Amex Sees Both Sides of Every Transaction and Still Missed $13 Billion

If any company in US payments should catch trade-based money laundering on a credit card, it's American Express.

Amex runs a closed-loop network, so on its own branded cards it both issues the card and signs up the merchant. The cardholder's spending data and the merchant's acceptance data sit inside the same company. When someone pays an inflated invoice with an Amex corporate card and then repays the balance from a clean account, both ends of that transaction flow through one organization's monitoring systems.

The obvious explanation is negligence or understaffing, and both were present. But a staffing gap doesn't explain why an 11-year, $13 billion pattern went largely unreported at a company with a structural data advantage over every other card network.

If the company with the most complete transaction picture in US payments couldn't see the full scope of approximately $13 billion in suspected trade-based money laundering over 11 years, what does that tell you about transaction monitoring architecture?

The risk assessment pointed at the wrong product

Amex is one of the largest credit and charge card issuers in the United States by transaction volume, with roughly 87 million proprietary cards in circulation. Its worldwide billed business approached $1.7 trillion in 2025, while customer deposits stood at about $153 billion.

The OCC found that Amex's BSA/AML risk assessment "focused on the risks in the Bank's relatively narrow demand deposit account products and services and insufficiently on the risks in its more dominant credit and charge card products."

The risk assessment weighted a $153 billion deposit book over a card business that processed $1.7 trillion in a single year.

When your risk assessment points at deposits, everything downstream tends to follow it. Monitoring rules get tuned to deposit patterns, and investigators learn deposit typologies.

The card business, which moves roughly 11 times more money in a year than the deposit book holds, gets less scrutiny than its size warrants because the risk model says it's lower risk.

According to the consent order, what followed were systemic breakdowns in suspicious activity monitoring and reporting, along with late and incomplete SARs. Gaps in customer identification kept the bank from forming "a reasonable belief that it knew the true identity of each customer," and internal audit failed to catch any of it.

From June 2014 to May 2025, approximately $13 billion in suspected trade-based money laundering flowed through card charges and their repayments. The bank reported some of it, but in the OCC's words it "lacked the internal controls and monitoring capabilities to timely identify and report the full scope." Some of that activity involved accounts associated with bank insiders.

What trade-based laundering looks like on a card

Trade-based money laundering is one of the harder patterns to catch, even without a miscalibrated risk assessment. A merchant issues an inflated invoice for goods or services, the buyer pays it with a corporate card, and the payment looks legitimate because both the invoice and the merchant are real.

The inflated portion is the laundered money, hidden inside what appears to be normal commerce.

On a Visa or Mastercard transaction, detecting this requires correlating data across separate companies. The issuing bank sees the cardholder's spending and the acquiring bank sees the merchant's receipts, with the network carrying transaction metadata in between, so no single company sees both the cardholder's behavior and the merchant's.

Amex's three-party model eliminates that fragmentation. The same company that issued the card also onboarded the merchant. If a merchant consistently receives charges that are 3x the industry average for its category, and those charges come from a small cluster of cardholders who repay their balances from accounts with unusual funding patterns, the data to detect that pattern exists in one system.

The constraint is whether the monitoring architecture is configured to look, because the data already exists in one place.

Five days later, $1.21 billion

On October 13, five days after the Amex order, the Treasury Department announced penalties of more than $1.21 billion against Bank of America, combining FinCEN's $1.2 billion assessment, the OCC's $750 million civil money penalty (the largest in that agency's history, credited toward the FinCEN total), and an $11.6 million OFAC settlement over 475 apparent sanctions violations.

BofA admitted it willfully violated the Bank Secrecy Act. As Treasury described it, the bank's transaction monitoring program "failed to properly monitor trillions of dollars in transactions," and the SARs it eventually filed came so late that Treasury called them "of limited utility to law enforcement."

The bank had received a cease-and-desist order from the OCC in December 2024 requiring it to fix these problems. More than a year later, the OCC found it "still failed to escalate potentially suspicious activities to investigators for review."

Treasury also found that BofA "effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations."

In practice, the bank's internal monitoring wasn't surfacing suspicious activity on its own. Law enforcement inquiries and requests from other financial institutions were doing the work that the bank's own controls should have done, while the bank allowed suspicious activity to "accumulate uninvestigated."

Over $5 billion in suspicious transactions went unreported, and more than $1 billion of that involved priority risks including Chinese money laundering networks and illicit finance along the US southwest border.

Staffing doesn't explain an escalation failure

Both regulators pointed at resources. The OCC said Amex lacked "appropriate resources, including staffing with commensurate skills, expertise, and training," and Treasury said BofA "prioritized its revenues and minimized the impact on its required compliance resources."

Both findings are true, but they describe what went wrong in staffing without explaining why the monitoring system itself failed.

A transaction monitoring system has two jobs before a human gets involved. It has to flag the right activity, and it has to route what it flags to someone who will investigate.

BofA's record points at the second job. The OCC's finding that the bank still wasn't escalating suspicious activity to investigators, more than a year after its 2024 order, describes a routing failure.

More investigators can't help with activity that never reaches them. If the system doesn't escalate, a fully staffed team works through an incomplete queue while the suspicious activity sits elsewhere, and detection falls to whoever outside the bank notices first. Treasury's term for that was "material dependence on external referrals."

BofA said it "has invested billions of dollars in technology and assigned thousands of employees to combat financial crime," and that its remediation work is "well advanced." The OCC's escalation finding came more than a year after the remediation order.

The public documents don't say exactly where BofA's escalation broke, but one common route runs through alert triage. Vendor and industry estimates put AML false positive rates above 90%, so for every ten alerts an investigator opens, about nine turn out to be legitimate activity. Under that load, teams build auto-closure rules and risk-score cutoffs to keep queues manageable, and those rules are where suspicious activity can stop short of an investigator.

If your false positive rate is 95% and you generate 100,000 alerts per month, your investigators review 95,000 legitimate transactions to find 5,000 suspicious ones. Hiring more investigators treats the symptom, while reducing the false positive rate through better threshold calibration and risk segmentation treats the cause.

Amex's failure sat further upstream. A risk assessment centered on deposits shapes what the monitoring program is built to look for, and you can staff deposit-focused monitoring perfectly without catching laundering that runs through card charges.

What the consent orders actually require

Both orders mandate specific architectural fixes.

Amex must rebuild its risk assessment to cover "all pertinent data" across all product lines, with specific requirements for product-level risk analysis, geographic risk, customer type, and transaction type. The bank must implement ongoing customer due diligence that "ensures the Bank complies with all applicable CDD requirements." Independent testing must be "appropriate in scope and effective relative to the Bank's BSA/AML risk profile." The OCC reserved the right to review and approve each component.

BofA must hire a third party to conduct a lookback, reviewing past transactions to identify suspicious activity that went undetected and report it to FinCEN. The bank must also undergo an independent review of its suspicious activity monitoring and due diligence programs, testing how well they address priority risks that Treasury named as the southwest border and cartels, Iran, and Russia.

The Amex order also requires a board-level compliance committee and quarterly progress reports to the OCC.

The question for production monitoring

US financial institutions file nearly 5 million suspicious activity reports a year. In five days this October, regulators imposed $1.56 billion in AML penalties on two institutions that had monitoring systems in place and still failed.

Amex had a data advantage no other US payments company can match on its own branded cards and didn't build its monitoring around it. BofA ran trillions of dollars through a monitoring program that left much of its detection to outside referrals.

Both companies had AML programs, but the programs were misconfigured in ways that staffing couldn't fix, with a risk assessment aimed at the wrong product at one and detection that depended on external referrals instead of internal escalation at the other.

If you're building or operating a transaction monitoring system, the enforcement documents are worth reading in full. The OCC consent order against Amex walks through every component a BSA/AML program requires, from risk assessment methodology to independent testing. The Treasury release on BofA shows what happens when a bank effectively outsources detection to the people outside it.