Treasury Announces First-Ever Penalty Under the Outbound Investment Security Program

On October 7, 2026, the U.S. Department of the Treasury (Treasury) announced the first civil penalty under its Outbound Investment Security Program (OISP).

This was a $200,000 penalty against Amidi LLC, a U.S. investment firm and parent entity of the Plug and Play Tech Center, for failing to notify Treasury of a $92,478 investment by its Chinese subsidiary in a Chinese robotics, artificial intelligence (AI), and embodied intelligence company. The dollar amount is small, but that is part of the point: Treasury chose a notification failure by a controlled foreign subsidiary of a U.S. investor for its first penalty under the OISP — it did not wait for either a prohibited transaction or a large transaction.

Treasury Secretary Scott Bessent stated that the “penalty announcement under the Outbound Investment Security Program underscores Treasury’s commitment to safeguarding U.S. national security through robust investment security measures that preserve America’s technological leadership and advance President Trump’s America First Investment Policy.”

The OISP Requirements

The OISP (as set forth under 31 C.F.R. Part 850), which became effective January 2, 2025, requires notification to Treasury within 30 days of completing, and in some cases prohibits outright, certain U.S. investments in “persons of a country of concern” — currently China (including Hong Kong and Macau) — that are engaged in specified semiconductor, quantum, or AI activities (“covered activities”).

Liability under the OISP is knowledge-based, reflecting what a U.S. person knew or should have known about the transaction. Treasury has stated that a U.S. person must conduct a “reasonable and diligent inquiry” to “obtain relevant information about a transaction as part of a reasonable pre-transaction due diligence process,” which includes questions to the investment target or counterparty, contractual representations or warranties, and efforts to obtain and consider public and available nonpublic information, including through commercial databases. Treasury will consider the presence of “warning signs,” or whether a U.S. person “purposefully avoided learning or seeking relevant information,” in assessing knowledge.

Critically, and relevant here, the OISP imposes obligations on a U.S. person with respect to its controlled foreign entities. As Treasury’s release noted, a U.S. person is required “(a) to file a notification with Treasury regarding any transaction by its controlled foreign entity if the transaction would be notifiable if engaged in by a U.S. person; and (b) to take all reasonable steps to prohibit and prevent transactions by its controlled foreign entity if the transaction would be prohibited if engaged in by a U.S. person.”

The Amidi Enforcement Action

Per Treasury’s release, on April 19, 2025, Amidi’s Chinese subsidiary invested $92,478 in Shanghai Qiongche Intelligent Technology Co. (Noematrix), “a private Chinese company that develops artificial intelligence, robotics, and embodied intelligence.” The transaction was notifiable under the OISP, but no notification was filed. In July 2026, Treasury imposed a $200,000 penalty, more than twice the transaction value, for the notification failure.

Treasury stated that it “identified this transaction as part of its regular and ongoing compliance and market monitoring efforts.” The release cites the aggravating and mitigating factors in Treasury’s January 2025 Enforcement Guidance but does not enumerate the specific factors that informed the enforcement action.

The release does not indicate that Treasury compelled Amidi to divest, which is a remedy only available where there is a “prohibited transaction.”

Key Takeaways

By penalizing a small, notifiable investment by a non-U.S. subsidiary of a U.S. investment firm, Treasury is signaling that it is actively monitoring for non-notified transactions — including transactions by non-U.S. affiliates — and will act on them.

The penalty underscores that U.S. companies must carefully consider outbound investment rules and restrictions early in deal diligence, including by their controlled foreign entities. First, as this case illustrates, the U.S. parent must notify Treasury of a notifiable transaction by its controlled foreign entity, which practically means the parent needs visibility into its foreign affiliates’ deal flow in time to file within 30 days of closing. Second, the parent must take “all reasonable steps” to prohibit and prevent any transaction by its controlled foreign entity that would be a prohibited transaction if engaged in by a U.S. person.[1] Treasury has stated that it expects a U.S. person will “exercise its rights as a parent to prevent a controlled foreign entity from engaging in a transaction that would be prohibited if undertaken directly by the U.S. person” and that “all reasonable steps” would include the following measures:

• “[T]he execution of agreements with respect to compliance with the Outbound Rules between the U.S. person and its controlled foreign entity;
• The existence and exercise of governance or shareholder rights by the U.S. person with respect to the controlled foreign entity, where applicable;
• The existence and implementation of periodic training and internal reporting requirements by the U.S. person and its controlled foreign entity with respect to compliance with the Outbound Rules;
• The implementation of appropriate and documented internal controls, including internal policies, procedures, or guidelines that are periodically reviewed internally, by the U.S. person and its controlled foreign entity; and
• Implementation of a documented testing and/or auditing process of internal policies, procedures, or guidelines.”

U.S. companies with controlled foreign entities should consider reviewing their compliance programs against these measures to ensure that they have taken steps that would meet Treasury’s expectations.

Even if a foreign entity is not controlled by a U.S. company, the OISP still has implications for “U.S. nationals working at foreign entities.” Specifically, as Treasury noted in FAQ 8, “U.S. persons are prohibited from knowingly directing transactions by non-U.S. entities that the U.S. person knows at the time of the transaction would be prohibited if engaged in by a U.S. person.” The rules, in effect, “provide for a U.S. person’s recusal from participation in certain activities to avoid violating this prohibition.”

Looking Ahead: Where Outbound Is Going

Parties can expect the OISP’s jurisdictional breadth to significantly expand and enforcement actions to continue.

The FY2026 National Defense Authorization Act (NDAA), signed December 18, 2025, includes the Comprehensive Outbound Investment National Security Act (the COINS Act), which codifies the OISP under the Defense Production Act. Treasury has 450 days from enactment — until March 13, 2027 — to issue implementing regulations.

In the Amidi penalty announcement, Treasury noted that the COINS Act will “expand OISP jurisdiction to include investments in additional countries and technology sectors.” The Act adds Russia, Iran, North Korea, Cuba, and Venezuela (under the Maduro regime)[2] as countries of concern; adds high-performance computing, supercomputing, and hypersonics as covered technologies; mandates a non-notified transaction process; and funds the program at $150 million a year with direct hiring authority. The COINS Act also extends the rule’s “knowingly directing” restriction (described above) from prohibited to notifiable transactions.

Treasury is signaling that it intends to make outbound investment enforcement a priority as the COINS Act regulations take effect. Assistant Secretary for Investment Security Christopher Pilkerton said Treasury “will continue to ensure that investors comply with the requirements established under the program.” Notably, the press release invites tips to be submitted to Outbound.Tips@treasury.gov, and FinCEN’s proposed whistleblower rule will provide potential monetary rewards for tips relating to violations of the outbound regulations.[3]

Accordingly, U.S. investors should incorporate OISP diligence, processes, and protections as standard components of their cross-border investment activities. Counterparties, including Chinese target companies and co-investors, should also expect continued diligence and scrutiny from U.S. LPs and investors, including on the scope and nature of the target company’s technology and representations and covenants on covered activities.

The Paul Hastings team will continue to monitor Treasury’s outbound investment security program, including its implementation of the COINS Act, and provide further updates as appropriate.