American Express Bank Faces $350 Million AML Penalty; Remediation Is the Next Test

The Office of the Comptroller of the Currency announced a $350 million civil money penalty against American Express National Bank on October 8, 2026, alongside an order addressing weaknesses in its anti-money-laundering programme. A coordinated Federal Reserve action covers the parent company and American Express Travel Related Services.

What regulators found

The OCC identified shortcomings in staffing, internal controls, independent testing and training. It said risk assessment did not adequately reflect the bank’s dominant credit and charge-card business. Monitoring and reporting failures concerned approximately $13 billion in suspected trade-based money-laundering activity over the past decade.

That figure describes activity the regulator says was not identified and reported sufficiently in time. It is not an established amount of criminal proceeds, a company loss or a second monetary penalty. The $350 million penalty is directed to the US Treasury.

The Fed separately described deficiencies in the group-wide programme, particularly at the national bank. Reuters reported the enforcement action on October 8. The regulatory announcements establish the actions; they do not establish completion of the required repairs.

American Express’s dated response describes the reviews as previously disclosed and says it investigated identified misuse, reported information to law enforcement and took appropriate action. That is the company’s account, distinct from the regulators’ findings.

NetNapz assessment: a control problem beyond the fine

A monetary penalty is the most visible part of an enforcement announcement. The longer test is whether a business can correct the systems that allowed the failures. That involves how risks are assessed, how alerts reach investigators and how conclusions are checked, rather than simply assigning a larger compliance budget.

For a card network, the pattern of commerce matters. A monitoring programme that concentrates on one product can miss the risks present in another. The operational lesson is to match controls to the business that actually generates transactions, rather than assuming the design of a narrower banking activity is sufficient.

Implications for markets and management

Investors should separate the known penalty from future remediation spending and any effect on business execution. The release does not quantify those additional costs or establish a change to earnings guidance. NetNapz has not modelled a share-price impact, and no current trading level is supplied here.

A constructive outcome would be evidence that monitoring quality and governance improve without creating persistent service problems. A weaker outcome would involve repeated findings, a growing backlog of reviews or fixes that do not address the underlying risk assessment. These are conditional scenarios, not claims about what has already occurred.

Customers and counterparties also need to distinguish enforcement from operating status. A control deficiency deserves attention, but the announcement alone does not establish that every transaction is affected or that the institution has stopped serving customers. Claims about particular restrictions need their own evidence.

Confirmation and the next evidence

Over the coming reporting cycles, the useful catalysts are dated remediation disclosures, regulator updates and any quantified effect on costs or operations. Closure of an order would be different evidence from a company stating that it is working on improvements. Until then, progress should be assessed against specific milestones rather than a general assurance.

The October 8 enforcement date is retained. Suspected activity remains described as suspected, and this article does not make findings about individual customers.

Sources

OCC action, October 8, 2026; Federal Reserve action, October 8, 2026; Reuters reporting, October 8, 2026; American Express response. Findings are attributed to regulators; forward-looking implications are NetNapz assessment.