Extreme Networks, Inc. (Extreme), a North Carolina-based networking equipment and services provider, has resolved parallel civil and criminal investigations into sales to a blocked Russian defense manufacturer. The transactions involved equipment, software, and related services supplied through Extreme’s Russian subsidiary to Moscow Machinery Building Plant Avangard (MMZA), a manufacturer of Russia’s S-300 and S-400 anti-aircraft missile systems. Although transaction records identified a different company as the end user, Extreme’s Russian subsidiary dealt directly with MMZA, and records reviewed by Extreme contained repeated indications of MMZA’s involvement.

On October 27, 2026, the Treasury Department’s Office of Foreign Assets Control (OFAC) and the Department of Justice (DOJ) announced separate resolutions with Extreme. OFAC’s civil settlement totaled $1,529,685. DOJ’s criminal resolution required a $487,860.92 fine and forfeiture of another $487,860.92 in proceeds from the offenses. OFAC agreed to credit the criminal fine against its settlement, leaving $1,041,824 payable to OFAC. DOJ resolved its investigation through a non-prosecution agreement rather than bringing criminal charges. It described the agreement as its first “near-miss” resolution under its 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy: Extreme’s report came under imminent threat of press disclosure and did not qualify as a timely voluntary self-disclosure, but its full cooperation and timely, appropriate remediation supported the agreement.

OFAC emphasized three compliance concerns: (1) sanctions due diligence before acquiring a company or its assets, (2) continued vigilance regarding sanctions risks after the acquisition, and (3) adequate oversight of foreign activities and operations. The DOJ resolution adds an important disclosure consideration: Even when a company reports too late to qualify for a declination under DOJ’s policy, full cooperation and timely, appropriate remediation can materially affect the outcome.

In March 2018, Extreme’s Russian subsidiary acquired customer accounts and contracts from the Russian subsidiary of another U.S. networking business. Extreme’s U.S.-led compliance team reviewed a contract naming MMZA but missed its blocked status under OFAC’s 50 Percent Rule. MMZA was majority owned by JSC Concern Almaz Antey, which OFAC added to its Specially Designated Nationals and Blocked Persons List in July 2014. MMZA was therefore also blocked, meaning U.S. persons were generally prohibited from dealing with it, directly or indirectly, even before OFAC separately listed MMZA in June 2022.

Extreme’s Russian subsidiary continued dealing directly with MMZA while falsely identifying another company, Dmitrovskiy Experimental Mechanical Plant (DEMZ), as the end user. During fulfillment, Extreme’s centralized compliance team screened all nine purchase orders in OFAC’s case but failed to resolve warning signs: Seven contained MMZA email addresses or its delivery address. The same discrepancy appeared in support-portal registrations, which the subsidiary’s personnel instructed MMZA staff to submit under DEMZ’s name. The dealings continued until March 2022.

Two website inquiries in 2020 show how the warning signs went unresolved. Extreme’s distributor supplied MMZA’s website, then substituted DEMZ’s website after Extreme questioned MMZA’s military affiliations. Extreme accepted the explanation that the earlier references were mistakes and approved the orders based on an end-user statement identifying DEMZ, without further investigation.

Disclosure and Remediation Reduced OFAC’s Penalty

OFAC treated the apparent violations as egregious, citing reckless disregard for sanctions, reason to know MMZA was the actual end user, and harm to U.S. foreign-policy objectives. Voluntary self-disclosure halved the applicable base penalty. OFAC also credited substantial remediation and the absence of prior enforcement action during the relevant five-year lookback.

The OFAC settlement also requires Extreme to maintain specified sanctions compliance measures for at least five years, supported by annual senior-executive certifications and substantive explanations beginning 180 days after execution. The OFAC settlement is neither a final agency determination that a violation occurred nor an admission by Extreme.

DOJ’s First “Near-Miss” Non-Prosecution Agreement

The DOJ agreement explains how the disclosure came to be. Extreme received a whistleblower complaint in April 2022 and began a good-faith investigation. After receiving additional allegations, it reopened and expanded that investigation. In October 2022, an investigative journalist contacted Extreme seeking the company’s response to allegations for an upcoming news article. In that inquiry, the journalist presented Extreme with facts previously unknown to its counsel, indicating possible willful misconduct by the company’s Russia-based employees. Extreme then disclosed the potential violation to DOJ’s National Security Division (NSD) in writing, days before the article was published. DOJ credited the company’s good-faith efforts to investigate the earlier, incomplete allegations, but concluded that its report, issued in anticipation of imminent public disclosure, failed the policy’s timeliness and voluntariness requirements. OFAC’s disclosure credit did not establish eligibility under DOJ’s separate requirements. For companies investigating potential misconduct, disclosure should be assessed as the facts develop. DOJ expressly encourages reporting before an internal investigation is complete.

DOJ also credited Extreme’s cooperation and remediation in agreeing not to prosecute. Extreme provided relevant facts and documents, made employees available for interviews, terminated the distributor relationship, and strengthened its compliance program. DOJ found full cooperation, timely and appropriate remediation, and no aggravating circumstances.

The DOJ agreement has a three-year term, requires annual compliance reporting, and imposes no independent compliance monitor. In contrast to the OFAC settlement’s non-admission provision, Extreme admitted responsibility under the DOJ agreement for the conduct described in its statement of facts. It acknowledged that the conduct constituted violations of law.

Implications for Companies

Companies should consider the following when reviewing acquisition diligence, foreign operations, and their response to potential misconduct:

  • Investigate customer ownership when acquiring a company or its assets. Checking customers and end users against sanctions lists is only part of the diligence. For the blocking sanctions applicable here, OFAC’s 50 Percent Rule treats an entity as blocked when one or more blocked persons own 50% or more of it, directly or indirectly, individually or in the aggregate — even if the entity is not separately listed. Extreme’s review of an acquired contract naming MMZA as an end user did not identify that MMZA was majority owned by Almaz Antey, which OFAC had designated in 2014.
  • Assign responsibility for post-acquisition monitoring. Integrate acquired accounts into screening and compliance systems, resolve outstanding ownership and end-user questions before further business proceeds, and reassess relationships as relevant information changes. Extreme’s remediation included daily rescreening of counterparties in its customer database.
  • Resolve conflicting information throughout the relationship. Investigate inconsistencies in transaction and counterparty information before approving the transaction, obtain independent evidence of the actual end user, and document the basis for releasing a compliance hold. In Extreme’s case, the distributor substituted DEMZ’s website for MMZA’s after questions arose about military affiliations, and Extreme approved the orders based on an end-user statement without resolving the discrepancies. Extreme’s remediation subsequently included a process requiring compliance personnel to document their reasons for lifting holds.
  • Test oversight of foreign operations. Ensure centralized compliance reviewers have the information needed to assess foreign business activities and continuing services, and test whether oversight procedures identify and escalate conflicting customer or end-user information across sales and customer-support functions. Extreme’s Russian personnel concealed MMZA’s identity, but purchase orders and support portal registrations still listed MMZA email addresses.
  • Include software and continuing services. Apply customer and end-user controls to subscriptions, portal access, technical support, repairs, and maintenance. DOJ’s statement of facts identifies 11 total purchase orders, including two zero-revenue orders for software and cloud subscriptions, as well as eight separate repair and maintenance transactions.
  • Consider disclosure before the opportunity for full credit is lost. Assess whether and when to report potential misconduct to each relevant agency as the investigation develops. Evaluate each agency’s requirements promptly; waiting for the investigation to conclude may limit the benefits available. OFAC credited Extreme’s voluntary disclosure, while DOJ concluded that the report under imminent threat of press disclosure did not qualify for a declination under its policy.
  • Support self-disclosure with cooperation and remediation. When submitting a self-disclosure, preserve relevant evidence, cooperate fully with investigators, and address the underlying compliance failures, regardless of whether the disclosure qualifies for full voluntary self-disclosure credit. Extreme provided documents and facts, made employees available for interviews, terminated the distributor relationship, and strengthened its compliance program. DOJ credited that response in granting a non-prosecution agreement despite the late disclosure.

Conclusion

Do not wait for a whistleblower, a reporter, or a regulator to test your sanctions compliance program. Pressure-test acquisition diligence, challenge end-user inconsistencies, and establish a clear path for escalating concerns and making disclosure decisions now. If a red flag has already surfaced, engage counsel early to investigate, remediate, and assess reporting options before those options narrow.