BSA/AML Lessons from the American Express Enforcement Action

A BSA/AML program should reflect the business your institution actually conducts. Products change, customer activity evolves, and responsibilities move between teams. The risk assessment, controls, staffing and oversight need to keep pace.

The OCC’s October 2026 action against American Express National Bank offers a timely reason for community banks and credit unions to examine those connections.

What the OCC found

On October 8, 2026, the OCC announced a cease-and-desist order and a $350 million civil money penalty against American Express National Bank. The agency identified weaknesses in resources, internal controls, independent testing, training, customer due diligence, customer identification, and suspicious activity monitoring and reporting.

The OCC also found that the bank’s risk assessment emphasized its relatively narrow deposit business without sufficiently addressing its larger credit and charge card operations. According to the agency, monitoring and reporting failures affected approximately $13 billion in suspected trade-based money laundering activity over roughly a decade. “Suspected” matters: this figure describes activity identified in the enforcement findings, not a determination that every transaction involved proven money laundering.

The Federal Reserve issued a concurrent order against American Express Company and American Express Travel Related Services Company, Inc. See the OCC announcement and consent order.

Seven practical checks for your institution

The order applies to American Express National Bank. The following questions offer a practical review agenda for your own program. Specific obligations depend on applicable law, supervisory requirements and your institution’s circumstances.

1. Does your risk assessment reflect today’s business?

Review the products, services, customers and geographies that drive your activity. Include card, lending and digital offerings where relevant. Look for areas where transaction volume, customer behavior or business growth has changed without a corresponding review of controls.

Keep the assessment current as risks change. An annual review may be a useful internal practice, but the FFIEC manual does not establish a universal requirement to update it on a specified periodic schedule.

2. Do staffing and expertise match the workload?

Consider whether the BSA officer and supporting team have the time, skills and authority to carry out their responsibilities. Review investigation backlogs, coverage during absences, and the expertise needed for higher-risk products. Where specialist support is needed, define who remains accountable for decisions and follow-through.

3. Do customer information and risk ratings support useful monitoring?

Test how customer identification and due diligence work in practice. Are missing or inconsistent records identified and resolved? Does the institution understand the nature and purpose of the relationship? Can the monitoring team use current information when evaluating activity?

For business accounts, review applicable beneficial ownership obligations with qualified compliance personnel, including current exemptions or relief. Avoid relying on an outdated checklist.

4. Can an alert become a timely, documented decision?

Walk through the process from initial detection to investigation and any SAR filing. Check monitoring coverage, handoffs, escalation timelines and documentation. Confirm that staff can explain both filing decisions and decisions not to file. Generic monitoring settings deserve scrutiny when they do not reflect your customer base or product activity.

5. Does independent testing challenge how the program works?

Testing should evaluate effectiveness across the institution’s risk profile. Use qualified, independent reviewers with relevant BSA/AML knowledge, whether internal or external. Give findings clear owners and remediation dates, and verify that corrective actions address the underlying issue.

The FFIEC independent testing guidance addresses qualifications, independence, scope and reporting to the board or an appropriate board committee.

6. Is insider-related activity included in your controls?

Review how BSA-relevant concerns involving insiders are detected, escalated and handled. Establish clear responsibilities and appropriate referral procedures. The American Express order’s insider-related controls and referral requirements make this a useful area to include in a broader program review.

7. Do training and board reporting lead to action?

Tailor training to responsibilities. Front-line staff, investigators, the BSA officer and directors need information appropriate to the decisions they make. Provide periodic training, respond to changes, and maintain records of participation and follow-up. The FFIEC training guidance supports this risk-based, role-specific approach rather than a universal annual cadence for every role.

Give the board substantive information about risk, resources, significant findings and remediation. Make unresolved issues and decisions needed visible, and document how leadership responds.

Start with a focused review

Bring compliance, operations and leadership together around one question: Where has our business changed faster than our controls?

Choose the highest-priority gap, assign an owner, set a realistic completion date and decide what evidence will demonstrate improvement. Then follow through.

Community banks and credit unions have different structures, products and supervisory relationships. The practical lesson is to assess the risks specific to your institution and ensure the program is equipped to address them. Reviewing, testing and strengthening those connections now can make the next examination a more informed conversation.

This article is for informational purposes only and does not constitute legal advice. Consult qualified BSA/AML counsel regarding your institution’s circumstances.