The entity cannot be named and the penalty cannot be imposed until the full process is exhausted, which includes court proceedings. If an entity were to decide to go to court, the case might be sealed, which means that you might never know there was a penalty, you might never know the name of the entity, and the court decision might take years before we know what it is.
Between the uncertainty of the potential court process and the certainty of the penalty and the deterrence attached to it, I decided to go for the penalty without naming the institution.