On October 8, 2026, the Federal Reserve Board and the Office of the Comptroller of the Currency (OCC) each announced an enforcement action over anti-money-laundering compliance at American Express. The companies consented without admitting or denying the Fed's allegations or the OCC's findings. The OCC's penalty order requires American Express National Bank to pay a $350 million civil money penalty.
What the Federal Reserve ordered
The Fed's consent order directs American Express Company and American Express Travel Related Services Company, Inc. to "cease and desist, and take affirmative actions." Its press release says the action addresses, among other things, the firm's "failure to sufficiently detect and report certain suspicious activity related to money laundering."
The order sets no dollar penalty. It requires written plans on board oversight, the firm's enterprise-wide anti-money-laundering program, and the travel-services company's compliance with Treasury sanctions rules. It bars retaining anyone who, on the investigative record the firm compiled from 2024 to the present, took part in the misconduct underlying the order, was formally disciplined over it, and left or was legally terminated in connection with it.
What the OCC found and ordered
The OCC issued the bank two consent orders: a cease-and-desist order and a penalty order. In both, the Comptroller finds, and the bank "neither admits nor denies," that it "has not established and maintained a reasonably designed BSA/AML compliance program," meaning its Bank Secrecy Act and anti-money-laundering program.
The findings state that from approximately June 2014 to approximately May 2025 the bank "processed approximately $13 billion in suspected TBML activity" (trade-based money laundering), including suspicious card charges and associated repayments, in certain instances through accounts associated with bank insiders. They say weaknesses in its controls over suspicious activity reports (SARs), which banks file with the government, "resulted in untimely, missed, or incomplete SARs." The cease-and-desist order requires an independent consultant's review that "shall determine whether SARs should be filed for any previously unreported suspicious activity."
What it means for cardholders
None of the three orders mentions refunds, restitution or any step customers must take. The OCC order does require a written customer due diligence program, including verifying the identity of customers opening new accounts "to the extent reasonable and practicable" and keeping customer information updated; it does not say whether customers will be asked for more. In a Form 8-K dated October 8, American Express said the consent orders "do not impose an asset cap on the Company" (an asset cap limits total assets).
The dates
All three orders took effect October 8. The Fed's plans are due within "90 days of the effective date"; the OCC's action plan within "ninety (90) days of this Order." By this desk's count, both fall on January 6, 2027. Both provide for extensions.
What the documents do not say
- The Fed order does not describe the misconduct beyond its opening paragraphs, and no order says how many customers or accounts were involved.
- The Fed order says it does not bar other agencies from acting; the OCC orders say they do not resolve or affect actions by other federal agencies, including the Justice Department. None is described.