Fed Orders American Express to Fix AML Monitoring With Three Plans in 90 Days

What the Federal Reserve ordered on 8 October

On 8 October 2026 the Federal Reserve Board announced a consent cease-and-desist order against American Express Company and American Express Travel Related Services Company, Inc. (TRS). The order addresses the firm's failure to timely and sufficiently detect, investigate, and report certain suspicious activity related to money laundering. It assesses no civil money penalty. Its obligations are written plans and quarterly reports, and its provisions remain binding until the Federal Reserve Bank of New York releases the firm from them.

The same day, the Office of the Comptroller of the Currency issued a cease-and-desist order and a $350 million civil money penalty against American Express National Bank, the company's national bank. American Express confirmed both actions in a Form 8-K filed that day.

Neither company admitted or denied the Board's allegations. The order was issued "without Amex or TRS admitting or denying any allegation made or implied by the Board of Governors."

Three plans due within 90 days

Paragraphs 1, 2 and 3 set three planning deadlines, all measured from the order's effective date of 8 October 2026, which puts the three submissions in the first week of January 2027.

The Amex board owes the first. Within 90 days it must submit a written plan covering four items: how it will hold senior management accountable for the remediation required by this order and the OCC order, how it will ensure management has adequate resources for that work and maintains an effective enterprise-wide BSA/AML compliance risk management program, and how it will keep reporting and escalation strong enough to oversee the work.

Amex owes the second, a plan to improve the firm's enterprise-wide BSA/AML compliance risk management program. Six items are required: written policies and procedures for business line and legal entity compliance; transaction monitoring measures that meet regulatory requirements, including methodologies for setting and documenting monitoring rules and thresholds that consider customer type, product type and geography; a customer due diligence program commensurate with the firm's money laundering, terrorist financing and other illicit financial activity risk; a suspicious activity reporting program that identifies, evaluates and reports timely suspicious activity or suspected violations of law across all lines of business; risk-based oversight of BSA/AML systems that use information from network partnerships, ATM partners and third parties; and timely escalation of material BSA/AML and sanctions risk issues to senior management and the board.

TRS owes the third, a plan acceptable to the Reserve Bank for its compliance with Office of Foreign Assets Control regulations. The order names a methodology for assessing OFAC risks, training matched to each employee's job responsibilities, and enhanced procedures that include OFAC screening.

Paragraph 6 governs implementation. Each plan must carry a timeline for full implementation with specific deadlines for every component. Once the Reserve Bank approves a plan, Amex and TRS have ten days to adopt it, must implement it promptly and then comply with it fully. An approved plan cannot be amended or rescinded without the Reserve Bank's prior approval.

Quarterly reports and a bar on retaining some individuals

Paragraph 7 creates the recurring obligation. Within 45 days after the end of the first full calendar quarter following the order, and each quarter after that, the Amex board or an authorized committee must send the Reserve Bank written progress reports detailing the compliance actions taken, a timetable for specific remedial actions, the results, and copies of all progress reports required under the OCC order. The Reserve Bank can discontinue the requirement in writing or change its form or schedule.

Paragraph 4 applies to people rather than plans. Amex and TRS may not retain anyone as an officer, employee, agent, consultant or contractor who, based on the investigative record the firm compiled from 2024 onward, participated in the misconduct underlying the order, was disciplined through the firm's internal reviews over it, and then left or was legally terminated. Paragraph 5 requires continued cooperation and substantial assistance, including information, testimony and documents, in investigations of institution-affiliated parties involved in that misconduct.

What the Fed found and what Amex had already told investors

The order's preamble records a Board investigation into the firm's failure to detect, investigate and report suspicious activity, and says recent supervisory assessments by the Federal Reserve Bank of New York identified significant deficiencies in the firm's enterprise-wide financial crimes risk management program, including weaknesses in transaction monitoring, fraud referral processes, third-party risk assessment, and financial crimes risk management. Amex and TRS, the order adds, fully cooperated and have undertaken remedial actions.

American Express's quarterly report for the period ended 30 June 2026, filed on 24 July 2026, said the company had been engaging with regulators about certain aspects of its anti-money laundering programs and expected to be subject to enforcement action, which could include civil money penalties. The 8-K described the orders as resolving previously disclosed reviews of those programs and said part of the penalty was reserved for in prior periods, the orders impose no asset cap, the penalty does not affect the company's full-year 2026 guidance, and related costs are not expected to affect 2027 guidance.

Why the $350 million penalty is the OCC's

The OCC's penalty order, docket AA-ENF-2026-47, states that the bank neither admits nor denies the Comptroller's findings and requires payment of $350,000,000 on execution of the order. A companion order, docket AA-ENF-2026-46, sets the bank's program requirements. The OCC said the penalty goes to the U.S. Treasury.

The OCC's findings are more specific than the Fed's. The penalty order says that from approximately June 2014 to approximately May 2025 the bank processed approximately $13 billion in suspected trade-based money laundering activity, a combination of suspicious card charges and repayments of those charges, in some cases through accounts associated with bank insiders. The order says the bank reported suspicious activity periodically over that period but lacked the controls to report its full scope. The violations it cites include the BSA/AML program rule, the suspicious activity reporting rule, and customer due diligence and identification rules.

The OCC also requires a look-back. An independent third-party consultant, acceptable to the examiner-in-charge, must review the bank's suspicious activity monitoring and reporting, decide whether reports should have been filed for unreported activity and whether earlier filings need correction, and report to the bank's board within 60 days of finishing.

Where the documents disagree

The Fed's order puts American Express National Bank in New York, New York, and the OCC's orders put it in Sandy, Utah. Neither document explains the difference. The release also credits the deficiency finding to the Board, while the order credits it to the New York Fed's supervisory assessments.

Deadlines and figures the orders do not set

The Fed's order sets no deadline for completing the remediation. The plans carry their own timetables and the Reserve Bank approves them, so the end date is set later. Paragraph 11 keeps every provision effective and enforceable until the Reserve Bank stays, modifies, terminates or suspends it in writing, which leaves the order open-ended.

The order names no individuals and puts no figure on the suspicious activity the Board investigated; the $13 billion figure belongs to the OCC's findings about the bank. Nor does it say what the Reserve Bank will require if it rejects one of the three plans. The OCC's penalty order notes that it does not release actions other parts of the United States government may bring, including the Department of Justice.

For compliance teams elsewhere, the shape of this order is the point: a supervisory finding about suspicious activity reporting becomes a 90-day planning exercise with board accountability, quarterly reporting, an employment restriction and a cooperation duty that outlasts the settlement.