Amex’s $350m fine: lessons for Jersey (and elsewhere) when the RISK ASSESSMENT misses the main business

On 8 October 2026, the US Office of the Comptroller of the Currency (OCC) announced a cease-and-desist order and a $350 million civil money penalty against American Express National Bank, based in Sandy, Utah, for deficiencies in its Bank Secrecy Act (BSA) and anti-money laundering (AML) compliance programme.

At the same time, the Federal Reserve issued a cease-and-desist order against American Express Co. and American Express Travel Related Services Co. The Fed did not impose a separate financial penalty.

What went wrong

• The risk assessment covered the wrong products.

  • According to the OCC, the bank’s risk assessment concentrated on its relatively narrow deposit account business and gave too little attention to the risks in its much larger credit and charge card products.

• Suspicious activity went unreported.

  • The OCC found systemic breakdowns in suspicious activity monitoring and reporting, leading to a failure to identify, evaluate and adequately report around $13 billion of suspected trade-based money laundering over the past decade.

• The basics were weak.

  • The OCC cited inadequate resources, including staff lacking sufficient expertise, gaps in internal controls, weak independent testing, and weak BSA/AML training for both employees and directors.

• Comptroller Jonathan Gould said Amex

  • Had not maintained a programme “properly aligned with the money laundering risks of its operations.”

• Under the Fed order, Amex must submit a plan to improve its enterprise-wide BSA/AML compliance risk management programme.

• Reuters reported that Amex neither admitted nor denied the allegations. This is the OCC’s first civil money penalty against a bank since its $450 million penalty on TD in October 2024.

Could this happen in Jersey? Read it against the Handbook

Each of the OCC’s findings has a direct counterpart in the JFSC AML/CFT/CPF Handbook. If a Jersey-supervised person had the same failings, here is where the JFSC would look.

1. A business risk assessment (BRA) that covers the wrong business: Section 2.3 and 2.3.1

   1. COP1 requires the board to conduct and record a BRA that assesses risk “in the round”.

   2. It must cover the firm’s customers, countries, the products and services it provides and how they are delivered, and it must consider the cumulative effect of the risks identified.

   3. The guidance in 2.3.1 also expects firms to assess the vulnerabilities of each product and service (para 18). It warns against focusing too much on any single factor (para 19) and against relying on a template BRA (para 20).

   4. A BRA that carefully covers a minor business line and lightly covers the main revenue line fails COP1. That is exactly what the OCC found at Amex.

1A. Customer risk assessment and CDD built on the wrong foundation – Sections 3.3.4 and 3.3.5

5. Reporting on the OCC order describes

                                                  i.      Failures in ongoing due diligence and enhanced due diligence for higher-risk customers, and

                                                ii.      The Federal Reserve has ordered a rebuilt CDD programme.

6. In Jersey, the link is direct:

                                                  i.      The Handbook says the sophistication of the CUSTOMER RISK ASSESSMENT may be set by the BRA (3.3.4, para 57), and

                                                ii.      That retail customers may be assessed generically by building on product risk (para 63).

7. If the BRA under-rates a product, every customer risk rating built on it inherits the error.

8. The customer business and risk profile, which must allow unusual activity to be recognised (3.3.5, para 80) and must be tailored for complex products (para 81), then gives monitoring nothing reliable to measure against.

• Monitoring that wasn’t built from the risk assessment: Section 6.4

  1. Article 11 of the Money Laundering Order requires policies and procedures for identifying and scrutinising complex or unusually large transactions and unusual patterns of transactions.

  2. COP58 to COP60 extend this to activity and require findings to be set out in writing. The guidance says red flags should be drawn from the BRA (paras 34 and 49).

  3. Where products are bespoke, monitoring must be tailored to the business (para 33). After examining notable activity, firms should adjust their monitoring and strengthen controls for more vulnerable products (para 51).

  4. The consequence is simple: if the BRA is wrong, the monitoring will be wrong too.

  5. Note also that the Handbook does not specifically mention trade-based money laundering. Firms with trade-finance, corporate card or commodity-linked exposure need to build those indicators themselves.

• Reporting failures: Section 9 and Section 2.4.1

  1. Under Article 34D of the Proceeds of Crime (Jersey) Law 1999, a report must be made as soon as is practicable. Article 21 of the Money Laundering Order then requires the MLRO to report to the FIU as soon as is practicable.

  2. Failure to report under Article 34D carries up to five years’ imprisonment, a fine, or both.

  3. The Handbook also expects the board to receive management information on the number of internal and external SARs and how quickly they were made.

  4. It should also see FIU inquiries or production orders received where the firm’s own controls had not already identified the issue (2.4.1, para 43). If a law enforcement request is the first sign of a problem, the board should treat it as evidence that controls are failing, not as a one-off.

• Under-resourcing and lack of expertise: Sections 2.3, 2.6 and 2.7

  1. The board must ensure sufficient resources are devoted to managing ML/TF/PF risk (2.3, para 8). COP19 and COP24 require the MLCO and MLRO to have sufficient resources, including time, and where appropriate deputies and support staff.

  2. The board’s periodic effectiveness review should specifically consider the resources available to scrutinise transactions (2.4.1, para 42).

  3. The OCC criticised staff who lacked sufficient expertise. The Jersey equivalent is whether the people handling alerts are “appropriately trained and experienced” (6.4.1, para 42).

• Weak training, including for directors: Section 10.5

  1. COP94 requires training that is tailored to the firm and relevant to the people receiving it.

  2. Board members should be trained on conducting and recording the BRA, setting the financial crime strategy, and assessing the effectiveness of controls (10.5.2).

  3. All relevant employees should be trained on the vulnerabilities of the firm’s own products, as identified in its BRA (10.5.1).

  4. Generic, off-the-shelf training that doesn’t reflect the firm’s actual business would not meet this standard. That was the gap the OCC identified for Amex’s directors.

• Weak independent testing: Sections 2.4 and 2.4.2

  1. Article 11(11) of the Money Laundering Order requires procedures for monitoring compliance with, and testing the effectiveness of, policies, awareness measures and training.

  2. COP5 and COP11 require the board to assess effectiveness and compliance and to act promptly on any deficiencies.

  3. Where the MLCO also designs the controls, the Handbook expects periodic independent scrutiny (Section 2.6).

  4. It also matters what happens when testing finds something: COP7 requires the board to notify the JFSC immediately, in writing, of any material failure to comply with the Money Laundering Order or the Handbook.

The bottom line

• The $350 million figure gets the attention, but the root cause is a risk assessment that didn’t match the business. In Jersey, that would be a COP1 failure, and every subsequent finding would trace back to it.

• Boards should ask one question this week:

  • Does our BRA weigh our risks in proportion to where our revenue, volumes and customers actually are?

COMSURE

• At Comsure, we regularly review BRAs, monitoring frameworks and board training against the Handbook.

• If you would like an independent view, contact us.

  • Mathew Beale  |  Chartered FCSI

  • MATHEW@COMSUREGROUP.COM

Sources

• OCC News Release 2026-87 (8 October 2026): https://occ.gov/news-issuances/news-releases/2026/nr-occ-2026-87.html

• Federal Reserve consent order, American Express Co. and TRS: https://www.federalreserve.gov/newsevents/pressreleases/files/enf20261008a1.pdf

• Banking Dive: https://www.bankingdive.com/news/amex-dinged-by-fed-occ-must-pay-350m-for-aml-failures/832570/

• Payments Dive: https://paymentsdive.com/news/amex-dinged-by-fed-occ-must-pay-350m-for-aml-failures/832575

• Investment Executive: https://www.investmentexecutive.com/?p=116759

JFSC AML/CFT/CPF Handbook (version effective 30 June 2026): https://www.jerseyfsc.org/industry/financial-crime/amlcftcpf-handbooks/