Amex’s $350 Million AML Fine: What the OCC Found
The Office of the Comptroller of the Currency (OCC) found that American Express National Bank had serious weaknesses in its anti-money-laundering controls, including failures in customer due diligence, transaction monitoring and suspicious-activity reporting. In October 2024, the OCC ordered the bank to pay a $250 million civil money penalty; the separate $100 million figure reported alongside it was a Federal Reserve penalty against American Express Company, bringing the combined total to $350 million.
What the OCC’s order said
The OCC, which supervises national banks, described deficiencies in the bank’s anti-money-laundering (AML) program and its compliance with the Bank Secrecy Act (BSA). Its October 2024 consent order imposed a $250 million civil penalty on American Express National Bank and required corrective action. The order addressed weaknesses in the bank’s controls and oversight; it was not simply a fine for one isolated transaction.
The distinction between the two penalties matters. News accounts often summarized the enforcement actions as a $350 million Amex fine, but the OCC did not impose all $350 million. The OCC’s penalty was $250 million on the bank. The Federal Reserve separately announced a $100 million penalty against American Express Company, the bank’s holding company, citing deficiencies in its risk-management and compliance oversight. These were related but legally distinct actions by two regulators.
Where the AML controls fell short
The OCC’s findings centered on the effectiveness of the bank’s AML and BSA compliance program. Such a program is meant to identify, assess and report potential financial crime risks. Regulators said the bank’s processes did not adequately detect and handle suspicious activity across relevant parts of its business.
In practical terms, the control weaknesses involved several linked functions:
- Customer due diligence: A bank needs reliable information about who its customers are, the nature of their activities and the risks associated with their accounts. Weak or incomplete information can make unusual behavior harder to recognize.
- Transaction monitoring: Monitoring systems and procedures should identify activity that may warrant review. If controls are not designed or managed effectively, potentially suspicious patterns can be missed or reviewed too late.
- Investigations and reporting: Alerts must be assessed, documented and escalated when appropriate. Banks must file suspicious activity reports (SARs) when required, within the applicable deadlines.
- Governance and oversight: Compliance needs adequate staffing, clear accountability, reliable procedures and effective oversight by senior management and the board.
These are connected stages, not interchangeable safeguards. A monitoring alert is not proof of wrongdoing, and a customer’s risk rating alone does not establish that a transaction is suspicious. The bank must have a sound process to examine relevant facts, make decisions and preserve records.
Why these findings matter
AML obligations are intended to help financial institutions detect and report possible money laundering and other illicit financial activity. Banks generally need a risk-based program that includes internal controls, independent testing, a designated compliance officer, staff training and ongoing customer due diligence. The exact controls should fit the institution’s products, customers and risks.
A weak program can create blind spots even when a bank has policies on paper. For example, an alert system may generate large numbers of cases but still fail if its scenarios are poorly calibrated, backlogs are not managed, or investigators lack enough information. Likewise, customer records may be collected at account opening but become less useful if they are not updated when circumstances change.
The enforcement action also illustrates that responsibility can extend beyond the bank itself. The Federal Reserve’s separate action focused on the parent company’s oversight and risk management. A holding company does not replace the bank as the entity responsible for its own compliance, but regulators can examine whether parent-level governance supports appropriate controls at a subsidiary.
What the penalties require—and what they do not mean
The OCC’s consent order required American Express National Bank to address the identified deficiencies and improve its compliance arrangements. Regulatory orders commonly require a bank to submit plans, strengthen controls and provide evidence of remediation under supervisory oversight. The order’s specific requirements and the regulators’ later assessments, rather than the dollar amount alone, determine whether problems have been corrected.
A penalty is not the same thing as a criminal conviction, and the enforcement findings do not establish that every customer or transaction was involved in illegal conduct. AML rules require banks to maintain systems capable of identifying and reporting suspicion; a compliance failure can exist because those systems are inadequate, even without a public finding that a particular customer committed a crime.
Nor does the $350 million combined headline mean that one regulator assessed a single $350 million fine. The OCC and Federal Reserve took separate actions against different Amex entities. Keeping the agencies and recipients straight is essential when interpreting the headline.
How remediation is assessed
After an enforcement order, a bank generally has to show that changes work in practice, not merely that it has rewritten policies. Relevant improvements can include clearer risk assessments, better customer information, more effective monitoring, sufficient investigative capacity and stronger quality assurance. Independent testing and regulatory examination help evaluate whether controls are functioning and whether identified gaps have been resolved.
For a reader following the case, useful questions include whether the bank has completed the required corrective work, whether regulators have modified or terminated the order, and whether later examinations identify remaining weaknesses. A large penalty signals the seriousness of supervisory concerns, but it does not by itself answer those questions.
Frequently Asked Questions
What did the OCC find at American Express?
The OCC found serious weaknesses in American Express National Bank’s AML and Bank Secrecy Act compliance, including shortcomings in controls for customer due diligence, monitoring and handling suspicious activity.
Did the OCC fine Amex $350 million?
No. The OCC imposed a $250 million penalty on American Express National Bank. The additional $100 million was a separate Federal Reserve penalty against American Express Company, its holding company.
When was the OCC penalty announced?
The OCC announced its enforcement action in October 2024.
Does the fine prove that Amex customers laundered money?
No. The enforcement action concerned deficiencies in the bank’s compliance program. It does not mean that every customer or transaction was implicated in criminal activity.
What is a suspicious activity report?
A SAR is a confidential report that a financial institution files with the federal government when its review identifies activity that meets reporting requirements. Filing one is not an accusation or proof of a crime.
What happens after a bank receives an OCC consent order?
The bank must comply with the order, correct the identified weaknesses and meet supervisory requirements. Regulators can monitor progress and assess whether the remediation is adequate.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.