Narrow Deposits, Dominant Cards: The OCC's Amex Orders

Prepared from publicly available information as of 12 October 2026.

I was reading the financial news recently when I came across the reports on American Express’s 8 October enforcement actions. The Global Trade Review headline the following day was hard to miss: “Amex processed US$13bn in trade-based money laundering transactions, US alleges”. John Basquill’s report was more careful in its description, referring to “around US$13bn in transactions believed to relate to trade-based money laundering (TBML)”. In Banking Dive, Gabrielle Saulsbery quoted Michael Padula, a former US Department of Justice trial attorney who had worked on money laundering cases, saying “the bigger question is how $13 billion went inadequately reported for so long”. It was understandable that the story would first reach readers through a large number and a question about what the bank had failed to identify and report in time.

But as I followed the reporting back to the orders of the Office of the Comptroller of the Currency (OCC), I found myself returning to a quieter detail. The OCC had identified a mismatch between American Express National Bank’s risk assessment and the business it actually conducted. The assessment focused on its relatively narrow demand deposit account products and services, while giving insufficient attention to its more dominant credit and charge card products. That comparison is less striking than the $13 billion figure, but it seemed to me a more useful place to begin understanding what this case might mean beyond American Express itself.

There are two possible readings worth being careful about. One is to see trade-based money laundering as a concern belonging mainly to trade finance departments, with little relevance to a bank that does not operate one. The other is to regard the American Express case as evidence that cards have only recently emerged as a TBML channel. Neither quite fits the public record. Earlier guidance had already described the use of card purchases and subsequent repayments in money laundering schemes, while the OCC’s findings did not identify a particular trade finance product. What the orders brought into focus was something more familiar, but no less important: whether a bank’s understanding of its risks adequately reflects the products through which it conducts most of its business.

I find it useful to separate three questions when reading this case. The first concerns the mechanisms through which TBML can occur. The second concerns where, within an institution, responsibility for those risks is understood to sit. The third concerns whether the institution’s risk assessment and controls actually cover the products and activities that matter most to its business. This is my own way of organising the public record, rather than a classification adopted by the regulators. Keeping these questions separate helps explain why the significance of the orders may lie less in the headline figure than in the relationship between a bank’s business and the risks its controls are designed to recognise.

What the $13 billion figure does and does not tell us

The figure comes from the OCC’s Civil Money Penalty Consent Order AA-ENF-2026-47 against American Express National Bank. At Art. II(3), the OCC found that between approximately June 2014 and approximately May 2025 the bank processed “approximately $13 billion in suspected TBML activity”, made up of “a combination of suspicious card charges and associated repayments of those card charges”, some of it through accounts connected to bank insiders. The failure it found was that the bank did not identify, evaluate and adequately report that activity in time. The same paragraph records that the bank did report suspicious activity intermittently over the period, while lacking the controls and monitoring capacity to identify and report its full extent in time.

Read closely, the paragraph gives less to work with than the headline suggests. The $13 billion is the OCC’s figure for suspected activity, and the public material offers no way to rebuild it: the order does not say how charges and repayments were combined or deduplicated, so whether a charge and its repayment both sit inside the total cannot be told from outside. Without a way to separate the components of the figure, it is difficult to use it as a benchmark for another institution. The more revealing question is where American Express’s risk assessment and monitoring placed their attention. The OCC’s other order addresses that question more directly.

What the orders identified

The sentence that matters most to peers sits in the cease and desist order issued the same day, Consent Order AA-ENF-2026-46, at Art. II(2)(a):

“The Bank’s risk assessment was not appropriately tailored to its business activities because it focused on the risks in the Bank’s relatively narrow demand deposit account products and services and insufficiently on the risks in its more dominant credit and charge card products;”

Both OCC orders were issued on 8 October 2026 and took effect that day: the cease and desist order under 12 U.S.C. 1818(b), and the civil money penalty order under 12 U.S.C. 1818(i), with a penalty of $350,000,000. Neither OCC order mentions letters of credit, documentary collections, guarantees or trade finance. The orders make no finding about a named documentary trade finance product. For those responsible for card compliance, however, the OCC identifies a more immediate issue: the bank’s dominant card products received insufficient attention in its risk assessment. The OCC does not divide the cards into consumer, commercial or corporate products, and does not attribute the activity to B2B payments or merchant acquiring, so the $13 billion cannot be assigned to any one card line.

The Federal Reserve Board acted the same day against American Express Company and American Express Travel Related Services Company, Inc., with an Order to Cease and Desist Issued Upon Consent, No. 26-052-B-HC, effective that day and with no civil money penalty assessed. The words “card”, “trade”, “trade-based money laundering”, “TBML” and “$13 billion” do not appear anywhere in the order’s extractable text. The Board’s press release placed its concern this way: “The Board also identified significant deficiencies in how American Express Company’s enterprise-wide anti-money laundering program was implemented, in particular at the firm’s subsidiary national bank.” The Board’s action points at the bank as well, but the card findings and the $13 billion are the OCC’s alone. Table 1 sets the three orders side by side, and Figure 1 shows which of the key terms each one contains.

Table 1. The three orders of 8 October 2026

Issuer	Order	Addressed to	Civil money penalty	Effective
OCC	Consent Order AA-ENF-2026-46	American Express National Bank	None in this order	8 Oct 2026
OCC	Civil Money Penalty Consent Order AA-ENF-2026-47	American Express National Bank	$350,000,000	8 Oct 2026
Federal Reserve Board	Order to Cease and Desist Issued Upon Consent, 26-052-B-HC	American Express Company; American Express Travel Related Services Company, Inc.	None assessed	8 Oct 2026

Figure 1. Card, TBML and $13 billion terms appear only in the two OCC orders, and no trade finance product term appears in either OCC order. Literal, case-insensitive counts in the full text of each order, as of 12 October 2026. “Not searched” means the term was not searched in that order and is not a zero; the Federal Reserve order’s 0 for “credit and charge card” and “trade finance” follows from the searched terms “card” and “trade” occurring 0 times. Sources: the three orders as cited in Table 1.

American Express’s own announcements and filings give the OCC’s adjectives some scale. The Business Checking launch announcement of 28 October 2021 introduced a fully digital checking account for US small and mid-sized businesses, under a title announcing the “First-Ever Amex-Issued Debit Card”. The Rewards Checking launch announcement called that product “the company’s first all-digital consumer checking account”, with accounts offered by American Express National Bank. On the card side, the group’s 2025 Form 10-K, filed on 6 February 2026, reports billed business of $1,669.8 billion for 2025, the volume transacted on payment products American Express issues, cash advances included, and Card Member loans of $151,832 million and Card Member receivables of $62,031 million at 31 December 2025, both before allowances for credit losses. The 10-K figures are consolidated group figures, not the bank’s, and the OCC does not name the deposit products it meant. These figures cannot quantify the bank-level product mix, but they help put the OCC’s comparison in context: a business checking account and an Amex-issued debit card dating only from late 2021 sat alongside a card franchise of that size at the group level. That still leaves a separate question: whether the card-related TBML risks discussed in this case were newly recognised. The earlier guidance helps answer it.

The mechanism was on paper before the orders

The earlier documents make it difficult to treat cards as a newly recognised TBML channel. They were written at different times and for different professional audiences, which may help explain why the connection between card risk and trade-based money laundering is not always visible from within a single team.

Scope came first. In its Best Practices Paper on Trade Based Money Laundering of 20 June 2008, the Financial Action Task Force (FATF) defined trade finance to cover managing payments for goods and related services in international trade, listing “managing payments for open account trading” beside issuing letters of credit, standby letters of credit and guarantees. A year later, the Wolfsberg Group’s guidance on credit and charge card issuing and merchant acquiring named card-side risk situations that included “Settlements/partial settlements from unrelated third parties”, where the issuer has access to the relevant information, and “charging for non-existent goods”. That guidance never uses the term trade-based money laundering. In January 2017 the Wolfsberg Group, the International Chamber of Commerce and BAFT issued Trade Finance Principles that drew TBML’s scope beyond the trade finance business to include “transactional activities across current and deposit accounts and payments”, while confining their own discussion to the trade finance activities they describe.

The full mechanism, a credit card purchase paid off by someone else, appears from 2020. The FATF and the Egmont Group’s Trade-Based Money Laundering: Trends and Developments, published on 9 December 2020, describes purchasers buying “goods using credit cards”, with criminal groups or professional money launderers then “settling their debt using the proceeds of crime”. The Financial Crimes Enforcement Network (FinCEN), in Advisory FIN-2025-A003 of 28 August 2025, describes purchases made “with credit cards that are subsequently paid off” by money laundering networks or by a complicit business owner. In March 2026, the US Department of the Treasury’s 2026 National Money Laundering Risk Assessment, building on FinCEN’s analysis, described “purchasing items from retailers in store or online using credit cards”, with funds obtained from money laundering networks used “to make payments towards account balances”. These are typologies and risk descriptions; none of them describes the activity in the OCC’s orders.

Across the six pre-enforcement documents checked for this piece, from seven issuing bodies, pieces of the picture appear in all six and the complete mechanism in three. Figure 2 places them on a time scale: the complete mechanism clusters in the six years before the orders, and the scope and card-risk fragments sit well before that. By March 2026 the Treasury’s own national risk assessment described the card version of the scheme. The mechanism was in the literature; the remaining question was whether this bank’s controls gave it the attention it required.

Figure 2. Public documents on TBML scope, card-channel risk indicators and the complete card mechanism before the orders of 8 October 2026, on a true time scale. Sources: documents as cited in the text.

What the OCC penalised was coverage

Set the OCC’s comparison sentence beside that literature and the three questions come apart. The typology was public. The presence or absence of a trade finance department was not the basis of the finding: the OCC made a TBML-related finding without identifying a particular trade finance product. What the OCC wrote up was the weighting of a risk assessment against the bank’s business, “relatively narrow” deposit products on one side, “more dominant” credit and charge cards on the other, and an assessment that “focused on” the first.

For institutions without a trade finance department, the important point is that the finding here did not depend on having one. That reading is consistent with the 2017 Trade Finance Principles, which had already placed the scope of TBML beyond the trade finance function, including across accounts and payments. The same Principles supply the reason control at the payment level has to rest somewhere other than documents. Where a bank’s part in an open-account trade is limited to an ordinary payment, “it will not generally be aware of the underlying reason for the payment”, and it lacks visibility of the transaction. That leaves a risk assessment weighted by product, which decides where monitoring looks.

For a card bank, the place monitoring has to look is the pair the OCC described, card charges and “associated repayments of those card charges”. The 2009 card guidance flagged settlement by unrelated third parties, and the 2020, 2025 and 2026 documents put the laundering in the link between a purchase and whoever pays it off. Figure 3 sets the two paths side by side. If a risk assessment gives most of its attention to deposit products, the connection between a card purchase and its eventual repayment may receive less attention than it warrants. This is an inference from the OCC’s comparison, not a specific monitoring failure attributed by the regulator to one individual control. Comptroller of the Currency Jonathan Gould’s statement is consistent with that reading. In the OCC’s news release, his second sentence measured the bank’s Bank Secrecy Act/anti-money laundering (BSA/AML) program against its business: “American Express failed to maintain a BSA/AML compliance program properly aligned with the money laundering risks of its operations, which resulted in the bank’s failures to timely identify and report significant missed suspicious activity and to provide important information to law enforcement.” Alignment with the risks of one’s operations is a coverage standard, and it can be checked against the operations themselves.

Figure 3. A card purchase and its repayment by someone else meet at the card account; the OCC’s phrase for the pair is “card charges and associated repayments of those card charges”. Schematic: a composite of public typologies; it does not depict the transactions in the OCC’s orders. Sources: documents as cited in the text.

What the OCC wrote down for this bank

The cease and desist order’s remediation articles are the most specific text in this case’s public record on what proper alignment was to mean for American Express National Bank. Article V requires a bank-wide BSA/AML risk assessment covering products and services, including arrangements such as supplementary cardholders, together with customer types, the entities served, bank insiders, transaction types, the countries or geographies of customers and transactions, and the methods by which the bank interacts with customers. The assessment is to be reviewed and updated at intervals of no more than 12 months, and whenever risk changes materially. Article VIII requires the bank to identify, evaluate and report suspicious activity across all lines of business, with monitoring systems and controls covering every business unit, including red flags for TBML. Article IX requires an independent third-party consultant to conduct a lookback of suspicious activity reporting and, within 60 calendar days of completing it, to give the board a written report listing the number and types of customers, accounts and transactions reviewed and the suspicious activity reports (SARs) it recommends be filed, corrected or amended. The lookback follows the OCC’s finding that deficiencies in monitoring, investigation and reporting led to “untimely, missed, or incomplete SARs”, covering suspected TBML and other suspicious activity. Its report goes to the board, not to the public. These requirements apply to American Express National Bank, not to the industry as a whole. Their relevance beyond this case is more limited, but still useful: they show in concrete terms the range of products and activities the OCC expected this particular card bank’s controls to cover.

American Express National Bank “neither admits nor denies” the findings in the OCC’s orders. Stephen J. Squeri, chairman and chief executive of American Express, said in a statement on the consent orders on 8 October that “We believe our reporting has provided important intelligence to law enforcement”, and that “there is more work to do”.

How far a finding about one bank can travel

There is a reasonable limit to drawing broader lessons from these orders: they concern one bank, under circumstances particular to that bank. The figure is very large, part of the activity ran through accounts linked to bank insiders, and the risk assessment the OCC criticised was American Express’s own construction. All three orders are addressed to American Express entities, and no regulator issued a new industry-wide definition or guidance alongside them. On that reading, other institutions learn something about American Express and nothing about themselves.

The orders did not establish a new industry rule, and the insider-linked accounts are facts of this case, not evidence about other institutions. What travels is the form of the finding. The comparison sentence needed no transaction-level evidence; it could be written by placing a bank’s own risk assessment beside its own business mix. For a bank that already reviews its BSA/AML risk assessment annually and presents it for board and supervisory review, the two things being compared, the assessment and the business it describes, are available. An examiner can ask whether they fit without assuming that another institution shares American Express’s particular deficiencies. Gould’s first sentence frames the expectation by category: “The OCC expects banks of American Express’s size and complexity to devote sufficient resources to ensure compliance with laws and regulations designed to detect and prevent money laundering”. It creates no requirement, and it is addressed to a class of bank.

This leaves a narrower conclusion than the headline might suggest. The record does not establish the exposure of other institutions, and the $13 billion figure and insider-linked accounts remain specific to this case. What can reasonably carry beyond American Express is the form of the comparison: whether an institution’s risk assessment gives appropriate attention to the products and activities that make up its business.

A risk assessment can end up describing the bank familiar to its compliance function, rather than the bank visible in its business reporting. Taken separately, both accounts may seem coherent. Side by side, one shows attention concentrated on relatively narrow deposit products, while the other shows a business dominated by credit and charge cards. This was the work of the OCC’s comparison sentence: it made visible the distance between the institution’s account of its risks and the business those risks were supposed to follow.

Why might they come apart? One possibility, and an inference from the published material rather than an OCC finding about internal responsibilities, is that a card purchase and the repayment that settles it are seen separately by different functions. Public guidance was divided by audience, too. Trade finance principles described TBML risks extending beyond documentary transactions; later TBML reports described goods bought with credit cards and balances paid off with criminal proceeds. Guidance for card issuers and merchant acquirers separately identified settlements by unrelated third parties and charges for non-existent goods. Neither perspective is mistaken. Together, they make the connection between a purchase and its repayment easier to see.

For a head of anti-money laundering compliance, the question may be whether the risk assessment weights products in line with the business, with evidence across the dimensions the OCC required for this bank: products and services, including supplementary-cardholder arrangements; customer types and insiders; transaction types; geographies; and methods of customer interaction. For a card or payments product head, it is whether monitoring connects purchases with the people or entities repaying them, especially unrelated third parties where relevant information is available. For a head of trade finance, it is whether TBML policy stops at documentary business while payment risks sit elsewhere. A board could ask not for an assurance that no TBML occurs, which cannot be proved, but for an account of coverage it can check against the business.

A product-by-product comparison would make those answers concrete. Each row would show the product’s importance to the business, its weight in the anti-money laundering risk assessment, the TBML typologies in the public literature relevant to it, and the monitoring rules intended to address them. For cards, that last column would show how purchases and repayments are considered together. Where a relevant cell is blank, the gap becomes visible; where business importance and risk weighting diverge, there is a specific question to examine. That brings me back to the OCC’s comparison sentence: does the bank described in the risk assessment resemble the bank described by its business?

Sources

Office of the Comptroller of the Currency, news release on enforcement actions against American Express National Bank, 8 October 2026. https://occ.gov/news-issuances/news-releases/2026/nr-occ-2026-87.html (accessed 12 October 2026)
Office of the Comptroller of the Currency, Consent Order AA-ENF-2026-46, American Express National Bank, 8 October 2026. https://occ.gov/news-issuances/news-releases/2026/nr-occ-2026-87a.pdf (accessed 12 October 2026)
Office of the Comptroller of the Currency, Civil Money Penalty Consent Order AA-ENF-2026-47, American Express National Bank, 8 October 2026. https://occ.gov/news-issuances/news-releases/2026/nr-occ-2026-87b.pdf (accessed 12 October 2026)
Board of Governors of the Federal Reserve System, press release announcing enforcement action with American Express Company, 8 October 2026. https://www.federalreserve.gov/newsevents/pressreleases/enforcement20261008a.htm (accessed 12 October 2026)
Board of Governors of the Federal Reserve System, Order to Cease and Desist Issued Upon Consent, American Express Company and American Express Travel Related Services Company, Inc., No. 26-052-B-HC, 8 October 2026. https://www.federalreserve.gov/newsevents/pressreleases/files/enf20261008a1.pdf (accessed 12 October 2026)
American Express, statement by Stephen J. Squeri regarding the Federal Reserve and OCC consent orders, 8 October 2026. https://www.americanexpress.com/en-us/newsroom/articles/company-statements/statement-regarding-the-frb-and-occ-s-consent-orders.html (accessed 12 October 2026)
Global Trade Review, John Basquill, “Amex processed US$13bn in trade-based money laundering transactions, US alleges”, 9 October 2026. https://www.gtreview.com/news/americas/amex-processed-us13bn-in-trade-based-money-laundering-transactions-us-alleges/ (accessed 12 October 2026)
Banking Dive, Gabrielle Saulsbery, report on the Federal Reserve and OCC actions against American Express, 8 October 2026, updated 9 October 2026. https://www.bankingdive.com/news/amex-dinged-by-fed-occ-must-pay-350m-for-aml-failures/832570/ (accessed 12 October 2026)
Financial Action Task Force, Best Practices Paper on Trade Based Money Laundering, 20 June 2008 (copy hosted by the U.S. Department of the Treasury). https://home.treasury.gov/system/files/246/best-practices-paper-Trade-based-ML-062008.pdf (accessed 12 October 2026)
Wolfsberg Group, guidance on credit and charge card issuing and merchant acquiring activities, 2009. https://db.wolfsberg-group.org/assets/c2914086-4775-4110-860e-adac57371988/Wolfsberg%20Credit%20Card%20Guidance.pdf (accessed 12 October 2026)
Wolfsberg Group, International Chamber of Commerce and BAFT, Trade Finance Principles, 24 January 2017. https://library.iccwbo.org/tfb/ps/ICC-Wolfsberg-Trade-Finance-Principless-2017.pdf (accessed 12 October 2026)
Financial Action Task Force and Egmont Group, Trade-Based Money Laundering: Trends and Developments, 9 December 2020. https://www.fatf-gafi.org/content/dam/fatf-gafi/reports/Trade-Based-Money-Laundering-Trends-and-Developments.pdf.coredownload.inline.pdf (accessed 12 October 2026)
Financial Crimes Enforcement Network, Advisory FIN-2025-A003, 28 August 2025. https://www.fincen.gov/system/files/2025-08/FinCEN-Advisory-CMLN-508.pdf (accessed 12 October 2026)
U.S. Department of the Treasury, 2026 National Money Laundering Risk Assessment, March 2026. https://home.treasury.gov/system/files/246/2026-NMLRA.pdf (accessed 12 October 2026)
American Express, launch announcement for American Express Business Checking, Business Wire, 28 October 2021. https://www.businesswire.com/news/home/20211028005659/en/American-Express-Launches-New-Fully-Digital-Business-Checking-Account-for-U.S.-Small-and-Mid-Sized-Businesses-with-First-Ever-Amex-Issued-Debit-Card (accessed 12 October 2026)
American Express, launch announcement for American Express Rewards Checking, Business Wire. https://www.businesswire.com/news/home/20220208005516/en/American-Express-Expands-Membership-With-New-American-Express-Rewards-Checking-Account (accessed 12 October 2026)
American Express Company, Annual Report on Form 10-K for the fiscal year ended 31 December 2025, filed 6 February 2026. https://www.sec.gov/Archives/edgar/data/4962/000000496226000080/axp-20251231.htm (accessed 12 October 2026)