OCC penalises American Express National Bank over BSA and AML deficiencies

Sourced news briefing

The Office of the Comptroller of the Currency announced on 8 October 2026 a cease-and-desist order and a $350 million civil money penalty against American Express National Bank. The OCC said the bank had deficiencies in its Bank Secrecy Act and anti-money laundering program, including inadequate resources, internal-control gaps, weak independent testing and weak training. It also said the bank's risk assessment did not sufficiently reflect its dominant credit and charge card activities and that monitoring and reporting failures affected suspected trade-based money laundering activity.

The Federal Reserve issued a concurrent enforcement action concerning American Express Company and American Express Travel Related Services Company. The detailed findings apply to the named regulated entities and US legal framework. They do not establish that an ordinary merchant committed wrongdoing, nor do they create a universal merchant AML rule. These are attributed regulatory findings, not FixPays claims. The analysis below identifies governance lessons and does not provide US legal advice or imply a relationship between FixPays and American Express.

Independent merchant analysis: Make the risk assessment match the business

A risk assessment becomes unreliable when it concentrates on a small product while overlooking the main source of transactions. Merchants should inventory real revenue streams, countries, customer types, fulfilment, suppliers, refunds, chargebacks and payment instruments. Weight analysis by actual and expected exposure rather than by which product is easiest to document. If card activity dominates, the controls, staffing and monitoring plan should reflect that fact. A static questionnaire completed before launch is not enough when volume or business models change.

Trade-based risks can arise when payments and underlying goods or services do not align. Merchants should retain invoices, product details, counterparties, shipment or delivery evidence and explanations for unusual price, quantity or routing. This does not mean treating every cross-border sale as suspicious. It means giving reviewers enough context to distinguish legitimate complexity from patterns that require escalation. Payment data alone may not explain the commercial purpose, while commercial documents without payment references can be difficult to test.

Independent merchant analysis: Resource controls for their actual workload

A policy can promise review, but insufficient people, expertise or tools can produce growing backlogs and superficial decisions. Estimate case volume, complexity, languages, operating hours and escalation needs. Define qualifications for high-impact roles and provide training tied to the merchant's products. Quality assurance should sample decisions and test whether investigators considered relevant information. A team should be able to explain why an alert closed, not merely show that someone clicked a disposition.

Vendors can support monitoring, screening and case management, but the merchant remains responsible for using the outputs appropriately under its obligations. Test data quality, duplicate handling, model changes and access. Contracted service levels should address material failures and evidence. If the merchant cannot investigate the volume generated, adjust thresholds through governed analysis rather than allowing alerts to expire. Under-resourced monitoring can create false confidence while legitimate customers face unexplained holds.

Independent merchant analysis: Connect identification, due diligence and monitoring

Customer or counterparty identification is not a one-time document collection exercise. Information should connect to expected activity and be refreshed when risk, ownership or behavior changes. A merchant may need business documentation from suppliers, sellers or platform participants depending on its model. Collect only what is lawful and necessary, secure it, and record the reason for decisions. A payment credential does not prove identity, beneficial ownership or commercial legitimacy.

Monitoring should incorporate the context the merchant actually possesses: order value, product, delivery, account history, geography, refund behavior, linked parties and payment outcomes. Escalation rules must avoid exposing sensitive investigative logic to customers. At the same time, ordinary support should identify what legitimate evidence is missing and provide a path forward. Blanket silence or repeated generic document requests can generate complaints without improving detection.

Independent merchant analysis: Test independence and remediation

Independent testing should challenge design and operation, including whether earlier findings were fixed. Select testers with appropriate competence and freedom from the work they assess. Scope should follow the material business, not a comfortable subset. Track issues to owners, due dates and evidence of sustainable correction. Closing an item because a policy changed is weak if data, staffing and outcomes remain unchanged.

Senior management needs reporting that shows exposure, backlogs, overdue investigations, repeat findings, data gaps, training completion and customer impact. Metrics should not reward rapid closure without quality. When a serious weakness appears, pause or limit the affected activity where required, preserve evidence and seek qualified advice. Merchants should not claim regulatory compliance based on a provider logo, a passed onboarding review or a newly purchased monitoring tool.

Independent merchant analysis: operating review

Merchants should calibrate controls to both financial risk and customer harm. An alert process that freezes ordinary customers for weeks without meaningful review can be as operationally weak as one that misses suspicious behavior. Segment outcomes by trigger, market, product and review team, then compare confirmed concerns, false positives, abandoned cases, complaints and time to decision. Document authority for overrides and prevent commercial staff from bypassing controls informally. Board or senior-management reporting should identify assumptions and data limitations instead of presenting a single risk score as certainty. When external counsel or specialists are engaged, retain a clear implementation owner inside the business. Regulatory findings at a large financial institution should not be copied mechanically into a small merchant program, but they provide a useful warning that resources, risk assessment, monitoring, training and independent challenge must operate together around the actual transaction population. A marketplace or platform should also map monitoring responsibility between itself, payment providers and sellers. Contract language does not replace a working escalation route when activity crosses those boundaries. Reconcile the transaction population supplied to monitoring against finance totals so missing channels become visible. Sample cases from low-alert segments to test whether rules overlook risk. Review system access for investigators and external consultants. When remediation changes customer onboarding or payment holds, test communications and complaint handling before broad release. A remediation plan needs milestones that demonstrate operating change: complete data coverage, trained staff, tested scenarios, independent validation and stable case quality. Senior leaders should receive evidence of overdue actions and residual exposure, not merely a percentage marked complete. Customer-impact review should identify whether controls produce avoidable exclusion or repeated requests without weakening necessary investigation. Document exceptions, review them for common causes and update processes when the same workaround recurs.