What happened
This month, the OCC hit two national banks with $1.1 billion ($750 million plus $350 million) in civil money penalties over Bank Secrecy Act and anti-money laundering compliance. On October 8, it announced a cease-and-desist order and a $350 million penalty against American Express National Bank. On October 13, it announced a $750 million penalty against Bank of America, N.A., which the OCC says is the largest penalty in its history. These order documents were published on October 22, as part of the OCC’s monthly enforcement release.
On paper, the two banks have little in common. One is a card issuer with a narrow deposit business while the other is the second largest bank in the country. However, the OCC's findings echo each other. In both cases the bank's program for spotting and reporting suspicious activity did not match the actual risk in its business. Suspicious activity reports (SARs) went out late or not at all, and the people and systems responsible for catching problems were not up to the job. This was not about a rogue product or a bad actor. The OCC’s findings focused on core BSA controls, from transaction monitoring to staffing and training. Bank-fintech partnerships depend on those same controls.
Bank of America: unfinished fixes
Bank of America's main problem was not fixing what the OCC had already told it to fix. The bank has been under a cease-and-desist order since December 2024 that required it to repair its BSA/AML program. According to the OCC, the program still, almost two years later, has what the Comptroller called "widespread breakdowns in internal controls."
The OCC’s findings against Bank of America:
- The bank's transaction monitoring system was deficient, so it failed to properly monitor trillions of dollars in transactions. Activity the system does not flag usually is not investigated, so no SAR is filed.
- The bank filed large numbers of late SARs involving billions of dollars. Many of those late SARs had signs of money laundering. The OCC says the bank knew for years that it was failing to escalate potentially suspicious activity to investigators and did not correct it.
- The BSA Officer and staff lacked sufficient skills and expertise. Key personnel did not get appropriate training, which led to inaccurate and late SARs. The bank’s BSA audit function also missed long-standing problems that examiners later found.
- Even after the 2024 order, the bank did not finish many of the steps needed to build an effective program. More than a year after the order, it still was not escalating suspicious activity for review. A systemic gap in monitoring let potential trade-based money laundering transactions through.
- The October 22 release adds one more finding: the bank sent wires with inaccurate transmittor name information, that is, the sender information the “travel rule” requires to accompany a wire.
The OCC acted in coordination with FinCEN, which imposed a $1.2 billion penalty the same day and credited the OCC's $750 million against it, leaving $450 million payable under the FinCEN order. The penalty is for violations of the BSA and its implementing regulations, including 12 CFR 21.21, which requires national banks to maintain a BSA compliance program, and 12 CFR 21.11, which requires them to file SARs.
American Express: program aimed at the wrong risks
The American Express case is a different lesson. Its problem was not execution so much as design: the program was built around the wrong risks.
According to the OCC, the bank's risk assessment focused on its relatively small demand deposit account business and paid too little attention to its dominant credit and charge card products. In other words, the bank looked hardest where its risk was lowest. The OCC says the result was that the bank failed to timely identify, evaluate and sufficiently report approximately $13 billion of suspected trade-based money laundering activity over the past decade.
The OCC also found that the program did not have adequate resources: staff lacked sufficient expertise, there were systemic internal control gaps, with weak independent testing and insufficient BSA/AML training for employees and directors. The bank's customer due diligence (CDD) processes and customer identification program (CIP) procedures contributed to the monitoring and reporting failures. Without knowing who its customers are and how they normally transact, a bank cannot tell when activity is unusual.
The OCC's action is paired with a cease-and-desist order from the Federal Reserve against American Express Company and its travel services subsidiary.
Why the OCC treats BSA gaps as serious
Congress wrote the BSA to do several things: require records and reports that are highly useful in criminal, tax and regulatory investigations and in counterterrorism intelligence, prevent money laundering and terrorist financing through risk-based compliance programs, help track money tied to crime or terrorism, and protect the U.S. financial system and national security (31 U.S.C. § 5311). In practice, that means banks generate the information law enforcement uses to follow money. A SAR filed months late, or never, is a tip investigators did not get when it may have mattered. A wire that goes out with the wrong sender’s name could be a lead that goes cold. That is why the Comptroller framed both actions in terms of national and economic security rather than paperwork.
The commonalities between these two cases highlight where examiners are likely to look next:
- Know your customer. Both banks had gaps in CIP and CDD or in the risk assessments building from them. Monitoring only works if the bank understands who it is banking and what normal looks like for them.
- File SARs on time. Both banks filed late. Bank of America did not escalate suspicious activity for review more than a year after agreeing to fix it.
- Get the data right. Bank of America sent wires with inaccurate transmittor name information. Clean, complete originator data makes a transaction traceable.
The Comptroller's closing line in the Bank of America release speaks to every bank: "The OCC expects all banks to have an effective BSA/AML compliance program. Those that do not can expect swift and significant action from the OCC."
If you're a bank
The Bank of America case is a warning about pace. The OCC was clearly more upset about what did not get fixed after the 2024 order than about the original problems. If you are under a consent order, or have open BSA findings from a previous exam, address them now, ahead of the next milestone date.
The American Express case warns of fit. Pull your BSA/AML risk assessment and ask whether it actually reflects where your volume and your risk are today. If you have added fintech partners, card programs or new payment rails since it was last refreshed, the risk assessment may no longer fit your business. Expect examiners to look through you to your partners. Every fintech program you sponsor is part of your BSA program, and your CIP, CDD, monitoring and SAR obligations persist even when a partner does the onboarding.
If you're a fintech with a bank partner
Your bank partner just watched two large institutions pay $1.1 billion for problems that live inside bank partnerships every day: who the customer is, whether activity gets flagged and reported on time, and whether the data on each transaction is accurate. Expect the bank to tighten these in your program agreement at your next renewal, and do not be surprised if the asks start sooner. Expect more detailed CIP and CDD requirements, firm deadlines for referring suspicious activity to the bank, and new requirements around originator data on wires and other payments. The bank may not wait for renewal. Your existing agreement likely already gives it broad rights to change its policies and program requirements for a wide range of reasons, including safety and soundness concerns or regulatory requirements, to request records, documents and other information from you, and to audit your program. Expect the bank to start using rights it has never exercised, and to ask for evidence rather than attestations.
Your sponsor bank will take these findings seriously, and it will expect you to do the same. Pull your program agreement, find the compliance covenants, and map them to the three areas above. Identify what you already do, what you can document and where the gaps are, before the bank asks.
Need help reviewing your program agreement, preparing for your bank’s questions or negotiating your next renewal? We’re happy to talk.
Sources: OCC News Releases 2026-87 (Oct. 8, 2026), 2026-89 (Oct. 13, 2026) and 2026-93 (Oct. 22, 2026); FinCEN Consent Order No. 2026-03 (Oct. 13, 2026); 31 U.S.C. § 5311. This post is general information, not legal advice.
- The OCC imposed $1.1 billion in penalties on Bank of America and American Express for failures in their Bank Secrecy Act and anti-money laundering compliance programs.
- Bank of America failed to fix widespread BSA/AML breakdowns identified in a 2024 cease-and-desist order, including deficient transaction monitoring and late suspicious activity reports.
- American Express built its BSA program around the wrong risks, focusing on its small deposit business instead of its dominant card products, failing to timely identify and report approximately $13 billion in suspected trade-based money laundering.
- Both enforcement actions highlight critical gaps in customer identification, transaction monitoring, timely SAR filing, and data accuracy that examiners will scrutinize at all banks.
- Banks with fintech partnerships face heightened scrutiny because every sponsored program is part of the bank's BSA obligations, making partner compliance essential.
- Fintechs should expect their bank sponsors to tighten program requirements at renewal and possibly sooner, exercising audit rights and demanding evidence rather than attestations of compliance.
| Record Penalties | The OCC says that the $750 million Bank of America penalty is the largest in OCC history. |
|---|---|
| Bank of America's Failures | Failed to fix problems from a 2024 order: deficient monitoring of trillions in transactions, late SARs, inadequate staff training, and inaccurate wire data. |
| American Express's Misstep | Built its BSA program around low-risk deposits instead of high-risk card products, failing to timely identify and report approximately $13 billion in suspected trade-based money laundering over a decade. |
| Common Compliance Gaps | Both banks had weaknesses in customer identification, transaction monitoring, timely SAR filing, and data accuracy that enabled suspected money laundering to go undetected. |
| Implications for Banks | Banks must fix BSA findings promptly and ensure risk assessments match actual business activities, especially when adding fintech partnerships or new payment products. |
| Fintech Partner Expectations | Banks will demand tighter CIP/CDD processes, faster suspicious activity referrals, and better data quality from fintech partners, exercising audit rights more aggressively. |
| Regulatory Message | The OCC framed these actions as national security issues, promising swift and significant enforcement against any bank without an effective BSA/AML program. |
Why did the OCC impose such large penalties on these two banks?
The OCC found widespread failures in core BSA/AML controls at both institutions. Bank of America failed to fix problems identified in a 2024 order, while American Express built its program around the wrong risks, failing to timely identify and report approximately $13 billion in suspected money laundering. The Comptroller framed these as national and economic security failures rather than mere paperwork violations.
What were the main problems the OCC found at Bank of America?
The bank's transaction monitoring system failed to properly monitor trillions of dollars in transactions, it filed late SARs involving billions of dollars with signs of money laundering, key personnel lacked appropriate training and expertise, and it failed to complete required fixes more than a year after a 2024 cease-and-desist order.
How did American Express's BSA program fail despite being a major financial institution?
American Express focused its BSA risk assessment on its small deposit business rather than its dominant credit and charge card products. This mismatch meant the bank looked hardest where its risk was lowest, failing to identify and report approximately $13 billion in suspected trade-based money laundering over a decade.
What should fintechs expect from their bank partners after these enforcement actions?
Fintechs should expect banks to tighten program requirements at renewal or potentially sooner. This includes more detailed customer identification and due diligence requirements, firm deadlines for referring suspicious activity, stricter data accuracy standards for payments, and use of audit rights they have not exercised before, demanding documented evidence rather than simple attestations of compliance.
What are the key areas banks and fintechs should focus on to avoid similar penalties?
Focus on three critical areas: knowing your customer through robust CIP and CDD processes, filing SARs on time without delays in escalation or investigation, and ensuring complete and accurate data in all transactions, especially originator information on wires and payments.