The Office of the Comptroller of the Currency (OCC) and the U.S. Federal Reserve Board (FRB) issued a cease-and-desist order against American Express National Bank on October 8, assessing a $350 million civil monetary penalty for BSA/AML compliance program deficiencies. The core issue: the bank failed to establish and maintain a program "reasonably designed to assure and monitor compliance with the BSA and its implementing regulations."
This isn't just another enforcement headline. It's a clear signal about what regulators view as fundamental program failures, offering lessons for every BSA officer evaluating their own framework.
Key Insights from the Enforcement Action
The OCC's language is precise. The order doesn't cite isolated control failures or missed alerts. Instead, it identifies systemic deficiencies in program design. When regulators say your program isn't "reasonably designed," they're indicating that the architecture itself is flawed, not just the execution.
This is significant because the Bank Secrecy Act requires you to establish and maintain a compliance program "reasonably designed" to ensure and monitor compliance. That phrase in 31 CFR § 1020.210 for banks isn't decorative. It sets the standard: your program must be capable of achieving its purpose. If your framework can't reliably identify, escalate, and report suspicious activity, you've failed the design test before filing a single Suspicious Activity Report.
The dual-agency action compounds the significance. When both the OCC and the FRB coordinate enforcement, it signals that the deficiencies crossed business lines and touched multiple regulatory touchpoints. For institutions with both national bank and bank holding company structures, this creates a blueprint for how regulators will approach systemic compliance failures.
Key Findings and Their Implications
Program design failures carry the highest regulatory cost. The $350 million penalty against American Express reflects the seriousness regulators assign to foundational program defects. Compare this to penalties for isolated transaction monitoring or Customer Due Diligence gaps. When the program architecture itself is deficient, the penalty scale shifts.
"Reasonably designed" is a testable standard. Your program must demonstrate it can achieve BSA compliance outcomes. This means documented policies, adequate staffing models, functioning technology, clear escalation paths, and governance structures that ensure board and senior management oversight. If you can't show how your program design connects to compliance outcomes, you're exposed.
Multi-agency coordination is the new enforcement norm. The OCC and FRB acted together, which means your program must satisfy multiple regulatory perspectives simultaneously. If you're a state-chartered bank with federal oversight, or if you operate across regulatory jurisdictions, your program design must account for overlapping expectations.
Cease-and-desist orders require structural remediation. The OCC didn't just assess a penalty. The cease-and-desist order likely mandates specific program enhancements, independent testing, and ongoing regulatory reporting. These orders typically require board resolutions, action plans with deadlines, and third-party validation. The compliance cost extends well beyond the monetary penalty.
Steps to Strengthen Your Program
You need to audit your program against the "reasonably designed" standard now. Start with your BSA/AML compliance program documentation. Does it describe how your framework achieves compliance outcomes, or does it list controls without connecting them to risk mitigation?
Your board and senior management must demonstrate active oversight. Regulators expect documented evidence that leadership understands BSA/AML risks, receives meaningful reporting, and makes informed decisions about resource allocation. If your board materials consist of high-level summaries without actionable risk intelligence, you're replicating a known deficiency pattern.
Your independent testing must evaluate program design, not just control performance. Many institutions test whether controls operate as documented but never assess whether the documented design is adequate. Your testing scope should include whether your transaction monitoring rules cover relevant typologies, whether your Customer Due Diligence procedures identify beneficial ownership effectively, and whether your Suspicious Activity Report decision-making process functions consistently.
Action Items by Priority
Immediate: Commission a program design assessment. Engage independent testing or external counsel to evaluate whether your BSA/AML compliance program meets the "reasonably designed" standard. Don't wait for your next exam cycle. The assessment should cover governance, policies, procedures, staffing, technology, and training. Document findings and create a remediation plan with assigned owners and deadlines.
Within 30 days: Review board and senior management reporting. Evaluate what your board receives about BSA/AML compliance. Does the reporting include risk assessments, key performance indicators, suspicious activity trends, and resource adequacy analysis? If your board materials wouldn't enable an informed compliance decision, redesign them. Include specific metrics: Suspicious Activity Report volumes by typology, alert disposition rates, Customer Due Diligence refresh completion rates, and staffing levels against industry benchmarks.
Within 60 days: Validate your transaction monitoring rules. Test whether your Transaction Monitoring Rules detect the suspicious activity typologies relevant to your customer base and product mix. This isn't about tuning thresholds. It's about confirming your rules cover structuring, layering, rapid movement of funds, and other patterns consistent with money laundering. If you've relied on vendor default rules without customization, you're carrying design risk.
Within 90 days: Assess your independent testing scope. Review your last three years of BSA/AML testing reports. Did they evaluate program design or just control execution? Expand your testing scope to include whether your framework can achieve compliance outcomes. Require your testing function to assess program adequacy, not just policy adherence.
Ongoing: Establish program design governance. Create a process for reviewing program adequacy at least annually. This should include risk assessment updates, regulatory change analysis, and resource planning. Assign clear ownership to a senior compliance officer who reports directly to your board's risk or audit committee.
