. Execution, however, is the differentiator. The firms that treat AML as a core risk discipline—not a compliance checkbox—tend to avoid repeat findings, reduce noise, and spot the sophisticated typologies that make headlines years later if missed.
Sources:
zerohedge.com, occ.gov, bankingdive.com, straitstimes.com, finance.yahoo.com, news.ssbcrack.com, fincen.gov, occ.treas.gov
