Amex's $350 Million Fine Is About 10 Days of Profit. The Orders Go Further

For about 11 years, suspect money moved through the cards American Express is known for, while its bank's risk assessment focused on a relatively narrow deposit business. On Thursday, Oct. 8, 2026, the Office of the Comptroller of the Currency (OCC) put a price on that mismatch: a $350 million civil money penalty and a cease-and-desist order against American Express National Bank. The Federal Reserve issued its own order, with no fine, against the parent company.

The OCC found that from about June 2014 to about May 2025 the Sandy, Utah-based national bank processed approximately $13 billion in suspected TBML activity, meaning trade-based money laundering, some of it through accounts tied to bank insiders. The penalty is about 11% of one quarter's profit and was partly set aside already; the real weight sits in two orders that force a rebuild of how Amex knows its customers and stay in force with no end date.

The bank, which neither admits nor denies the findings, is in the OCC's words one of the largest credit and charge card issuers in the United States by transaction volume. Yet its risk assessment, the document that tells a compliance team where to look, focused on the risks in the Bank's relatively narrow demand deposit account products and services and insufficiently on the risks in its more dominant credit and charge card products. A card giant was guarding the side door. Comptroller Jonathan Gould named the problem:

"American Express failed to maintain a BSA/AML compliance program properly aligned with the money laundering risks of its operations, which resulted in the bank's failures to timely identify and report significant missed suspicious activity and to provide important information to law enforcement."

Jonathan Gould, Comptroller of the Currency

BSA/AML means the Bank Secrecy Act and related anti-money-laundering rules: know your customers, report what looks suspicious. The OCC found the bank's customer identification program had substantial gaps and did not let it form a reasonable belief that it knew the true identity of each customer. And systemic breakdowns in monitoring produced untimely, missed, or incomplete SARs, the suspicious activity reports banks file confidentially with the Treasury's Financial Crimes Enforcement Network (FinCEN). The OCC said the program was not historically supported with appropriate resources.

Trade-based money laundering disguises illicit value as commerce. Here the OCC points to suspicious card charges and associated repayments of those card charges: a card is charged, the bill is paid, and dirty money can pass as ordinary purchases and bill payments. The order names no scheme and no insiders. It also says the bank periodically reported suspicious activity but lacked the internal controls and monitoring capabilities to timely identify and report the full scope of this activity. It saw pieces and missed the pattern.

Missing it was easy. Across the roughly 11 years of the OCC's window, $13 billion averages about $99 million a month. Amex-issued cards handled $455.8 billion of billed business in the second quarter of 2026 alone, so the whole 11-year suspected total is less than 3% of one quarter's charges (a global figure, for scale only).

Every dollar of the penalty is the OCC's, and the OCC's announcement is plain about where it goes: The OCC-assessed penalty will be directed to the U.S. Treasury. The Fed fined nobody. The Fed's order reaches higher up the corporate tree instead, to American Express Company and American Express Travel Related Services Company (TRS), citing significant deficiencies in the enterprise-wide program. The Fed's announcement said the problems were in particular at the firm's subsidiary national bank.

What it lacks in cash it makes up in reach over people. Amex and TRS may not retain anyone their own investigative record since 2024 shows took part in the misconduct, was disciplined for it and left or was terminated over it, and they must cooperate fully with Fed investigations of individuals, including sworn testimony pursuant to administrative subpoena.

Against Amex's own filings, $350 million is small. It earned $3,110 million in the second quarter of 2026, so the penalty is 11.25% of that quarter's profit. Spread the quarter's earnings over its 91 days and Amex made about $34.2 million a day: the penalty is about 10 days of second-quarter profit. Against full-year 2025 net income of $10,833 million, it is 3.23%.

Per card, it is about $4.00 for each of the 87.6 million cards Amex issues itself. Against the $13 billion of suspected activity it is roughly 2.7 cents per dollar, a ratio for scale only; the OCC gave no formula.

Nor was it a surprise. On July 24, 2026, 76 days before the orders, Amex's quarterly filing said it expected to be subject to enforcement action, which could include civil money penalties. In a securities filing on Oct. 8, it said part of the penalty was reserved for in prior periods and that compliance costs are not anticipated to affect the Company's 2027 guidance.

Investors shrugged. AXP closed at $308.10 on Oct. 8 and fell 1.7% after hours, GuruFocus reported. Yahoo Finance had it down 0.3% in premarket trading Friday, Oct. 9.

For a shareholder, the fine is close to a rounding error, which is exactly why it is the wrong number to watch. The orders govern the years after the fine, and they carry no price tag.

The orders run on a clock, and they have no end date

Stephen J. Squeri, chairman and chief executive, put it this way: While we have made meaningful progress, we know there is more work to do. The 30-page consent order defines the work.

By Friday, Oct. 23, the bank's board must appoint a compliance committee of at least three members, mostly outside directors. By Wednesday, Jan. 6, 2027, it owes the OCC an Action Plan with deadlines and named owners.

It starts with a rebuilt risk assessment whose scope maps where the old one looked away. It must cover products and services offered, inclusive of accessories and extensions (e.g., supplemental cardholders), as well as customer type, entities served, and Bank insiders, and be refreshed at least every 12 months. Customer files with missing or inaccurate CDD information must be caught and fixed. Monitoring must reach across all business units, with appropriate risk-based transaction limits and procedures for insider activity.

Then the part with the most unknowns. An independent consultant, subject to OCC no-objection, must run a SAR look-back to determine whether SARs should be filed for any previously unreported suspicious activity and to check the quality and accuracy of previous SAR filings. Its report is due 60 days after the work ends, and no completion date is fixed. The OCC may … expand the scope of the SAR Look-Back, either in terms of the subjects to be addressed, the time period(s) to be covered, or both.

The rest is people and plumbing: a staff augmentation plan, a succession plan for the BSA Officer, board and staff training, new independent testing, and limits on automated clearinghouse (ACH) activity, the bank-to-bank network behind bill payments and direct deposits.

The Fed's clock runs alongside. By Jan. 6, the Amex board must show how it will hold senior management accountable, and the company must deliver an enterprise BSA/AML plan that covers oversight of network partnerships, ATM partners, and third parties engaged to support BSA/AML compliance. TRS separately owes a sanctions plan with OFAC screening procedures. The first quarterly progress report is due by May 15, 2027.

None of it expires on its own. The bank will not be deemed to be in compliance with this Order until it has adopted, implemented, and adhered to all of the corrective actions, and the order lasts until the OCC ends it in writing.

For cardholders, the orders change the bank's homework, not your account. They contain no refunds, change no card terms and require nothing of you, and with no asset cap nothing limits Amex's ability to issue cards or take deposits. Amex has not said whether existing cardholders or merchants will be asked for new information, or whether limits or account reviews are coming. Rules like these tend to reach customers as identity checks or information requests, though that is an inference, not an announcement. Regulation that lands on your bill directly looks different, as the debate over credit card late fees shows.

Supplemental cardholders are named for a reason in Amex's own record. In July 2022, the bank paid $430,500 to settle 214 apparent violations of Kingpin sanctions after it processed transactions for an account whose supplemental card holder was designated in connection with illegal drug distribution and money laundering.

Merchants sit closer to the action. The suspect money moved through card charges, and the Fed's plan must cover network partnerships, so the network side is plainly in scope, though Amex has given no specifics.

TD Bank got an asset cap. American Express did not

The severe benchmark is TD Bank in 2024: a $450 million civil money penalty from the OCC and a restriction on the growth of the bank that Acting Comptroller Michael J. Hsu called the imposition of an asset cap. TD pleaded guilty and accepted an independent monitor. Amex's penalty is 77.8% of that, yet it got none of what made TD's case severe: no guilty plea, no monitor, no asset cap.

Case	Year	Penalty cited	Admission	Other conditions
American Express National Bank (OCC)	2026	$350 million	Neither admits nor denies	No asset cap
TD Bank (OCC)	2024	$450 million	Guilty plea to Justice Department	Asset cap (growth restriction)
TD Bank (FinCEN)	2024	$1.3 billion	Guilty plea to Justice Department	Four-year monitorship
Capital One (FinCEN)	2021	$390 million	Admitted willful failures	None in the agency release
American Express entities (Fed, FinCEN, Justice Department)	2007	$65 million total	No admission in Fed and FinCEN orders; deferred prosecution agreement with Justice Department	Fed cease-and-desist order

The Justice Department's own TD penalty was $1,886,945,780.40, and it credited $123.5 million of that toward the Fed's resolution, so the rows should not be added up.

Capital One admitted to willfully failing to implement and maintain an effective Anti-Money Laundering (AML) program. Amex's bank admitted nothing. And Amex has been here before: its 2007 case cost $65 million, and this penalty is 5.4 times that, about 19 years later. Its January 2025 agreement to pay about $230 million resolved a separate sales-practices case.

The open question is the look-back. The OCC can widen it, expressly reserves its right to assess additional civil money penalties, and says its penalty order is no release of actions by other agencies, including, without limitation, the United States Department of Justice. No Justice Department action has been reported. Amex has paid for what the OCC already found. Nobody has priced what the look-back turns up.