Treasury Announces First Civil Penalty Under Outbound Investment Security Program

On 7 October 2026, the US Department of the Treasury (Treasury) announced its first civil penalty under the Outbound Investment Security Program (OISP). This penalty was imposed on a transaction that reportedly occurred only four months after the OISP entered into effect, and underscores that Treasury will be taking an active role in enforcing this program. Treasury imposed a US$200,000 penalty on Amidi, LLC (Amidi) in July 2026 for failing to submit a required notification of an investment by its controlled foreign entity in a Chinese embodied artificial intelligence (AI) company. The penalty is more than double the reported value of the transaction. Treasury’s announcement focuses on the failure to submit the required notification and does not indicate that the underlying investment was prohibited.

Background

According to Treasury, on 19 April 2025, Amidi’s subsidiary, a Chinese fund, invested approximately US$92,478 in Shanghai Qiongche Intelligent Technology Company Limited (Noematrix). Noematrix is a private Chinese company that develops AI, robotics, and embodied intelligence. Treasury identified the transaction through its regular compliance and market monitoring efforts. The announcement does not provide additional detail regarding the notification failure or explain how Treasury calculated the US$200,000 penalty.

The notification requirement arises under the OISP (31 C.F.R. Part 850), which took effect on 2 January 2025. The OISP currently requires notification to Treasury of certain types of investments and prohibits certain other types of investments by US persons into entities in or connected to the People’s Republic of China, the Special Administrative Region of Hong Kong, and the Special Administrative Region of Macau that are engaged in certain activities in the quantum computing, AI, and semiconductor sectors. The notification generally must be submitted within 30 days after completion of the transaction.

In its 17 January 2025 Outbound Investment Security Program Enforcement Overview and Guidance (Guidance), Treasury describes the conduct that may violate the OISP and the factors it may consider in determining whether to impose a civil penalty and the appropriate penalty amount. The Guidance states that Treasury may consider information from across the US government, publicly available information, tips, and filing parties; and may request information or use its subpoena authority when appropriate. Treasury’s identification of the Amidi transaction through its regular compliance and market monitoring efforts appears consistent with this enforcement approach. 

On 18 December 2025, Congress enacted the Comprehensive Outbound Investment National Security Act of 2025 (COINS) as part of the Fiscal Year 2026 National Defense Authorization Act. COINS codifies the OISP framework and retains its coverage of semiconductors and microelectronics, AI, and quantum information technologies. It adds high-performance computing and supercomputing and hypersonic systems, extends the countries of concern beyond China, and directs Treasury to establish a program to identify transactions that were not notified. For quantum, COINS leaves the technical parameters of the prohibited and notifiable categories to Treasury’s rulemaking, so the existing thresholds could change.

Key Takeaways

As Treasury’s first publicly announced OISP civil penalty, the action provides an early indication of how Treasury may approach enforcement of the program. The US$200,000 penalty was more than twice the approximately US$92,478 investment; and Treasury imposed it for the failure to submit a required notification rather than for the investment itself, which appears to be one that was permissible. The announcement also demonstrates that Treasury is using its compliance and market monitoring efforts to identify potential OISP violations. Treasury also encouraged anyone who believes a violation may have occurred to submit tips or referrals through a dedicated OISP tips line.

The action involved an investment made through a controlled foreign entity, illustrating that OISP obligations may arise in connection with investments undertaken through foreign subsidiaries and controlled investment funds.

The action also comes as the OISP is poised to expand under COINS. Because COINS directs Treasury to identify nonnotified transactions, companies should assume that Treasury’s attention to notification compliance will continue and may reach a broader range of investments.

Treasury further noted that enforcement decisions are based on the facts and circumstances of a particular matter, including applicable aggravating and mitigating factors. Treasury’s Guidance identifies a nonexhaustive set of factors that Treasury may consider, including the actual or potential harm to US national security; and the subject person’s negligence, awareness, or intent. Treasury may also consider efforts to conceal or delay disclosure of the conduct, cooperation, and remediation; and the subject person’s compliance resources, policies, training, procedures, and compliance history. 

The Guidance also emphasizes timely and complete voluntary self-disclosure. In assessing timeliness, Treasury considers whether it learned of the conduct before the disclosure. The announcement does not indicate whether Amidi made a voluntary self-disclosure or identify which aggravating or mitigating factors Treasury considered in determining the US$200,000 penalty.

Practical Considerations

Companies with foreign subsidiaries or controlled investment funds should consider whether they have sufficient visibility into investments undertaken outside the United States to identify potential OISP issues. In light of this action, companies should consider the following steps: (i) requiring foreign subsidiaries and controlled funds to report proposed and completed China-nexus investments to the US parent; (ii) tracking the 30-day notification deadline for any transaction that may be notifiable, including investments made outside the United States; (iii) screening China-nexus investment targets before closing against the OISP’s technology categories, including AI-related businesses; and (iv) establishing a process for evaluating voluntary self-disclosure if a missed notification is identified.

Under the OISP’s knowledge standard, Treasury may consider information that a US person knew or could have obtained through a reasonable and diligent inquiry. Treasury’s regulations also identify compliance measures, training, internal controls, and audits among the factors that may be relevant in assessing whether a US person took reasonable steps to prevent a prohibited transaction by a controlled foreign entity (31 C.F.R. § 850.216). Although these factors address the prevention of prohibited transactions, similar controls are likely to be relevant to identifying notifiable transactions in time to meet the 30-day deadline.

Companies should also begin planning for COINS. Treasury must issue implementing regulations by mid-March 2027; and those regulations may revise the technology definitions, countries of concern, and exceptions. Investors with exposure to quantum, semiconductor, AI, high-performance computing, or hypersonic businesses should monitor the rulemaking; and consider how their screening and notification procedures would need to adapt. Until then, the current OISP rules continue to apply.

Please contact any member of our International Trade, Investment Controls, and National Security practice group if you have questions regarding the OISP or would like to discuss how the rules may apply to a particular transaction.