Key takeaway: A $350 million penalty against a major card issuer’s national bank signals that regulators are applying BSA/AML scrutiny to card-issuing banks with the same intensity they have long applied to traditional retail banks. Merchant risk and compliance teams working with card issuers should watch this shift closely.
The Office of the Comptroller of the Currency hit American Express National Bank with a $350 million civil money penalty and a cease-and-desist order on October 8. The Federal Reserve Board separately issued its own cease-and-desist order against parent company American Express and its travel-related services arm. Regulators cited serious shortcomings in the company’s Bank Secrecy Act and anti-money laundering compliance.
The OCC’s order applies only to American Express National Bank, based in Sandy, Utah. Examiners found that the bank had built its BSA/AML risk assessment around its smaller deposit account business. The bank had underweighted the risk posed by its much larger credit and charge card portfolio. The OCC also pointed to systemic breakdowns in the bank’s suspicious activity monitoring and reporting. Those breakdowns meant the bank did not fully identify or report roughly $13 billion in suspected trade-based money laundering activity between June 2014 and May 2025.
The Federal Reserve’s cease-and-desist order, issued the same day, carries no separate monetary penalty. It applies to American Express and its travel-related services arm. The Fed described the AML program weaknesses as spanning the company’s operations, with the most acute problems concentrated at the national bank subsidiary.
Amex’s banking unit now has 90 days to submit a corrective action plan to the OCC. That plan must address building a BSA/AML risk assessment process tailored to the bank’s actual business lines and engaging an outside firm to conduct a lookback review of past suspicious activity reporting.
Amex Chief Executive Officer Stephen Squeri said the company takes its obligation to fight financial crime seriously. He said Amex has spent recent years working with regulators and law enforcement while strengthening its controls. Squeri said the company had already reserved a portion of the penalty in prior periods. He does not expect the orders to affect Amex’s full-year 2026 or 2027 guidance.
Why it matters: This is the first civil money penalty the OCC has levied against a bank since its $450 million penalty against TD in October 2024. It puts a major card issuer’s AML controls under the kind of regulatory spotlight regulators usually reserve for large retail banks. For merchants, processors, and payments vendors, the order is a reminder that transaction monitoring gaps at a card network’s issuing bank can carry nine-figure consequences. Those gaps can also trigger operational mandates that reach into how a bank manages risk across its card and charge products.
Sources: Payments Dive; OCC; Federal Reserve
