Fed's Amex AML order puts correspondent banking on notice

The Fed’s Amex action puts correspondent banking on notice

The Federal Reserve’s October 8 order against American Express makes enterprise-wide anti-money-laundering controls a board-level problem—and a correspondent-banking risk. Federal Reserve

For global banks, the message is straightforward: correspondent relationships depend on proving that transaction-monitoring systems can identify suspicious flows and escalate them to regulators. The Amex order does not announce a new sanctions rule or restrict specific countries. It raises a harder question for banks operating across jurisdictions—whether their controls are merely present, or integrated enough to detect and report risk across the group.

The Federal Reserve identified “significant deficiencies” in American Express Company’s enterprise-wide anti-money-laundering program, particularly at its national-bank subsidiary. The Office of the Comptroller of the Currency, which supervises that bank, issued a separate enforcement action. Federal Reserve

Key Takeaways

• The Federal Reserve’s October 8, 2026, action targets American Express Company and its enterprise-wide Bank Secrecy Act and anti-money-laundering framework. Federal Reserve
• The OCC separately imposed a $350 million civil money penalty and a cease-and-desist order on American Express National Bank. OCC Assesses $350 Million Civil Money Penalty Against American Express | OCC
• The Fed’s consent order requires Amex to submit an acceptable written plan within 90 days to improve its enterprise-wide compliance risk-management program. Federal Reserve
• A Law360 account reported that the findings included failures involving the detection and reporting of potentially suspicious activity totaling $13 billion; the supplied official excerpts do not provide the underlying calculation or methodology. BREAKING: Amex Fined $350M Over Anti-Money Laundering Lapses - Law360
• Amex has faced earlier sanctions-compliance scrutiny: the Treasury Department’s Office of Foreign Assets Control announced a settlement over 214 apparent violations of Kingpin sanctions, with Amex agreeing to pay $430,500. U.S. Department of the Treasury

The enforcement architecture

The two-track action is important. The Fed addressed the parent company and the group-wide framework; the OCC addressed the national bank. The arrangement makes clear that responsibility does not stop at the legal entity where a control failure is discovered.

The Federal Reserve said its action is intended to ensure that American Express operates in compliance with U.S. laws and regulations. Federal Reserve The OCC’s action combined a cease-and-desist order with a $350 million penalty against American Express National Bank in Sandy, Utah. OCC Assesses $350 Million Civil Money Penalty Against American Express | OCC

That division of labor also raises the practical standard for multinational financial groups. A parent company may not be able to treat a subsidiary’s monitoring failures as an isolated operational problem if the group’s governance, reporting or escalation systems fail to identify and correct them.

The consent order puts the American Express board in the remediation chain. It requires “effective reporting and escalation” so directors can oversee management’s response to the matters identified in the Fed and OCC orders. Federal Reserve

That language places governance alongside technology and staffing. The issue is not simply whether a bank has transaction-monitoring software. It is whether senior management and directors receive reliable information, understand the risk, and act when controls do not perform.

The Fed’s public enforcement database describes its purpose as providing a searchable and downloadable record of enforcement actions against institutions it supervises. Board of Governors of the Federal Reserve System (via Public) / Federal Reserve The Amex order therefore sits within an established supervisory mechanism rather than representing an informal warning.

Why correspondent banking is exposed

Correspondent banking allows one financial institution to provide payment, clearing or settlement access to another institution, often across borders. The model depends on each bank’s ability to understand its counterparties and screen transactions against financial-crime and sanctions risks.

The Amex action does not establish that all correspondent relationships are unsafe, nor does it announce a broad withdrawal from any geography. The defensible inference is narrower: banks will have stronger incentives to test whether their counterparties can demonstrate effective detection, investigation, reporting and escalation.

That matters because a correspondent bank can face regulatory exposure from activity initiated elsewhere in the payment chain. A control framework that works for ordinary retail transactions may not be sufficient when products, subsidiaries, merchants and international counterparties create a complex pattern of activity.

The reporting converges on the core finding but not the scale. ACAMS described failures to detect and flag suspicious activity related to money laundering. OCC, Fed Tag AMEX with $350 Million Penalty | ACAMS Reuters, carried by WDSM, reported deficiencies in the lender’s anti-money-laundering program. American Express fined $350 million for insufficient anti-money laundering progr Law360 reported $13 billion in potentially suspicious activity, but the available official excerpts do not independently substantiate that amount. BREAKING: Amex Fined $350M Over Anti-Money Laundering Lapses - Law360

That distinction matters for decision-makers. The penalty is an official regulatory fact. The precise scale of potentially suspicious activity requires more detail about the transactions, the review period, the regulator’s methodology and whether the figure refers to gross transaction volume rather than illicit proceeds.

The sanctions-compliance connection

Money-laundering controls and sanctions compliance are distinct obligations, but they overlap in the systems banks use to identify customers, transactions and counterparties. A weakness in one control environment can raise questions about the reliability of adjacent controls.

American Express National Bank previously settled potential civil liability with OFAC over 214 apparent violations of Kingpin sanctions. OFAC said Amex agreed to remit $430,500. U.S. Department of the Treasury The earlier action does not prove that the AML findings caused or repeated sanctions violations. It does show why banks and their counterparties may examine the two control areas together.

The likely calculation among global banks is therefore defensive. If a U.S. supervisor finds that an institution’s enterprise-wide program was not sufficiently implemented, counterparties may request more documentation about customer due diligence, transaction monitoring, alert disposition, suspicious-activity reporting and sanctions-screening governance.

That could increase the cost of maintaining relationships with smaller or less transparent institutions. It could also encourage banks to narrow services where the commercial return does not justify the cost of enhanced monitoring.

The geopolitical consequence is uneven access to the international financial system. Banks that cannot satisfy major correspondents’ compliance requirements may face slower onboarding, higher fees, tighter transaction limits or termination of relationships. Those outcomes can affect trade finance and remittances even without a formal government sanction.

That is an analysis of the enforcement signal, not a finding that the Fed ordered banks to exit particular markets. No evidence supplied here identifies a country, correspondent, payment corridor or customer category that the Fed targeted.

What the order requires

The most concrete forward obligation is the 90-day planning deadline. Under the Fed consent order, American Express must submit an acceptable written plan to the Reserve Bank to improve its enterprise-wide Bank Secrecy Act and anti-money-laundering compliance risk-management program. Federal Reserve

The order also requires board-level reporting and escalation. Federal Reserve That creates several measurable questions for supervisors and investors:

• Does Amex map risks consistently across the parent company and its subsidiaries?
• Can management show that alerts are investigated and reported promptly?
• Does the board receive information that is complete enough to challenge management?
• Are remediation resources sufficient for the program’s scope?

The evidence supplied does not specify the precise suspicious-activity typologies, systems, business lines or reporting failures behind the action. It also does not include American Express’s response, the expected remediation cost or a timetable for terminating the order.

Those omissions limit the forecast. A $350 million penalty is material, but the more consequential test will be whether supervisors accept the remediation plan and whether the group can demonstrate sustained control performance.

Key figures

What to Watch

• The 90-day Fed deadline: American Express must submit an acceptable written improvement plan to the Reserve Bank under the consent order. Federal Reserve
• The remediation scope: Watch for public detail on whether the plan changes board reporting, transaction monitoring, suspicious-activity reporting, sanctions screening or subsidiary oversight.
• Counterparty responses: The evidence does not identify any bank exits or restrictions. The next meaningful signal would be a disclosed correspondent-review process, service limitation or increased compliance requirement tied to the action.

Diplomat View

The Fed’s Amex action is best read as a governance signal, not a new sanctions regime. Its immediate target is American Express, but its broader effect will be to make global banks prove that AML controls operate across legal entities and reach the boardroom. That pressure will likely increase compliance costs and make correspondent banks more selective, with the greatest effects on institutions that cannot document reliable monitoring and escalation.

The forecast should be revised upward if the Fed or OCC identifies additional institutions with comparable enterprise-wide failures, or if banks disclose correspondent exits linked to the action. It should be revised downward if American Express submits its plan on schedule, regulators accept it without expanding the order, and no material changes appear in correspondent access or sanctions controls. The decisive question is execution: whether supervisory scrutiny produces durable control improvements rather than another penalty followed by the same weaknesses.

The Bottom Line

The Federal Reserve’s action turns an Amex compliance failure into a broader test of how financial groups govern AML risk. The immediate obligations fall on American Express, but the market signal reaches its banks, counterparties and correspondent networks. In cross-border finance, a control that stops at the subsidiary is no control the market can trust.