American Express Built Its Money Laundering Controls Around Deposit Accounts. The US$13 Billion Went Through the Cards.

By LCN Business Desk

The order says where the bank was looking, and it was not where the money was.

American Express National Bank's anti-money laundering risk assessment "focused on the risks in the Bank's relatively narrow demand deposit account products and services and insufficiently on the risks in its more dominant credit and charge card products." That is the Comptroller's finding, in the consent order the bank consented to without admitting or denying it.

The bank is, in the same order's words, "one of the largest credit and charge card issuers in the United States by transaction volume."

What did the regulator find?

A programme that failed on four regulations at once.

The programme requirement, suspicious activity reporting, customer due diligence and customer identification each produced a separate violation, set out in the table below. On identity, the order says the bank's procedures "had substantial gaps and did not enable the Bank to form a reasonable belief that it knew the true identity of each customer." On reporting, it finds "a pattern or practice of noncompliance."

It also records, in the language that sets the penalty tier, that the violations "were part of a pattern of misconduct and caused more than a minimal loss to the Bank."

Source: OCC consent order AA-ENF-2026-46 and civil money penalty order AA-ENF-2026-47, and the Board of Governors of the Federal Reserve System order of 8 October 2026. Quotations are the orders' own.

How did US$13 billion move?

On the cards, and back off them.

The order is specific about the mechanism:

Three things sit in that sentence. The span is close to eleven years, not a recent lapse. The mechanism is a charge and its repayment, which is a card transaction pair rather than a wire. And the last clause records that some of it ran through accounts associated with people inside the bank.

The order adds that over that period the bank "periodically reported suspicious activity but lacked the internal controls and monitoring capabilities to timely identify and report the full scope of this activity."

What did the Federal Reserve do?

Acted against the parent, on the same day.

Under Regulation YY the holding company must maintain an enterprise-wide risk management programme. The Board's order records that supervisory assessments by the Federal Reserve Bank of New York "identified significant deficiencies in Amex's enterprise-wide financial crimes risk management program."

So the bank was ordered by its own supervisor and the group above it by the Board, on one day.

Why does this matter in the Caribbean?

Because it is the second American anti-money laundering action in six days built on trade-based money laundering, and because of the channel.

No Caribbean country, bank or institution is named in any of these orders, and nothing in them should be read as a finding about the region. The region's own framework is moving separately: Guyana's anti-money laundering and asset forfeiture legislation was examined in Guyana's AML and CFT Bill, and how Caribbean jurisdictions are assessed by GAFILAT in The Caribbean's Best Performer Is Not Who You Expect.

What has changed in a week is the pattern of enforcement. On 13 October the OCC assessed its largest ever penalty, US$750 million, as part of more than US$1.21 billion against Bank of America, reported in Bank of America and the Merrill Lynch Pattern, where weak due diligence on correspondent accounts was examined in There Is One Correspondent Banking Rule. Five days earlier the same regulator had fined American Express US$350 million. Trade-based money laundering is at the centre of both. A separate United States prosecution tracing Venezuelan state money through an Antiguan account, and never naming the bank, was reported in The Man Whose Money Moved Through Antigua.

The channel is the difference. Correspondent banking is the route the Caribbean is usually asked about, and the route by which regional institutions reach the United States dollar. This order concerns card charges, which is the business most of the region's tourism economies handle every day as acquirers and merchants rather than as respondents. The compliance question a card acquirer faces is not the one a respondent bank answers on a correspondent questionnaire. Correspondent withdrawal from the region, and the reasoning used to justify it, were examined in After the Jenec Ruling and A Designation Is Not a Conviction.

What does the bank have to do?

Appoint a committee within fifteen days, and pay immediately.

The consent order requires the board to appoint a compliance committee of at least three members within fifteen days, a majority of whom must be directors who are not employees or officers of the bank or its subsidiaries or affiliates, and to submit the names to the examiner-in-charge. The penalty was payable on execution, by wire, with the docket number entered on the confirmation.

What the title card shows

Every data point on the article's title card, in text.

• US$350 million. The civil money penalty assessed by the OCC against American Express National Bank, payable on execution of the order.
• US$13 billion. The suspected trade-based money laundering activity the bank processed, per the consent order.
• June 2014 to May 2025. The period over which that activity ran, close to eleven years.
• 4 regulations. Those the OCC found violated: the programme requirement, suspicious activity reporting, customer due diligence and customer identification.
• 15 days. The time the board has to appoint a compliance committee under the order.

Frequently Asked Questions

What did the OCC do?

Issued a cease-and-desist order and assessed a US$350 million civil money penalty against American Express National Bank, Sandy, Utah, on 8 October 2026, for deficiencies in its Bank Secrecy Act and anti-money laundering compliance programme. The bank neither admits nor denies the findings.

What was the US$13 billion?

Suspected trade-based money laundering activity the bank processed from approximately June 2014 to approximately May 2025, which the order describes as a combination of suspicious card charges and associated repayments of those charges, and which it says in certain instances ran through accounts associated with bank insiders.

What did the regulator say was wrong with the programme?

That the risk assessment focused on the bank's relatively narrow deposit products rather than its more dominant credit and charge card products, that customer identification procedures had substantial gaps, that there were systemic breakdowns in suspicious activity monitoring amounting to a pattern or practice of noncompliance with SAR filing requirements, and that staffing, training and independent testing were inadequate.

Did any other regulator act?

Yes. The Board of Governors of the Federal Reserve System issued a cease-and-desist order the same day against American Express Company and American Express Travel Related Services Company.

Is there any finding about the Caribbean?

No. No Caribbean country, bank or institution is named in the orders.