In July 2026, the U.S. Treasury issued its first-ever civil penalty under the outbound investment (OISP) rules, publicly announced on October 7 — and the numbers should make every Chinese tech company and its U.S. investors sit up. The penalty was $200,000, imposed on a U.S. company for failing to notify an investment of roughly $92,478. The fine exceeded the investment more than twofold. And Treasury found the deal on its own, through market monitoring.
The transaction: on April 19, 2025, the U.S. company's controlled foreign entity — a Chinese fund — invested about $92,478 in a Chinese private company working in AI, robotics, and embodied intelligence. The U.S. company never filed the required notification. That was the entire violation. No prohibited transaction, no cover-up alleged — just a missed filing.
The outbound investment rules come from Executive Order 14105 (August 9, 2023), implemented by Treasury at 31 C.F.R. Part 850 and effective January 2, 2025. They cover three technology areas — semiconductors and microelectronics, quantum information technology, and artificial intelligence — where covered transactions are either prohibited or subject to mandatory notification.
The details that now matter:
And the regime is about to get wider. The Comprehensive Outbound Investment National Security Act of 2025 (COINS Act) was enacted as part of the FY2026 National Defense Authorization Act. It extends the covered countries to Cuba, Iran, North Korea, Russia, and Venezuela, and adds two new technology areas — high-performance computing/supercomputing and hypersonic systems. Treasury has roughly 450 days (to about mid-March 2027) to write the implementing rules. Until then, the current rules remain fully in effect.
The same month, the Bureau of Industry and Security (BIS) took action against Lambda Research Corporation — and the fact pattern reads like a compliance autopsy. The company had, in BIS's words, a longstanding lack of export-control compliance controls: no written compliance program, no dedicated compliance person, no training. Between 2021 and 2025, it automatically pushed 42 TracePro and 5 OSLO software updates to Huawei Japan — each push counted as a separate export violation. It also sold 15 perpetual TracePro licenses to ChinaSoft Technology (Shenzhen) through Shanghai-based distributor Shanghai LightPaths Technologies — the invoices listed "ChinaSoft (Sicarrier)" as the end user, and investigators confirmed ChinaSoft was acting as SiCarrier's intermediary. SiCarrier had been added to the Entity List in December 2024.
The lesson for Chinese tech companies and their U.S. partners: automatic software updates, reseller channels, and "we didn't know the customer was listed" are exactly where violations now accumulate. Each update is a separate count.
On July 31, 2026, the Department of Homeland Security added 43 entities to the UFLPA Entity List in a single action — the largest expansion in the program's history. The list grew from 144 to 187 entities (a 30% jump), spanning aluminum, apparel, copper, cotton, and tomatoes. DHS says CBP has now denied entry to more than 24,300 shipments worth nearly $1 billion. For Chinese companies importing into the United States, a mapped, documented supply chain is no longer best practice — it is the price of admission.