Fintech · Industry brief

The Office of the Comptroller of the Currency issued a $350 million civil money penalty and cease-and-desist order against American Express National Bank on October 8, 2026, for deficiencies in its Bank Secrecy Act and anti-money laundering compliance program. The OCC found the Sandy, Utah bank failed to establish adequate monitoring controls, citing insufficient staffing expertise, systemic internal control gaps, weak independent testing, and inadequate employee training. At the center of the enforcement action is approximately $13 billion in suspected trade-based money laundering activity spanning June 2014 to May 2025 that the bank failed to identify and report timely, including suspicious card charges and repayments involving accounts tied to bank insiders. The agency determined the bank's risk assessment was misaligned with its business, focusing narrowly on deposit products while overlooking its dominant credit and charge card operations, and identified customer due diligence and identification gaps. The Federal Reserve issued a concurrent cease-and-desist order against American Express and American Express Travel Related Services.

Federal banking regulators have proposed new Third-Party Risk Management Guidance that significantly reshapes how banks oversee fintech vendors and partnership programs. For fintech vendors, the Proposal permits banks to rely on outside sources like peer feedback and management qualifications when assessing startups with limited operating history, eliminates prescriptive contract requirements, and allows banks to oversee subcontractors through vendor contracts rather than conducting separate diligence. The Federal Reserve separately proposed a Community Bank Guide for institutions under $30 billion in assets that lists specific vendor due-diligence considerations across eight categories, including BSA/AML platforms and digital banking—areas where fintechs are principal sellers. The FDIC is reportedly developing a voluntary certification program called Risk-Assessed, Manageable Partnerships (RAMP), though certification would be an input to, not a substitute for, bank diligence. For partnership programs where fintechs market bank products directly to consumers, regulatory relief appears more limited. Partnership programs are likely designated as higher-risk relationships under the Proposal because fintech failures could constitute material violations of consumer protection laws, Bank Secrecy Act rules, and FDIC deposit insurance requirements. The Proposal withdraws the 2024 Joint Statement on bank-fintech partnerships without replacement guidance, leaving compliance responsibility allocation between banks and fintechs unresolved—though Governor Cook invited comments on this issue. State attorneys general enforcement, CFPB oversight, and FTC authority remain unaffected by the federal agencies' narrower supervisory standards. Comments on the proposals are due November 16, 2026.