The US Office of the Comptroller of the Currency (OCC) and the Federal Reserve found that US-based American Express, primarily through its national bank, failed to maintain a sufficient AML compliance programme. According to the regulators, the shortcomings included inadequate resources, inexperienced staff, weak training, and gaps in internal controls. American Express neither admitted nor denied the findings, as reported by Reuters.
Scope of the regulatory findings
The OCC stated that what it described as ‘systemic breakdowns’ in the company’s monitoring and reporting processes meant that American Express failed to identify, evaluate and sufficiently report approximately USD 13 billion in suspicious activity over the past decade. The regulator also identified deficiencies in the company’s customer due diligence and customer identification programmes.
A central element of the OCC’s assessment concerns how American Express allocated its compliance efforts across business lines. The regulator said the company concentrated on risks linked to its relatively narrow deposit products and gave insufficient attention to its much larger credit card business. At the same time, the finding points to a mismatch between where compliance resources were directed and where the bulk of the company’s activity, and therefore its potential exposure, was located.
In its statement, the OCC said it expects banks of American Express’s size and complexity to commit sufficient resources to complying with laws and regulations designed to detect and prevent money laundering. It described these rules as critical to both economic and national security.
American Express CEO Stephen Squeri stated that the institution is fully committed to addressing the regulators’ concerns and continuing to improve its compliance. It was also added that the company has made meaningful progress, but that further work remains.
American Express also said it does not expect the penalty, or the costs of meeting the regulators’ requirements, to affect its financial guidance for 2026 and 2027.
Implications for card issuers
The OCC framed its expectations in terms of an institution’s size and complexity rather than individual product lines. The action indicates that regulators assess AML programmes against the full scope of a bank’s operations. Some card issuers also run deposit-taking banking operations. For them, the case illustrates the expectation that monitoring, reporting, and customer due diligence should be proportionate to the risks across all business lines, including large card portfolios. The combination of resourcing, staffing, training, and control weaknesses cited by the regulators also shows that the OCC treats AML compliance as an organisational capability as well as a technical function.
