In Brief: What does a $350 million AML penalty tell us about compliance technology? The American Express enforcement action highlights the risks that emerge when AML operations fail to keep pace with the business—and why adaptability matters.
On October 8, 2026, the Office of the Comptroller of the Currency (OCC) imposed a $350 million penalty on American Express National Bank for serious deficiencies in its Bank Secrecy Act and anti-money laundering compliance program. The Federal Reserve simultaneously issued a cease-and-desist order addressing broader AML compliance deficiencies at American Express Company and American Express Travel Related Services Company.
According to the OCC, systemic monitoring and reporting failures left approximately $13 billion in suspected trade-based money laundering activity inadequately identified, evaluated, or reported between 2014 and 2025.
But perhaps the most revealing finding wasn’t the dollar amount. It was the disconnect between American Express’s business and its AML compliance operations.
The OCC found that the bank concentrated its AML risk assessment on its relatively narrow deposit business while insufficiently addressing the risks associated with its much larger credit and charge card operations.
The regulator’s conclusion was unmistakable: The bank’s compliance program was not adequately aligned with the money laundering risks of its operations.
AML risk assessment must reflect the business
The OCC identified a broad set of deficiencies, including inadequate resources and expertise, weak internal controls, ineffective independent testing, and shortcomings in employee and director training. It also identified problems with customer due diligence, customer identification procedures, and suspicious activity monitoring and reporting.
Those findings matter together.
An AML program cannot effectively monitor risks it has not adequately identified. Customer due diligence loses value if customer information and risk don’t inform subsequent monitoring and review. And suspicious activity monitoring cannot operate as an isolated control disconnected from what an institution knows about its customers, products, and business.
The American Express enforcement action exposes the danger of allowing those functions to become separate compliance exercises.
Effective AML depends on connecting risk assessment, customer due diligence, monitoring, investigation, and operational response.
And those connections have to change when the business changes.
The business moves. Can the AML operation move with it?
Financial institutions don’t stand still.
They introduce products, enter markets, change distribution channels, acquire customers, encounter new typologies, and respond to new regulatory requirements. Each change can alter the institution’s financial crime risk.
The American Express findings raise a broader operational question for every financial institution:
How effectively can its AML systems translate changing business risks into working compliance controls?
A revised risk assessment may identify a new exposure. Compliance leaders may determine that different information needs to be collected, a customer population requires additional review, an approval process needs to change, or investigators need a different escalation path.
The operational question comes next: How quickly can those decisions become working controls?
If every meaningful change requires a development project, vendor customization, or a long queue for scarce technical resources, the institution accumulates a gap between the AML program it has designed and the AML program it is actually running.
Over time, that gap becomes risk.
RegTechONE turns Compliance decisions into operational change
This is one of the problems AML Partners designed RegTechONE to solve.
RegTechONE brings customer lifecycle management, risk management, compliance workflows, investigations, and governance into a configurable platform rather than treating them as a collection of disconnected processes.
That changes what happens after an institution identifies a risk.
Authorized users can configure workflows and operational processes without coding. Customer and risk information can travel with the relationship through ongoing due diligence and review. Compliance teams can orchestrate tasks, approvals, escalations, and investigations around defined risk requirements. Authorized users can implement change within a governed environment that preserves oversight and accountability.
Increasingly, AI and specialized agents can also perform defined tasks within these workflows, helping institutions take advantage of new capabilities without separating AI from the processes, controls, and governance surrounding the work.
The goal isn’t simply automation. It is alignment: keeping the institution’s risk understanding, compliance decisions, and operational execution connected as conditions change.
Technology cannot determine whether leadership has correctly assessed its risks. It cannot substitute for sufficient expertise, staffing, testing, or governance. But technology architecture can determine how difficult it is to turn a sound compliance decision into operational reality.
The better question: Does your AML operation still match your business?
The American Express enforcement action leaves financial institutions with a more useful question than whether their AML technology is functioning as designed.
Does the AML operation still match your business?
That question reaches beyond any individual AML control. It asks whether today’s customers, products, risks, and regulatory requirements are actually reflected in the controls operating across the institution. And it leads to another question:
When the answer changes, how hard is it to change the system?
For institutions operating complex businesses in a rapidly changing risk environment, adaptability is no longer simply a desirable software characteristic. It is part of the compliance operating model.
See what adaptable AML operations look like
AML Partners offers a free Proof of Concept for financial institutions evaluating RegTechONE.
Rather than relying on a generic product demonstration, bring your own requirements, workflows, and compliance challenges. See how RegTechONE can configure and orchestrate them in a governed environment—and how quickly the platform can adapt when those requirements change.
