; or (bb) the expiration of an identification document provided under clause (iv) of such paragraph (2)(B). (II) Assistance FinCEN shall provide assistance to, and may not impose any penalty upon, any person seeking to remedy a de minimis violation of paragraph (1) and come into compliance with this section. (ii) Waiver The Secretary of the Treasury shall waive the penalty for violating paragraph (1) if the Secretary determines that the violation was de minimis and the reporting company took reasonable steps to update the information. (iii) Repeated violations In determining whether a violation is de minimis, the Secretary of the Treasury may treat repeated violations as 1 violation. (3) Treasury Office of Inspector General investigation in the event of a cybersecurity breach (A) In general In the event of a cybersecurity breach that results in substantial unauthorized access and disclosure of sensitive beneficial ownership information, the Inspector General of the Department of the Treasury shall conduct an investigation into FinCEN cybersecurity practices that, to the extent possible, determines any vulnerabilities within FinCEN privacy security protocols and provides recommendations for fixing such deficiencies. (B) Report The Inspector General of the Department of the Treasury shall submit to the Secretary of the Treasury a report on the investigation required under this paragraph. (C) Actions of the Secretary Upon receiving a report submitted under subparagraph (B), the Secretary of the Treasury shall— (i) determine whether the Director had any responsibility for the cybersecurity breach or whether policies, practices, or procedures implemented at the direction of the Director led to the cybersecurity breach