Regulators Hammer AmEx – $13B Slipped Through

US dollar bills inside a washing machine drum — Photo: Antonov Roman / Shutterstock

Big AML cases are not really about catching a single bad transaction; they are about whether a bank’s defenses work at scale. American Express National Bank’s $350 million penalty is a textbook example: regulators concluded the bank’s Bank Secrecy Act program was structurally unsound for years, allowing roughly $13 billion in suspected trade-based money laundering to flow without adequate detection or reporting—an institutional control failure, not a one-off miss.

At a Glance

OCC issued a $350 million civil money penalty and a cease-and-desist order against American Express National Bank over systemic BSA/AML program deficiencies.
Regulators said the bank failed to identify, evaluate, and report approximately $13 billion in suspected trade-based money laundering over nearly a decade.
The Federal Reserve, in parallel, ordered American Express to strengthen enterprise-wide compliance controls.
This action fits a well-established enforcement pattern: penalties target weak AML systems—risk assessment, monitoring, SAR reporting—more than proving each underlying transaction was criminal.

What Regulators Found and Why It Mattered

The Office of the Comptroller of the Currency (OCC) assessed a $350 million civil money penalty and issued a cease-and-desist order to American Express National Bank, citing systemic deficiencies in its Bank Secrecy Act/anti–money laundering (BSA/AML) program. The consent order requires the bank to overhaul its risk assessment methodology, enhance customer due diligence and beneficial ownership controls, remediate transaction monitoring gaps, and improve suspicious activity reporting (SAR) governance and escalation—all pillars of a sound AML framework. The OCC’s findings emphasized breadth and persistence: these were not isolated clerical errors but program-level weaknesses that, over time, impaired the bank’s ability to detect and report red flags at scale.

In coordination, the Federal Reserve directed American Express to strengthen enterprise risk management and financial crimes compliance at the holding company—an acknowledgment that AML is an enterprise capability, not merely a bank-subsidiary function. Public reporting around the action quantified the scope of unaddressed risk: about $13 billion in suspected trade-based money laundering (TBML) activity went inadequately monitored or reported across nearly eleven years, underscoring the cumulative consequences of weak controls in high-volume payments environments.

Mechanics: How AML Programs Break Down at Scale

In U.S. enforcement practice, agencies focus on whether an institution maintains a program “reasonably designed” to identify, evaluate, and report suspicious activity—not on proving beyond doubt that every flagged dollar is illicit. A modern AML program integrates five disciplines: risk assessment; customer due diligence (CDD) and ongoing monitoring; transaction monitoring tuned to the institution’s risk profile; SAR decisioning and filing; and independent testing with governance that actually triggers change. When any of these degrade—especially risk assessment and monitoring—volumes of suspicious activity can flow unalerted or unanalyzed.

TBML, the typology at issue, hides illicit value in trade flows via over/under-invoicing, phantom shipments, and carousel schemes. These patterns do not look like classic “smurfing”; they resemble legitimate commerce, which is exactly why AML monitoring must contextualize counterparties, geographies, and expected activity, and why SAR processes must synthesize anomalies across time and products. FinCEN and FATF typologies have warned for years that TBML requires robust data and investigator judgment to pierce the veneer of ordinary trade. When risk assessment is incomplete, monitoring logic mis-specified, or SAR governance weak, TBML is among the first typologies to slip through.

The Enforcement Pattern: This Case Is Not an Outlier

OCC and FinCEN actions across the past decade show a consistent pattern: institutions are penalized when systemic control failures persist across examinations and prior remediation cycles. The OCC’s 2024 action against TD Bank, which described “significant, systemic breakdowns” and levied $450 million in penalties, mirrors the structure of the American Express order—risk assessment gaps, monitoring defects, SAR delays, and escalation failures. Earlier OCC enforcement files read the same: deficiencies in risk-identification, testing, training, and SAR processes are load-bearing grounds for civil money penalties and corrective orders. In other words, regulators are not inventing a new theory here; they are applying the same program-design standard they have enforced repeatedly.

This perspective also clarifies the “$13 billion” figure widely cited in coverage. Regulators and outlets used it as an estimate of suspected activity that should have been triaged by effective controls—not as a declaration that every dollar was criminally proven in court. That distinction is routine in BSA supervision and does not diminish the seriousness of a program that let such volumes bypass adequate review.

What the Orders Demand: From Paper Programs to Operational Control

The consent order language is explicit about what “fix” means. First, rebuild the BSA/AML risk assessment so it reflects a comprehensive, data-driven view of money-laundering and terrorist-financing risk across products, customers, counterparties, and geographies; then align controls to that risk, not the other way around. Second, modernize monitoring—data quality, scenarios, thresholds, and model governance—so that alerts are both risk-sensitive and investigable at scale. Third, reinforce CDD and ongoing due diligence to support continuous risk re-rating, especially for higher-risk segments and complex trade counterparties. Fourth, repair SAR workflows—timeliness, documentation, quality review, and board reporting—so management can see pattern failures early and intervene.

These requirements are not box-ticking; they push institutions to demonstrate efficacy. Independent testing must challenge assumptions, produce metrics that matter (alert precision, case cycle times, SAR quality), and prove that governance closes the loop—findings turn into changes, and changes measurably reduce residual risk. The Fed’s parallel action extends that standard to the group level, ensuring resourcing and accountability cannot be isolated within a single subsidiary.

Technology’s Role—and Its Limits—in Fixing AML

Many institutions will reach for AI to boost detection. Used well, AI can sharpen risk segmentation, prioritize alerts, and enrich investigations. But AI that merely accelerates noisy legacy rules offers little relief; quality depends on data lineage, feedback loops from investigations, and human-led typology design. FinCEN has encouraged outcome-focused adoption—improving signal-to-noise and SAR usefulness—rather than automating flawed processes. The practical constraint remains: models learn from history and struggle with novel TBML schemes; human investigators, informed by typologies and commerce context, are indispensable.

The operational answer is architecture and governance: model risk management tailored to AML, rigorous monitoring change control, investigator training on trade documents and logistics, and metrics that track true positives, not just volumes. Institutions that treat AML as an analytics function embedded in business decisioning—not a back-office obligation—close the gap faster and sustain compliance longer.

🇺🇸 BREAKING: OCC fines American Express $350 MILLION over systemic anti-money laundering failures.

The regulator says Amex failed to properly detect and report approximately $13 BILLION in suspected trade-based money laundering over the past decade. pic.twitter.com/inLqyvoDpO

— Lory Reports | Authentic (@loryreport_01) October 11, 2026

Why This Case Matters Beyond One Bank

First, the dollar size signals that systemic BSA/AML weaknesses carry enterprise-scale consequences. For global card and payments firms, where transaction velocity and data heterogeneity are defining features, the bar for monitoring and SAR programs is materially higher than a decade ago. Second, the coordinated posture—OCC at the bank, Fed at the holding company—underscores that board-level oversight and funding are nonnegotiable. Third, the TBML emphasis is a reminder that financial crime has migrated into trade and cross-border payments complexity; controls must evolve accordingly.

Finally, this action reinforces the regulatory through-line: enforcement hinges on program design and effectiveness. Institutions that invest in dynamic risk assessment, credible monitoring governance, and SAR quality—proven by metrics, not memos—reduce both illicit finance risk and enforcement exposure. American Express’s orders do not just penalize past gaps; they define, in unusually concrete terms, what an effective large-scale AML program must now look like.