American Express was fined $350 million on Thursday after regulators said its bank failed for years to catch and report suspicious transactions that may have touched about $13 billion in activity they viewed as potentially tied to money laundering. The Office of the Comptroller of the Currency said the lapses were serious enough that American Express National Bank did not maintain adequate safeguards to detect what was moving across its systems.
The penalty lands as investors were already watching how far the bank’s controls had fallen behind the scale of its business. American Express shares fell 2% in extended trading on Thursday after the order, while the company agreed to the enforcement action without admitting or denying the regulator’s findings.
Jonathan Gould, the comptroller of the currency, said the failures kept the bank from passing along important information to law enforcement. That is the heart of the case: the OCC said the bank’s monitoring systems missed suspicious activity over nearly 11 years, from June 2014 through May 2025, even as the activity moved through card charges, repayments and trade-based transactions across the company’s network.
The scope matters because this was not just a narrow problem in a deposit business. Regulators said the bank’s risk assessments focused too heavily on its smaller deposit-taking activities and did not adequately reflect the risks in its much larger credit and charge card businesses. The OCC also cited weak customer identification procedures, internal controls, staffing, training and audit coverage. Some transactions, the agency said, involved accounts linked to bank insiders, though it did not identify the people involved.
American Express said it had already identified weaknesses in its Financial Crimes Compliance program through internal and external reviews. It also said it investigated transactions processed over its network by people misusing its products to buy goods and services, reported that information to law enforcement and took other appropriate action. That response shows the friction at the center of the case: the company says it acted, while the OCC said its controls still failed to detect and report the full scope of suspicious activity.
The company said part of the $350 million penalty had already been reserved in earlier periods. It also said the order would not affect its full-year 2026 financial guidance and that it did not expect compliance costs to affect its 2027 guidance. The consent orders do not impose a cap on the company’s assets, but they do leave American Express with a clear task now: rebuild the monitoring and reporting systems regulators said were not doing their job.
