Federal Reserve Orders American Express to Strengthen AML Controls

The Federal Reserve Board on Thursday, October 8, 2026, announced an enforcement action against American Express Company (AXP ) to address, among other things, the firm’s failure to sufficiently detect and report certain suspicious activity related to money laundering. Acting in coordination with the Board, the Office of the Comptroller of the Currency announced a concurrent cease-and-desist order and a $350 million civil money penalty against American Express National Bank (NBHC ) of Sandy, Utah, the firm’s subsidiary national bank.

The Board’s announcement, issued for release at 4:30 p.m. EDT, states that the Board identified significant deficiencies in how the company’s enterprise-wide anti-money laundering program was implemented, in particular at the subsidiary national bank. The Office of the Comptroller of the Currency, the primary federal regulator of the bank, issued a separate enforcement action against the bank. The Board said its action will help ensure that the firm operates in compliance with all U.S. laws and regulations.

The Board’s action took the form of an Order to Cease and Desist Issued Upon Consent, Docket No. 26-052-B-HC, naming American Express Company of New York, New York, a registered bank holding company, and American Express Travel Related Services Company, Inc. of New York, New York, also a registered bank holding company. American Express Company owns and controls Travel Related Services and American Express National Bank, and the three entities are referred to collectively in the order as the Firm. The Board of Governors is the appropriate federal supervisor of the two holding companies.

Under section 252.33(a)(2) of the Board’s Regulation YY, American Express Company is required to maintain an enterprise-wide risk management program designed to identify and manage risks across the consolidated organization. The order recites that the company adopted such a program covering the Bank Secrecy Act, rules issued under it by the U.S. Department of the Treasury, the Board’s Regulation Y, and regulations issued by the Treasury’s Office of Foreign Assets Control.

The order states that the Board of Governors conducted an investigation into the Firm’s failure to timely and sufficiently detect, investigate, and report certain suspicious activity. Recent supervisory assessments of the company conducted by the Federal Reserve Bank of New York (the Reserve Bank) identified significant deficiencies in its enterprise-wide financial crimes risk management program, including weaknesses in transaction monitoring, fraud referral processes, third-party risk assessment, and financial crimes risk management. The order also states that American Express Company and Travel Related Services fully cooperated with the Board of Governors and the Reserve Bank and undertook remedial actions to address the deficiencies.

OCC Penalty and Bank-Level Findings

The Office of the Comptroller of the Currency determined that American Express National Bank failed to establish and maintain a Bank Secrecy Act and anti-money laundering compliance program reasonably designed to assure and monitor compliance with the BSA and its implementing regulations. The OCC said the deficiencies involved inadequate resources, including staff without sufficient expertise, systemic internal control gaps, weak independent testing, and weak BSA/AML training for employees and directors.

The OCC found that the bank failed to tailor its BSA/AML risk assessment to its business activities, focusing on the risks in its relatively narrow demand deposit account products and services and insufficiently on the risks in its more dominant credit and charge card products. The bank’s customer due diligence processes and customer identification program procedures contributed to its monitoring and reporting failures, and systemic breakdowns in suspicious activity monitoring and reporting resulted in a failure to timely identify, evaluate, and sufficiently report approximately $13 billion of suspected trade-based money laundering activity that took place over the past decade, the OCC said.

“The OCC expects banks of American Express’s size and complexity to devote sufficient resources to ensure compliance with laws and regulations designed to detect and prevent money laundering, which are critical to both economic and national security,” said Comptroller of the Currency Jonathan Gould. He said American Express failed to maintain a BSA/AML compliance program properly aligned with the money laundering risks of its operations. The OCC-assessed penalty will be directed to the U.S. Treasury.

Required Remediation Under the Consent Order

Within 90 days of the order’s effective date, the American Express Company board of directors must submit to the Reserve Bank a written plan to execute its oversight of the matters identified in the order. The plan must cover actions to hold senior management accountable for executing effective remediation plans required by the Board’s order and the OCC order, to ensure senior management has adequate resources for that remediation, to ensure implementation and maintenance of an effective enterprise-wide BSA/AML compliance risk management program, and to ensure effective reporting and escalation to the board.

Within the same 90-day period, American Express Company must submit a written plan to improve the Firm’s enterprise-wide BSA/AML compliance risk management program. The order requires six elements: written policies, standards, and procedures ensuring business-line and legal-entity compliance; transaction-monitoring measures, including methodologies for establishing, analyzing, testing, and documenting monitoring rules and thresholds that consider the type of customer, the type of product or service, and geographic location; a customer due diligence program commensurate with the Firm’s money laundering, terrorist financing, and other illicit financial activity risk; a suspicious activity reporting program that identifies, evaluates, and reports timely suspicious activity or suspected violations of law across all lines of business; risk-based oversight of the full range of BSA/AML systems, including network partnerships, ATM partners, and third parties engaged to support BSA/AML compliance; and measures ensuring that material BSA/AML and sanctions risk issues are appropriately assessed, addressed, and escalated in a timely manner by senior management and the board or a committee.

Travel Related Services must separately submit, within 90 days, a written plan addressing its compliance with OFAC regulations, including a methodology for assessing OFAC risks, ongoing periodic training appropriate to employees’ job responsibilities, and enhanced policies and procedures that include OFAC screening procedures.

Each plan must contain a timeline for full implementation with specific deadlines, and the companies must adopt an approved plan within ten days of Reserve Bank approval and promptly implement it. Approved plans may not be amended or rescinded without the Reserve Bank’s prior approval. The American Express Company board, or an authorized committee, must submit written progress reports to the Reserve Bank within 45 days after the end of the first full calendar quarter following the order and each quarter thereafter. The Reserve Bank may grant written extensions of time to comply with any provision of the order.

The companies entered the order pursuant to sections 8(b)(1) and (b)(3) of the Federal Deposit Insurance Act without admitting or denying any allegation. The American Express Company board adopted resolutions at a duly constituted meeting authorizing the order and waiving rights that include the issuance of a notice of charges, a hearing, judicial review, and any challenge to the order’s basis, issuance, terms, validity, effectiveness, or enforceability.

The order also provides that the companies may not in the future directly or indirectly retain, as an officer, employee, agent, consultant, or contractor, any individual who, based on the investigative record compiled by the Firm during the period from 2024 to the present, participated in the misconduct underlying the order, was subjected to formal disciplinary action in connection with it, and either separated from the Firm or had his or her employment terminated in connection with it. The companies must continue to cooperate fully with and provide substantial assistance to the Board of Governors, including making present or former officers, directors, employees, agents, and consultants available for interviews or sworn testimony pursuant to administrative subpoena.

The order is binding on the companies and each of their institution-affiliated parties, and each provision remains effective until stayed, modified, terminated, or suspended in writing by the Reserve Bank. Its provisions do not bar the Board of Governors, the Reserve Bank, or any other federal or state agency from taking any other action affecting the companies or their subsidiaries. The order is effective October 8, 2026, and was signed for the companies by Bernadette Miragliotta, Managing Counsel Litigation & Investigations, and for the Board of Governors by Michele Taylor Fennell, Associate Secretary of the Board.