The Federal Reserve Board on 8 October announced an enforcement action against American Express Company for failing to sufficiently detect and report certain suspicious activity related to money laundering. The consent cease-and-desist order, Docket No. 26-052-B-HC, also covers American Express Travel Related Services Company (TRS). The order carries no Fed penalty. Its weight lies in what it demands of the holding company’s board, and in a clause on former staff that will follow the people involved for the rest of their careers in the group.
The Fed found weaknesses across the group, centred on the bank
According to the order, supervisory assessments by the Federal Reserve Bank of New York identified significant deficiencies in Amex’s enterprise-wide financial crimes risk management programme, including weaknesses in transaction monitoring, fraud referral processes, third-party risk assessment and financial crimes risk management. The Board also conducted an investigation into the firm’s failure to detect, investigate and report certain suspicious activity in a timely and sufficient way.
The press release says the deficiencies showed up in particular at the group’s national bank, American Express National Bank. The Office of the Comptroller of the Currency, which supervises the bank, issued its own consent cease-and-desist order and a civil money penalty against it. The Fed’s documents do not state the amount of the OCC penalty, so readers should go to the OCC’s release for that figure.
As is standard in consent orders, Amex and TRS neither admit nor deny the allegations. The order records that both companies cooperated fully and have already begun remediation.
The board’s own oversight plan comes first
Within 90 days, the Amex board must give the New York Fed a written plan setting out how it will oversee the remediation. That plan must cover how the board will hold senior management accountable for executing the remediation required by both the Fed and OCC orders, how it will ensure management has adequate resources, how it will make sure management runs an effective enterprise-wide BSA/AML programme, and how reporting and escalation will reach the board.
The order lists the board’s plan as paragraph 1, ahead of the AML programme itself, and every one of its four items is about directors holding management to account. Directors at other card issuers and payment groups should read it as a description of what examiners will want to see in board minutes and committee papers.
Network partners and ATM providers are named in the AML plan
Amex must also deliver, within the same 90 days, an acceptable plan to improve the firm-wide BSA/AML programme. Its six required elements include transaction monitoring methodologies that are established, analysed, tested and documented with regard to customer type, product and geography; a customer due diligence programme commensurate with the firm’s risk; and a suspicious activity reporting programme that works across all lines of business.
One element is specific to Amex’s business model. The plan must include risk-based oversight of the full range of BSA/AML systems, including the processes and controls that oversee and use information from “network partnerships, ATM partners, and third parties”. Amex runs a card network as well as issuing cards, and the order treats information from partners on that network as part of the AML control set. Separately, TRS must file a plan on compliance with OFAC sanctions regulations, covering an OFAC risk assessment methodology, role-specific training and enhanced screening procedures.
Amex and TRS shall not in the future directly or indirectly retain any individual as an officer, employee, agent, consultant, or contractor of the Firm or any subsidiary or affiliate thereof who, based on the investigative record compiled by the Firm during the period 2024 to the present: (i) participated in the misconduct underlying this Order.
Federal Reserve Board, Order to Cease and Desist, Docket No. 26-052-B-HC
Former employees involved cannot come back
Paragraph 4 bars Amex and TRS from retaining, directly or indirectly and in any capacity including as a consultant or contractor, any individual who participated in the misconduct, was disciplined for it through the firm’s internal processes, and separated from the firm or was terminated in connection with it, based on the firm’s investigative record from 2024 onward. Paragraph 5 requires the firm to give the Fed “substantial assistance” in investigations of individuals, including making current and former staff available for sworn testimony.
The cooperation clause suggests the Fed has not finished. Actions against individuals, such as prohibition orders, would be the natural next step, and the firm has committed in advance to help build those cases.
What to watch
- 6 January 2027: the 90-day deadline for the board oversight, BSA/AML and OFAC plans, counted from the order’s effective date of 8 October.
- The OCC’s consent order and penalty against American Express National Bank.
- Any Federal Reserve actions against individuals connected with the misconduct.
Primary sources
- Federal Reserve Board, Federal Reserve Board announces enforcement action against American Express Company, 8 October 2026
- Federal Reserve Board, Order to Cease and Desist Issued Upon Consent, American Express Company and American Express Travel Related Services Company, 8 October 2026
Photo: G. Edward Johnson, CC BY 4.0 via Wikimedia Commons
