Regulators identified “significant deficiencies” in how American Express' enterprise-wide anti-money laundering program was implemented, in particular at the firm’s national bank subsidiary