American Express Agrees to Pay $350M Penalty After Regulators Flag $13B in Suspected Money-Laundering Activity

American Express has agreed to pay a $350 million penalty after US banking regulators found that its compliance failures left approximately $13 billion in suspected money-laundering activity insufficiently identified, investigated, and reported over more than a decade.

The enforcement action announced on 8th October by the Office of the Comptroller of the Currency (OCC) targets American Express National Bank, while the Federal Reserve Board has separately ordered American Express Company and two related entities to address deficiencies in their anti-money-laundering controls.

The OCC said the failures included weak internal controls, inadequate staffing and training, ineffective customer checks, and shortcomings in systems designed to detect suspicious transactions.

The suspected activity stretched from approximately June 2014 to May 2025. In certain instances, it involved accounts associated with bank insiders, raising additional questions about how effectively the bank monitored potentially suspicious activity across its business.

The regulators' findings concern suspected transactions, not a determination that the entire $13 billion represented proven criminal proceeds. American Express agreed to the OCC's consent order without admitting or denying the findings.

Trade-based money laundering involves using commercial transactions to disguise the origins or movement of illicit funds. Such schemes can exploit payments for goods and services to make suspicious financial activity appear legitimate.

The OCC said American Express periodically reported suspicious activity during the period but lacked the monitoring capabilities and internal controls needed to identify and report its full scope in a timely manner.

The 90-Day Deadline: What American Express Must Fix

The consent order sets out a detailed remediation programme, with firm deadlines and continuing oversight by the OCC.

American Express National Bank must submit an acceptable written action plan within 90 days of the date of the order. The plan must identify the corrective measures, assign responsibility for each task, and establish supported completion dates.

The bank must also appoint a compliance committee of at least three members within 15 days of the order. A majority must be directors who are not employees or officers of the bank or its subsidiaries or affiliates. The committee must oversee compliance, meet at least quarterly, and maintain detailed minutes for the OCC.

Further requirements mandate the bank to conduct a comprehensive money-laundering risk assessment at least annually, bolster customer identification and due diligence, and improve transaction monitoring across its business.

CEO Stephen Squeri Says Amex Had Already Identified Weaknesses

American Express chairman and chief executive officer Stephen Squeri said the company takes its responsibility to combat financial crime seriously and is committed to addressing the regulators' concerns.

Squeri added that the civil money penalty does not impact full-year 2026 guidance. The consent orders also do not impose an asset cap on American Express, and costs associated with addressing the requirements are not anticipated to affect 2027 guidance as well, according to the CEO.

The exec added that American Express had identified areas for improvement through its own internal and external reviews.

'Through our own internal and external reviews, we identified areas for improvement in our Financial Crimes Compliance program. We also investigated transactions that we identified as being processed over our network by individuals misusing our products for the purchase of goods and services, reported that information to law enforcement, and took other appropriate action,' according to Squeri.

His statement indicates that American Express had undertaken some remedial work before the enforcement announcements. It does not, however, negate the regulators' findings about the scale of the deficiencies or the need for further corrective action.

The company's response will now be measured against the requirements of the consent orders, including the independent review and the deadlines for strengthening its compliance systems.