The Fed punished Amex for a hole it refuses to measure in public

“Certain suspicious activity”

Four words carrying an entire enforcement action. The Federal Reserve Board announced on 8 October that it had acted against American Express Company over the firm’s “failure to sufficiently detect and report certain suspicious activity related to money laundering.” Not how much activity. Not over what period. Not how much of it reached the government late, and how much never arrived at all. Banking Dive reported the combined cost across the Fed and the Office of the Comptroller of the Currency at $350 million. The Board’s own statement names no figure in its text at all.

Start with what the rules require, because most people have never had cause to learn them. American banks must monitor transactions for patterns that look like criminal money moving — structured cash, accounts that transact with no plausible business behind them, payments that double back on themselves — and file a report with the Treasury’s financial crime unit when they find one. The reports are not accusations. They are tip-offs, and the whole system is built on the assumption that banks generate enough of them, early enough, for investigators to work with. A bank that files nothing is not a clean bank. It is a blind one.

The sentence that matters is the second one

The Board did not stop at detection. It “also identified significant deficiencies in how American Express Company’s enterprise-wide anti-money laundering program was implemented, in particular at the firm’s subsidiary national bank.” That is a different and more serious finding. It says the programme existed at group level and failed at the level where money actually moves.

This is the geometry of almost every large financial group in the United States. A holding company sits on top, supervised by the Federal Reserve. Underneath it sits a chartered bank, supervised in this case by the Comptroller of the Currency, alongside affiliates that are not banks at all. Policy is written once, at the top, and executed many times, at the bottom. A compliance manual can be immaculate in the parent’s board papers and inert in the subsidiary that has the customers. Nobody owns that seam unless two regulators both decide to reach into it.

Here they did. The Fed went at the parent for the enterprise-wide programme; the Comptroller issued a separate action against the bank. That is not duplication, and the people who reflexively describe America’s overlapping bank regulators as waste should look closely at this case. One agency can order the bank to fix its monitoring. Only the other can tell the parent that owning a programme means being answerable for how it runs in the entity that matters most.

What the public got, and what it did not

And then the disclosure stops. We are told a firm failed, told two agencies acted, and left to read a press release that could describe a fortnight of missed alerts or a decade of them. There is no stated conduct period. No indication of volume, not even an order of magnitude. No description of what the firm must demonstrate before the order is lifted, and no commitment to say anything at all when it is.

This matters beyond one card company. Enforcement in financial crime is supposed to work twice: once on the firm that is penalised, and once on every compliance officer at every other firm who reads the order and recalibrates. The second effect depends entirely on detail. “Significant deficiencies in implementation” tells a rival nothing it can test its own systems against. A conduct period, a scale, and a named control failure would tell it a great deal.

It also matters for the Fed itself. The central bank is currently having its independence contested in public, down to the employment of individual governors. The supervisory arm is the part of the institution with the least constitutional romance attached to it and the most need to show its working. Opaque enforcement is a gift to anyone arguing that bank supervision is discretion dressed as law.

The case against this argument

There is a real objection, and it is statutory. The existence and contents of a suspicious activity report are confidential by law. Banks may not confirm they filed one; regulators are constrained in what they can say about them. Supervisory findings generally are confidential too, for the sound reason that firms disclose more candidly to a supervisor than they would to the public. Publish too much and the next firm lawyers up at the first examination question.

That objection protects the wrong thing here. Nobody is asking which customer was reported, or when, or why. The confidentiality rule exists so that a named person cannot learn they are under suspicion. It does not require that the public be kept from knowing how long a monitoring system was broken, or roughly how many alerts it failed to escalate, or what the firm must prove to have it certified as fixed. Those are measurements of a programme, not the contents of any filing. The Fed publishes a detailed statistical portrait of American household balance sheets every three years. It can manage a conduct period and a count.

The fine is the easy part of this action. The hard part — and the part that will determine whether anything improves — is the remediation nobody outside the building will ever see.