The Committee on Foreign Investment in the United States has imposed an unprecedented $1 million civil penalty for repeated breaches of a 2016 CFIUS mitigation agreement, according to a notice on the U.S. Treasury Department's website.

The penalty was imposed in 2018 without fanfare but was recently published on its resource page along with annual reports to Congress. The penalty was also imposed for “failure to establish requisite security policies and failure to provide adequate reports to CFIUS,” according to the notice.

CFIUS is an interagency committee that reviews mergers and acquisitions of U.S. companies by foreign investors for potential risks to U.S. national security.

No further information about the parties or the specific transaction involved was disclosed by the committee, whose actions normally are confidential.

Asked for comment, a Treasury Department representative said: “The Committee on Foreign Investment in the United States (CFIUS) takes very seriously the negotiation and enforcement of agreements that mitigate national security risk. As the Treasury Department, which chairs CFIUS, recently posted on its website, in 2018 CFIUS imposed a $1 million penalty for violation of a CFIUS mitigation agreement. The penalty related to repeated breaches of a 2016 mitigation agreement, including failure to establish requisite security policies and failure to provide adequate reports to CFIUS. This action demonstrates CFIUS's commitment to enforcement. The Committee relies on negotiated mitigation agreements in order to resolve national security concerns, and we expect companies to adhere to them.”

The representative did not provide further details about the parties involved or the transaction in response to a request for more information. In recent years, however, CFIUS has been increasingly focused on the security of personally identifiable information, and it has been requiring companies to spin off or otherwise segregate units with personal data on Americans as a condition of approving transactions. Other CFIUS concerns that have resulted in mitigation requirements or even rejections lately include high-technology transfers and location of facilities near military bases or other strategic locations.

“This penalty is singular. It is historic. It is the first time that CFIUS has imposed a penalty for noncompliance,” said Mario Mancuso, leader of the international trade and national security practice at Kirkland & Ellis in  Washington, D.C. He said the committee is “demonstrating a new commitment to actually enforce—and to signal its willingness to enforce—its mitigation requirements when parties fail to abide by their agreements.”

Mancuso added, “Mitigation agreements should not be seen as boilerplate. They are not paper agreements. There is also a sense in which it is signaling to the market that CFIUS is focused on enforcement broadly.”

Usually CFIUS's internal workings occur in a “black box” because of confidentiality rules, but its actions have come to light more often in recent years. For instance, Toshiba announced on Thursday that China's ENN Ecological Holdings Co. had withdrawn its offer for Toshiba's U.S. liquified natural gas business because of failure to win approval from CFIUS and shareholders by a closing date.

An overhaul of CFIUS legislation enacted by Congress last year expanded the scope of transactions that are subject to mandatory rather than voluntary review by the committee and imposed new penalties for noncompliance. On Oct. 10, the U.S. Treasury Department published new pilot program regulations in its first step toward implementing the just-passed Foreign Investment Risk Review Modernization Act, or FIRRMA.

In 2016, when the sanctioned transaction occurred, CFIUS had received 172 notices and conducted 79 investigations, with one presidential rejection: In December of that year, on the committee's recommendation, President Barack Obama blocked the acquisition of Aixtron, a technology company with U.S. facilities, by Chinese-controlled Fujian Grand Chip Investment Fund. A total of 27 CFIUS notices were withdrawn, 15 notices were withdrawn-and-refiled and five were withdrawn and abandoned that year because of national security concerns. Seven notices were withdrawn for other reasons, according to the Treasury Department.

Mancuso, who authored the recently published “A Dealmaker's Guide to CFIUS,” said he believed CFIUS' imposition of penalties would have been more effective had it been formally publicized. “A million dollars is a lot of money. To many parties I suspect it will get their attention. But monetary plus being publicly identified would have gotten more. They chose to make it public but not to publicize it.”

He added, “I suspect the next shoe to drop will be a transaction that should have been filed under the pilot program for which one wasn't submitted and CFIUS will double down on this enforcement theme by imposing a penalty for not submitting a mandatory declaration.”

Chinese foreign direct investment in the United States tumbled to $4.8 billion last year, down from $29 billion in 2017 and $46 billion in 2016, according to Rhodium Group research.