United States bank regulators have ordered American Express to overhaul its financial crime controls and assessed a 350 million dollar civil money penalty against its national bank, in an action that turns on roughly 13 billion dollars of suspected trade based money laundering the bank failed to report.
The Office of the Comptroller of the Currency announced a cease and desist order and the penalty against American Express National Bank on 8 October 2026, saying the bank failed to timely identify, evaluate and sufficiently report approximately 13 billion dollars of suspected trade based money laundering activity that took place over the past decade. The regulator said the bank failed to establish and maintain a Bank Secrecy Act and anti money laundering compliance program "reasonably designed to assure and monitor compliance" with the Act and its implementing regulations. Comptroller of the Currency Jonathan Gould said the regulator "expects banks of American Express's size and complexity to devote sufficient resources to ensure compliance". The penalty is directed to the United States Treasury.
The Federal Reserve Board acted the same day, announcing an enforcement action against American Express Company and American Express Travel Related Services Company to address, among other things, the firm's failure to sufficiently detect and report certain suspicious activity related to money laundering. The two regulators acted in coordination, with the Federal Reserve issuing a concurrent cease and desist order at the holding company level.
The structure of the action is the part boards should read twice. The penalty landed on the bank, but the Federal Reserve order reaches the parent and the travel services company, which means remediation is being supervised as an enterprise wide obligation rather than a subsidiary problem. A reporting gap of this size across a decade is not a monitoring tool misfire; it points to a control design aimed somewhere other than where the risk actually sat. For any group that runs regulated and unregulated businesses alongside each other, the inference is uncomfortable but useful: supervisors are increasingly willing to treat the group, not the chartered entity, as the unit of accountability.
Trade based money laundering is the specific exposure worth re examining. It is detected through documentary and counterparty anomalies rather than through the deposit account patterns most transaction monitoring systems were calibrated to catch, and it sits across commercial card, merchant acquiring and cross border payment flows that often report to commercial leadership rather than to the financial crime function. Chief risk officers and audit committees should be asking which business lines carry trade finance like risk without being described that way internally, and whether monitoring coverage follows the risk or the organisation chart.
There is a governance reading too. Our inference is that enforcement at this scale usually follows a period in which supervisory findings were known internally and not resolved at the pace supervisors expected. Boards should want to see, in writing, the history of unresolved regulatory findings in their own institutions, with owners attached, and should treat a long tail of open items as a leading indicator rather than a reporting nuisance. For investors, the number to watch is not the penalty, which is absorbable for a firm of this size, but the compliance cost run rate and the constraint on new business activity that remediation orders usually impose.
