On October 27, 2026, the Office of Foreign Assets Control announced a $1,529,685 settlement with Extreme Networks, Inc., a North Carolina-based AI and cloud networking provider with more than 2,800 employees in 29 countries, over nine apparent violations of the Ukraine-/Russia-Related Sanctions Regulations. The Department of Justice announced a parallel non-prosecution agreement the same day. This is a case about a company that had a sanctions screening process, ran the process, and still shipped to a blocked Russian defense manufacturer because it accepted answers it should have questioned.

The Setup: An Acquired Customer Book

Around 2009, Extreme established a Russian subsidiary, Extreme Networks Rus LLC (“Extreme Russia”), which sold Extreme-branded products and provided support in Russia. It ceased operations in March 2022. In March 2018, Extreme Russia bought customer accounts and contracts from a Russian business-communications networking company. One of the end users named in those contracts was Joint Stock Company Moskovskiy Mashinostroitelniy Zavod Avangard (MMZA), a Russian defense manufacturer majority-owned by the state-owned Almaz-Antey.

Almaz-Antey was designated on July 16, 2014 under Executive Order 13661. Under OFAC’s 50 percent rule, that made MMZA a blocked person at all relevant times, even though MMZA itself was not designated until June 28, 2022 under Executive Order 14024, for producing missiles for Russia’s S-300 and S-400 air defense systems. The absence of MMZA’s name on the SDN List for years did not mean the absence of a prohibition.

OFAC says Extreme’s U.S.-led compliance team reviewed the March 2018 purchase agreement, including the contract naming MMZA as end user, and did not conduct sufficient diligence to recognize that MMZA was blocked. Nor did it question earlier purchases under that contract that at times identified a different Russian company, Dmitrovskiy Experimental Mechanical Plant (DEMZ), as the end user.

The Violations

Between September 2018 and September 2021, Extreme Russia negotiated and received nine purchase orders for hardware (routing switches, ports, power supplies) and software. OFAC states that Extreme Russia dealt directly with MMZA staff, including in-person meetings at MMZA offices in Moscow and elsewhere and communications through MMZA email addresses, and provided training and post-sale support. The nine exports, completed through March 2022, are the nine apparent violations of 31 C.F.R. § 589.201.

What makes the case instructive is that the control was running. Extreme’s centralized U.S. compliance function screened each of the nine purchase orders under a company-wide policy to review all dealings involving Russia. OFAC says the function either ignored or failed to respond appropriately to numerous indications that DEMZ was not the true end user:

• The documents themselves. Seven of the nine purchase orders contained MMZA email addresses or identified MMZA’s Moscow office as the ultimate destination, even though DEMZ was named as end user.
• Internal reporting. In May 2018 and February 2019, the Regional Director for Northern and Eastern Europe, who supervised Extreme Russia, received routine activity reports describing Extreme Russia’s dealings with MMZA.
• The distributor’s shifting answer. On October 20 and November 10, 2020, during diligence on two orders, Extreme asked its third-party distributor for the end user’s website. Both times the distributor supplied MMZA’s website. After Extreme voiced concern about MMZA’s apparent military affiliations, the distributor said the earlier references were mistakes and gave DEMZ’s website. Extreme approved the orders without further investigation, relying on the distributor’s end-user statement.
• The portal. Extreme Russia personnel instructed MMZA employees to list DEMZ as their company name when registering for Extreme’s customer portal while using MMZA email addresses. The registrations were initially held up by the Russia review policy, but Extreme approved them, in one instance after an MMZA employee failed to answer a diligence request for company name, address, and corporate email.

The Penalty Math

OFAC found the violations egregious and voluntarily self-disclosed. Under its Enforcement Guidelines, that combination sets the base penalty at one-half of the statutory maximum, here $1,699,650. The $1,529,685 settlement reflects OFAC’s weighing of the general factors; it is about 90 percent of the base amount.

OFAC’s aggravating factors were: reckless disregard for U.S. sanctions in failing to conduct sufficient diligence and to heed warning signs; actual knowledge that Extreme fulfilled the nine orders and reason to know that MMZA was the actual end user; and substantial harm to U.S. foreign policy objectives, given that MMZA describes itself as the sole supplier of Russia’s S-300 and S-400 mobile surface-to-air missile systems.

Mitigating factors were no OFAC enforcement action in the five years before the earliest transactions, and substantial remediation: enhanced screening to identify entities majority-owned by sanctioned parties or with military or government affiliations, expanded end-user diligence, additional sanctions compliance personnel, more training for compliance and customer-facing staff, and updated M&A diligence that screens the target and its customers.

The DOJ Piece

Per press reports of the DOJ resolution (I have not reviewed the DOJ documents), Extreme entered into a non-prosecution agreement with a criminal fine of $487,860.92 and forfeiture of an equal amount. OFAC’s release says Extreme’s obligation to pay a portion of the settlement is deemed satisfied up to an equal amount of the DOJ fine; press reports put the credit at up to $487,861, leaving about $1.04 million for Treasury. Extreme must maintain a sanctions compliance program for at least five years and submit executive certifications, according to those reports.

The same reports say DOJ’s National Security Division considered Extreme’s disclosure not to meet its policy’s timeliness and voluntariness standards for a declination, calling it a “near-miss” because it was made under imminent threat of disclosure after an investigative journalist contacted the company with new allegations. DOJ reportedly described this as its first non-prosecution agreement in a “near-miss” case and credited Extreme with full cooperation and timely, appropriate remediation.

Note the different outcomes of one disclosure: OFAC treated it as voluntarily self-disclosed, while DOJ treated it as a near-miss. The two agencies apply different tests, and a company should plan to satisfy both.

What OFAC Says the Case Means

OFAC’s compliance section highlights three themes:

1. Diligence before and after acquisitions. Even if a deal involves only certain assets, diligence must be tailored to all the risks. Here, a target’s preexisting customer relationship with a blocked person “quickly gave rise to multiple apparent violations” when it continued after the acquisition.
2. Red flags demand more diligence, not less. Where evidence suggests a known counterparty is not the real or only interested party, companies should work to identify the risk of dealing indirectly with a sanctioned person. OFAC calls inconsistent explanations and questionable end-user representations red flags of particular concern, and cites interagency warnings that sanctioned Russian parties use third-party intermediaries to hide their identities.
3. Foreign affiliates. “Risks that hatch abroad often come home to roost.” Even companies with centralized or global compliance programs can be ensnared by affiliates who are complicit or inattentive, and the existence of procedures alone is not enough where a company fails to follow them or to investigate and resolve potential risks.

OFAC also reminded readers of the benefits of voluntary self-disclosure, which generally reduces both the likelihood of a penalty and its amount even in an egregious case, and noted the FinCEN whistleblower incentive program for sanctions violations, which can provide awards where information leads to penalties exceeding $1 million.

Practical Lessons

• Treat the acquired customer list as an acquired risk. Screen every named end user, and the owners of each, as part of diligence and again at integration.
• Make the 50 percent rule operational. Screening against the SDN List will not catch a majority-owned subsidiary. Ownership data and a defense-sector or state-owned flag should trigger escalation.
• Reconcile the paperwork with the facts. When a purchase order names one entity and the email domain, delivery address, or website point to another, the mismatch has to be resolved with independent evidence.
• A distributor’s statement is not a control. A distributor that changes its answer when asked about military affiliation has told you something important.
• A screening step that finds nothing because nobody follows up is not screening. Extreme’s policy flagged every Russia dealing for review. The failure was in what happened next.
• Close the information gaps in the business line. Regional management received reports describing the MMZA relationship. Compliance needs a path to learn what the commercial teams already know.
• Watch customer-facing portals and support channels. Access to training, support, and contract tools is itself a dealing with the customer.
• Disclose before anyone else asks. The difference between OFAC’s and DOJ’s characterizations of this disclosure shows the value of moving early.