American Express's $350M AML Fine: Lessons for Banks

On 8 October 2026, the Office of the Comptroller of the Currency issued a $350 million civil money penalty against American Express National Bank — one of the largest AML enforcement actions in the United States this decade. The Federal Reserve followed the same day with a concurrent cease-and-desist order. Neither regulators nor the bank contest the numbers at the centre of the case: roughly $13 billion in suspected trade-based money laundering moved through American Express accounts over approximately a decade, from mid-2014 to mid-2025, without ever triggering a suspicious activity report.

This is not a story about a small institution with inadequate compliance resources. American Express is a Fortune 50 company with a dedicated financial crimes compliance team. The fine does not reflect the presence of bad actors inside the firm. It reflects a programme that lacked the operational architecture to detect a specific class of illicit financial flows — and held that gap for ten years.

Understanding why that happened is more instructive for compliance leaders than any single fine amount.

What Is Trade-Based Money Laundering?

Trade-based money laundering, or TBML, exploits the structure of international commercial transactions to move and layer illicit funds. It is among the most technically complex and operationally demanding money laundering typologies for financial institutions to monitor — not because the mechanics are novel, but because they are embedded in the same commercial flows that legitimate global trade relies on.

The core technique involves manipulating invoices in cross-border transactions. A company wiring payment for imported goods at triple their actual value appears — to any single institution with visibility into only one leg of the transaction — to be conducting ordinary trade finance. The financial institution sees a payment instruction, a counterparty, and an invoice. It does not see whether the stated values are accurate, or whether the goods exist at all.

FATF, FinCEN, and the EU have each published guidance on TBML typology indicators that financial institutions are expected to embed in their transaction monitoring controls. Those indicators include:

Indicator	Description
Invoice misrepresentation	Prices that diverge significantly from commodity benchmarks
Phantom shipments	Payments for goods with no verifiable underlying trade
Multiple payments for one shipment	More than one financial leg attached to one documented trade transaction
High-risk counterparty geographies	Jurisdictions with elevated TBML exposure per FATF and supervisory guidance
Round-number transactions	Amounts structured to avoid standard reporting thresholds

The OCC found that American Express's monitoring programme had not been calibrated to detect patterns consistent with these indicators across its commercial book.

The Three Failures the OCC Cited

The enforcement order identified three structural deficiencies in the American Express AML programme.

1. Inadequate Resources

The first finding was direct: the BSA/AML compliance programme was not adequately resourced for the volume and complexity of the activity it was meant to monitor. The programme's scope had expanded through new products and customer segments over the period under review. The resources allocated to monitor that expanded scope had not kept pace.

This is a common regulatory finding and a deceptively difficult operational problem. Resourcing for AML compliance is calibrated to a programme's stated scope, but stated scope and actual risk exposure can diverge quietly over time — particularly when commercial growth happens across multiple product lines and jurisdictions. By the time the gap becomes visible in a regulatory examination, it has typically been accumulating for years.

2. Risk Assessment Not Tailored to Business Activities

The OCC found that American Express's AML risk assessment was not tailored to reflect the specific risk profile of its actual business activities — that it applied a generalist framework to a portfolio that included commercial products with materially different TBML exposure than its core consumer card business.

A pattern consistent with the Ikano Bank case, in which Sweden's Finansinspektionen identified identical structural failures in EDD processes and risk segmentation, emerges here. Generic risk scoring does not satisfy the regulatory requirement. Supervisors in both cases found programmes that existed in full documentation — they were simply not calibrated to the actual population of risks the institution was running.

3. Systematic Breakdown in SAR Monitoring and Reporting

The most consequential finding was the third: that suspicious activity monitoring and reporting had broken down systematically in the commercial accounts where TBML was present.

$13 billion in suspected illicit transactions over a ten-year period generated no suspicious activity reports. That is not a monitoring gap. It is a monitoring failure at a structural level — and regulators characterised it as such. The investigation found that neither the systems configured to detect anomalous transaction patterns nor the processes intended to escalate and document suspicious activity were functioning as required.

Why Ten Years?

Institutional AML examinations operate on a lag. Regulators do not monitor transaction data in real time; they conduct periodic examinations and request historical data. A monitoring gap that operates below the threshold of any single examination cycle can persist across multiple cycles before it becomes visible.

The second dynamic is more structural. Trade finance sits across product silos. A commercial lending team, a correspondent banking team, and a payments team each produce data that is relevant to TBML detection — but that data typically lives in separate systems, reviewed against separate monitoring rules, by separate teams. TBML patterns require correlating data across those silos, over time, against external commodity pricing benchmarks. That correlation has, historically, required human analysts to conduct it manually. At the transaction volumes American Express was processing, systematic manual review of cross-product, multi-year patterns was not a realistic control.

This is precisely the architecture problem that perpetual KYC and continuous monitoring models are designed to address — not as a regulatory buzzword, but as an operational imperative.

The Economics of Reactive Monitoring

The $350 million penalty sits at the public end of the cost calculation. It is not the total cost to American Express of this failure.

The Federal Reserve's concurrent order requires the bank to implement a remediation programme for its AML controls — a process that, at the scale of an institution of American Express's size, will require significant investment in people, technology, and process redesign. The OCC's cease-and-desist further restricts operational flexibility during the remediation period. Reputational exposure in corporate and commercial banking relationships is difficult to quantify but material.

The pattern is consistent across enforcement actions at this scale. Fine amounts are a fraction of total remediation costs. The business case for investing in adequate monitoring architecture before an examination is, in most scenarios, substantially stronger than the business case for responding after one.

Cost Category	Observed Pattern at Scale
Civil money penalty	$350M (this case)
Remediation programme	Typically 2–5x the penalty over three years
Regulatory restrictions	Product and geographic expansion limitations
Reputational and commercial impact	Not disclosed; material for corporate banking

What Autonomous Monitoring Changes

The specific failure pattern in this case — undetected TBML across commercial accounts over a decade — reflects the architecture of a monitoring programme built for a different era of financial crime.

Manual controls, periodic review cycles, and siloed transaction data are not adequate for detecting TBML at scale. The typology requires correlating data across multiple transaction types, against external benchmarks, continuously. No human review team operating on an annual or quarterly cycle can do that systematically.

AI agents in financial compliance change this equation. Not by replacing the compliance function, but by giving it continuous, cross-product visibility at a scale that manual review cannot achieve. A system that monitors transaction patterns across commercial accounts in real time — correlating invoice amounts against commodity benchmarks, flagging round-number structuring, mapping counterparty geographies against FATF risk guidance — can detect TBML indicator clusters that fall below any single transaction threshold but are visible in aggregate across time.

Joinble's autonomous identity and compliance agents are designed for exactly this operational model: continuous monitoring against regulatory intelligence, with risk scoring that updates as new typology guidance is issued, not as a manual implementation project.

This is not a claim that technology eliminates compliance risk. Regulators are clear that the obligation remains with the institution, not the vendor. What changes is the operational ceiling — the maximum coverage that a given compliance investment can achieve. A manual programme optimised for annual examination cycles cannot match the coverage of a continuously running automated system. The $13 billion that moved undetected through American Express accounts over a decade illustrates what falls into that gap.

What Compliance Teams Should Do Now

The American Express case provides a clear diagnostic framework. Three questions map directly to the three OCC findings:

On resourcing: Is your BSA/AML programme resourced for the current risk profile of the business — including products, customer segments, and geographies added in the last five years? Not at the time the programme was last designed, but today?

On risk assessment: Does your AML risk assessment distinguish between commercial trade finance activity and consumer account activity with separate, segment-specific controls? A single generalist risk framework applied across both populations does not satisfy the regulatory standard, as this case and the Ikano Bank enforcement confirm.

On monitoring: Do your SAR monitoring and reporting processes produce consistent output across your commercial accounts, or do they depend on individual analysts exercising discretion about what to escalate? Systematic breakdown in SAR reporting — the third OCC finding — is almost always preceded by a period in which escalation decisions become informally discretionary rather than systematically rule-based.

For a full view of what a current-standard KYC and AML programme should deliver across all dimensions, the complete KYC guide for 2026 covers the regulatory baseline from the ground up.

---

FAQ

What is trade-based money laundering and why is it hard to detect?

Trade-based money laundering exploits international commercial transactions — typically through invoice manipulation — to move illicit funds. It is particularly hard to detect because the financial institution processing payment often sees only one leg of a multi-party transaction, and because the control requires correlating invoice amounts against external commodity pricing data that financial institutions do not always have access to or monitor systematically.

How large was the American Express AML enforcement action?

The OCC issued a $350 million civil money penalty against American Express National Bank on 8 October 2026. The Federal Reserve issued a concurrent cease-and-desist order. The underlying finding was approximately $13 billion in suspected trade-based money laundering that moved through commercial accounts over a decade without triggering suspicious activity reports.

What three failures did the OCC identify in the American Express AML programme?

The OCC identified: (1) inadequate resources for the programme's scope; (2) failure to tailor the BSA/AML risk assessment to the specific risk profile of the bank's business activities; and (3) systematic breakdown in suspicious activity monitoring and reporting in commercial accounts.

How can a bank detect TBML at scale?

Effective TBML detection requires correlating data across product silos — commercial lending, correspondent banking, payments — continuously and against external benchmarks such as commodity price data and counterparty geography risk ratings. Periodic manual review cycles cannot achieve this coverage at scale. Automated transaction monitoring systems that run continuously and calibrate against updated regulatory typology guidance are the operational standard regulators expect.

What is the typical total cost of an AML enforcement action at this scale?

The civil money penalty is typically a fraction of the total cost. Remediation programmes — required changes to systems, staffing, and processes — have historically run at two to five times the penalty amount over a three-year remediation period. Operational restrictions imposed during remediation and reputational impact on commercial banking relationships add further costs that are not publicly disclosed.

Does a large, sophisticated institution guarantee a sound AML programme?

No. The American Express case, like the Ikano Bank enforcement earlier in 2026, illustrates that structural AML programme failures are not limited to under-resourced institutions. Both were established, regulated financial institutions with documented compliance programmes. What both cases show is that a programme assembled correctly at one point degrades when it is not continuously calibrated to evolving risk exposure, updated typology guidance, and the actual complexity of the business it is meant to cover.