I still remember the first time I really paid attention to how credit card companies handle the dirty side of finance. It was years ago during a conversation with a compliance officer who half-jokingly said most big issuers treat anti-money laundering rules like an expensive checkbox. Fast forward to this week and that casual remark feels a lot less funny. American Express just got hit with a $350 million civil penalty after federal regulators uncovered what they called critical deficiencies in its anti-money laundering controls. The number alone stops you cold. Three hundred and fifty million dollars. And the activity they allegedly missed? Roughly thirteen billion dollars worth of suspected transactions stretched across more than a decade.
What Exactly Triggered The Massive Penalty
The Office of the Comptroller of the Currency came down hard on American Express National Bank, the Utah-based banking arm of the well-known credit card company. At the same time the Federal Reserve issued its own concurrent enforcement action against the parent company and its subsidiaries. Both agencies pointed to serious gaps in the enterprise-wide program designed to detect and stop money laundering.
According to the findings, the bank simply did not build its risk assessment around the way it actually operates. It spent a lot of energy on relatively narrow demand deposit products while giving far less attention to the risks tied to its dominant credit and charge card business. That mismatch created blind spots. Big ones.
I’ve found that this kind of imbalance shows up more often than people realize. Companies grow, products evolve, yet the compliance framework stays stuck in an older version of the business. In this case the result was systemic breakdowns in monitoring and reporting suspicious activity.
The Scale Of The Missed Activity
Regulators determined that the bank failed to identify and report about thirteen billion dollars in suspected trade-based money-laundering activity. That figure includes card charges and the repayments tied to those charges. Trade-based money laundering is a sophisticated method that uses commercial transactions to disguise criminal proceeds or move illicit value. It can involve manipulating prices, quantities, or the quality of goods in trade deals.
In some instances the transactions involved accounts linked to bank insiders. That detail raises the stakes considerably. When internal accounts appear in the mix, questions about culture and internal controls become unavoidable.
The bank did report some suspicious activity from time to time. Yet it lacked the internal controls and monitoring tools needed to catch problems quickly and consistently. Periodic reporting is not the same as effective detection. The difference matters when the volume of activity reaches into the billions.
How The Risk Assessment Went Wrong
At the heart of the case sits a flawed risk assessment process. Federal rules require banks to tailor their anti-money laundering programs to their actual business model. American Express National Bank apparently focused too narrowly on deposit products and services that represented a smaller slice of its overall activity. Meanwhile the credit and charge card products that dominate its business received insufficient attention.
That approach left the institution exposed. Credit cards generate enormous transaction volumes. They also create unique opportunities for layering and integration stages of money laundering. Without proper monitoring calibrated to those risks, red flags can stay buried inside mountains of legitimate spending data.
Perhaps the most interesting aspect is how long the deficiencies persisted. More than a decade of missed activity suggests the problems were not fleeting glitches. They look structural. Fixing structural issues usually requires more than a quick software patch or a new policy memo.
What The Consent Orders Actually Require
American Express National Bank must submit a detailed action plan within ninety days. That plan has to show exactly how the bank will correct its compliance deficiencies. The requirements go further. The institution must strengthen its Bank Secrecy Act and anti-money laundering risk assessment process. Customer due diligence and risk-identification programs also need upgrades.
On top of those changes the bank has to hire an independent third party. That outsider will conduct a retrospective review of suspicious activity. The goal is to determine whether additional transactions should have been identified and reported in the past. Looking backward can be uncomfortable, but it is often the only way to measure the true scope of past failures.
The Federal Reserve order places separate obligations on the parent company. American Express and its subsidiaries must improve the enterprise-wide anti-money laundering compliance program. One subsidiary, American Express Travel Related Services, faces additional requirements related to sanctions administered by the Office of Foreign Assets Control.
The OCC expects banks of American Express’s size and complexity to devote sufficient resources to ensure compliance with laws and regulations designed to detect and prevent money laundering, which are critical to both economic and national security.
Those words from the Comptroller of the Currency capture the broader context. This is not simply a paperwork problem. Effective anti-money laundering programs protect the financial system itself.
Company Response And Next Steps
American Express neither admitted nor denied the findings in the consent order. That language is standard in these settlements. It allows the company to move forward without a formal admission of wrongdoing while still accepting the remedies and the financial penalty.
Chief Executive Officer Stephen Squeri stated that the company takes its responsibility to combat financial crimes seriously. He acknowledged that meaningful progress has already been made yet more work remains. The tone is measured and forward-looking, which is what investors and regulators usually want to hear at this stage.
Still, words only go so far. The real test will be the quality of the action plans submitted in the coming months and the results of that independent retrospective review. If additional unreported activity surfaces, the public narrative could shift again.
Why Trade-Based Money Laundering Matters So Much
Trade-based money laundering deserves extra attention because it is harder to detect than more traditional methods. Criminals can over-invoice or under-invoice goods, ship phantom cargo, or repeatedly move the same merchandise. Credit and charge cards can play a role when they are used to settle related payments or move value across borders under the cover of commercial activity.
Banks that issue cards at scale therefore need monitoring systems capable of spotting unusual patterns across both the card side and any linked repayment or deposit activity. When those systems lag behind the business model, the window for exploitation widens.
In my experience the institutions that handle this risk well invest heavily in data analytics and cross-product visibility. They treat card transactions as part of a larger customer relationship rather than isolated events. That integrated view is exactly what appears to have been missing for an extended period at American Express National Bank.
Broader Implications For The Industry
This enforcement action sends a clear signal. Size and brand recognition offer no immunity. Regulators expect sophisticated institutions to match their compliance resources to the complexity and volume of their products. A narrow focus on deposit products while card businesses generate the bulk of activity is no longer defensible, if it ever was.
Other card issuers and large banks are almost certainly reviewing their own risk assessments right now. They should be. The combination of a substantial civil money penalty, a cease-and-desist order, and a required look-back review creates a template that future cases may follow.
National security considerations add another layer. Money laundering can finance terrorism, sanctions evasion, and other threats. When a major financial institution misses thirteen billion dollars in suspected activity, the potential downstream effects extend well beyond balance sheets.
- Regulators will continue prioritizing enterprise-wide program effectiveness
- Card products will face increased scrutiny relative to traditional deposit accounts
- Independent look-back reviews are becoming a standard remedial tool
- Boards and senior management will be expected to demonstrate active oversight
Those four points capture the practical takeaways for anyone working in financial services compliance today.
The Human Side Of Compliance Failures
It is easy to talk about systems and processes. Behind every deficiency sits a collection of decisions made by real people under real constraints. Budgets get tight. Priorities shift. New products launch faster than control frameworks can adapt. Over time small gaps widen into systemic problems.
I’ve seen teams that are stretched thin try to cover expanding product lines with the same headcount and technology they used five years earlier. Eventually something breaks. In this instance the break was large enough to attract the attention of two major federal agencies and produce a nine-figure penalty.
The good news is that the same human element can drive recovery. When leadership commits real resources and sustained attention, compliance cultures can improve. The next twelve to twenty-four months will show whether American Express turns this enforcement action into a genuine turning point.
What Investors And Customers Should Watch
From an investor perspective the $350 million penalty is material but not existential for a company of this scale. The bigger questions involve ongoing remediation costs, potential reputational impact, and any future findings from the retrospective review. Markets tend to punish uncertainty more than known costs.
Customers are less likely to notice immediate changes. Card acceptance, rewards programs, and daily operations should continue as usual. Over time, however, stronger monitoring may produce more frequent requests for additional information on certain transactions. That is the practical price of tighter controls.
Anyone who holds an American Express card or follows the stock should keep an eye on the company’s future disclosures about the progress of its action plans. Those updates will reveal how seriously the institution is treating the required improvements.
Lessons That Extend Beyond One Company
Every large financial institution faces the same fundamental challenge. Business lines evolve. Customer behaviors change. Criminal methods adapt. Compliance programs must keep pace or risk falling behind. The American Express case illustrates what happens when that race is lost for an extended period.
Strong risk assessments start with an honest inventory of products, delivery channels, customer types, and geographic reach. They then assign realistic risk ratings and allocate monitoring resources accordingly. When the assessment underweights the dominant products, everything downstream suffers.
Technology helps, but it is not a substitute for judgment. Algorithms can flag outliers. Humans still decide which outliers deserve deeper investigation and eventual reporting. Both pieces must function well.
Looking Ahead At Regulatory Expectations
Regulators have made clear that they expect banks of significant size and complexity to devote sufficient resources to anti-money laundering compliance. That expectation is not new, yet enforcement actions of this magnitude reinforce the message. Half-measures and outdated frameworks will continue to attract attention and penalties.
Future examinations will likely probe whether institutions have truly tailored their programs to current business realities. Examiners will ask hard questions about card products, cross-border activity, insider risks, and the effectiveness of transaction monitoring systems. Boards will be expected to demonstrate that they understand those risks and have overseen meaningful improvements.
The combination of the OCC order and the Federal Reserve action creates a dual track of accountability. Both the bank subsidiary and the parent holding company face specific obligations. That dual structure increases the pressure for coordinated, enterprise-wide progress.
A Final Perspective On Accountability
Three hundred and fifty million dollars is a large number. Thirteen billion dollars in missed suspected activity is even larger. Together they form a stark reminder that compliance is not optional and that scale does not confer protection. American Express now has a clear roadmap and a fixed timeline to demonstrate improvement.
Whether this episode becomes a footnote or a lasting case study depends on what happens next. The independent review, the quality of the new risk assessments, and the sustained attention of senior leadership will decide the outcome. In the meantime the rest of the industry has a vivid example of the cost of letting control frameworks lag behind the business they are supposed to protect.
I keep coming back to that conversation with the compliance officer years ago. Checkbox approaches eventually get exposed. When they do, the price can be steep. The institutions that treat anti-money laundering work as a core operational discipline rather than a regulatory burden are the ones that sleep better at night. Right now American Express has every incentive to join that group.
The coming months will show whether the company converts this costly lesson into durable strength. For the broader financial system the message is already clear. Effective detection of money laundering protects more than individual banks. It protects the integrity of the markets themselves.
Regulators will keep watching. Investors will keep calculating. And compliance professionals across the industry will keep studying the details of this case for clues about where the next examination priorities may land. In that sense the $350 million penalty is already generating returns that extend far beyond one company’s balance sheet.
The real work of strengthening controls now begins in earnest. Ninety days is not a long time to produce a credible action plan. The retrospective review will take longer and may surface additional findings. Through it all the company must continue serving millions of card members while rebuilding the trust of its primary regulators. That dual mandate is demanding, yet it is the path that leads out of the current situation.
In the end the story is less about a single fine and more about the ongoing tension between business growth and control effectiveness. Every major financial institution lives inside that tension. American Express simply found itself on the wrong side of it for longer than regulators were willing to tolerate. The corrective process now underway will test whether the organization can realign those priorities and sustain the change.
That is the part worth watching most closely. Penalties make headlines. Lasting improvements change how institutions actually operate. If American Express succeeds in the latter, the $350 million will eventually look like the cost of a necessary and overdue course correction rather than a pure loss. Time, and the quality of the remediation work, will render that verdict.
