A compliance risk assessment should describe the business the company actually conducts. What happens when it does not?
The AMEX enforcement actions provide a consequential answer. On October 8, 2026, the Office of the Comptroller of the Currency (OCC) announced a $350 million civil monetary penalty (OCC Penalty) and a cease-and-desist order(OCC Order) against American Express Company and American Express Travel Related Services Company, Inc. (collectively, AMEX) for Bank Secrecy Act and anti-money laundering deficiencies. The Federal Reserve separately issued a cease-and-desist order (FED Order) against AMEX. The OCC Press Release noted that the monetary penalty was imposed by the OCC, not both agencies.
For Chief Compliance Officers, directors, counsel, and internal auditors, the central lesson extends beyond banking: a compliance program must reflect the business’s actual risks, and oversight must demand evidence that it works. Over the next couple of blog posts, we will explore the Orders and Penalties. Today, we’ll start with what went wrong at AMEX.
What the enforcement record establishes
The OCC found violations involving the BSA/AML program, suspicious activity reporting, customer due diligence, and customer identification. According to the OCC Order, from approximately June 2014 through May 2025, the bank processed approximately $13 billion in suspected trade-based money laundering activity. That figure includes suspicious card charges and associated repayments. In some cases, the activity passed through accounts linked to bank insiders. The bank periodically reported suspicious activity but lacked the controls and monitoring capabilities to identify and report its full scope promptly.
Precision matters. The $13 billion figure does not mean AMEX laundered that amount, nor should it be described as $13 billion in distinct criminal proceeds. The findings concern suspected activity and failures in detection, evaluation, and reporting. The reference to insider-associated accounts also does not establish that every associated individual knowingly participated in misconduct.
The risk assessment did not match the business
The OCC’s most instructive finding concerns the program’s starting point. The bank’s risk assessment focused on its relatively narrow demand deposit products and services while giving insufficient attention to its more dominant credit and charge card products. This was a mismatch between the business being conducted and the risks being assessed.
For a CCO, the question should be immediate: does our assessment accurately represent how our company generates revenue, moves money, serves customers, and uses intermediaries?
The DOJ’s 2024 Evaluation of Corporate Compliance Programs (ECCP) begins its risk-assessment analysis by understanding the company’s business and examining how compliance scrutiny and resources address its risks. The ECCP asks “how the company has identified, assessed, and defined its risk profile, including specific factors that mitigate the company’s risk, and the degree to which the program devotes appropriate scrutiny and resources to the remaining spectrum of risks.” That provides a useful comparison here, not an additional finding against AMEX or the legal basis for these orders.
Consider a hypothetical manufacturer that rigorously reviews employee expenses but inadequately evaluates high-risk distributor payments. The expense controls may function exactly as designed. They still do not answer the more consequential risk question. The lesson is that the largest business line does not always present the greatest compliance risk. Management should demonstrate a defensible relationship between business activities, assessed risks, and control coverage. Completing an assessment is not the same as assessing the right business.
Customer information failures undermined monitoring
The OCC identified weaknesses in two distinct functions. Customer identification procedures did not adequately support a reasonable belief that the bank knew each customer’s true identity. Ongoing customer due diligence did not effectively establish the nature and purpose of customer relationships, undermining risk ratings and monitoring. Read together, these findings describe more than incomplete onboarding files. They connect customer knowledge to the ability to recognize transactions that warrant further investigation.
For businesses outside banking, the useful analogy is the difference between collecting a distributor’s documents and understanding what the distributor actually does. Who is involved? What commercial purpose does the relationship serve? What activity would fall outside that purpose?
The OCC also found systemic breakdowns in suspicious activity monitoring, investigation, and reporting, resulting in late, missed, or incomplete suspicious activity reports (SARs). Those failures extended beyond suspected trade-based money laundering to other suspicious activity. Importantly, the bank did file some reports. The OCC criticized the bank for failing to promptly identify and report the full scope of the activity.
That distinction should change how a compliance committee evaluates performance. Ask what the reporting process covered, what it missed, and how those conclusions were tested. A report count alone does not establish the answer. The same challenge should be applied to investigation totals, due diligence completions, and training statistics.
Audit, resources, and training did not provide effective safeguards
The OCC found that the internal audit did not effectively monitor BSA/AML compliance. Independent testing was neither appropriately scoped nor effective relative to the bank’s risk profile, contributing to delayed detection and remediation of deficiencies. The key takeaway is that an audit plan should challenge the compliance program’s assumptions, not simply confirm that documented procedures were followed. Testing a process against an incomplete view of risk can leave the underlying problem untouched.
The findings also addressed staffing and capability. Historically, the bank has not supported its BSA/AML program with appropriate resources, including personnel with the necessary skills, expertise, and training. Employee training did not adequately address job-specific responsibilities, impairing identification, escalation, and reporting of risks and suspicious activity.
For compliance leadership, those findings support a practical distinction: headcount, competence, and operational capacity should be assessed separately. Hiring more people should not substitute for determining which expertise a control requires.
Likewise, training should be evaluated against decisions employees must make. Can an investigator recognize a relevant pattern? Can an account manager identify a concern and route it correctly? Can a director challenge an explanation of control effectiveness? These are better questions to bring to the next program review than whether everyone completed the assigned course.
The Federal Reserve extended the concern to the enterprise
The FED Order identified significant deficiencies in the enterprise-wide financial crimes risk management program, including transaction monitoring, fraud referral processes, third-party risk assessment, and financial crimes risk management. Its order directs the AMEX board to address management accountability, remediation resources, program effectiveness, and reporting and escalation.
The broader governance lesson is not that the compliance department alone must work harder. Management responsibilities and board information should be examined alongside the technical controls. A remediation plan should identify who must act, what resources are required, and how directors will know whether the action worked.
AMEX’s public response
In its October 8 public statement, AMEX said internal and external reviews identified areas for improvement. It described investments in people, technology, training, governance, and oversight, as well as cooperation with regulators and law enforcement. Chairman and Chief Executive Officer Stephen J. Squeri stated, “While we have made meaningful progress, we know there is more work to do.”
The company also said the penalty would not affect full-year 2026 guidance, that the orders imposed no asset cap, and that anticipated remediation costs would not affect 2027 guidance. These are company statements, including forward-looking expectations, not regulatory findings about remediation effectiveness. The Federal Reserve separately acknowledged cooperation and remedial actions already undertaken. Progress deserves recognition, but corrective work should not be confused with demonstrated completion.
Three practical takeaways
- Start with business reality. Compare the risk assessment with actual products, transaction flows, customer relationships, and third-party arrangements. Require explanations for significant gaps in coverage.
- Challenge evidence of effectiveness. Ask the internal audit to test whether controls identify the risks that matter, not merely whether staff follow procedures. Examine decision quality and timeliness alongside activity counts.
- Make capability a governance discussion. Bring the board a clear account of required expertise, unresolved resource constraints, and the risks those constraints leave exposed.
The question for the next board meeting is straightforward: What evidence demonstrates that our compliance program addresses the business we actually operate?
Join us tomorrow, in Part 2, as we examine how the Federal Reserve’s remediation requirements can help CCOs and directors turn that question into accountable action.
