American Express’s $350 Million Penalty Reprices Control Capacity

American Express’s $350 million regulatory penalty is large. The more useful signal for finance leaders is what regulators say sat behind it: resources, expertise, training, independent testing and controls that were not aligned with the scale and risk of the business.

On October 8, the Office of the Comptroller of the Currency announced a cease-and-desist order and civil money penalty against American Express National Bank. The OCC said weaknesses in the bank’s anti-money-laundering program contributed to a failure to timely identify, evaluate and sufficiently report approximately $13 billion of suspected trade-based money laundering activity over the past decade. The Federal Reserve issued a concurrent enforcement action against the parent company and another subsidiary.

The judgment

• Implication: Compliance capacity is an operating constraint, not a support-function budget line. When products, transaction volume or risk change faster than staffing, systems and testing, the control deficit accumulates before the financial penalty appears.
• What would change the conclusion: Evidence that the cited failures were narrow, already fully remediated and unlikely to recur would reduce the forward risk. The consent orders and continuing remediation requirements indicate that regulators do not yet treat the work as complete.
• Management action: Tie financial-crime and other critical-control budgets to measurable risk drivers—transaction volume, product complexity, alert inventory, investigation age, model coverage and independent-testing exceptions—rather than prior-year spending.

The finding was about capacity and alignment

The OCC identified inadequate resources, staff without sufficient expertise, systemic internal-control gaps, weak independent testing, and weak training for employees and directors. It also said the bank’s risk assessment concentrated on a relatively narrow deposit business while giving insufficient attention to its much larger credit- and charge-card operations.

That combination matters. A control environment can appear complete on paper while being underpowered in practice. Policies, committees and monitoring systems do not create capacity by themselves. The operating question is whether the institution can identify risk, investigate alerts, challenge models, escalate exceptions and preserve evidence at the pace the business generates them.

The finance lesson extends beyond banking. A company that adds customers, products, geographies or transaction channels without re-scaling the control layer is effectively financing growth with an unrecorded liability. The obligation does not appear as debt, but it can emerge later as remediation expense, regulatory limits, delayed projects, management distraction and reputational damage.

A risk assessment should follow the economic engine

The OCC’s contrast between deposit products and the card business is the most transferable fact in the order. Controls should be weighted toward the activities that create the institution’s actual exposure, not toward the organizational chart, the easiest data set or the program that has historically received the most attention.

For a CFO, that means the risk map should reconcile to the operating model. Revenue concentration, transaction count, customer mix, product velocity, cross-border exposure and exception volume should all have a visible connection to control coverage and resources. If the largest business line is not producing the largest control conversation, management should be able to explain why.

This is the same principle behind moving contract controls upstream of the ledger: risk begins where the economic activity is created, not where a later review happens to find it.

Guidance can survive while control risk rises

American Express said that a portion of the penalty had been reserved in prior periods, that the orders do not impose an asset cap, and that neither the penalty nor the expected remediation costs are anticipated to affect its 2026 or 2027 guidance. That is important reported information, but it does not make the control issue financially irrelevant.

Forecast guidance measures expected financial outcomes within a stated period. A consent order measures a control and governance condition. The two can coexist. Remediation may fit inside the forecast while still consuming scarce management capacity, changing investment priorities or increasing execution risk.

Boards should therefore resist a false choice between “material to guidance” and “important.” The earlier Numbers & Judgment analysis of the SEC’s proposed internal-control assurance threshold made a related point: the cost of a control process and the value of the discipline it creates are different questions.

The operating dashboard needs leading indicators

A penalty is a lagging indicator. By the time it is announced, the underlying failures may have accumulated for years. A finance-led remediation dashboard should focus on the earlier signals:

1. Workload: alerts, investigations and cases per qualified employee, including contractor dependence and vacancy duration.
2. Timeliness: aging by risk tier, overdue escalations and the time from detection to documented disposition.
3. Coverage: the share of products, channels, customers and transaction types included in the monitoring design.
4. Quality: reopened cases, late reports, validation exceptions, testing findings and repeat issues.
5. Change risk: new-product launches, system migrations and model changes that add exposure before controls are proven ready.

The free Board Finance Dashboard offers a useful reporting structure for decisions, warning flags and ownership, although a financial-crime program needs a dedicated compliance supplement and legal review.

Budget the control layer from the risk drivers

Annual budgeting often starts with last year’s head count and applies an adjustment. That approach is poorly suited to control functions because the work does not grow only with revenue. It can grow faster when transaction velocity, product variety, geographic reach or regulatory expectations increase.

A better budget starts with expected activity and risk. Management can then translate those drivers into staffing, technology, testing and remediation capacity. Where the model is uncertain, the answer is not a single precise ratio. It is a range, a trigger and a contingency plan.

The $350 million penalty is therefore not a useful benchmark for what another company should spend. The useful benchmark is whether control capacity changes when the business changes—and whether the board can see the gap before a regulator does.

Sources

• Office of the Comptroller of the Currency, “OCC Assesses $350 Million Civil Money Penalty Against American Express,” October 8, 2026.
• Federal Reserve Board enforcement announcement, October 8, 2026.
• American Express statement regarding the consent orders, October 8, 2026.
• Reuters, “American Express fined $350 million for insufficient anti-money laundering program,” October 8, 2026.

Regulatory findings, company statements and financial facts are attributed above. The judgments about control capacity, budgeting and board oversight are Numbers & Judgment analysis.