On October 27, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a $1,529,685 settlement with Extreme Networks, Inc. (Extreme), a U.S. company that provides artificial intelligence and cloud networking solutions, to resolve nine apparent violations of the Ukraine-/Russia-Related Sanctions Regulations, 31 C.F.R. Part 589. OFAC is the U.S. government agency with primary responsibility for administering and enforcing U.S. economic sanctions and embargoes.

Notably, the OFAC settlement coincided with a parallel Department of Justice (DOJ) resolution, under which Extreme entered into a non-prosecution agreement (NPA) and agreed to pay nearly $1 million in criminal penalties. Half of the criminal penalty amount is comprised of forfeited proceeds from the sanctions (and related export controls) offenses.

The government asserted that between September 2018 and March 2022, Extreme exported networking equipment, software, and related services to a Russian defense manufacturer blocked under U.S. sanctions. While acknowledging that Extreme did maintain a centralized compliance function, the government also concluded that the company’s compliance controls were inadequate.

Acquisition of Customer Contracts Introduced Sanctions Exposure

The violations arose out of a March 2018 transaction in which Extreme’s Russian subsidiary (Extreme Russia) entered into a transaction to acquire customer accounts and contracts from another Russian networking business. Among these contracts was an agreement identifying Joint Stock Company Moskovskiy Mashinostroitelniy Zavod Avangard (MMZA), a Russian defense manufacturer, as an end user.

At the time, MMZA was majority owned by JSC Concern Almaz Antey (Almaz Antey), a Russian state-owned defense company that OFAC designated as a Specially Designated National (SDN) in July 2014. Generally speaking, U.S. companies and individuals are prohibited from conducting any business with an SDN.

Under OFAC’s 50 Percent Rule, an entity owned 50% or more by one or more SDNs is itself considered an SDN even if not listed on OFAC’s SDN List. As a result, MMZA was an SDN – despite not being independently designated as an SDN until June 2022 – based on the fact it was more than 50% owned by an SDN (Almaz Antey).

According to OFAC, Extreme’s sanctions compliance team reviewed the acquisition agreement, including the contract identifying MMZA as an end user, but did not conduct due diligence necessary to recognize that MMZA was blocked. The relationship thus continued, ultimately resulting in multiple violations.

Extreme Failed to Address Red Flags

Both OFAC and the DOJ emphasized that Extreme did not adequately address a number of compliance red flags. To begin with, following the acquisition, Extreme Russia continued its relationship with MMZA, maintaining direct communications with MMZA personnel, attending meetings at MMZA offices, fulfilling nine additional purchase orders for networking hardware and software, and providing training and post-sales technical support. Extreme’s regional leadership received reports detailing the relationship.

Additionally, while purchase orders identified Russian company Dmitrovskiy Experimental Mechanical Plant (DEMZ) as the end user, at least a few purchase orders also included MMZA email addresses or identified MMZA’s Moscow offices as the actual destination for the purchased equipment. These warning signs were particularly significant given MMZA’s role in manufacturing missiles for Russia’s S-300 and S-400 anti-aircraft systems.

The government also cited the fact that one of Extreme Russia’s distributors twice provided MMZA’s website despite purchase orders identifying DEMZ as the end user. (Like other Extreme businesses, Extreme Russia sold products to end users indirectly, through third-party distributors and resellers.) According to the DOJ, the distributor also consulted Extreme Russia employees about how to respond to questions from Extreme’s U.S. compliance personnel regarding discrepancies in the end-user information.

After Extreme raised concerns about MMZA’s military affiliations, the distributor attributed the discrepancies to a mistake and provided documentation identifying DEMZ, which Extreme accepted without further investigation. Additionally, Extreme Russia personnel instructed MMZA employees to register for its customer portal under DEMZ’s name, despite using MMZA email addresses. Several MMZA emails also referenced Almaz Antey, and Extreme failed to use an available diligence resource that likely would have revealed Almaz Antey’s ownership of MMZA.

During this time, Extreme compliance personnel conducted sanctions and export controls screening for each purchase order under a company-wide policy requiring review of transactions involving Russia. Yet Extreme failed to recognize that it was dealing indirectly with a blocked entity and did not adequately investigate indications that MMZA, rather than the company identified in the purchase orders, was the actual recipient of the goods and services.

OFAC determined that Extreme acted with reckless disregard for U.S. sanctions requirements by failing to identify MMZA’s blocked status or adequately investigate evidence of its involvement in the transactions. OFAC also found that Extreme had reason to know MMZA was the actual end user and that the transactions substantially harmed U.S. foreign policy objectives aimed at limiting Russia’s military capabilities.

OFAC and DOJ Credit Remediation, Reach Different Conclusions on Disclosure

OFAC determined that the apparent violations were egregious and voluntarily self-disclosed, resulting in a base civil monetary penalty of $1,699,650. The final settlement of $1,529,685 reflected several mitigating considerations, including Extreme’s lack of OFAC enforcement history during the relevant five-year period and its substantial remedial measures, including enhancing screening procedures, expanding end-user diligence, hiring additional compliance personnel, increasing employee training, and strengthening sanctions diligence in mergers and acquisitions. (As noted, approximately $500,000 of the criminal penalty was credited toward the amount due under Extreme’s resolution with OFAC.) The OFAC settlement agreement also requires Extreme to certify to its ongoing sanctions compliance program for at least five years through submission to OFAC of annual certifications verifying that it is meeting its compliance commitments.

Separately, DOJ entered into an NPA with Extreme to resolve its investigation in the matter, which also involved a review of related export controls issues. DOJ asserted that certain Extreme Russia personnel had concealed MMZA’s identity from Extreme’s global compliance team, resulting in false electronic export information and unlawful shipments from the United States.

DOJ credited Extreme’s cooperation and remediation, including terminating its relationship with the Russian distributor and strengthening its compliance program. These measures resulted in an NPA rather than criminal prosecution.

Interestingly, OFAC and DOJ reached different conclusions regarding Extreme’s voluntary self-disclosure. Although OFAC credited Extreme’s disclosure, DOJ determined that Extreme did not qualify for a full voluntary self-disclosure under its policy because the company reported the conduct only after facing an imminent threat of public disclosure by a news outlet.

Because of this, DOJ characterized the resolution as its first “near-miss” NPA under its 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy, meaning it involved full cooperation and appropriate remediation but did not qualify for a declination of prosecution. 

Compliance Lessons for Companies Operating Internationally

The Extreme settlement highlights the importance of meaningful sanctions diligence in any merger and acquisition context where cross-border business, contracts, and/or ongoing relationships are being acquired. Companies need to carefully evaluate acquired customer relationships, counterparties, contracts, agreements, and other assets before completing transactions. Diligence – or really ongoing vigilance – needs to continue during operations that involve higher-risk jurisdictions.

The case also demonstrates the risk of relying on representations from distributors or customers without independently investigating conflicting information. Companies should consider information such as email domains, shipping destinations, customer communications, website addresses, and other details about the end-use and end-users of their products and services when evaluating the true identity of the parties involved.

This matter also illustrates the importance of maintaining effective oversight of non-U.S. operations. This is true for any non-U.S. jurisdiction; it is crucially important when operating in a geography or industry that presents higher risk under U.S. sanctions and other trade issues, such as export controls and corruption.

Please contact the authors if you have any questions.