American Express has been ordered to pay a $350m penalty by US regulators after its AML safeguards allowed roughly 3bn in suspected illicit activity to go insufficiently monitored and reported for almost 11 years.