In October 2026, federal banking regulators brought two major Bank Secrecy Act/Anti-Money Laundering (BSA/AML) actions in which trade-based money laundering (TBML) featured prominently. On October 8, 2026, the Office of the Comptroller of the Currency (OCC) issued a cease-and-desist order and a $350 million civil money penalty against American Express National Bank. On October 13, 2026, the Treasury Department, via the Financial Crimes Enforcement Network (FinCEN), announced more than $1.21 billion in penalties against Bank of America, including a $1.2 billion FinCEN penalty (crediting a $750 million OCC penalty, the largest in OCC history) and an $11.6 million OFAC settlement. These actions signal that TBML detection is now a supervisory expectation and, in particular, that regulators expect financial institutions to identify and address TBML risks as part of their overall BSA/AML compliance programs.
The actions are significant not only for their size and their focus on TBML, but also for what they say about the evolving enforcement environment in 2026. Even as federal financial regulators have shifted priorities, emphasized more risk-based supervision, and moved away from some of the broader regulatory approaches of recent years, traditional financial crime risks remain a clear enforcement priority. The actions also highlight an increasingly important distinction between avoiding customers based on generalized reputational concerns and identifying and managing concrete risks presented by particular customers, products, and transaction flows.
What Is Trade-Based Money Laundering?
TBML disguises illicit proceeds through trade transactions and related payments, for example by misrepresenting the price, quantity, or quality of goods, or by routing payments for goods through unrelated third parties. Because the underlying activity may appear to be legitimate commerce, it can be difficult to detect without monitoring tailored to a bank's actual products and customer payment flows.
American Express: $13 Billion in Missed TBML Activity
The OCC determined that American Express National Bank (Amex Bank) failed to identify, evaluate, and sufficiently report in a timely manner approximately $13 billion in suspected TBML activity over the past decade. Specifically, the OCC found that Amex Bank focused on its relatively narrow demand deposit products at the expense of its more dominant credit and charge card products. As a result, Amex Bank had weak customer due diligence and customer identification procedures, inadequate staffing and expertise, weak independent testing, and deficient training, which ultimately resulted in systemic monitoring and reporting breakdowns. The Federal Reserve issued a concurrent cease-and-desist order against the parent company and its travel-related services subsidiary.
The finding is a useful reminder that a risk-based approach does not mean focusing compliance resources only on products traditionally associated with heightened AML risk. Regulators increasingly expect an institution's monitoring framework to reflect where its business and its actual risk reside. For Amex Bank, the OCC's concern was that the compliance program did not adequately account for the institution's dominant card business.
Bank of America: TBML Red Flags
FinCEN determined that Bank of America (BofA) willfully violated the BSA and failed to report over $5 billion in suspicious transactions in a timely manner. Of the $5 billion in suspicious transactions, FinCEN found that $1 billion implicated priority risks, including Chinese money laundering networks, fraud, and potential TBML with a substantial nexus to the United States Southwest border. BofA's due diligence processes failed to account for customers' extensive reliance on payments from unknown third parties. BofA did not respond meaningfully to red flags, including potential ties to narcotics proceeds, even after their compliance staff escalated TBML and fraud concerns. Moreover, the OCC found that BofA processed potential TBML transactions due to a systemic gap in its transaction monitoring program. This occurred more than a year after BofA was subject to a December 2024 cease-and-desist order. FinCEN's order requires a third-party SAR lookback and independent reviews addressing the Southwest border, cartels, and narcotics trafficking, as well as Iran and Russia.
The BofA action highlights that regulators are focusing on what institutions do with information generated by their own compliance systems and personnel, particularly where concerns have been escalated or similar deficiencies have previously been identified. In that respect, the action is as much about remediation and institutional response as it is about TBML detection.
Key Takeaways
Align risk assessments with the business. Monitoring must cover the products and services that drive the institution's actual money laundering risks, including card products where they constitute a significant part of the business.
Treat third-party payments as a red flag. Payments from unknown or unrelated third parties may present significant money laundering risks and warrant appropriate scrutiny, particularly where they may indicate potential TBML and Chinese money laundering network activity.
Act on red flags; do not outsource detection. Treasury stressed that documenting concerns or conducting prolonged internal reviews, without taking corrective action, does not satisfy AML obligations. Treasury also made clear that a bank cannot rely on law enforcement inquiries or outside referrals in place of its own monitoring.
Integrate AML and sanctions compliance and remediate promptly. Treasury urged institutions to ensure their AML and sanctions efforts are integrated and mutually reinforcing. Gaps under existing orders should be remediated promptly.
Risk-based regulation does not mean less enforcement. These actions are an important counterpoint to the broader regulatory reset in 2026. Even as federal regulators have moved toward more targeted, risk-based supervision and away from generalized reputational risk concerns, traditional financial crime risks remain enforcement priorities. For financial institutions, greater latitude to serve lawful customers and industries comes with a continued expectation that they identify, monitor, and respond to the actual risks presented by particular customers, products, and transaction flows.
Organizations seeking guidance on these developments or their potential impact are encouraged to contact the authors.