American Express Fined $350 Million Over Decade of Money Laundering Control Failures

Key Takeaways

• $350 Million OCC Penalty: American Express National Bank was fined $350 million and received a cease-and-desist order over systemic deficiencies in its Bank Secrecy Act and anti-money laundering compliance program.
• $13 Billion in Suspected Activity: Regulators found that the bank failed to timely identify, evaluate and sufficiently report approximately $13 billion in suspected trade-based money laundering activity over the past decade.
• Misaligned Compliance Controls: The bank focused its risk assessments on relatively limited deposit account operations while giving insufficient attention to its larger credit and charge card business. Regulators also identified deficiencies in staffing, internal controls, independent testing, training and customer due diligence.
• Federal Reserve Orders Board-Level Remediation: American Express's parent companies must improve enterprise-wide financial crimes risk management, with the board required to oversee management accountability, resources and corrective actions.
• Employee Accountability and Ongoing Supervision: The Federal Reserve order restricts the retention of certain individuals involved in misconduct, requires continued cooperation with investigations and mandates quarterly remediation reporting, subject to supervisory modification.

Deep Dive

American Express devoted more attention to the money laundering risks of its deposit accounts than to those of its much larger credit and charge card business. Over the past decade, approximately $13 billion in suspected trade-based money laundering activity went without timely identification, evaluation and sufficient reporting, according to federal regulators.

The Office of the Comptroller of the Currency imposed a $350 million penalty on the bank, finding that its anti-money laundering program suffered from systemic weaknesses in staffing, internal controls, customer due diligence and transaction monitoring. The Federal Reserve issued a separate order against two American Express holding companies, requiring improvements to financial crimes oversight that reach as far as the company's board of directors.

The OCC's findings describe a bank whose assessment of its own risks bore too little resemblance to the business it conducted. American Express National Bank had concentrated on its relatively narrow demand deposit products and services while insufficiently accounting for the risks associated with credit and charge cards, which represented a more substantial part of its operations.

The shortcomings ran through the compliance program. Some employees lacked sufficient expertise, independent testing was weak, and training for employees and directors was inadequate. Regulators also identified systemic gaps in internal controls and deficiencies in customer identification and due diligence procedures that contributed to failures in monitoring and reporting suspicious activity.

The OCC determined that the bank had failed to establish and maintain a program reasonably designed to ensure compliance with the Bank Secrecy Act. The weaknesses were sufficiently widespread that the regulator characterized the breakdowns in suspicious activity monitoring and reporting as systemic.

The approximately $13 billion cited in the enforcement action represents suspected trade-based money laundering activity that the bank failed to identify, evaluate and sufficiently report in a timely manner. It is not a finding that the entire amount consisted of proven criminal proceeds. The bank's obligation was to recognize and examine suspicious activity and provide the required information to authorities, regardless of whether investigators ultimately established that a crime had occurred.

Comptroller of the Currency Jonathan Gould said the bank had failed to devote the resources necessary to meet those obligations.

“The OCC expects banks of American Express’s size and complexity to devote sufficient resources to ensure compliance with laws and regulations designed to detect and prevent money laundering, which are critical to both economic and national security,” Gould said.

He said the bank's compliance program had not been properly aligned with the money laundering risks of its operations, resulting in failures that deprived law enforcement of important information.

The deficiencies identified by the OCC extended beyond the monitoring systems themselves. Weak independent testing left an important part of the bank's compliance arrangements inadequate, while shortcomings in personnel and training affected the people responsible for carrying them out. The regulator's findings encompassed the bank's assessment of risk, the controls intended to address it and the processes through which suspicious activity was reported.

The Federal Reserve's Demands

The Federal Reserve's concurrent action concerns American Express Company and American Express Travel Related Services Company Inc., the holding companies above the national bank. Its investigation examined failures to detect, investigate and report certain suspicious activity in a timely and sufficient manner.

Supervisory assessments by the Federal Reserve Bank of New York identified significant deficiencies in American Express's enterprise-wide financial crimes risk management program. The weaknesses included transaction monitoring, fraud referral processes, third-party risk assessment and financial crimes risk management.

The Federal Reserve's order requires American Express's board to submit a written oversight plan within 90 days of the order's effective date. Directors must explain how they will hold senior management accountable for correcting the deficiencies identified by both regulators, ensure that adequate resources are available and improve the reporting and escalation of significant compliance concerns.

American Express must also submit a plan to improve its enterprise-wide anti-money laundering program. The Federal Reserve specified that transaction monitoring rules and thresholds must be established, analyzed, tested and documented with regard to customer characteristics, products, services and geographic locations. The company must strengthen customer due diligence and ensure that suspicious activity is identified, evaluated and reported in a timely manner across its business lines.

The requirements extend to third parties supporting compliance operations, including network partnerships and ATM partners. Significant money laundering and sanctions risks must be assessed and brought to senior management or the board when appropriate.

American Express Travel Related Services faces additional requirements concerning sanctions compliance. Within 90 days, it must submit a plan addressing its risk assessment methodology, employee training and screening procedures under regulations administered by the Treasury Department's Office of Foreign Assets Control.

The Federal Reserve also addressed the treatment of employees involved in the misconduct underlying its order. American Express and Travel Related Services are prohibited from retaining certain individuals who participated in that misconduct, were formally disciplined in connection with it and subsequently separated from the firm or had their employment legally terminated. The restriction applies to individuals meeting all three conditions, based on the company's investigative record compiled from 2024 onward.

The companies must continue cooperating with the Federal Reserve in investigations involving current or former institution-affiliated individuals implicated in the misconduct. That obligation includes providing documents and testimony, identifying witnesses and making relevant personnel available to investigators.

American Express and Travel Related Services consented to the order without admitting or denying the allegations. The Federal Reserve acknowledged that both companies had fully cooperated with regulators and had already undertaken remedial actions.

The required corrective plans must include implementation schedules and specific deadlines. Once approved by the Federal Reserve Bank of New York, the companies must adopt them within 10 days and proceed with implementation. American Express's board must also submit quarterly progress reports detailing the work completed, its results and the timetable for outstanding measures, unless the Reserve Bank modifies or discontinues that requirement.

The two enforcement actions address related failures at different levels of the organization. The OCC found that American Express National Bank had maintained an inadequate anti-money laundering program, with failures involving approximately $13 billion in suspected activity over a decade. The Federal Reserve identified weaknesses in the enterprise-wide arrangements through which the parent companies were expected to manage financial crimes risks.

The latter order places a considerable burden on the board. Directors must oversee management's corrective work, account for the resources devoted to it and ensure that significant problems are brought to their attention. The company must also demonstrate that its monitoring methods reflect the risks presented by different products and customers, an area in which the OCC found the national bank's program deficient.

The OCC's penalty resolves the monetary assessment against the bank. The Federal Reserve's order, meanwhile, establishes continuing obligations for its parent companies, including formal oversight plans, compliance improvements and reporting to supervisors.

Those reports will provide the Federal Reserve Bank of New York with a continuing record of the corrective work. They must include the actions taken, the results achieved and copies of progress reports required under the OCC order. For American Express's directors, the deficiencies identified by regulators will remain a matter of documented oversight long after the $350 million penalty has been paid.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.