The Office of the Comptroller of the Currency and the Federal Reserve issued enforcement actions against American Express and its subsidiaries Thursday over failures in their anti-money laundering programs.

American Express National Bank was hit with a cease-and-desist order and a $350 million civil money penalty by the OCC, while American Express and its travel-related services arm received a cease-and-desist from the Fed.

Amex’s bank subsidiary, based in Sandy, Utah, failed to tailor its Bank Secrecy Act/anti-money laundering risk assessment to its business activities, according to the OCC, by focusing too much on its “relatively narrow” demand deposit account products and services and not enough on the risks in its “more dominant” credit and charge card products.

Additionally, the bank experienced “systemic breakdowns” in its suspicious activity monitoring and reporting processes, resulting in roughly $13 billion of suspected trade-based money laundering activity between June 2014 and May 2025, the OCC said.

The Fed called $308 billion-asset Amex’s AML program issues “enterprise wide,” but particularly an issue at its national bank subsidiary.

“The OCC expects banks of American Express’s size and complexity to devote sufficient resources to ensure compliance with laws and regulations designed to detect and prevent money laundering, which are critical to both economic and national security,” Comptroller of the Currency Jonathan Gould said in a prepared statement.

Amex’s banking subsidiary must create an action plan within 90 days to address its compliance deficiencies, as well as develop an effective BSA/AML risk assessment process and consumer due diligence and risk identification program, according the OCC order. It must also engage a third-party to conduct a suspicious activity review look-back.

Under the Fed order, Amex is required to submit a plan to improve its enterprise-wide BSA/AML compliance risk management program. The travel-related services arm must submit to the Fed a plan to address Office of Foreign Assets Control compliance.

Amex CEO Stephen Squeri said Thursday that his company “takes its responsibility to combat financial crimes seriously,” and that it will address the concerns of both the Fed and the OCC.

“Over the last few years, we have engaged closely with regulators as we have strengthened our controls and with law enforcement to provide information,” Squeri said in a prepared statement. “While we have made meaningful progress, we know there is more work to do.”

A portion of the civil money penalty was “reserved for in prior periods,” he said, and it does not impact the full-year 2026 guidance. The consent orders are not anticipated to affect Amex’s 2027 guidance, he said.

This is the first civil money penalty imposed on a bank by the OCC since it levied a $450 million penalty against TD in October 2024, according to data from the regulator.

Toronto-based TD’s penalty was also related to BSA/AML issues, but amounted to much more: more than $3.5 billion in penalties overall, and a $434 billion asset cap on TD’s U.S. retail banking operations.

“I know $350 million penalty gets the headline, but I think the bigger question is how $13 billion went inadequately reported for so long,” said Michael Padula, a former Justice Department trial attorney in the money laundering section, on Amex’s AML issues.

“Amex’s compliance program was wholly inadequate. It looks like they had people on the front lines who didn’t have the basics, and a compliance program is only as effective as the people, resources and oversight behind it,” said Padula, who now runs his own firm in Miami.

Padula sees the enforcement actions and penalty as a signal to financial institutions that filing suspicious activity reports is non-negotiable. SARs, he said, are not only important to regulators but also to law enforcement.

“A lot of times, they’re the first line for law enforcement to pick up on trends or illegal conduct occurring in a certain geographic area or certain business area,” he said.