US Banking Regulator Fines American Express $350 Million and Bank of America $750 Million Over AML Failures
The OCC's October enforcement package pairs cease-and-desist orders with civil money penalties for failures in suspicious-activity reporting, customer due diligence and wire-transfer information accuracy.
The US Office of the Comptroller of the Currency announced enforcement actions on October 22, news release 2026-93, including a cease-and-desist order and a $350 million civil money penalty against American Express National Bank for deficiencies in its Bank Secrecy Act compliance program — specifically late suspicious-activity report filings and failures in customer due diligence and customer identification procedures. Bank of America received a $750 million penalty for processing wire transfers with inaccurate or missing transmittor information. The package also includes prohibition orders in two small internal embezzlement cases.
The two penalties are among the largest AML actions of the year, and both trace back to process and document failures rather than exotic exploits — late filings, incomplete customer records, inaccurate payment data. That puts the remediation burden squarely on operational compliance: timely data capture, document verification and reporting automation. While these are US actions with no direct Indonesian equivalent announced this week, Indonesian banks face directionally similar requirements under APU-PPT regulations, where mid-tier institutions with small compliance teams carry the heaviest document workload.