• Treasury announced its first public enforcement action under the Outbound Investment Security Program (“OISP”), imposing a $200,000 civil penalty on a U.S. company for failing to notify Treasury of its Chinese fund subsidiary’s investment in a Chinese artificial intelligence and robotics company.
• Within the next several weeks, Treasury is expected to issue proposed regulations implementing the Comprehensive Outbound Investment National Security Act of 2025, which authorizes expansion of the current OISP framework.

On October 7, 2026, the U.S. Treasury Department (“Treasury”) announced its first Outbound Investment Security Program (“OISP”) civil penalty since the OISP came into force on January 2, 2025. This announcement comes as Treasury prepares to implement the Comprehensive Outbound Investment National Security Act of 2025 (the “COINS Act”), which authorizes Treasury to expand its existing OISP in key areas, including the countries and technology sectors targeted for U.S. investment restrictions. According to recent remarks by senior Treasury officials, we expect Treasury to propose COINS Act regulations within the next several weeks.

In light of Treasury’s enforcement action and the anticipated proposed COINS Act regulations, firms may wish to consider reviewing their OISP compliance programs, assessing how their business activities may be impacted by expansions to the OISP under the COINS Act and reminding stakeholders about OISP compliance and enforcement risks.

Background on the OISP

The OISP, established pursuant to Executive Order 14105 and implemented through Treasury’s regulations at 31 C.F.R. Part 850, became effective on January 2, 2025. Currently, the OISP prohibits or requires notice to Treasury of certain investments by U.S. persons involving entities with specified connections to the People’s Republic of China (together with the Special Administrative Regions of Hong Kong and Macau, “China”) that are engaged in certain activities in the semiconductors and microelectronics, artificial intelligence (“AI”) or quantum information technologies sectors.

Importantly, U.S. persons also have obligations with respect to their “controlled foreign entities.” A U.S. person must notify Treasury of a transaction by its controlled foreign entity that would be notifiable if undertaken by a U.S. person and must take all reasonable steps to prohibit and prevent its controlled foreign entity from engaging in a transaction that would be prohibited if undertaken by a U.S. person.

OISP violations may result in civil penalties of up to the greater of the applicable inflation-adjusted statutory maximum under the International Emergency Economic Powers Act (currently, $377,700) or twice the value of the underlying transaction. Willful violations may also result in criminal penalties of up to $1 million and, for individuals, imprisonment for up to 20 years.

Treasury’s First OISP Civil Penalty

On October 7, 2026, Treasury announced that it had imposed a $200,000 civil penalty in July 2026 against Amidi, LLC (“Amidi”) for Amidi’s failure to submit a required notification to Treasury for an investment of approximately $92,478 by Amidi’s “Chinese fund” subsidiary in Shanghai Qiongche Intelligent Technology Company Limited (“Noematrix”), a private Chinese company developing AI, robotics and “embodied intelligence.” According to the announcement, Treasury identified the relevant transaction through its “regular and ongoing compliance and market monitoring efforts.”

Treasury’s press release does not state clearly the covered activities under the OISP engaged in by Noematrix. Based on Treasury’s description of Noematrix’s business and the fact that the violation related to a notifiable transaction, Noematrix’s covered activities potentially could include developing an AI system intended for the control of robotic systems, which is expressly covered at 31 C.F.R. § 850.217(d)(2)(iv).

More generally, Treasury’s announcement offers few details about other relevant aspects of the investment by Amidi’s subsidiary that implicated Amidi’s OISP obligations and warranted a civil penalty. For example, it is not apparent what OISP compliance steps, if any, Amidi took with respect to its subsidiary’s investment activities; what diligence, if any, was conducted by Amidi or its subsidiary regarding Noematrix’s activities; what aggravating or mitigating factors were considered by Treasury in connection with the violation; or how Treasury calculated the final penalty amount. Rather, Treasury states that, in determining whether to pursue an OISP enforcement action, it will consider the facts and circumstances of a violation, including the aggravating and mitigating factors identified in its OISP Enforcement Overview and Guidance document.

In contrast to most enforcement releases published by Treasury’s Office of Foreign Assets Control for U.S. sanctions enforcement actions, Treasury’s Amidi announcement does not highlight particular OISP compliance considerations for U.S. persons raised by the enforcement action. Although it is thus difficult to glean broader insights from the Amidi action about Treasury’s approach to OISP enforcement, it is important to note Treasury’s emphasis on its commitment to OISP compliance, its apparently proactive monitoring of market activity in this regard and its determination to issue a penalty with regard to a relatively small investment.

Anticipated COINS Act Rulemaking and OISP Expansion

Treasury’s press release notes that the COINS Act, enacted on December 18, 2025, will expand the OISP to cover investments involving additional countries and technology sectors. Treasury is required to issue implementing COINS Act regulations within 450 days of enactment (i.e., by mid-March 2027). Based on recent remarks by senior Treasury officials and the White House Office of Management and Budget list of submissions under review, we expect Treasury will issue proposed COINS Act regulations within the next several weeks.

As we discussed in detail in a December 2025 client update, the COINS Act provides for significant expansion of and other changes to the existing OISP framework. Key changes authorized under the COINS Act that may be addressed in the forthcoming regulations include the following:

• Expanded countries of concern. The COINS Act expands the targeted countries of concern beyond China to include Cuba, Iran, North Korea, Russia and Venezuela under the Nicolás Maduro regime.

• Expanded technology sectors. In addition to the three sectors currently covered by the OISP, the COINS Act adds (i) high-performance computing and supercomputing and (ii) hypersonic systems.

• Revised definitions. The COINS Act introduces certain revised and new definitions, including a new “covered national security transaction” term that generally encompasses the current scope of covered transactions but additionally includes a U.S. person knowingly directing a transaction by a non-U.S. person that would be prohibited or notifiable if undertaken by a U.S. person.

• Additional exceptions. The COINS Act provides for certain new exceptions, including for certain “ancillary transactions” by a financial institution (e.g., underwriting services, among other financial services), a “transaction secondary to a covered national security transaction” (e.g., bank lending and payment processing, among other transactions) and any “ordinary or administrative business transaction,” as defined in implementing regulations.

• Procedural OISP enhancements. The COINS Act contemplates additional administrative mechanisms, including, among others, a potential public database of covered foreign persons and a process for persons to seek non-binding feedback as to whether a transaction may be covered under the OISP.

Compliance Implications

Treasury’s first public OISP enforcement action reinforces the Trump Administration’s continuing focus on the use of outbound investment restrictions as a national security tool and underscores the importance of OISP compliance for U.S. firms, particularly as Treasury prepares to expand the regime.

Practical steps for U.S. firms in response to Treasury’s enforcement action and in preparation for the COINS Act proposed regulations may include the following:

• Re-affirming the importance of OISP compliance to any controlled foreign entities and, as appropriate, reviewing the policies and procedures in place to comply with the U.S. parent’s OISP obligations with respect to activities of its controlled foreign entities.

• Reviewing OISP risk assessments and compliance programs in preparation for the expanded OISP regime under the COINS Act. Firms also may consider reminding relevant business teams and other stakeholders about continuing OISP compliance and enforcement risk, as demonstrated by Treasury’s enforcement action, and the forthcoming expansion of the targeted countries and sectors under the COINS Act rulemaking.

This publication is for general information purposes only. It is not intended to provide, nor is it to be used as, a substitute for legal advice. In some jurisdictions it may be considered attorney advertising.