$13 billion, eleven years, one blind spot.

What happened, in one paragraph

American Express National Bank did not maintain a BSA/AML compliance program reasonably designed to catch what its own business most invited.

The Office of the Comptroller of the Currency found that the Bank’s anti-money-laundering program carried systemic internal-control gaps and did not meet the standard set by 12 CFR 21.21 and the customer-due-diligence rule at 31 CFR 1020.210(a).¹ At the center of the order is a single, quiet design choice: the Bank’s risk assessment was not appropriately tailored. It gave real weight to the comparatively narrow demand-deposit products and far less to the credit and charge card products that actually dominate the Bank. From roughly June 2014 to May 2025, about $13 billion in suspected trade-based money laundering ran through that under-watched product, in the form of suspicious card charges and the repayments behind them, in certain instances through accounts tied to Bank insiders. The Bank reported some of it periodically, but lacked the controls to identify and report the full scope in time. The OCC imposed a $350 million civil money penalty, which the Bank accepted without admitting or denying the findings. Everything else in the order, the weak customer due diligence, the identity-verification gaps, the missed and incomplete suspicious-activity reports, the ineffective independent testing, the thin training and staffing, follows from the same root: a program pointed at the wrong door.

The number that frames it

Thirteen billion dollars is the figure to hold onto, but the more revealing number is eleven. Not eleven days, or eleven months. Eleven years of suspected laundering flowing through a product that the Bank’s own risk methodology treated as a secondary concern.

A single large laundering event is a detection failure. You can imagine the alert that did not fire, the analyst who was out that week, the threshold set a notch too high. Eleven years is something else. It is a coverage failure, structural and self-renewing. The controls were doing what they were designed to do. They were simply not designed to look where the money was. Each annual cycle re-ratified the same scope, each review confirmed the program against the same map, and the map was wrong in the one place it most mattered.

That is why this case belongs in a series about machine speed and human governance alongside a trading blowup and a market-access control failure. The common thread is not the asset class. It is that an automated system did precisely what it was told, while the thing that told it what to do, the scope, the risk assessment, the calibration, was set once, by people, under pressure, and then trusted for years without challenge.

A card bank, and the door it watched

American Express National Bank is an insured national bank and part of the American Express group. Unlike a typical retail bank whose risk sits in cash, wires, and correspondent relationships, its center of gravity is the card: credit and charge products, the merchants that accept them, and the payments that settle them. Demand-deposit accounts exist, but they are a modest line of business next to the card engine.

A money-laundering risk assessment is supposed to be the document that reflects this. It inventories products, customers, channels, geographies, and transaction types, scores the inherent risk in each, weighs the controls against it, and records where the residual risk lands. Done well, it is the instrument that aims the entire program: what gets monitored, how customers are rated, where investigators spend their hours, what the independent testers scope their work around.

The OCC’s finding is that the Bank’s assessment did not reflect its own shape. It weighted the deposit side, where a conventional AML playbook is comfortable, and underweighted the card and charge side, where the Bank actually lives.¹ The result was a program well tuned to a bank American Express is not, and poorly tuned to the one it is.

Aimed at the wrong product

Strip the order down and one sentence carries it: the risk assessment was not appropriately tailored to the Bank’s business, and in particular to its dominant credit and charge card activity. Everything the examiners found radiates out from that.

This matters because of what a risk assessment does mechanically. It is not a compliance artifact that sits in a binder. It is the configuration file for the whole program. Transaction monitoring scenarios are built to cover the risks the assessment names. Customer risk ratings weight the factors the assessment emphasizes. Investigators are staffed against the volumes the assessment predicts. Independent testers scope their sampling to the risks the assessment flags. Get the assessment wrong at the top, and you do not get one broken control. You get a program that is coherently, internally consistently wrong, every layer faithfully serving a picture of the bank that does not match the bank.

There is a seductive comfort in a program that passes its own tests. The monitoring fired and cleared its alerts. The testing sampled and found the sampled areas sound. The ratings were applied as written. None of it was lying. It was all measuring a model of the institution in which the card business was a minor risk. The $13 billion did not slip past the controls. It flowed through a region the controls were never told was a frontier.

The regulatory hooks are specific. A reasonably designed program is required under 12 CFR 21.21 and, for the risk-based CDD element, 31 CFR 1020.210(a).⁵ “Reasonably designed” is the phrase that does the work. The OCC is not alleging the Bank ignored AML. It is finding that the design, starting with scope, did not reasonably fit the risk the Bank actually carried.

How the money moved

The order describes the suspected activity as trade-based money laundering: roughly $13 billion running through the card products as a combination of suspicious card charges and the repayments associated with them, from about June 2014 to about May 2025.¹

Trade-based laundering is the hardest of the classic typologies to see, because every individual piece looks like commerce. A charge is a purchase. A repayment is a customer paying a bill. Nothing in a single transaction announces itself. The signal lives in the pattern: charges and repayments that, taken together and across linked accounts, do not match any plausible real economy of goods and services. Seeing that requires monitoring built for cards, tuned to merchant behavior, spend velocity, repayment sources, and the relationships among accounts. It requires, in other words, exactly the coverage the risk assessment had deprioritized.

One detail in the order sharpens it. In certain instances, the activity ran through accounts associated with Bank insiders.¹ Insider-adjacent flows are precisely where a program needs its escalation paths and its independent challenge to be strongest, because the ordinary first-line instinct to defer does the most damage there. A program already thin on tailored monitoring and independent testing is least equipped to handle the one category that most demands both.

And the reporting tells the story of the blind spot in miniature: the Bank did file suspicious-activity reports periodically over the period. What it lacked were the controls to timely identify and report the full scope.¹ It was not blind. It was under-focused, seeing fragments, reporting fragments, and never assembling the whole because nothing in the program was built to assemble it.

The stack that failed, layer by layer

AML is designed as defense in depth. No single control is meant to carry the load; each is a net below the last. The order’s most sobering quality is that it describes a failure at essentially every layer, which is the signature of a root cause upstream of all of them rather than a run of bad luck.

Read top to bottom, it is not eight independent failures. It is one failure, inherited eight times. A mis-scoped assessment yields monitoring that does not cover the real risk. Weak CIP and CDD starve that monitoring of the customer context it would need to work anyway. Under-resourced investigation turns what alerts do fire into incomplete reports. And the two functions whose entire job is to catch all of this from the outside, independent testing and internal audit, were themselves scoped against the same wrong picture, so they certified the program against the risks it was built for rather than the risks it carried.

Not knowing the customer: CIP and CDD

Two layers deserve their own treatment, because they are where monitoring gets its raw material.

Customer identification

The order describes substantial gaps in the customer identification program: identity information was collected and verified inconsistently, such that the Bank could not reliably form the reasonable belief that it knew the true identity of its customers that 31 CFR 1020.220(a)(2) requires.⁵ CIP is the foundation. If you are not certain who the customer is, every later control is building on sand. A monitoring alert is only as actionable as the identity behind the account.

Ongoing due diligence

On CDD, the finding is that the Bank lacked an effective framework for understanding the nature and purpose of customer relationships and for maintaining that understanding over time, as 31 CFR 1020.210(a)(2)(v) contemplates.⁵ This is the control that lets a bank say what “normal” looks like for a given customer, and therefore what “abnormal” is. Without a usable expected-activity baseline, transaction monitoring is reduced to generic thresholds, and customer risk ratings cannot be accurate. The order draws exactly that line: ineffective CDD impaired the risk ratings, and impaired ratings degrade the monitoring that depends on them.

The through-line from this section to the AI discussion later is direct. The most sophisticated detection model in the world produces noise if its inputs, who the customer is and what they are expected to do, are missing or wrong. Data quality is not a prerequisite to the model. It is part of the model.

Periodic reports, never the full scope

It would be easy to read “$13 billion undetected” as total blindness. The order is more precise, and the precision is the lesson. The Bank filed suspicious-activity reports from time to time across the period. The deficiency was that it could not timely identify and report the full scope of the suspected activity, and that SARs were in instances untimely, missed, or incomplete, amounting to a pattern the OCC addresses under 12 CFR 21.11.⁵

Partial sight is its own hazard, arguably worse than none, because it generates the paperwork of compliance without the substance. A program that files periodically looks, from a distance and on a metrics dashboard, like a program that is working. Alerts are being generated, cases are being worked, reports are going out the door. The number that mattered, the share of the real activity being captured, was not on any dashboard, because the program was not scoped to know what the denominator was.

This is the quiet danger of measuring activity instead of outcomes. Counts of alerts cleared and SARs filed can all trend healthily while coverage of the actual risk sits near zero in the one product that matters. Volume is not the same as reach.

The watchers who did not watch

Every regulated firm runs assurance functions whose purpose is to catch exactly this kind of drift: independent testing and internal audit. In this case, both were found wanting, and the way they failed is instructive.

Independent testing was found not appropriately scoped or effective relative to the Bank’s BSA/AML risk profile.¹ Internal audit did not effectively monitor and test compliance. The temptation is to read this as two more lazy controls. The deeper reading is that assurance functions usually scope their own work from the same risk assessment that scopes the first line. If the enterprise view says the card business is a secondary risk, the testers sample the deposit business thoroughly and the card business lightly, and they do so believing they are being risk-based. They were. They were just risk-based against the wrong risk.

This is the single most portable lesson in the order for anyone governing an automated system. Your validation is only independent if it can question the scope, not just the execution. A model-validation function that tests whether the model does what it was specified to do, without asking whether the specification covers the real risk, will pass a dangerous model with full marks. True independence means the authority, and the mandate, to say “you are testing the wrong thing.”

Staffing, resourcing, and the quiet cause

Underneath the technical findings sits a plainer one. The order states that the Bank historically did not support its BSA/AML function with appropriate resources, including staffing with skills and expertise commensurate with the program’s demands, and that risk-based training for employees and directors was insufficient.¹

Resourcing is the cause that hides behind every other cause. A risk assessment is not re-scoped to the real business because no one has the capacity to do the deeper work. Monitoring scenarios are not rebuilt for the card product because the team is absorbing alert volume from the scenarios that already exist. Investigations are closed thin because the queue is long and the clock is running. SARs are late or incomplete for the same reason. Independent testing is shallow because it is staffed to confirm, not to challenge. None of this requires bad intent. It is what an under-resourced function does under load: it keeps the lights on and defers the hard, structural work indefinitely.

Training is the same story at the level of the individual. A front-line employee who has not been trained on the red flags specific to their product cannot escalate what they do not recognize. A director who has not been given a clear, current picture of the program’s risk profile and its known gaps cannot provide informed challenge. The order names both, employees and directors, which is a reminder that governance failures run all the way up.

It is worth saying directly, because it is the version of this story that recurs across AML enforcement: the cheapest line item to defer is the one whose absence is invisible until a regulator counts eleven years of it.

Why it ran eleven years

Put the findings in sequence and the duration stops being a mystery. Each link made the next one inevitable, and the loop re-ratified itself every annual cycle.

There is no villain at any node. That is the point. Each step is a reasonable local decision given the step before it. The failure is global, and only visible from above the whole chain, which is precisely the vantage point that risk assessment, independent testing, and board oversight are supposed to supply, and the three places the order says the Bank fell short.

The AI cross-comparison

AML monitoring was one of the first large-scale machine-decision systems in finance, long before “AI governance” was a phrase. A modern transaction-monitoring stack is a pipeline of models: risk-scoring, anomaly detection, alert triage, increasingly machine-learning classifiers that decide what a human ever sees. Which makes this order a remarkably clean parable for the governance of any AI system, because the Bank’s failure was not a failure of the model. It was a failure of everything around the model that humans own.

The sharpest line from this case to AI governance is the second one down, and the one about independent testing. Organizations racing to deploy AI are investing heavily in model validation, which is good. But almost all of that effort goes to checking whether the model does what it was specified to do. Almost none goes to the harder question the American Express order is actually about: was the specification right? Did the people who scoped the system understand the business well enough to point it at the real risk? An eleven-year, thirteen-billion-dollar blind spot is what it looks like when the answer is no and nobody with the authority to say so was asked.

This is not an outlier

The specific blind spot is new; the shape is not. The largest AML resolutions of the last decade share a family resemblance with this one. A program that was under-scoped or under-resourced, a monitoring footprint that did not cover the real activity, and a duration measured in years before anyone outside the firm counted the cost.

Set against these, the American Express order is in one way more unsettling, not less. Binance had no real program; TD Bank left most of its volume unmonitored. American Express had a program, staffed and running and passing its own tests, and it still ran an eleven-year blind spot. That is the version of this failure that any well-run, well-intentioned firm should fear most, because it does not announce itself as neglect. It looks like a working compliance function, right up until someone asks what it was actually covering.

What a card-weighted program looks like

The OCC order, and the control framework that maps to it, point to a short list of things a program of this kind should be able to demonstrate. None are exotic. The failure was never that these controls are unknown; it was that they were not aimed, resourced, or independently challenged.

• A risk assessment weighted to the real business. Card and charge products should carry risk coverage proportionate to their scale and complexity, scored on volume, velocity, cross-border exposure, third-party payments, and trade-related indicators, with documented residual risk and an independent challenge on the scope itself.
• Monitoring coverage you can inventory. You should be able to produce, on demand, a map of which product, channel, and transaction types are covered by which scenarios, and where the gaps are. Coverage is a claim; make it auditable.
• Typology-specific detection for the core product. Charge-and-repayment patterns, merchant anomalies, velocity and fragmentation across linked accounts: the detection has to be built for how the Bank’s own money actually moves, not inherited from a generic deposit-bank template.
• CIP and CDD treated as model inputs. Identity verification with a hard stop on activation, an expected-activity baseline per relationship, and event-driven refresh so that ratings and monitoring do not run on stale information.
• Independent testing with a mandate to question scope. Validation that can say “you are testing the wrong thing,” not just “the thing you tested works.” Coverage of the card-heavy risks, CDD, CIP, monitoring, SARs, training, staffing, and governance.
• Outcome metrics, not activity counts. Dashboards that estimate the share of real risk being captured, SAR timeliness and completeness, and alert-queue aging, rather than raw volumes that look healthy while reach is near zero.
• Resourcing as a control, not a cost center. Staffing and expertise sized to the program’s actual demands, with role-based training that is tested for application, and a board given a current, honest picture of the risk profile and its known gaps.

Coverage is a decision

The easy lesson from a $350 million AML penalty is “spend more on compliance.” It is also the wrong one. American Express National Bank had a compliance program. It had monitoring, testing, audit, and reporting. The order does not describe an absence. It describes a program faithfully covering the wrong thing for eleven years.

The real lesson is that coverage is a decision, and someone makes it. The risk assessment is where a firm decides what its automated controls will and will not watch. That decision is made by people, early, often under resource pressure, and then it is trusted, by the monitoring, by the testers, by the auditors, by the board, usually without anyone revisiting whether it was ever right. The most dangerous blind spots are not the ones you are fighting. They are the ones your program has quietly agreed not to look at, and then certified itself against, year after year.

That is why this case sits in a series about machine speed and human governance. A trading system that could not be stopped in time, a market-access control calibrated never to fire, and now a monitoring program aimed at the wrong door. Different decades, different asset classes, the same structural truth. The machine is rarely the problem. The problem is the human decision, upstream and invisible, about what the machine was ever asked to do, and whether anyone had the authority, the resources, and the mandate to say it was wrong.