The risk map that looked at the wrong product

This week in one sentence: According to the OCC, the US national bank supervisor, American Express National Bank focused its anti-money-laundering risk assessment on narrow deposit products and did not focus sufficiently on the card products that dominate its business; in the same week, regulators set out how they will look at banks' technology providers, and a public bank moved settlement onto a tokenised layer. Evidence maturity: EARLY SIGNAL.

Three questions guide this piece. What is actually happening beneath the headlines? Why does the same question appear in three separate layers this week? And who bears the cost?

INot the fine, the mechanism

On 8 October the OCC assessed a $350 million civil money penalty against American Express National Bank and issued a cease-and-desist order. On the same day the Federal Reserve announced a concurrent cease-and-desist order against American Express Company and American Express Travel Related Services; the Fed's release states no penalty amount. In short, the fine is the OCC's; the Fed's action is a remediation obligation at holding-company level.

The number draws attention, but the substance is in the mechanism the decision describes. The OCC found inadequate resources and expertise in the bank's Bank Secrecy Act and anti-money-laundering compliance programme, systemic internal control gaps, weak independent testing and weak training. More importantly, the bank focused its risk assessment on its relatively narrow demand deposit products and insufficiently on the risks of the credit and charge card products that dominate its business. Customer due diligence and customer identification procedures also contributed to the monitoring and reporting failures.

The result is the sentence most likely to be quoted: approximately $13 billion of suspected trade-based money laundering activity over the past decade was not timely identified, evaluated and sufficiently reported. The figure needs careful reading. It is not an amount proven to have been laundered; it is the scale of suspicious activity the bank should have reported in time and did not.

It is a reasonable reading that the volume and speed on the card side outgrew a monitoring set-up built around deposits. It remains a hypothesis: the decision locates the cause in the mismatch between products and risk assessment, not in a specific technical monitoring gap.

For a cardholder, the day-to-day effect of this decision is not measured in the sources. For a compliance or risk executive, the question is plain: is the programme looking at the product that carries the institution's revenue and transaction volume, or at the one that is easiest to monitor? The OCC says this about American Express; it does not issue a sector-wide verdict.

IIThe provider layer: a priority, not a penalty

On 5 October the Fed, the FDIC and the OCC published SR 26-7, a joint statement on community banks' engagement with core service providers: the technology companies that run a bank's account, transaction and record systems. The statement describes the factors the agencies will weigh when allocating supervisory attention to these providers and notes that they may initiate supervisory and enforcement actions under their statutory authorities.

This is not an enforcement action. No provider is named and no penalty has been imposed. For professionals, however, the meaning is concrete: choosing and contracting a core provider is framed not only as a technology decision but as a risk decision that supervisors will examine. A community bank customer's account often runs on a provider's system rather than the bank's own; the direct effect of this statement on customers is not yet measured.

IIIThe settlement layer: where does control sit when speed rises?

On 5 October the Bank of North Dakota announced the launch of Roughrider Coin, a US dollar-backed tokenised digital asset designed to modernise payments between community banks and credit unions in the state. According to the announcement, Fiserv provides the platform and banking integration, and the infrastructure is Solana. Settlement is described as "near real-time".

A link can be drawn between the two documents: Fiserv is the kind of core service provider SR 26-7 addresses, and in the same week it is carrying a new settlement layer. That is an interpretation. SR 26-7 names no provider, and the two documents appearing in the same week is not evidence of coordination.

The clearest sentence this week on speed and control comes from a company post. In a piece published on 7 October, Airwallex writes that a prompt is not a financial control: you can tell an AI agent not to overspend, but only infrastructure can actually enforce a card limit, an approval threshold or a beneficiary restriction. This is the company's own view, not a supervisory rule. The reading that slow settlement gave compliance review time, while fast settlement requires the rule to be written into the transaction itself, is a hypothesis that extends this view.

IVWhat the evidence says, and what is missing

Four documents point in a direction; they do not establish a trend. The American Express decision penalises a decade-long past failure; it introduces no new rule. SR 26-7 is a statement of priorities. Roughrider's participant count and transaction volume are not in the Bank of North Dakota announcement, so we say nothing about its scale of use.

For Atlas's payments infrastructure thesis, this week brings neither strengthening nor weakening. The thesis conditions rest on Partior and DiSH going live, Arc volume measured by a source other than Circle, the institutions implementing the Swift standard, and the Citi survey; this week there is no in-window primary evidence on any of them. Roughrider is logged as a watch note consistent with the thesis direction.

What we do not know is also clear: the American Express remediation timeline and the scope of the Fed's action, the first concrete supervisory step after SR 26-7, and Roughrider's actual usage data. Third-quarter results from large US banks begin on 13 October; the first broad disclosures on returns from AI spending may come there, but that is an expectation, not data.

VClosing

Back to the analogy: the question is not how advanced the alarm is, but which door it faces. The OCC decision put that on record for one institution. The signals to watch in the coming weeks are measurable: the remediation timeline in the OCC and Fed orders, the first named supervisory action after SR 26-7, and Roughrider's participant count and transaction volume. Until those arrive it is too early to say that control is moving between layers; if they do arrive, the question becomes how quickly the risk map follows to the new layer.