What happened
The Office of the Comptroller of the Currency assessed a cease-and-desist order and a $350 million civil monetary penalty against American Express National Bank on October 8, as reported by Compliance Week. The bank is chartered in Sandy, Utah. In the OCC's words, it failed to establish and maintain a BSA/AML compliance program "reasonably designed to assure and monitor compliance with the BSA and its implementing regulations."
The Federal Reserve Board separately took its own enforcement action against American Express over deficiencies in the same program. Two regulators, one set of findings, and a penalty that ranks among the larger AML actions of recent years.
It is worth being precise about what this action is. It is a finding about the design and operation of a compliance program. It is not a public allegation that the bank moved money for a named criminal group, and no such case appears in the reporting. The fine is attached to the machinery, not to a specific transaction.
Why this is a GRC story
"Reasonably designed" is the whole test. Regulators do not ask a bank to catch every criminal. They ask whether the program was built to see the risk in the first place. That standard is satisfied by a chain of ordinary work: an accurate risk assessment, customer due diligence that reflects it, transaction monitoring tuned to the bank's actual business, alert review, and timely reporting. Break any link and the program stops being reasonably designed, even if nobody can point to a specific dirty dollar.
Two regulators means two examiners, two timelines and two sets of expectations. When the OCC and the Federal Reserve both act on one AML program, the practical burden is not the headline number. It is running remediation for two supervisory relationships at once, each with its own reporting cadence and its own view of what acceptable progress looks like. Programs that treat regulatory findings as a project with one owner tend to struggle here.
The cost is in the order, not the fine. A cease-and-desist order usually brings board-level reporting, an approved remediation plan, an independent review, and named accountability for delivery. That is a multi-year operating commitment, and it lands on the same teams already running the day job.
What to watch
Watch the remediation terms rather than the dollar figure. If the order requires an independent assessment of the monitoring and risk-assessment process, the findings from that assessment will tell the market more about the bank's control environment than the penalty does.
For anyone running an AML or financial crime program, the useful question is smaller and closer to home: when did we last test whether our monitoring rules still match the customers and products we actually have? If the answer is not recent, that gap is what an examiner will find first, and it is much cheaper to close on your own schedule.
Attribution: Analysis based on Compliance Week and related public reporting. This article is original commentary, not a repost of the source material.