OCCBSA / AMLOctober 8, 2026

OCC Hits American Express with $350M Penalty for BSA/AML Failures

The OCC issued a cease-and-desist order and a $350 million civil money penalty against American Express National Bank for deficiencies in its BSA/AML compliance program. This is a high-profile enforcement action signaling that regulators are actively scrutinizing AML program adequacy at large financial institutions. Compliance officers should treat this as a benchmark for the level of rigor expected in BSA/AML controls.

What to do

Review your institution's BSA/AML program against OCC expectations — including transaction monitoring, suspicious activity reporting, and governance — and document any gaps identified for remediation.

Who this affects

Bank / Credit UnionFintech / NeobankMoney Services BusinessPayments Company

Does this affect your program?

Pick your institution type for an instant read on whether you're in scope — then see exactly which sections of your own policies this changes.

Source

Read the official publication

This radar entry is educational and does not constitute legal advice. Summaries are AI-assisted and grounded in the linked official source; always verify against the primary source and consult qualified legal counsel for jurisdiction-specific guidance.

Related developments

OCC

OCC Hits Bank of America with Record $750M BSA/AML Penalty

The OCC levied a historic $750 million civil money penalty against Bank of America for violations of the Bank Secrecy Act and its implementing regulations, the largest such penalty in OCC history. This action signals that regulators are prepared to impose landmark fines for systemic BSA/AML compliance failures, sending a clear message to all regulated institutions — including banks that partner with or provide services to crypto and fintech firms — that AML program deficiencies will be met with severe consequences.

OCC

OCC Comptroller Highlights Community Bank Efforts to Fight Financial Fraud

Comptroller Gould convened community bankers in Minnesota to discuss strategies for combating financial fraud, signaling continued OCC focus on fraud as a supervisory priority. While directed at community banks, the discussion reflects broader regulatory attention to fraud controls that fintech partners and bank-affiliated crypto firms should also take note of.

FinCEN

FinCEN Withdraws Proposed Rule Targeting CVC Mixing as AML Risk

FinCEN is withdrawing its Section 311 finding and proposed rulemaking that would have classified international convertible virtual currency (CVC) mixing as a class of transactions of primary money laundering concern, along with associated enhanced recordkeeping and reporting requirements. This means the specific regulatory burden proposed for CVC mixing transactions will not move forward. Compliance teams should note that while the formal rule is withdrawn, mixing activity may still carry AML risk warranting internal controls.

OCC

OCC Updates Cybersecurity Examination Work Program for Banks

The OCC has revised its Cybersecurity Supervision Work Program (CSW), which examiners use to assess cybersecurity risk at national banks and federal savings associations, updating its structure and references to reflect the evolving threat landscape and adoption of standardized frameworks. For compliance and risk officers at banks, neobanks, and trust companies under OCC supervision, this signals updated examiner expectations around cybersecurity controls and preparedness. Crypto custodians and fintechs with bank charters or partnerships should also take note, as vendor and third-party cybersecurity risk is often assessed through this lens.

Stay ahead of every rule change

PliOS monitors FinCEN, OCC, OFAC, the SEC and CFTC and tells you which of your policies each new rule affects — with the edit already drafted. Start free.

Run My Free Assessment