Extreme Networks Pays $1.53m OFAC Russia Penalty

Extreme Networks, the North Carolina networking company, has agreed to pay $1,529,685 to settle nine apparent breaches of US sanctions on Russia. The US Treasury’s Office of Foreign Assets Control (OFAC) said on 27 October that between September 2018 and March 2022 the company exported networking equipment and related services to JSC Moskovskiy Mashinostroitelniy Zavod Avangard (MMZA), a Russian defence manufacturer that was blocked because it is majority owned by the sanctioned state group JSC Concern Almaz-Antey.

The case is less about the hardware than about how it got through. According to OFAC, Extreme’s US compliance team screened every one of the orders and still approved them, after a Russian subsidiary and a distributor kept naming a different company as the customer. The same day, the Justice Department announced a non-prosecution agreement with Extreme over the same sales, with criminal penalties of $975,721.84.

In brief

What happened: Extreme will settle with OFAC for $1,529,685 and pay $975,721.84 to the Justice Department over sales that ended up with MMZA, a blocked Russian defence manufacturer.
Why it matters: the orders passed Extreme’s US screening because paperwork named a different end user, despite warning signs OFAC lists in detail.
What’s unknown: the two agencies count the sales differently (nine exports against 11 purchase orders), and Extreme had not commented publicly at the time of writing.

Orders named one customer while emails pointed to another

The problem began with an acquisition. OFAC’s enforcement release says that in March 2018 Extreme’s Russian subsidiary, Extreme Networks Rus LLC, bought customer accounts and contracts from another networking business. One contract named MMZA as the end user. Extreme’s US-led compliance team reviewed the deal but, OFAC says, “did not conduct sufficient due diligence to recognize that MMZA was blocked”.

Almaz-Antey was designated by OFAC in July 2014. Under the agency’s 50 Percent Rule, a company majority owned by a blocked person is itself blocked, so MMZA was off limits to US persons throughout. The US later designated MMZA in its own right in June 2022, citing its production of missiles for Russia’s S-300 and S-400 air-defence systems.

From September 2018 to September 2021, the Russian subsidiary took nine further purchase orders for routing switches, ports, power supplies, cloud and software subscriptions, and software. Every order named another Russian firm, Dmitrovskiy Experimental Mechanical Plant (DEMZ), as the end user. Yet OFAC says seven of them carried MMZA email addresses or listed MMZA’s Moscow office as the destination. The settlement agreement adds that at least three emails from MMZA staff mentioned Almaz-Antey in the signature block, and that subsidiary staff told MMZA employees to register for Extreme’s customer portal under DEMZ’s name.

There were chances to stop it. In October and November 2020, Extreme asked its distributor for the end user’s website and twice received MMZA’s. When Extreme raised concerns about MMZA’s apparent military links, the distributor called that a mistake, supplied DEMZ’s website and offered an end-user statement, which Extreme accepted. Extreme left the Russian market in March 2022 and disclosed the conduct to OFAC in October 2022.

How OFAC arrived at $1,529,685

OFAC judged the case both voluntarily self-disclosed and egregious. Under its Enforcement Guidelines, that combination sets the base penalty at half the statutory maximum: $1,699,650, against a maximum of $3,399,300. The final figure is $169,965 lower, which OFAC says reflects its weighing of the General Factors in the guidelines.

On the aggravating side, OFAC found that Extreme acted with “reckless disregard for U.S. sanctions”, had actual knowledge that it filled the orders and reason to know MMZA was the real end user, and “substantially harmed U.S. foreign policy objectives”. In mitigation, it had no OFAC enforcement action in the prior five years and took “substantial remedial actions”, including better ownership screening, wider end-user checks, more compliance staff and new due diligence for acquisitions.

The settlement is not an admission by Extreme that it broke the rules, and $487,861 of it is treated as paid by the company’s payments to the Justice Department. That leaves $1,041,824 due to the Treasury. Extreme has also committed to keep a sanctions compliance programme for at least five years, with a senior executive certifying it to OFAC every year.

The DOJ deal reads the same disclosure differently

The Justice Department tells a harsher version of the same story. It says Russia-based employees concealed MMZA’s identity from Extreme’s global trade compliance group, which led the company to file false export information and “smuggle goods from the United States”. Its count is 11 purchase orders between around March 2018 and March 2022, earning about $487,860.92 in revenue. Extreme will forfeit that sum and pay an equal criminal fine.

The department called this its first “near miss” non-prosecution agreement under its 2026 corporate enforcement policy. Extreme’s disclosure to the National Security Division “was not timely because it occurred under imminent threat of disclosure by a news publication”, DOJ said. The non-prosecution agreement sets out the sequence: a whistleblower report in April 2022, an internal investigation, then a request for comment from an investigative journalist in October 2022, after which Extreme disclosed days before the article ran. It got full credit for cooperation, including nearly 400,000 documents, and no monitor was imposed. Unlike the OFAC settlement, the agreement has Extreme admit the facts in its statement, and it runs for three years.

“The FBI remains dedicated to keeping sensitive technology out of the hands of the Russian military,” said Roman Rozhavsky of the FBI’s Counterintelligence and Espionage Division.

Two agencies, one disclosure, and a total smaller than it looks

Read side by side, the documents show why sanctions cases are easy to misreport. Adding the two headline figures gives roughly $2.5m, but OFAC’s crediting means Extreme’s outlay on the documents’ own numbers is closer to $2.02m: $1,041,824 to the Treasury plus $975,721.84 to the Justice Department. TSN covered a similar crediting arrangement when FinCEN fined Bank of America while counting an earlier OCC penalty. The second lesson is that “voluntary” means different things in different agencies. OFAC still treated the case as self-disclosed, which set the base penalty at half the statutory maximum; DOJ, under its own policy, said a disclosure made with a journalist’s questions pending was not timely.

For compliance teams the operational failure is familiar and uncomfortable. Extreme had a central screening function and a rule that every Russia deal be reviewed, and OFAC says the orders went through anyway. Name screening against the sanctions list was never going to catch MMZA, which was not listed in its own right until 2022; only ownership checks and attention to email domains, delivery addresses and shifting distributor answers would have. An end-user statement from the party whose story keeps changing is not evidence. And buying a customer book means buying its sanctions history, which is why both agencies stress diligence on acquisitions. The same reach of US sanctions into technology supply chains shows up in the State Department’s recent action against the backers of an ex-Google engineer’s AI start-up and in the Treasury’s proposed widening of outbound investment curbs.

No public statement from Extreme Networks on the settlement was found at the time of writing. The next fixed points are Extreme’s first compliance certification to OFAC, due 180 days after the settlement was executed, and its reporting to the Justice Department over the three-year term of the non-prosecution agreement.