OCC Fines American Express $350 Million Over AML Program Failures

Credit-union BSA leaders should test whether the institution's risk assessment follows its largest products and transaction flows—not merely the easiest accounts to describe—then reconcile that scope to monitoring coverage, expertise, independent testing and board training.

The Office of the Comptroller of the Currency said October 8 that it issued a cease-and-desist order and assessed a $350 million civil money penalty against American Express National Bank for deficiencies in its Bank Secrecy Act and anti-money-laundering program. The Federal Reserve announced a concurrent action against the parent company and a related service company.

The OCC said the bank's risk assessment concentrated on a relatively narrow set of demand-deposit products and insufficiently addressed the larger risks in its dominant credit and charge card business. The agency also cited inadequate resources, staff without sufficient expertise, systemic internal-control gaps, weak independent testing, weak employee and director training, and shortcomings in customer due diligence and customer-identification procedures.

According to the OCC, systemic failures in monitoring and reporting caused the bank to miss the timely identification, evaluation and sufficient reporting of approximately $13 billion in suspected trade-based money-laundering activity over the past decade. Reuters reported that American Express did not admit or deny the findings and said it was committed to addressing the concerns. The company said the penalty and remediation costs were not expected to affect its 2026 or 2027 guidance.

Start with the product-risk map

The order does not impose a new NCUA rule, and its legal requirements apply to the named companies. Its value for credit unions is as a concrete supervisory signal: a risk assessment can be formally complete yet operationally misaligned if it gives too little weight to the products, channels and transaction patterns that drive the institution's exposure.

For a credit union with material card, faster-payment, business-account or cross-border activity, the board and BSA officer should be able to trace each significant risk from the enterprise assessment into monitoring scenarios, data fields, alert ownership, staffing assumptions and escalation thresholds. Growth in a product line should trigger an explicit review of whether the control environment has grown with it.

That review needs denominators. Management should know the volume and value of transactions covered by each monitoring rule, the proportion of alerts delayed beyond internal service levels, the number of cases reopened after quality review, and the share of unusual activity that cannot be reconstructed from source systems. A count of alerts closed or suspicious-activity reports filed is not enough to show that the right activity entered the pipeline.

Treat staffing, testing and technology as one control system

The OCC's findings connect resources and expertise to internal controls, testing and training. Credit unions should make the same connection in their own evidence. A model or rules engine cannot compensate for analysts who lack product knowledge, and additional investigators cannot correct missing or poorly mapped data.

Independent testing should therefore sample the full chain: whether the risk assessment identifies the exposure; whether required transaction and customer data arrive complete and on time; whether scenarios behave as designed; whether investigators have sufficient context; whether decisions are reviewed; and whether material exceptions reach accountable executives and directors. If a vendor supplies monitoring or case-management technology, the institution still owns the product-risk map, validation evidence and final escalation.

AI-assisted investigation can help organize case material, but it does not change that accountability. Generated summaries should remain linked to underlying records, material omissions should be tested, and a human investigator should own the decision to close, escalate or report. Our coverage of agentic AML investigation tools explains why evidence traceability and approval separation matter before automation expands.

Give directors decision evidence, not training completion

Weak director training was one of the deficiencies identified by the OCC. A credit-union board should receive more than annual completion statistics. A useful packet shows the current risk assessment, material product changes, staffing and expertise gaps, overdue remediation, testing exceptions, monitoring coverage and a small number of trend measures tied to decisions the board may need to make.

The packet should also distinguish unresolved uncertainty from acceptable performance. Our decision-evidence standard for board reporting provides a structure for preserving sources, exceptions, owners and follow-up triggers without allowing a concise dashboard to hide missing proof.

The American Express action is unusually large, but the operating lesson is simple: BSA governance fails upstream when the institution's real business is not represented in the risk assessment. Credit unions can respond now by reconciling product scale to control scope, testing the complete monitoring chain and making every unresolved gap visible to an accountable owner.