When American Express National Bank received a $350 million penalty from the Office of the Comptroller of the Currency, it highlighted a significant issue: the bank's AML framework was focused on the wrong part of its business. While the bank concentrated on its smaller deposit operations, it neglected to assess the money laundering risks in its large credit and charge card portfolio. This oversight led to $13 billion in suspected trade-based money laundering activity going unreported between June 2014 and May 2025.
This checklist helps you audit whether your AML framework aligns with your institution's risk profile, staffing needs, and monitoring obligations under the Bank Secrecy Act.
What This Checklist Covers
You'll ensure your BSA/AML program targets where transaction risk actually exists in your business, not where it was assumed to be. This includes assessing risk accuracy, staffing adequacy, customer due diligence, and independent testing effectiveness.
Prerequisites
Before starting, gather:
- Your current BSA/AML risk assessment document
- Organizational charts showing AML staffing levels and reporting lines
- Transaction volume data by business line for the past 24 months
- Your most recent independent AML audit or testing report
- Customer due diligence policies and procedures
- SAR filing statistics by business unit
Risk Assessment Alignment
1. Quantify transaction volume and velocity by business line.
Don't treat "deposit risk" and "card risk" as equal if one generates 95% of your transaction volume. Calculate monthly transaction counts, dollar volumes, and cross-border percentages for each product line. A good approach includes a risk matrix where business lines are weighted by actual activity.
2. Update your risk assessment annually.
BSA/AML risk assessments must be current. If your business launched new products, entered new markets, or changed transaction processing systems, your assessment needs updating. Schedule annual reviews with trigger events like new product launches or regulatory changes.
3. Identify specific money laundering typologies for each business line.
Trade-based money laundering appears differently in card operations than in wire transfers. Good practice includes listing 3-5 specific typologies with detection methods tailored to each channel.
4. Provide senior management with quarterly reports comparing assessed risk to actual suspicious activity.
If you assessed merchant acquiring as "low risk" but filed 40% of your SARs from that channel, there's a misalignment. Use dashboards to show risk ratings alongside SAR counts and alert volumes.
Staffing and Expertise
5. Justify AML staffing levels by transaction volume.
If your card portfolio processes 10 million transactions monthly but your AML team was sized for a deposit-focused bank, you're understaffed. Document analysis should show FTE calculations based on alert volumes and investigation complexity.
6. Ensure AML staff have expertise in your highest-risk business lines.
Investigating trade-based money laundering in card transactions requires different skills than deposit monitoring. Training records should show specialized certifications or courses for staff in high-volume channels.
7. Document why your staffing model fits your risk profile.
Regulators expect proof of sufficiency. Conduct annual staffing assessments that calculate required hours for alert review and compare them to available FTE.
Customer Due Diligence
8. Differentiate CDD procedures by customer type and transaction pattern.
Corporate cardholders engaged in international procurement need different due diligence than domestic consumer cardholders. Implement tiered CDD requirements with specific documentation for high-risk segments.
9. Collect beneficial ownership information for commercial customers before account opening.
The Corporate Transparency Act and BSA requirements mandate this. Ensure documented beneficial ownership for all legal entity customers with certification dates within the past 36 months.
10. Calibrate enhanced due diligence triggers to actual red flags.
If you see trade-based money laundering typologies, your EDD triggers should include rapid goods movement or pricing anomalies. Reference specific behaviors observed in your SAR data.
Transaction Monitoring
11. Cover typologies specific to card-based money laundering.
Generic structuring rules miss card-specific patterns like rapid authorization-and-refund cycles. Implement at least five scenarios designed for card transaction flows, tested against known suspicious activity.
12. Tune alert thresholds every six months.
Untuned systems generate noise, not intelligence. Conduct threshold analysis showing alert volumes and SAR conversion rates, adjusting when conversion drops below 2%.
13. Flag trade-based money laundering indicators.
Given the $13 billion failure at American Express, this is essential for card issuers. Monitor for over-and-under invoicing patterns and shell company transactions.
Independent Testing
14. Ensure independent testing reports outside the AML compliance chain.
Testing isn't independent if the AML officer controls the scope and findings. Use an independent audit or risk function with direct board reporting for annual BSA/AML testing.
15. Include transaction monitoring effectiveness in testing scope.
Checking policy compliance is easy; checking monitoring effectiveness requires sampling and case review. Validate scenario effectiveness by reviewing closed investigations and missed typologies.
Common Mistakes
Treating all business lines as equal risk. Your deposit and card operations have different risk profiles. Weight your assessment accordingly.
Staffing based on peer benchmarks instead of your transaction volume. What works for a $5 billion deposit bank doesn't work for a card issuer processing millions of transactions.
Writing SARs only when alerts fire. Proactive case identification from news or customer complaints is expected.
Assuming your monitoring system is effective because it generates alerts. Alert volume doesn't equal detection effectiveness.
Next Steps
Schedule a 90-day action plan review with senior management. If your risk assessment doesn't quantify transaction volumes by business line, start there. If your monitoring scenarios don't cover card-specific typologies, add them now. If your independent testing hasn't validated detection effectiveness in your highest-volume channels, scope that work immediately.
The OCC's message is clear: your AML framework must be built around where your transaction risk actually sits. Anything else is regulatory exposure waiting to materialize.
