AML compliance failures cost American Express $350 million

AML compliance failures at American Express National Bank have produced a $350 million Bank Secrecy Act penalty. On October 8 the OCC announced a cease-and-desist order and a $350 million civil money penalty against the Sandy, Utah, bank, and the Federal Reserve Board issued a coordinated order against the parent companies.

Key takeaways

• The OCC says the bank failed to timely identify, evaluate and report about $13 billion of suspected trade-based money laundering over the past decade.
• The penalty is $350 million and will be directed to the U.S. Treasury.
• The Fed’s separate consent cease-and-desist order covers American Express Company and American Express Travel Related Services Company, Inc.
• The Fed order was entered on consent, without American Express admitting or denying the allegations.

The news

According to the OCC, the bank did not maintain a BSA and AML compliance program reasonably designed to ensure and monitor compliance. The agency cited inadequate resources, including staff without sufficient expertise, systemic internal control gaps, weak independent testing, and weak training for employees and directors.

The OCC said the bank did not tailor its risk assessment to its business. It concentrated on the risks of its relatively narrow demand deposit account products and gave too little attention to its dominant credit and charge card products. Customer due diligence and customer identification procedures contributed to monitoring and reporting failures, and the bank suffered systemic breakdowns in suspicious activity monitoring and reporting. As a result, the bank failed to timely identify, evaluate and sufficiently report about $13 billion of suspected trade-based money laundering over roughly a decade.

Comptroller Jonathan Gould said the OCC expects banks of American Express’s size and complexity to devote enough resources to detect and prevent money laundering, which he described as critical to economic and national security.

The Fed’s order, issued the same day, rests on an investigation into the firm’s failure to timely and sufficiently detect, investigate and report suspicious activity. It cites supervisory findings by the Federal Reserve Bank of New York of significant deficiencies in the enterprise-wide financial crimes risk management program, including weaknesses in transaction monitoring, fraud referral processes and third-party risk assessment. The order requires, within 90 days, a board oversight plan, a plan to improve the BSA/AML program and, for American Express Travel Related Services, a plan on OFAC sanctions compliance. It bars the firm from retaining employees involved in the misconduct, requires cooperation with investigations of individuals and calls for quarterly progress reports. The Fed’s release does not mention a penalty.

Our analysis

The central finding is a mismatch between risk assessment and business model. A bank that built its AML program around deposit accounts while its main activity was card lending had controls pointed at the wrong risk. Card networks, merchant payments and cross-border flows create their own typologies, and trade-based laundering in particular, which moves value through the misreporting of goods and invoices, is hard to catch without tailored monitoring rules.

The order language is a checklist for other institutions: written monitoring methodologies that consider customer, product and geography; customer due diligence proportionate to risk; a suspicious activity reporting program across all lines of business; oversight of network partnerships, ATM partners and third parties that support compliance; and timely escalation to the board. Those are the same program elements regulators expect of any institution, spelled out here for an enterprise-wide framework.

The coordination matters. The OCC supervises the bank and the Fed supervises the holding companies, and the Fed order requires the board to hold management accountable for remediation under both orders. The penalty is directed to the Treasury, and the compliance obligations extend to the parent.

Room for disagreement

American Express did not admit the Fed’s allegations, and the Fed order notes that the companies cooperated fully and have undertaken remedial action. The $13 billion figure describes suspected activity. The OCC’s penalty rests on the bank’s failure to identify and report it, not on a finding that laundering occurred.

What to watch

The Fed order gives the firm 90 days to deliver its board oversight, BSA/AML and OFAC plans, and quarterly progress reports follow. Banks whose AML programs were designed around a different business than the one they now run have a clear reason to revisit their risk assessments.