American Express's $350 million penalty comes to 2.7 cents per dollar of suspicious activity it under-reported

The penalty is small beside the activity it covers. At $350 million ^[1] against about $13 billion ^[2], it comes to 2.7 cents per dollar ^[16]. The order runs from June 2014 to May 2025 ^[12], so the under-reported flow averages roughly $1.2 billion a year ^[17]. Both sources call the $13 billion suspicious or suspected activity, so the figure measures what went unreported. The market's response was small too. Shares slipped 0.3% in premarket trading, on a stock already down more than 16% since the start of the year ^[13]. The consent orders place no limit on the company's assets ^[8].

The allocation finding is the one that applies to other card issuers with bank charters. The OCC said the company concentrated on risks linked to its relatively narrow deposit products and gave insufficient attention to its much larger credit card business ^[3]. Neither report gives headcount or budget for either side, so the size of the staffing gap cannot be computed from what has been published.

American Express accepted the OCC's orders without admitting or denying the findings ^[6]. Its public account stresses what it did report. "We also investigated transactions that we identified being processed over our network by individuals misusing our products for the purchases of goods and services," the company said. It also "reported that information to law enforcement, and took other appropriate action." ^[15] Comptroller of the Currency Jonathan Gould said the lapses stopped the bank from passing critical information to law enforcement ^[10]. The two statements can both hold. The company's statement is about transactions it identified. The OCC's finding is about activity it failed to identify, evaluate and sufficiently report ^[2]. The cause was systemic shortcomings in transaction monitoring, customer identification and internal controls, and they kept the full extent of suspicious behaviour from reaching law enforcement ^[11].

We think the order sets a sizing test for any card issuer that holds a bank charter, on the evidence of a single case. The Paypers makes the same argument. It writes that for issuers that also run deposit-taking operations, the case illustrates the expectation that monitoring, reporting and customer due diligence be proportionate to the risks across all business lines, including large card portfolios ^[18]. The counter-thesis is that this is an Amex problem. The OCC called the failings systemic ^[11], and a failure that broad says more about one bank's controls than about how regulators will treat its peers. We would call our view wrong if the next AML orders against card issuers cite other failings and none repeats the mismatch between a small deposit book and a large card book.