What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2024-02-09 compared with 2023-02-10 · 181 added, 125 removed, 355 unchanged (46% of the section changed)

10 unchanged sentences

Our businesses function together to form our end-to-end integrated payments platform, which we believe is a differentiator that underpins our business model.

For further information about our reportable operating segments, please see “Business Segment Results of Operations” under “MD&A.”

Our Integrated Payments Platform

For further information about our reportable operating segments, see “Business Segment Results of Operations” under “MD&A.”

Our Integrated Payments Platform and Technology

Through our general-purpose card-issuing, merchant-acquiring and card network businesses, we are able to connect participants and provide differentiated value across the commerce path.

We maintain direct relationships with both our Card Members (as a card issuer) and merchants (as an acquirer), and we handle all key aspects of those relationships.

These relationships create a “closed loop” in that we have direct access to information at both ends of the card transaction, which distinguishes our integrated payments platform from the bankcard networks.

Our integrated payments platform allows us to analyze information on Card Member spending and build algorithms and other analytical tools that we use to underwrite risk, reduce fraud and provide targeted marketing and other information services for merchants and partners and special offers and services to Card Members, all while respecting Card Member preferences and protecting Card Member and merchant data in compliance with applicable policies and legal requirements.

We maintain direct relationships with Card Members (as a card issuer) and merchants (as an acquirer), which provides us with direct access to information at both ends of the card transaction, distinguishing our integrated payments platform from the bankcard networks.

Through contractual relationships, we also obtain information from third-party card issuers, merchant acquirers, aggregators and processors with whom we do business.

Our integrated payments platform and the systems and infrastructure that underlie it allow us to analyze information on Card Member spending, build models and use analytical tools to help us underwrite risk, reduce fraud and provide targeted marketing and other information services for merchants and partners and special offers and services to Card Members, all while maintaining our commitment to respect Card Member preferences and protect Card Member and merchant data in compliance with applicable policies and legal requirements.

We also leverage technology to allow for faster introduction and greater differentiation of products, as well as to develop and improve our service capabilities to continue to deliver a high-quality customer experience.

Card Issuing Businesses

2 unchanged sentences

We acquire and retain high-spending, engaged and creditworthy Card Members by:

• Designing innovative products and features that appeal to our target customer base and meet their spending and borrowing needs

• Using incentives to drive spending on our various card products and increase customer engagement, including our Membership Rewards ® program, cash-back reward features, interest rates offered on deposits and participation in loyalty programs sponsored by our cobrand and other partners

• Providing digital and mobile services and an array of benefits and experiences across card products, such as airport lounge access, dining experiences and other travel and lifestyle benefits

• Designing innovative credit, charge and debit card products and payment and lending solutions that appeal to our target customer base and meet their spending and borrowing needs

• Using incentives to drive spending on our various card products and increase customer engagement, including our Membership Rewards ® and Amex ® Offers programs, cash-back reward features, interest rates offered on deposits and participation in loyalty programs sponsored by our cobrand and other partners

• Providing digital and mobile services and an array of benefits and experiences across card products, such as lounge access, dining experiences and other travel and lifestyle benefits

• Creating world-class service experiences by delivering exceptional customer care

1 unchanged sentence

Over the last several years, we have focused on broadening the appeal of our products to attract new customers, particularly Millennial and Gen Z customers, as well as expanding our position with small and mid-sized enterprise (SME) customers by providing more ways to help them manage and grow their businesses.

We have also introduced new adjacent products that complement our existing products, such as our business checking and consumer rewards checking account products and new digital capabilities, which in part result from our acquisitions of Kabbage, Resy and acompay.

Additionally, we have evolved our card issuing businesses by bringing together our consumer, SME and large commercial issuing activities outside of the United States into a new ICS organization to enable a greater focus on local priorities.

We have a number of products that complement our card products, such as our business checking and consumer rewards checking account products, our business-to-business (B2B) payment products and other non-card payment and financing products, our Business Blueprint digital cash flow management hub, our Resy restaurant platform and other new digital capabilities.

Additionally, we are focused on driving growth and efficiencies internationally, including a greater focus on local priorities in international jurisdictions.

Jurisdictions that represent a significant portion of our billed business outside of the United States include the United Kingdom (UK), the European Union (EU), Australia, Japan, Canada and Mexico.

4 unchanged sentences

We also build and maintain relationships with merchant acquirers, aggregators and processors to manage aspects of our merchant services business.

For example, through our OptBlue ® merchant-acquiring program, third-party acquirers contract directly with small merchants for card acceptance on our network and determine merchant pricing.

For example, through our OptBlue ® merchant-acquiring program, third-party processors contract directly with small merchants for card acceptance on our network and determine merchant pricing.

We continue to grow merchant acceptance of American Express cards around the world and work with merchant partners so that our Card Members are warmly welcomed and encouraged to spend in the millions of places where their American Express cards are accepted.

We also seek to drive greater usage of the American Express network by deepening merchant engagement and increasing Card Member awareness through initiatives such as our Shop Small campaigns and deploying new payment options such as debit and B2B capabilities.

We also seek to drive greater usage of the American Express network by deepening merchant engagement and increasing Card Member awareness through initiatives such as our Shop Small campaigns and expanding our payment options such as through debit and B2B capabilities.

GMNS also provides fraud-prevention tools, marketing solutions, data analytics and other programs and services to merchants and other partners that leverage the capabilities of our integrated payments platform.

8 unchanged sentences

Our integrated payments platform allows us to work with a range of business partners, and our partners in return help drive the scale and relevance of the platform.

There are many examples of how we connect partners with our integrated payments platform, including:

There are many examples of how we work with partners, including:

issuing cards under cobrand arrangements with other corporations and institutions (e.g., Delta Air Lines (Delta), Marriott International, Hilton Worldwide Holdings and British Airways);

offering innovative ways for our Card Members to earn and use points with our merchants (e.g., Pay with Points at Amazon.com);

expanding merchant acceptance with third-party acquirers (e.g., OptBlue partners);

providing greater value to our Card Members (e.g., Amex Offers and statement credits for purchases with partners);

expanding merchant acceptance with third-party acquirers and processors (e.g., OptBlue partners);

operating through joint ventures in certain jurisdictions (e.g., in China, the Middle East and Switzerland);

developing new capabilities and features with our digital partners (e.g., PayPal and i2c);

integrating into the supplier payment processes of our business customers (e.g., BILL, BillTrust and Versapay);

and extending the platform into travel services with American Express leisure and business travel (e.g., Fine Hotels and Resorts).

integrating into the supplier payment processes of our business customers (e.g., BILL and Extend);

and enhancing our travel benefits and services (e.g., Fine Hotels and Resorts).

We also have a significant ownership position in, and extensive commercial arrangements with, Global Business Travel Group, Inc.

9 unchanged sentences

Our “spend-centric” business model focuses on generating revenues primarily by driving spending on our cards and secondarily through finance charges and fees.

Spending on our cards, which is higher on average on a per-card basis versus our competitors, offers superior value to merchants in the form of loyal customers and larger transactions.

Spending on our cards, which is higher on average on a per-card basis versus our network competitors, offers superior value to merchants in the form of loyal customers and larger transactions.

Because of the revenues generated from having high-spending Card Members and the annual card fees we charge on many of our products, we are able to invest in attractive rewards and other benefits for Card Members, as well as targeted marketing and other programs and investments for merchants.

14 unchanged sentences

Finally, we want to continue to build on our unique global position, seeking ways to use our differentiated business model and global presence as we progress against our other strategic imperatives.

We previously had as a strategic imperative to make American Express an essential part of our customers’ digital lives, which we believe has become embedded in our company and is inherent in the work we do in furtherance of our strategic imperatives.

We also have an Environmental, Social and Governance (ESG) strategy that focuses on three pillars.

The Promoting Diversity, Equity and Inclusion (DE&I) pillar supports a diverse, equitable and inclusive workforce, marketplace and society.

The Building Financial Confidence pillar seeks to provide responsible, secure and transparent products and services to help people and businesses build financial resilience.

The Advancing Climate Solutions pillar focuses on enhancing our operations and capabilities to meet customer and community needs in the transition to a low-carbon future.

Finally, the Building Financial Confidence pillar seeks to provide responsible, secure and transparent products and services to help people and businesses build financial resilience.

Finally, the Promoting Diversity, Equity and Inclusion (DE&I) pillar supports a diverse, equitable and inclusive workforce, marketplace and society.

Our Colleagues

We are focused on our culture built on supportive relationships and an inclusive workplace, where colleagues can feel welcome and heard, and are provided with opportunities to grow and thrive.

As a result, we believe our colleagues are more engaged, committed, creative and effective in driving results.

Our colleagues are integral to executing our business strategies and to our overall success.

As of December 31, 2023, we employed approximately 74,600 people, whom we refer to as colleagues, with approximately 26,000 colleagues in the United States and approximately 48,600 colleagues outside the United States.

In 2023, we continued to invest in our colleagues, building on a wide range of learning and development opportunities and enhancing our competitive benefits in key areas including holistic health and wellness, total compensation and flexibility.

We conduct an annual Colleague Experience Survey to better understand our colleagues’ needs and overall experience at American Express, and in 2023, 91 percent of colleagues who participated in the survey said they would recommend American Express as a great place to work.

To attract and retain the best talent, we strive to offer a compelling value proposition to our colleagues, which represents the ways in which we support our colleagues in four key areas:

(1) our culture;

(2) career growth and development;

(3) rewards and holistic well-being;

and (4) diversity, equity and inclusion.

Our culture is built on strong relationships, shared values and purpose and a commitment to back our customers, communities and each other.

At the heart of our culture is what we call our Blue Box Values – a set of guiding principles that serve as the foundation for how we operate:

We Do What's Right We Embrace Diversity

We Do What’s Right

We Embrace Diversity

We Back Our Customers We Stand for Equity and Inclusion

1 unchanged sentence

We Respect People We Support Communities

As of December 31, 2022, we employed approximately 77,300 people, whom we refer to as colleagues, with approximately 26,000 colleagues in the United States and approximately 51,300 colleagues outside the United States.

We added colleagues in 2022 to support our strong business growth.

To attract and retain the best talent, we strive to offer a compelling value proposition to our colleagues, including competitive compensation and leading benefits.

Career Growth and Development

We continuously invest in programs, benefits and resources to foster the personal and professional growth of our colleagues.

We provide learning opportunities in many forms, including tools and guidance for maximizing learning on the job;

cross-border and cross-business unit assignments;

career coaching, mentoring and professional networking;

rotation opportunities;

virtual learning sessions;

and formal classroom instruction.

The health and wellness of our colleagues continue to be priorities for us and we take a holistic approach to well-being, providing resources that address the physical, financial and mental health of our colleagues.

Throughout 2022, we launched Amex Flex across our offices, where, depending on role and business needs, colleagues can work in the office, at home or take a hybrid approach that combines both.

This approach is designed to enable us to both broaden the talent pool from which we can attract candidates and increase colleague retention.

We conduct an annual Colleague Experience Survey to better understand our colleagues’ needs and overall experience at American Express and in 2022, 92 percent of colleagues who participated in the survey said they would recommend American Express as a great place to work.

Our 2022 annual company scorecard included talent retention, colleague engagement and diversity representation goals.

We start with opportunities for colleagues to learn on the job, build cross-functional skills and grow in their careers through a defined, collaborative process for performance management.

Colleagues have access to a wide variety of resources:

career coaching, mentoring, professional networking, and rotation opportunities, as well as courses on-demand and with classroom-style instruction.

Rewards and Holistic Well-Being

We aim to provide our colleagues with competitive compensation and leading benefits and take a holistic approach to well-being, providing resources that address the physical, financial and mental health of our colleagues.

Our financial well-being program, Smart Saving, provides tools and resources to help colleagues build their knowledge and skills for all life stages.

We support our colleagues’ physical health and well-being through our corporate wellness program, Healthy Living.

We also provide resources and support to increase awareness about mental health among our colleagues through our Healthy Minds Program.

Diversity, Equity and Inclusion

We continue to work to build an inclusive and diverse workplace that values our colleagues’ voices, rewards teamwork, celebrates different points of view and reflects the diversity of the communities in which we operate.

As of December 31, 2023, women represented 53.2 percent of our global workforce and Asian, Black/African American and Hispanic/Latinx people represented 20.6 percent, 15.6 percent and 14.3 percent, respectively, of our U.S.

2 unchanged sentences

As of December 31, 2023, 50 percent of our Executive Committee were women or from diverse races and ethnic backgrounds (based on self-identified characteristics).

We regularly review our compensation practices to ensure colleagues in the same job, level and location are compensated fairly regardless of gender globally, and regardless of race and ethnicity in the United States.

We also regularly review our compensation practices to ensure colleagues in the same job, level and location are compensated fairly regardless of gender globally, and regardless of race and ethnicity in the United States.

These reviews consider several factors known to affect compensation, including role, level, tenure, performance and geography.

2 unchanged sentences

Information About Our Executive Officers

Set forth below, in alphabetical order, is a list of our executive officers as of February 10, 2023, including each executive officer’s principal occupation and employment during the past five years and reflecting recent organizational changes.

Set forth below, in alphabetical order, is a list of our executive officers as of February 9, 2024, including each executive officer’s principal occupation and employment during the past five years.

None of our executive officers has any family relationship with any other executive officer, and none of our executive officers became an officer pursuant to any arrangement or understanding with any other person.

3 unchanged sentences

Buckminster (63) has been Vice Chairman since April 2021.

Prior thereto, he had been Group President, Global Consumer Services Group since February 2018 and President, Global Consumer Services Group from October 2015 to February 2018.

CAMPBELL — Vice Chairman and Chief Financial Officer

Campbell (62) has been Vice Chairman since April 2021 and Chief Financial Officer since August 2013.

Prior thereto, he had been Group President, Global Consumer Services Group since February 2018.

CAMPBELL — Vice Chairman

Campbell (63) has been Vice Chairman since April 2021.

He also served as Chief Financial Officer (CFO) from August 2013 to August 2023.

HOWARD GROSFIELD — President, U.S.

11 unchanged sentences

Prior thereto, he had been President, Global Risk and Compliance and Chief Risk Officer since September 2019.

He also served as President of International Consumer Services and Global Travel and Lifestyle Services from February 2018 to September 2019 and as Executive Vice President, Global Servicing Network from February 2016 to February 2018.

RAFAEL MARQUEZ— President, International Card Services

He also served as President of International Consumer Services and Global Travel and Lifestyle Services from February 2018 to September 2019.

CHRISTOPHE Y.

Chief Financial Officer

Le Caillec (58) has been CFO since August 2023.

Prior thereto, he had been Deputy CFO since December 2021 and Head of Corporate Planning since February 2019.

He also served as Business CFO for the Global Consumer Services Group from May 2016 to February 2019.

RAFAEL MARQUEZ —

President, International Card Services

Marquez (52) has been President, International Card Services since May 2022.

3 unchanged sentences

Prior thereto, she had been President, Commercial Services since September 2018.

Marrs joined American Express from Standard Chartered Bank, where she served as Regional CEO, ASEAN and South Asia since November 2016.

GLENDA MCNEAL —

Chief Partner Officer

McNeal (63) has been Chief Partner Officer since February 2024.

Prior thereto, she had been President, Enterprise Strategic Partnerships since March 2017.

DAVID NIGRO — Chief Risk Officer

Nigro (62) has been Chief Risk Officer since April 2021.

Prior thereto, he had been Executive Vice President and Chief Credit Officer, Global Consumer Services and Credit and Fraud Risk Capability since April 2018 and Executive Vice President and Chief Credit Officer, U.S.

Consumer Card Services since December 2013.

Prior thereto, he had been Executive Vice President and Chief Credit Officer, Global Consumer Services and Credit and Fraud Risk Capability since April 2018.

DENISE PICKETT — President, Global Services Group

Pickett (58) has been President, Global Services Group since September 2019.

Prior thereto, she had been Chief Risk Officer and President, Global Risk, Banking & Compliance since February 2018 and President, U.S.

Consumer Services from October 2015 to February 2018.

Prior thereto, she had been Chief Risk Officer and President, Global Risk, Banking & Compliance since February 2018.

RAVI RADHAKRISHNAN — Chief Information Officer

5 unchanged sentences

Rutledge (62) has been Chief Marketing Officer since February 2018.

Prior thereto, she had been Executive Vice President, Global Advertising & Media since February 2016.

SEEGER — Chief Legal Officer

3 unchanged sentences

Skyler joined American Express from WeWork, where she served as Chief Communications Officer from January 2018 to September 2019.

Prior thereto, she had been Global Head of Public Affairs from January 2016 to January 2018.

SQUERI — Chairman and Chief Executive Officer

Squeri (64) has been Chairman and Chief Executive Officer since February 2018.

Prior thereto, he had been Vice Chairman since July 2015.

ANRÉ WILLIAMS — Group President, Enterprise Services

Williams (58) has been Group President, Enterprise Services since April 2021.

Prior thereto, he had been Group President, Global Merchant and Network Services since February 2018 and President of Global Merchant Services and Loyalty since October 2015.

Prior thereto, he had been Group President, Global Merchant and Network Services since February 2018.

Williams also serves as the Chief Executive Officer of American Express National Bank.

We compete in the global payments industry with card networks, issuers and acquirers, paper-based transactions (e.g., cash and checks), bank transfer models (e.g., wire transfers and Automated Clearing House, or ACH), as well as evolving and growing alternative mechanisms, systems and products that leverage new technologies, business models and customer relationships to create payment, financing or banking solutions.

The payments industry continues to undergo dynamic changes in response to evolving technologies, consumer habits and merchant needs, some of which have accelerated as a result of the pandemic, such as an increased shift to digital payments.

As a card issuer, we compete with financial institutions that issue general-purpose credit and debit cards.

We also encounter competition from businesses that issue private label cards, operate mobile wallets or extend credit.

The payments industry continues to undergo dynamic changes in response to evolving technologies, consumer habits and merchant needs, such as an increased shift to digital payments.

As a card issuer, we compete with financial institutions that issue general-purpose credit and debit cards, as well as businesses that issue private label cards, operate mobile wallets, provide payment services or extend credit.

We face intense competition in the premium space and for cobrand relationships, as both card issuer and network competitors have targeted high-spending customers and key business partners with attractive value propositions.

We also face competition for partners and other differentiated offerings, such as lounge space in U.S.

and global hub airports.

and global hub airports, restaurant reservation capabilities and other experiential offerings to customers.

Our banking products also face strong competition, such as with respect to the rates offered on deposits.

Our global card network competes in the global payments industry with other card networks, including, among others, China UnionPay, Visa, Mastercard, JCB, Discover and Diners Club International (which is owned by Discover).

14 unchanged sentences

Various competitors are integrating more financial services into their product offerings and competitors are seeking to attain the benefits of closed-loop, loyalty and rewards functionalities, such as ours.

In addition to the discussion in this section, see “ Our operating results may materially suffer because of substantial and increasingly intense competition worldwide in the payments industry ” in “Risk Factors” for further discussion of the potential impact of competition on our business, and “ Our business is subject to comprehensive government regulation and supervision, which could materially adversely affect our results of operations and financial condition” and “ Legal proceedings regarding provisions in our merchant contracts, including non-discrimination and honor-all-cards provisions, could have a material adverse effect on our business and result in additional litigation and/or arbitrations, changes to our merchant agreements and/or business practices, substantial monetary damages and damage to our reputation and brand ” in “Risk Factors” for a discussion of the potential impact on our ability to compete effectively due to government regulations or if ongoing legal proceedings limit our ability to prevent merchants from engaging in various actions to discriminate against our card products.

In addition to the discussion in this section, see “ Our operating results may materially suffer because of substantial and increasingly intense competition worldwide in the payments industry ” under “Risk Factors” for further discussion of the potential impact of competition on our business, and “ Our business is subject to evolving and comprehensive government regulation and supervision, which could materially adversely affect our results of operations and financial condition ” and “ Legal proceedings regarding provisions in our merchant contracts, including non-discrimination and honor-all-cards provisions, could have a material adverse effect on our business and result in additional litigation and/or arbitrations, changes to our merchant agreements and/or business practices, substantial monetary damages and damage to our reputation and brand ” under “Risk Factors” for a discussion of the potential impact on our ability to compete effectively due to government regulations or if ongoing legal proceedings limit our ability to prevent merchants from engaging in various actions to discriminate against our card products.

SUPERVISION AND REGULATION

We are subject to extensive government regulation and supervision in jurisdictions around the world, and the costs of compliance are substantial.

We are subject to evolving and extensive government regulation and supervision in jurisdictions around the world, and the costs of ongoing compliance are substantial.

The financial services industry is subject to rigorous scrutiny, high regulatory expectations, a range of regulations and a stringent and unpredictable enforcement environment.

Governmental authorities have focused, and we believe will continue to focus, considerable attention on reviewing compliance by financial services firms with laws and regulations, and as a result, we continually work to evolve and improve our risk management framework, governance structures, practices and procedures.

Governmental authorities have focused, and we believe will continue to focus, considerable attention on reviewing compliance by financial services firms and payment systems with laws and regulations, and as a result, we continually work to evolve and improve our risk management framework, governance structures, practices and procedures.

Reviews by us and governmental authorities to assess compliance with laws and regulations, as well as our own internal reviews to assess compliance with internal policies, including errors or misconduct by colleagues or third parties or control failures, have resulted in, and are likely to continue to result in, changes to our products, practices and procedures, restitution to our customers and increased costs related to regulatory oversight, supervision and examination.

We have also been subject to regulatory actions and may continue to be the subject of such actions, including governmental inquiries, investigations, enforcement proceedings and the imposition of fines or civil money penalties, in the event of noncompliance or alleged noncompliance with laws or regulations.

External publicity concerning investigations can increase the scope and scale of those investigations and lead to further regulatory inquiries.

Policymakers around the world continue to propose and adopt new laws and regulations governing a wide variety of issues that may impact our business or change our operating environment in substantial and unpredictable ways.

For example, as previously disclosed, we are cooperating with governmental investigations related to certain of our historical sales practices, which are described in more detail in Note 12 to the “Consolidated Financial Statements.” External publicity concerning investigations can increase the scope and scale of those investigations and lead to further regulatory inquiries.

Policymakers around the world continue to propose and adopt new and increasingly complex laws and regulations governing a wide variety of issues that may impact our business or change our operating environment in substantial and unpredictable ways.

For example, legislators and regulators in various countries in which we operate have focused on the offering of consumer financial products and the operation of payment networks, resulting in changes to certain practices or pricing of card issuers, merchant acquirers and payment networks, and, in some cases, the establishment of broad and ongoing regulatory oversight regimes.

See “Risk Factors—Legal, Regulatory and Compliance Risks” for a discussion of the potential impact legislative and regulatory changes may have on our results of operations and financial condition.

The following discussion summarizes elements of the extensive regulatory environment in which we operate;

it does not purport to be complete or to describe all of the laws or regulations to which we are subject or all possible or proposed changes in laws or regulations that may become applicable to us.

See “Operational and Compliance/Legal Risks” under “Risk Factors” for a discussion of the potential impact that changes in applicable law or regulation, and in their interpretation and application by regulatory agencies and other governmental authorities, may have on our business, results of operations and financial condition.

Banking Regulation

American Express entities are subject to banking regulation in the United States and in certain jurisdictions internationally.

federal and state banking laws, regulations and policies extensively regulate the Company, TRS and our U.S.

7 unchanged sentences

government agencies and regulatory bodies.

For example, non-U.S.

regulators supervising our international regulated financial institutions use many of the same principles of regulation and supervision that are used by U.S.

federal bank regulators.

The BHC Act generally limits bank holding companies to activities that are considered to be banking activities and certain closely related activities.

2 unchanged sentences

Those requirements include that each of the Company and AENB must be “well capitalized” and “well managed,” and AENB must have received at least a “satisfactory” rating on its most recent assessment under the Community Reinvestment Act of 1977 (the CRA).

The Company and TRS engage in various activities permissible only for financial holding companies, including, in particular, providing travel agency services, acting as a finder and engaging in certain insurance underwriting and agency services.

If the Company fails to meet eligibility requirements for financial holding company status, it and its subsidiaries are likely to be barred from engaging in new types of financial activities or making certain types of acquisitions or investments in reliance on its status as a financial holding company, and ultimately could be required to either discontinue the broader range of

activities permitted to financial holding companies or divest AENB.

The Company and TRS engage in various activities permissible only for financial holding companies, including, in particular, providing travel agency

services, acting as a finder and engaging in certain insurance underwriting and agency services.

In addition, the Company and its subsidiaries are prohibited by law from engaging in practices that regulatory authorities deem unsafe or unsound (which such authorities generally interpret broadly) and regulatory authorities have discretion in determining whether new or modified activities can be conducted in a safe and sound manner.

3 unchanged sentences

Federal banking regulators have broad discretion in evaluating proposed acquisitions and investments that are subject to their prior review or approval.

Financial Regulatory Reform

Enhanced Prudential Standards

The Company is subject to the U.S.

federal bank regulatory agencies’ rules that tailor the application of enhanced prudential standards to bank holding companies and depository institutions with $100 billion or more in total consolidated assets.

Under these rules, each bank holding company, as well as its bank subsidiaries, is assigned to one of four categories based on its status as a U.S.

Under these rules, each such bank holding company, as well as its bank subsidiaries, is assigned to one of four categories based on its status as a U.S.

global systemically important banking organization and five other risk-based indicators:

(i) total assets, (ii) cross-jurisdictional activity, (iii) non-bank assets, (iv) off-balance sheet exposure, and (v) weighted short-term wholesale funding.

Under these rules, the Company (and its depository institution subsidiary, AENB) is subject to Category IV standards.

Because a firm’s categorization is determined by, and can change over time dependent upon, how the firm measures against the risk-based indicator thresholds, we are required to monitor and periodically report these risk-based indicators and there can be no assurance that the Company will continue to be a Category IV firm in the future.

(i) total assets, (ii) cross-jurisdictional activity, (iii) non-bank assets, (iv) off-balance sheet exposure, and (v) weighted short-term wholesale funding, with the most stringent requirements applying to Category I firms and the least stringent requirements applying to Category IV firms.

Under these rules, the Company (and its depository institution subsidiary, AENB) is currently subject to Category IV standards.

However, changes in the levels of these risk-based indicators at the Company could result in changes to our regulatory tailoring category.

Category III firms include those firms with greater than $250 billion but less than $700 billion in total consolidated assets, calculated based on a four-quarter trailing average.

Our total consolidated assets were $251 billion and $261 billion as of September 30 and December 31, 2023, respectively, and, accordingly, we anticipate becoming a Category III firm in 2024.

Category III firms are subject to heightened capital, liquidity and prudential requirements, single-counterparty credit limits and additional stress tests, which in some cases are subject to a transition period following a financial institution becoming a Category III firm.

Moreover, further changes in the risk-based indicators described above, such as if we have $75 billion or more in cross-jurisdictional activity (calculated based on a four-quarter trailing average), could result in us becoming a Category II firm and subject to more stringent capital, liquidity and prudential requirements.

Our cross-jurisdictional activity was $67 billion as of December 31, 2023, and the four-quarter trailing average was $60 billion.

Capital and Liquidity Regulation

2 unchanged sentences

These rules are intended to ensure that bank holding companies and depository institutions (collectively, banking organizations) have adequate capital given their level of assets and off-balance sheet obligations.

The federal banking regulators’ current capital rules (the Capital Rules) implement the Basel Committee on Banking Supervision’s (the Basel Committee) framework for strengthening international capital regulation, known as Basel III.

The federal banking regulators’ current capital rules (the Capital Rules) implement the Basel Committee on Banking Supervision’s framework for strengthening international capital regulation, known as Basel III.

For additional information regarding our capital ratios, see “Consolidated Capital Resources and Liquidity” under “MD&A.”

1 unchanged sentence

We report our capital adequacy ratios using risk-weighted assets calculated under the standardized approach.

As a Category IV firm, we are not subject to the advanced approaches capital requirements.

In December 2017, the Basel Committee published standards that, among other things, revise the standardized approach for credit risk (including by recalibrating risk weights and introducing additional capital requirements for certain “unconditionally cancellable commitments” such as unused credit card lines of credit) and provide a new standardized calculation for operational risk capital requirements.

In September 2022, federal banking regulators announced that they are reaffirming their commitment to implement enhanced regulatory capital requirements that align with the standards issued by the Basel Committee in December 2017 and that they are developing a joint proposed rule for issuance.

If adopted in the United States as issued by the Basel Committee and applicable to us, the new standards are likely to result in higher capital requirements for us.

Category IV firms such as us and Category III firms are not subject to the advanced approaches capital requirements, whereas Category II firms are subject to the advanced approaches capital requirements under current capital rules, which introduce additional complexities in the methodologies used to calculate risk-weighted assets for purposes of determining capital adequacy ratios.

On July 27, 2023, the U.S.

federal bank regulatory agencies issued a notice of proposed rulemaking that would significantly revise U.S.

regulatory capital requirements for large banking organizations, including the Company and AENB.

The proposed rules would apply a new expanded risk-based approach to calculating risk-based capital ratios, and large banking organizations would be required to calculate their risk-based capital ratios under both (i) the standardized approach and (ii) the expanded risk-based approach and use the lower of the two ratio calculations to determine binding capital constraints under each risk-based capital ratio.

The expanded risk-based approach to calculating risk-weighted assets would apply more granular risk-weighting methodologies for credit risk, include a new standardized methodology for operational risk, include new approaches for calculating market and credit valuation adjustment risk and revise the treatment of equity exposures not subject to market risk capital requirements.

The new approach to calculating market risk also would apply to calculations under the standardized approach.

The methodology for operational risk would include differential treatment of fee and other non-interest revenues as compared to interest income for purposes of determining operational risk-weighted assets.

The proposed rules would also include additional credit risk capital requirements for certain “unconditionally cancellable commitments” such as unused portions of committed lines of credit (e.g., credit cards), and would create a proxy methodology to assign capital requirements to credit exposure on products that carry no pre-set spending limits such as charge cards.

Under the proposal, the revisions would become effective on July 1, 2025, subject to a three-year transition period for certain provisions, including phasing in the use of risk-weighted assets under the expanded risk-based approach.

While the U.S.

federal bank regulatory agencies have solicited comments on the proposal and the rule may not be adopted as proposed, based on a preliminary analysis, we estimate that the increase in our risk-weighted assets under the expanded risk-based approach as currently proposed could consume the capital buffer between our minimum regulatory requirements and our current CET1 risk-based capital ratio.

See below for additional information on our minimum CET1 regulatory requirement and “Consolidated Capital Resources and Liquidity — Capital Strategy” under “MD&A” for additional information on our current CET1 risk-based capital ratio.

This estimated impact reflects our current understanding of the proposal, the application to our businesses as currently conducted and the current composition of our balance sheet, and therefore does not reflect the impact of any changes we may make in the future as a result of the expanded risk-based approach or otherwise.

The ultimate impact will depend on the final rulemaking, future minimum regulatory requirements as well as management decisions regarding our product constructs, capital distributions and target capital levels, and the actual impact of any final rule could materially differ from our current estimate.

In December 2018, federal banking regulators issued a final rule that provides an optional three-year phase-in period for the adverse regulatory capital effects of adopting the Current Expected Credit Loss (CECL) methodology pursuant to new accounting guidance for the recognition of credit losses on certain financial instruments, which became effective January 1, 2020.

In August 2020, federal banking regulators issued a final rule that provides an option to delay the estimated impact of the adoption of the CECL methodology on regulatory capital for up to two years, followed by the three-year phase-in period at 25 percent once per year beginning in January 1, 2022.

We elected to delay the recognition of $0.7 billion of impact to regulatory capital from the adoption of the CECL methodology for two years, followed by the three-year phase-in period.

We elected to delay the recognition of $0.7 billion of reduction in regulatory capital from the adoption of the CECL methodology for two years, followed by the three-year phase-in period.

As of January 1, 2024, the Company has phased in 75 percent of such amount.

3 unchanged sentences

The SCB equals (i) the difference between a bank holding company’s starting and minimum projected CET1 capital ratios under the supervisory severely adverse scenario under the Federal Reserve’s stress tests described below, plus (ii) one year of planned common stock dividends as a percentage of risk-weighted assets.

On August 4, 2022, the Federal Reserve confirmed the SCB for the Company of 2.5 percent, which remained unchanged from the level announced in June 2021.

On July 27, 2023, the Federal Reserve confirmed the SCB for the Company of 2.5 percent, which remained unchanged from the level announced in August 2022.

As a result, the effective minimum ratios for the Company (taking into account the SCB requirement) and AENB (taking into account the CCB requirement) are 7.0 percent, 8.5 percent and 10.5 percent for the CET1 capital, Tier 1 capital and Total capital ratios, respectively.

1 unchanged sentence

A bank holding company’s SCB requirement is effective on October 1 of each year and will remain in effect through September 30 of the following year unless it is reset in connection with resubmission of a capital plan, as discussed below.

Category III firms are also subject to (i) if enacted by the Federal Reserve, a CET1 countercyclical capital buffer requirement of up to an additional 2.5 percent and (ii) a minimum supplementary leverage ratio of 3.0 percent that takes into account both on‐balance sheet and certain off‐balance sheet exposures.

We are also required to comply with minimum leverage ratio requirements.

4 unchanged sentences

The rule requires the maintenance of a liquidity buffer, consisting of highly liquid assets, that is sufficient to meet projected net outflows for 30 days over a range of liquidity stress scenarios, and a minimum liquidity coverage ratio (LCR) that measures a firm’s high-quality liquid assets to its projected net outflows.

Category IV firms with less than $50 billion in weighted short-term wholesale funding, such as the Company, are not subject to a specific LCR requirement.

A second standard provided for in the Basel III liquidity framework, referred to as the net stable funding ratio (NSFR), requires a minimum amount of longer-term funding based on the assets and activities of banking entities.

Under the NSFR rule, Category IV firms with less than $50 billion in weighted short-term wholesale funding, such as the Company, are not subject to a specific NSFR requirement.

As a Category IV firm with less than $50 billion in weighted short-term wholesale funding, we are not currently subject to a specific LCR or NSFR requirement;

however, as described above, we anticipate becoming a Category III firm in 2024.

Category III firms and their depository institution subsidiaries are subject to LCR and NSFR requirements but at a reduced level (that is, at 85 percent of the full requirements), unless they have $75 billion or more in weighted short-term wholesale funding, in which case the full requirements would apply.

Category II firms and their depository institution subsidiaries are subject to the full requirements of the LCR and NSFR, as well as a requirement to submit a liquidity monitoring report on a daily (rather than monthly) basis.

Proposed Long-Term Debt Requirements

On August 29, 2023, the U.S.

federal bank regulatory agencies issued a notice of proposed rulemaking that, if adopted as proposed, would require covered bank holding companies such as the Company to issue and maintain minimum amounts of eligible external long-term debt with specific terms for purposes of absorbing losses or recapitalizing the covered bank holding company and its operating subsidiaries.

The notice of proposed rulemaking also proposed requiring certain insured depository institutions that have at least $100 billion in consolidated assets, such as AENB, to maintain minimum amounts of eligible internal long-term debt for purposes of absorbing losses or recapitalizing the insured depository institution.

Stress Testing and Capital Planning

1 unchanged sentence

As part of the Comprehensive Capital Analysis and Review (CCAR), the Federal Reserve uses pro-forma capital positions and ratios under such stress scenarios to determine the size of the SCB for each CCAR participating firm.

As a Category IV firm, the Company is required to participate in the supervisory stress tests every other year and was most recently subject to the Federal Reserve’s supervisory stress tests in 2022.

Because the Company is currently a Category IV firm, it is required to participate in the supervisory stress tests every other year and is subject to the Federal Reserve’s supervisory stress tests in 2024.

The Company is required to develop and submit to the Federal Reserve an annual capital plan on or before April 5 of each year.

For Category IV firms, such as the Company, the portion of the SCB based on the Federal Reserve's supervisory stress tests is calculated every other year.

For Category IV firms, the portion of the SCB based on the Federal Reserve’s supervisory stress tests is calculated every other year.

During a year in which a Category IV firm does not undergo a supervisory stress test, the firm receives an updated SCB that reflects the firm’s updated planned common stock dividends.

2 unchanged sentences

If we are required to resubmit our capital plan, we must receive prior approval from the Federal Reserve for any capital distributions (including common stock dividend payments and share repurchases), other than a capital distribution on a newly issued capital instrument.

Category III firms are subject to annual supervisory stress tests, with the SCB calculated each year, and must conduct company‐run stress tests every other year (commonly referred to as Dodd‐Frank Act Stress Tests or “DFASTs”).

Category II firms must conduct company-run stress tests on an annual basis rather than every other year.

Dividends and Other Capital Distributions

16 unchanged sentences

Certain bank holding companies are required to submit resolution plans to the Federal Reserve and FDIC providing for the company’s strategy for rapid and orderly resolution in the event of its material financial distress or failure.

However, Category IV firms, such as the Company, are not required to submit a holding company resolution plan.

However, Category IV firms are not required to submit a holding company resolution plan, while Category III firms are required to submit a holding company resolution plan every three years.

AENB continues to be required to prepare and provide a separate resolution plan to the FDIC that would enable the FDIC, as receiver, to effectively resolve AENB under the FDIA in the event of failure.

1 unchanged sentence

AENB submitted its most recent resolution plan in December 2022, as required.

On August 29, 2023, the FDIC issued a notice of proposed rulemaking that would require insured depository institutions with $100 billion or more in assets, including AENB, to submit full resolution plans every two years with interim supplements in non-submission years.

Under the proposal, resolution plans would be subject to more stringent standards with respect to their assumptions and content, as well as enhanced credibility standards for the FDIC’s evaluation of resolution plans and expanded expectations regarding engagement and capabilities testing.

Orderly Liquidation Authority

36 unchanged sentences

The FDIC’s deposit insurance fund is funded by assessments on insured depository institutions, including AENB, which are subject to adjustment by the FDIC.

On November 16, 2023, the FDIC adopted a final rule imposing a special assessment to recover the cost associated with protecting uninsured depositors in connection with the failures of two U.S.

banks in March 2023.

The special assessment will total approximately $53 million for us (which amount was recognized as an expense in the fourth quarter of 2023), and will be paid over eight quarterly assessment periods, with the first quarterly assessment period beginning on January 1, 2024.

Community Reinvestment Act

AENB is subject to the CRA, which imposes affirmative, ongoing obligations on depository institutions to meet the credit needs of their local communities, including low- and moderate-income neighborhoods, consistent with the safe and sound operation of the institution.

In May 2022, the federal banking agencies issued a joint notice of proposed rulemaking proposing revisions to the CRA regulations, including with respect to the delineation of assessment areas, the overall evaluation framework and performance standards and metrics, the definition of community development activities and data collection and reporting.

AENB is currently designated a “limited purpose bank” under CRA regulations.

In October 2023 , the U.S.

regulatory agencies adopted a final rule that makes extensive revisions to the CRA regulatory framework, including to the definition of “limited purpose bank,” which could impact AENB and alter its CRA compliance obligations.

Certain provisions of the final rule become effective on April 1, 2024, but the majority of the final rule’s operative provisions (including the revisions to the definition of “limited purpose bank”) become effective on January 1, 2026, with additional data collection and reporting requirements becoming effective on January 1, 2027.

We are currently evaluating the impact of the final rule but expect that it will increase AENB’s obligations and compliance costs.

Climate Risk Management

banking agencies have recently increased their focus on climate risk-related supervision.

For example, on December 16, 2021, the OCC issued for public comment a set of proposed “Principles for Climate-Related Financial Risk Management for Large Banks.” The principles would apply to OCC-regulated institutions with more than $100 billion in total consolidated assets, like AENB, and are broadly designed to provide a high-level framework for the safe and sound management of exposures to climate-related financial risks consistent with existing OCC rules and guidance.

federal bank regulatory agencies have recently increased their focus on climate risk-related supervision.

For example, on October 24, 2023, the U.S.

federal bank regulatory agencies issued “Principles for Climate-Related Financial Risk Management for Large Financial Institutions.” The principles would apply to financial institutions with more than $100 billion in total consolidated assets, like the Company and AENB, and are broadly designed to provide a high-level framework for the safe and sound management of exposures to climate-related financial risks consistent with existing U.S.

federal bank regulatory agencies’ rules and guidance.

The principles outline six key aspects of climate-related financial risk management:

5 unchanged sentences

In addition, the principles offer risk assessment guidance for incorporating climate-related financial risks in various traditional risk categories.

On March 30, 2022 and December 2, 2022, the FDIC and the Federal Reserve, respectively, also issued for public comment substantially similar sets of draft principles targeted at financial institutions with total consolidated assets of more than $100 billion subject to their respective supervision, including, with respect to the Federal Reserve, the Company.

It is too early to determine what regulations and policies may be adopted or apply to the Company and AENB and the effect of any such regulations or policies on the Company and AENB.

It is too early to determine what other regulations and policies may be adopted or apply to the Company and AENB and the effect of any such regulations or policies on the Company and AENB.

Consumer Financial Products Regulation

9 unchanged sentences

The proposed rule would also eliminate the annual inflation adjustment for such safe harbor amount and prohibit late fee amounts above 25 percent of the consumer’s required minimum payment.

The rule proposal, if adopted, is not expected to become effective before 2024.

On March 30, 2023, the CFPB adopted a final rule requiring covered financial institutions, such as us, to collect and report data to the CFPB regarding certain small business credit applications.

Based on our small business credit transaction volume, we will be required to comply with this rule by October 1, 2024, subject to the outcome of litigation over the final rule.

On October 19, 2023, the CFPB issued a proposed rule on personal financial data rights that the CFPB stated would accelerate a shift toward open banking.

The proposed rule would require data providers to provide consumers and consumer-authorized third parties with access to consumers’ financial data free of charge and would also impose requirements on authorized third parties, as well as data aggregators that facilitate access to consumers’ financial data.

If the proposed rule is adopted as proposed, it (and other open banking initiatives) has the potential to change the competitive landscape, which would present new challenges and opportunities to our business model.

We are also regulated in the United States under the “money transmitter” or “sale of check” laws in effect in most states.

4 unchanged sentences

Payments Regulation

Legislators and regulators in various countries in which we operate have focused on the operation of card networks, including through enforcement actions, legislation and regulations to change certain practices or pricing of card issuers, merchant acquirers and payment networks, and, in some cases, to establish broad and ongoing regulatory oversight regimes for payment systems.

The EU, Australia, Canada and other jurisdictions have focused on interchange fees (that is, the fee paid by the bankcard merchant acquirer to the card issuer in payment networks like Visa and Mastercard), as well as the rules, contract terms and practices governing merchant card acceptance.

3 unchanged sentences

There is uncertainty as to when or how interchange fee caps and other provisions of the EU payments legislation might apply when we work with cobrand partners and agents in the EU.

In a ruling issued on February 7, 2018, the EU Court of Justice confirmed the validity of fee capping and other provisions in circumstances where three-party networks issue cards with a cobrand partner or through an agent, although the ruling provided only limited guidance as to when or how the provisions might apply in such circumstances and remains subject to differing interpretations by regulators and participants in cobrand arrangements.

On August 29, 2023, the Dutch Trade and Industry Appeals Tribunal referred questions to the EU Court of Justice on the interpretation of the application of the interchange fee caps in connection with an administrative proceeding by the Netherlands Authority for Consumers and Markets regarding our cobrand relationship with KLM Royal Dutch Airlines.

Given differing interpretations by regulators and participants in cobrand arrangements, we are subject to regulatory action, penalties and the possibility we will not be able to maintain our existing cobrand and agent relationships in the EU.

See “ Our business is subject to comprehensive government regulation and supervision, which could materially adversely affect our results of operations and financial condition ” under “Risk Factors.”

In various countries, such as certain Member States in the EU and Australia, merchants are permitted by law to surcharge card purchases.

See “ Our business is subject to evolving and comprehensive government regulation and supervision, which could materially adversely affect our results of operations and financial condition ” under “Risk Factors.”

In various countries, such as certain Member States in the EU, Australia and Canada (other than in Quebec), merchants are permitted by law to surcharge card purchases.

In addition, the laws of a number of states in the United States that prohibit surcharging have been overturned and certain states have passed or are considering laws to permit surcharging by merchants.

Effective October 6, 2022, merchants in Canada (other than in Quebec) are now permitted to surcharge credit card purchases up to a maximum of 2.4 percent as a result of a litigation settlement with Visa and Mastercard.

Surcharging is an adverse customer experience and could have a material adverse effect on us, particularly where it only or disproportionately impacts credit card usage or card usage generally, our Card Members or our business.

4 unchanged sentences

In 2021, it imposed restrictions on American Express Banking Corp.

from engaging in certain card issuing activities in India, which were lifted in August 2022 following significant investment in technology, infrastructure and resources to comply with the regulation.

from engaging in certain card issuing activities in India, which were lifted in 2022 following significant investment in technology, infrastructure and resources to comply with the regulation.

The development and enforcement of these and other similar laws, regulations and policies may adversely affect our ability to compete effectively and maintain and extend our global network.

Privacy, Data Protection, Data Governance, Information and Cyber Security

Regulatory and legislative activity in the areas of privacy, data protection, data governance and information and cyber security continues to increase worldwide.

We have established, and continue to maintain, policies and a governance framework to comply with applicable privacy, data protection, data governance and information and cyber security laws and requirements, meet evolving customer and industry expectations and support and enable business innovation and growth.

Our regulators are increasingly focused on ensuring that our privacy, data protection, data governance and cyber security-related policies and practices are adequate to inform customers of our data collection, use, sharing and/or security practices, to provide them with choices, if required, about how we use and share their information, and to appropriately safeguard their personal information and account access.

Regulators are also focused on data management, resiliency and business continuity, and third-party risk management policies and practices.

Privacy, Data Protection, Data Governance, Information Security and Cybersecurity

Regulatory and legislative activity in the areas of privacy, data protection, data governance and information security and cybersecurity continues to increase worldwide.

We have established, and continue to maintain, policies and a governance framework to comply with applicable privacy, data protection, data governance and information security and cybersecurity laws and requirements, meet evolving customer and industry expectations and support and enable business innovation and growth;

however, our policies and governance framework may be insufficient given the size and complexity of our business and heightened regulatory scrutiny.

Our regulators are increasingly focused on ensuring that our privacy, data protection, data governance and cybersecurity-related policies and practices are adequate to inform customers of our data collection, use, sharing and/or security practices, to provide them with choices, if required, about how we use and share their information, and to appropriately safeguard their personal information and account access.

Regulators are also focused on data management, technology infrastructure and architecture, technology operations, resiliency and business continuity, and third-party risk management policies and practices.

In the United States, certain of our businesses are subject to the privacy, disclosure and safeguarding provisions of the Gramm-Leach-Bliley Act (GLBA) and its implementing regulations and guidance.

Among other things, GLBA imposes certain limitations on our ability to share consumers’ nonpublic personal information with nonaffiliated third parties and requires us to develop, implement and maintain a written comprehensive information security program containing safeguards that are appropriate to the size and complexity of our business, the nature and scope of our activities and the sensitivity of customer information that we process.

We have also expanded privacy rights to California residents who are not covered by GLBA, pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020.

Various regulators, U.S.

states and territories are considering similar requirements or have adopted laws, rules and regulations pertaining to privacy and/or information and cyber security that may be more stringent and/or expansive than federal requirements.

We are also subject to certain privacy, data protection, data governance and information and cyber security laws in other countries in which we operate (including countries in the EU, Australia, Canada, China, Japan, Hong Kong, India, Indonesia, Mexico, Singapore, Thailand and the United Kingdom), some of which are more stringent and/or expansive than those in the United States and some of which may conflict with each other.

Some countries and the EU have instituted or are considering instituting requirements that make it onerous to transfer personal data to other jurisdictions.

Other countries may require in-country data processing and/or in-country storage of data.

We also have expanded privacy-related obligations with respect to California residents who are not covered by GLBA, pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020.

Various regulators and other U.S.

states and territories are considering similar requirements or have adopted laws, rules and regulations pertaining to privacy and/or information security and cybersecurity that may be more stringent and/or expansive than federal requirements.

We are also subject to certain privacy, data protection, data governance and information security and cybersecurity laws in other countries in which we operate (including Member States in the EU, Australia, Canada, China, Japan, Hong Kong, India, Indonesia, Mexico, Singapore, Thailand and the United Kingdom), some of which are more stringent and/or expansive than those in the United States and some of which may conflict with each other.

Some jurisdictions have instituted or are considering instituting requirements that make it onerous to transfer personal data to other jurisdictions, and certain countries require in-country data processing and/or in-country storage of data.

Compliance with such laws results in higher technology, administrative and other costs for us, could limit our ability to optimize the use of our closed-loop data, and could require use of local technology services.

1 unchanged sentence

Data breach and operational outage notification laws or regulatory activities to encourage such notifications and regulatory activity and laws around resiliency, business continuity and third-party risk management are also becoming more prevalent in jurisdictions outside the United States in which we operate.

In Europe, the EU General Data Protection Regulation (GDPR) imposes legal and compliance obligations on companies that process personal data of individuals in the EU, irrespective of the geographical location of the company, with the potential for significant fines for non-compliance (up to 4 percent of total annual worldwide revenue).

The GDPR includes, among other things, a requirement for prompt notice of data breaches, in certain circumstances, to affected individuals and supervisory authorities.

The UK GDPR mirrors the compliance requirements and fine structure of the GDPR.

In October 2022, an Executive Order was signed that, together with regulations issued by the U.S.

Department of Justice, would implement a new data privacy framework for cross border transfers of EU personal data to the United States.

The EU General Data Protection Regulation (GDPR) and the equivalent UK GDPR impose legal and compliance obligations on companies that process personal data of individuals in the EU and UK, irrespective of the geographical location of the company, with the potential for significant fines for non-compliance (up to 4 percent of total annual worldwide revenue).

These laws include, among other things, a requirement for prompt notice of data breaches, in certain circumstances, to affected individuals and supervisory authorities and restrictions on the cross-border transfers of EU or UK personal data.

We rely on a variety of compliant transfer mechanisms to transfer this personal data, including the use of binding corporate rules and standard contractual clauses.

In 2023, the EU and UK regulators approved the EU-U.S.

Data Privacy Framework and the UK Data Bridge, enabling easier transfers of EU and UK personal data to participating companies in the United States.

We are also subject to certain data protection laws in Member States in the EU, which may be more stringent than the EU GDPR.

Our data protection programs have become the subject of heightened scrutiny in certain Member States in the EU and we continue to make changes to our privacy practices and data governance to comply with these requirements.

Anti-Money Laundering, Countering the Financing of Terrorism, Economic Sanctions and Anti-Corruption Compliance

7 unchanged sentences

AML/CFT laws.

Many of the statutory provisions in the AMLA will require additional rulemakings, reports and other measures, the effects of which are not known at this time.

Many of the statutory provisions in the AMLA will require additional rulemakings, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance.

In Europe, AML/CFT requirements are largely the result of countries transposing the 5th and 6th EU Anti-Money Laundering Directives (and preceding EU Anti-Money Laundering Directives) into local laws and regulations.

Numerous other countries, such as Argentina, Australia, Canada, India, Mexico, New Zealand and Russia, have also enacted or proposed new or enhanced AML/CFT legislation and regulations applicable to American Express.

Among other things, these laws and regulations require us to establish AML/CFT programs that meet certain standards, including, in some instances, expanded reporting, particularly in the area of suspicious transactions, and enhanced information gathering and recordkeeping requirements.

Our AML/CFT programs have become the subject of heightened scrutiny in some countries, including certain Member States in the EU.

Numerous other countries have also enacted or proposed new or enhanced AML/CFT legislation and regulations applicable to American Express.

Among other things, these laws and regulations generally require us to establish AML/CFT programs that meet certain standards, including policies and procedures to collect information from and verify the identities of our customers, and to monitor for and report suspicious transactions, in addition to other information gathering and recordkeeping requirements.

programs have become the subject of heightened scrutiny in some countries, including certain Member States in the EU.

Any errors, failures or delays in complying with AML/CFT laws, perceived deficiencies in our AML/CFT programs or association of our business with money laundering, terrorist financing, tax fraud or other illicit activity can give rise to significant supervisory, criminal and civil proceedings and lawsuits, which could result in significant penalties and forfeiture of assets, loss of licenses or restrictions on business activities, or other enforcement actions.

3 unchanged sentences

Failure to comply with such requirements could subject us to serious legal and reputational consequences, including criminal penalties.

The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others.

The United States prohibits U.S.

persons from engaging with individuals and entities identified as “Specially Designated Nationals,” such as terrorists and narcotics traffickers, without a license or other authorization.

These prohibitions are administered by the U.S.

Department of the Treasury’s Office of Foreign Assets Control (OFAC).

The United States has imposed economic sanctions that affect transactions involving targeted jurisdictions, parties or activities.

Department of the Treasury’s Office of Foreign Assets Control (OFAC) administers most U.S.

OFAC regulations prohibit U.S.

persons from engaging in financial transactions with or relating to a targeted individual, entity, vessel, government or country, require the blocking of assets in which the individual, entity, vessel, government or country has an interest, and prohibit transfers of property subject to U.S.

jurisdiction (including property in the possession or control of U.S.

persons) to such individual, entity, vessel, government or country.

Blocked assets (e.g., property or bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC.

persons from engaging in financial transactions with or relating to, or other dealings involving, a targeted individual, entity, vessel, government or country without a license or other authorization and require U.S.

persons to block property and property interests of parties on OFAC’s Specially Designated Nationals and Blocked Persons List and entities owned 50 percent or more by one or more Specially Designated Nationals.

Blocked property (e.g., bank deposits or other financial assets) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC.

Regulatory authorities in other international jurisdictions, such as the United Kingdom and Member States in the EU, administer similar programs to U.S.

sanction programs.

We maintain a global sanctions compliance program designed to meet the requirements of applicable sanctions regimes.

16 unchanged sentences

If these or other regulations are adopted in a form similar to what has been proposed, they will impose limitations on the manner in which we may structure compensation for our colleagues, which could adversely affect our ability to hire, retain and motivate key colleagues.

In October 2022, the SEC adopted a new rule directing national securities exchanges to require policies mandating, in the case of a restatement of previously issued financial statements, the recovery of excess incentive-based compensation paid to current or former executive officers and requiring listed issuers to disclose any recovery analysis where recovery is triggered by any such restatement.

ADDITIONAL INFORMATION

8 unchanged sentences

As a result, the amount of Card Member loans and receivables outstanding tend to be moderately higher during that quarter.

The average discount rate also tends to be slightly lower during the fourth quarter due to a higher level of retail-related billed business.

Additionally, we tend to have a higher proportion of retail-related billed business in the fourth quarter, which on average has a slightly lower merchant discount rate.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business