On October 8, 2026, the Office of the Comptroller of the Currency (OCC) assessed a $350 million civil money penalty against American Express National Bank and issued a cease-and-desist order over deficiencies in its Bank Secrecy Act (BSA) and anti-money laundering (AML) program. The Federal Reserve took parallel action against the bank’s parent companies the same day.
The headline number will get most of the attention, but the more useful lesson for compliance teams sits in the regulator’s explanation of what went wrong. According to the OCC, the bank’s risk assessment concentrated on its relatively narrow deposit products and gave too little weight to its far larger credit and charge card business. That single misjudgment helped roughly $13 billion in suspected illicit activity go insufficiently identified and reported over about a decade.
For any financial institution, the case is a reminder that an AML program can only be as accurate as the risk assessment underneath it.
What Regulators Found at American Express
The OCC found that the bank failed to establish and maintain a BSA/AML program reasonably designed to assure compliance. The deficiencies it cited cover nearly every part of a functioning program:
- Inadequate resources, including staff without sufficient expertise
- Systemic gaps in internal controls
- Weak independent testing
- Weak BSA/AML training for employees and directors
- Customer due diligence (CDD) and Customer Identification Program (CIP) procedures that contributed to monitoring and reporting failures
Much of the suspected activity was trade-based money laundering (TBML) processed between June 2014 and May 2025, and some of it ran through accounts associated with bank insiders. The Federal Reserve’s order requires American Express to submit plans within 90 days covering board oversight, CDD, transaction monitoring, suspicious activity reporting, and third-party oversight. American Express consented to both orders without admitting or denying the findings.
The Risk Assessment Was Pointed at the Wrong Business
Most AML failures are described in terms of missed alerts or late filings. This one starts earlier. When an institution’s enterprise-wide risk assessment underweights a business line, everything downstream inherits the blind spot. Monitoring scenarios get built for the products the assessment flagged. Staffing follows the risk ratings. Independent testing samples the areas the assessment called high risk.
Card programs present different exposure than deposit accounts. Payments and repayments can move value between parties in ways that resemble ordinary commercial spending, and merchant relationships add another layer of counterparties to understand. A risk assessment designed around deposit accounts will not ask the right questions about those flows, and the controls built from it will not catch them.
The lesson applies well beyond large card issuers. Community banks expanding into commercial lending, credit unions adding business accounts, and fintechs launching new payment rails all face the same question: has the risk assessment kept pace with where the institution actually makes its money?
Five Questions to Test Your Own Risk Assessment
Compliance teams can use the American Express findings as a practical checklist:
- Does the assessment weight each product line by its actual volume and revenue, or by how it was categorized when the program was first built?
- When the institution launched a product or entered a market in the past three years, did the risk assessment change as a result?
- Do monitoring scenarios map back to specific risks identified in the assessment, with documentation showing the link?
- Does independent testing sample the highest-volume business lines, or only the ones already rated high risk?
- Are insider accounts and employee-linked activity covered by monitoring with appropriate segregation of duties?
If the answer to any of these is unclear, the assessment likely needs work before an examiner points it out.
Why Risk Assessments Are Becoming a Regulatory Requirement
This case also lands during a broader shift in U.S. AML regulation. The Financial Crimes Enforcement Network’s (FinCEN) proposed AML/CFT program rule, published in April 2026, would make a risk assessment process an explicit, mandatory foundation of every covered institution’s program. Under the proposal, the risk assessment would need to cover products, services, distribution channels, customers, and geographies, and be updated promptly when the institution’s risk profile changes.
The rule is still pending, but the direction is clear. Examiners will increasingly ask institutions to show how their risk assessment drives resource allocation, not simply that one exists.
Turning Risk Assessment Into Daily Risk Decisions
An annual risk assessment document is necessary, but it is not enough on its own. Risk changes as customers change behavior, as products scale, and as new typologies emerge. Institutions that keep pace tend to connect enterprise-level risk ratings to customer-level scoring, so that a shift in a customer’s activity or profile updates their risk rating and the intensity of monitoring applied to them.
This is where risk scoring software can close the gap between policy and practice. Automated scoring that recalculates as new transaction, onboarding, and screening data arrives gives compliance teams a current view of risk instead of a snapshot from the last review cycle. Platforms such as Alessa combine customer risk scoring with transaction monitoring and case management, which makes it easier to document how risk ratings translate into specific controls.
Technology does not fix an assessment that is pointed at the wrong business. It does make it far harder for a growing product line to stay invisible for a decade.
Matching AML Controls to Where the Risk Actually Lives
The American Express penalty is a resourcing story and a controls story, but at its root it is a risk assessment story. The bank’s program was built for the business it understood rather than the business it had. For compliance leaders, the takeaway is straightforward: revisit the assessment every time the business changes, confirm that monitoring and testing follow the highest-volume risk, and keep evidence that those decisions were deliberate. Regulators are signaling that this is exactly what they will look for.
