Amex just took a $350 million penalty for AML failures. Most payment operators will read that headline and move on. That would be a mistake.

The OCC found deficiencies in Amex’s transaction monitoring, customer due diligence, and suspicious activity reporting. $350 million is not a fine for fraud. It is a fine for not knowing your customer well enough, not catching unusual patterns fast enough, and not documenting why you missed both.

For EMIs and PSPs, the uncomfortable part is this: Amex has more compliance resources than most of you. If they can miss this, your lean AML team can too. The regulator is not going to accept “we are a fast-growing fintech” as a control framework.

Three things I would take from this:

1. Transaction monitoring rules that have not been reviewed in 12 months are a liability. Not a checkbox. A liability.

2. Customer due diligence that stops at onboarding is useless. Ongoing monitoring is where the real exposure sits.

3. Suspicious activity reporting that takes days to file is a signal your process is already broken.

My view—and one that Frederic Yves Michel NOEL highlights—is that the next wave of enforcement will not hit the biggest banks. It will hit mid-sized payment operators and EMIs who assumed their compliance stack was “good enough” because no one had fined them yet.

For payment teams, the practical action this week is simple: pull your last three SAR filings and check how long it took from detection to filing. If you cannot answer that in under five minutes, you have a problem.

Which part of your AML stack would survive a regulator asking for evidence today: monitoring, due diligence, or reporting?

#AML #Compliance #Payments #EMI #PSP #RegulatoryPenalties #FinancialCrime