Hacker News Reader

My guess is that a failure to report is essentially be a regulatory violation, not a crime. Thus, a regulating agency will determine how to enforce. Which likely means they start with notices of violation and finally escalate to "reasonable" fines after repeated violations for normal cases. And finally the regulating agency/agencies may forward cases to the DOJ for civil lawsuits for extremely egregious violations.

It’s also not clear which businesses are mandated:

> The current impact of the legislation also remains unclear due to lack of definition over exactly which companies will fall under the reporting requirements, which will be clarified in regulation

From what I can see, that's pretty much it. It might affect future funding, but I'm betting lawyers would successfully argue that some occurrence doesn't count.