The Office of the Comptroller of the Currency (“OCC”) and the Board of Governors of the Federal Reserve System (“Federal Reserve”) issued parallel consent orders on Oct. 8, 2026, against a major financial services corporation and bank holding company addressing significant deficiencies in its Bank Secrecy Act (“BSA”) and Anti-Money-Laundering (“AML”), along with enterprise-wide financial crimes compliance programs. The OCC separately imposed a $350 million civil money penalty against another large financial institution.
The actions against American Express National Bank and its parent and affiliated entities (collectively, the “Bank”) are a timely reminder that BSA/AML enforcement remains a significant regulatory risk. Institutions should not only ask whether their current controls satisfy regulatory requirements, but whether their risk assessments accurately reflect the businesses they operate, whether historical control weaknesses may have resulted in missed suspicious activity and whether boards and senior management are positioned to oversee remediation if significant deficiencies emerge.
The OCC Order:
The OCC found that the Bank’s BSA/AML program suffered from systemic internal-control gaps, weak independent testing, and inadequate BSA/AML training. Among other things, the OCC found that:
- The Bank’s BSA/AML risk assessment focused on its relatively narrow demand-deposit business and did not sufficiently address the risks associated with its much larger credit and charge-card business.
- The Bank failed to maintain an effective framework for ongoing customer due diligence and customer risk rating.
- Gaps in customer-identification procedures resulted in inconsistent collection and risk-based verification of customer information.
- Systemic breakdowns in suspicious-activity monitoring, investigation and reporting resulted in untimely, missed or incomplete Suspicious Activity Reports (“SARs”).
- Independent testing did not adequately assess the Bank’s BSA/AML risk profile.
- The Bank historically did not provide sufficient staffing, expertise and other resources to its BSA/AML program.
- BSA/AML training did not adequately address employees’ job-specific responsibilities.
According to the OCC, these deficiencies contributed to the Bank’s processing of approximately $13 billion in suspected trade-based money laundering activity from approximately June 2014 through May 2025, including suspicious card charges and associated repayments and, in some instances, activity through accounts associated with Bank insiders. The OCC imposed a $350 million civil money penalty.
The Federal Reserve Order:
The Federal Reserve’s parallel order focuses on enterprise-wide financial-crimes risk management. The Federal Reserve stated that its investigation concerned the Bank’s failure to timely and sufficiently detect, investigate and report certain suspicious activity, and that supervisory assessments identified significant deficiencies involving transaction monitoring, fraud-referral processes, third-party risk assessment and financial-crimes risk management.
The order therefore extends beyond the Bank itself and places responsibility for remediation at the enterprise and board levels.
Significant Remediation Obligations by the Regulators
The OCC order requires extensive remediation, including:
- Board-level compliance committee.
- A comprehensive remediation action plan.
- An institution-wide BSA/AML risk-assessment process.
- Enhanced customer due diligence and risk identification.
- An enhanced financial-crimes risk-management program.
- A risk-based suspicious-activity identification, evaluation and reporting program.
- Enhanced independent BSA/AML testing.
- Assessments and enhancements relating to BSA/AML staffing and expertise.
- Enhanced BSA/AML training.
- A dedicated BSA/AML insider-activity program.
Notably, the OCC also requires the Bank to retain an independent third-party consultant to conduct a SAR look-back. The consultant must review the Bank’s historical suspicious-activity monitoring, investigation, decision-making and reporting to determine whether previously unreported activity should have resulted in SAR filings and whether previously filed SARs require correction or amendment.
The public order does not establish a fixed historical period for the initial look-back. Instead, the methodology, scope and timeline are subject to OCC non-objection, and the OCC expressly reserves the right, based on the results, to require additional work or expand the review by subject matter, time period or both.
The Federal Reserve order separately requires the Bank’s Board to oversee remediation under both orders, hold senior management accountable, ensure adequate resources, strengthen the enterprise-wide BSA/AML compliance risk-management program and maintain effective reporting and escalation. It also requires remediation of the Office of Foreign Assets Control compliance program, including risk assessment, training, policies and screening procedures.
Practical Takeaways
These orders provide several important reminders for financial institutions:
- Risk assessments must reflect the business as it actually operates.
An AML risk assessment cannot focus primarily on traditional deposit products if other products, customers, channels or business lines drive materially different or greater financial crime risk. The OCC expressly criticized the disconnect between the Bank’s risk assessment and its predominant credit and charge-card business.
- Historical control gaps can create substantial retrospective exposure.
Fixing a deficient monitoring system prospectively may not be enough. Where weaknesses may have resulted in missed or inadequate SAR reporting, regulators can require an independent look-back to identify historical reporting failures. Here, the OCC retained the ability to expand that review after considering its results.
- BSA/AML remediation is a governance issue, not a compliance-function issue.
Both orders place significant responsibility on the board. The Federal Reserve Order specifically requires board oversight of management accountability, resources, enterprise-wide risk management, reporting and escalation.
- Institutions should test whether compliance resources match their risk profile.
The OCC specifically identified shortcomings in staffing, expertise, independent testing and training, and the remediation order requires a staffing and skills assessment as well as a staff-augmentation plan.
Enforcement Trends
The coordinated actions send an important message about BSA/AML enforcement. Whatever the broader shift in regulatory philosophy toward reducing regulatory burden, these orders demonstrate that material BSA/AML failures, particularly those associated with deficient transaction monitoring and suspicious-activity reporting, remain capable of producing substantial monetary penalties and extensive remediation obligations.
The actions also reflect a broader focus on accountability and remediation, rather than penalties alone. The Federal Reserve Order requires board oversight and senior management accountability, containing provisions to address individuals involved in the underlying misconduct. The OCC Order couples its $350 million penalty with extensive forward-looking remediation and an independent historical SAR review.
Read the OCC Consent Order here.
Read the Federal Reserve Consent Order here.
