When the Federal Reserve and the OCC fine a payments giant $350 million for AML/CFT Framework deficiencies, the message is clear: your enterprise-wide framework is only as strong as its weakest subsidiary. American Express's penalty stemmed from significant deficiencies in how its AML/CFT Framework was implemented at its national bank subsidiary. This failure pattern should trigger immediate self-assessment at any institution with multiple legal entities.
The Problem: Why Subsidiary Gaps Matter
Most financial institutions structure their AML/CFT Framework at the enterprise level, assuming implementation cascades uniformly to subsidiaries. It doesn't. National bank subsidiaries operate under dual regulatory oversight (OCC and Federal Reserve), face different customer risk profiles than parent entities, and often inherit legacy systems that don't integrate cleanly with enterprise platforms.
The $350 million penalty against American Express signals a shift in enforcement focus. Regulators aren't just checking whether you have policies; they're validating whether those policies actually function at the subsidiary level where customer relationships live and transactions clear.
What You Need Before Starting
Before you audit your subsidiary AML controls, gather these baseline artifacts:
Enterprise-level documentation:
- Your current enterprise AML/CFT Framework policy manual
- Board-approved risk assessment methodology
- Subsidiary governance structure and reporting lines
- Data flow diagrams showing how transaction data moves from subsidiaries to enterprise monitoring systems
Subsidiary-specific materials:
- Each subsidiary's banking charter or license
- Customer demographic breakdowns by subsidiary
- Transaction volume and typology reports for each entity
- Suspicious Activity Report filing history by subsidiary
- Most recent regulatory examination reports (OCC, state banking departments, Federal Reserve)
Technical environment:
- Core banking system documentation for each subsidiary
- Transaction Monitoring Rules configuration files
- Name Screening system integration architecture
- SAR case management workflow diagrams
If your subsidiaries operate separate core banking platforms or maintain customer data in isolated databases, flag this immediately. Data fragmentation is a common root cause of subsidiary compliance failures.
Step-by-Step Implementation
Step 1: Map Your Regulatory Exposure
Create a matrix with each subsidiary as a row and these columns: primary regulator, charter type, customer count, annual transaction volume, highest-risk product lines, and date of last regulatory exam. This reveals which subsidiaries carry the highest enforcement risk.
For national bank subsidiaries specifically, confirm you're meeting OCC Bulletin 2014-56 requirements for independent testing and Board-level AML oversight. The OCC expects national banks to maintain AML programs that function independently, even when owned by a larger financial institution.
Step 2: Audit Transaction Monitoring Coverage
Pull a sample of 50 transactions from each subsidiary and trace them through your enterprise monitoring system. Verify:
- The transaction appears in the monitoring queue within 24 hours
- Customer risk ratings from the subsidiary feed correctly into monitoring thresholds
- Geographic and product-specific risk factors from the subsidiary are captured
- Alerts generated at the subsidiary level route to analysts with appropriate context
If you discover transactions that never enter monitoring, or alerts that lack subsidiary-specific context, you've found your gap. Document every instance where subsidiary data doesn't flow cleanly to enterprise systems.
Step 3: Test Customer Due Diligence Handoffs
Select 25 customer files from each subsidiary and verify:
- Beneficial Owner Identification was completed per 31 CFR 1010.230 requirements
- Customer Risk Profiles contain subsidiary-specific occupation and transaction pattern data
- Periodic Review schedules align with enterprise policy (typically 12-36 months based on risk rating)
- Enhanced Due Diligence documentation exists for high-risk customers
Pay special attention to customers who bank across multiple subsidiaries. These relationships often fall through the cracks because no single entity owns the complete risk picture.
Step 4: Validate Suspicious Activity Report Authority and Workflow
Confirm each subsidiary has:
- Designated staff with BSA E-Filing System credentials
- Clear escalation paths to file Suspicious Activity Reports within the 30-day deadline (or 60 days if no suspect is identified)
- Access to the same SAR decisioning criteria used at the enterprise level
- A process to file Continuing Activity SARs when suspicious patterns persist
Interview compliance staff at each subsidiary. Ask them to walk through the last SAR they filed. If they describe different thresholds or approval chains than your enterprise policy specifies, you have a control gap.
Step 5: Review Independent Testing Scope
Pull your most recent independent testing report. Verify the testing firm:
- Physically visited each subsidiary location or conducted subsidiary-specific remote testing
- Sampled transactions originating from subsidiary systems, not just enterprise aggregates
- Interviewed subsidiary compliance staff separately from enterprise teams
- Tested subsidiary-specific controls like cash handling procedures or wire transfer approval workflows
If your independent testing treats all subsidiaries as a single control environment, you're not meeting regulatory expectations. The OCC and Federal Reserve expect subsidiary-level testing with separate findings and remediation tracking.
Validation: How to Verify It Works
Run these quarterly checks:
Data completeness test: Pull 100 random transactions from each subsidiary's core system. Verify all 100 appear in your enterprise monitoring platform within 24 hours with complete customer risk data attached.
Alert quality audit: Review 20 alerts generated from subsidiary transactions. Confirm analysts have access to subsidiary-specific context (branch location, relationship manager notes, local transaction patterns) when investigating.
SAR timeliness review: Track days-to-file for all Suspicious Activity Reports originating from subsidiaries. If subsidiary SARs consistently take longer to file than enterprise SARs, investigate why.
Regulatory exam preparation: Before each subsidiary's regulatory examination, conduct your own mock exam using the same sampling methodology regulators use. Surface deficiencies before examiners do.
Maintenance and Ongoing Tasks
Monthly: Review subsidiary transaction monitoring alert volumes. Sudden drops often indicate data feed failures, not improved compliance.
Quarterly: Update your subsidiary risk matrix with new customer counts, transaction volumes, and product mix changes. Adjust monitoring thresholds accordingly.
Annually: Refresh your enterprise risk assessment with subsidiary-specific threat scenarios. A national bank subsidiary faces different risks than a trust company subsidiary or a payments processing entity.
After any subsidiary system change: Revalidate data flows from subsidiary systems to enterprise monitoring platforms. Core banking upgrades and CRM migrations frequently break AML data feeds without triggering obvious errors.
The American Express enforcement action proves that enterprise-wide policies mean nothing if subsidiaries can't execute them. Your job isn't to write better policies; it's to verify those policies actually work where customers bank and transactions clear. Start with your national bank subsidiaries. That's where regulators are looking first.
