Extreme Networks, Inc. OFAC Settlement: $1.5M (2026)

Extreme and its affiliates operate globally, employing over 2,800 people across 29 countries. Around 2009, Extreme established a Russian subsidiary, Extreme Networks Rus LLC ("Extreme Russia"), which sold Extreme-branded networking products and services in Russia and provided post-sale customer support in Russia. Extreme Russia ceased operations in March 2022.

In March 2018, Extreme Russia purchased customer accounts and contracts to provide telecommunications equipment and services from a Russian networking business that specialized in business communications. Among the end users named in the contracts Extreme Russia acquired through the purchase agreement was Joint Stock Company (JSC) Moskovskiy Mashinostroitelniy Zavod Avangard (MMZA), a Russian defense manufacturer majority owned by Russian state-owned defense company JSC Concern Almaz Antey ("Almaz Antey"). Almaz-Antey was designated on July 16, 2014 pursuant to Executive Order ("E.O.") 13661. Consequently, at all relevant times MMZA was a blocked person with which U.S. persons were prohibited from dealing, directly or indirectly. MMZA was independently designated on June 28, 2022 pursuant to E.O. 14024 for operating in the defense and related material sector of the Russian economy, and specifically for producing missiles for Russia's S-300 and S-400 anti-aircraft systems.

Extreme's U.S.-led compliance team reviewed Extreme Russia's March 2018 purchase agreement, which included the contract that named MMZA as the end-user. However, Extreme did not conduct sufficient due diligence to recognize that MMZA was blocked. Neither did Extreme raise questions concerning earlier purchases made under this contract that at times identified another Russian company, Dmitrovskiy Experimental Mechanical Plant (DEMZ), as the end-user.

Between September 2018 and September 2021, Extreme Russia maintained the relationship with MMZA, including through the negotiation and receipt of nine additional purchase orders (POs) for hardware (e.g., routing switches, ports, and power supplies) and software. During this period, Extreme Russia dealt directly with MMZA staff to develop these orders, including through in person meetings at MMZA's offices in Moscow and elsewhere, and by communicating through MMZA email addresses. Extreme Russia also provided training and post-sales support to MMZA staff on multiple occasions.

Extreme's U.S.-led centralized compliance function conducted sanctions and export controls screening for each of the nine POs under a company-wide policy to review all dealings involving Russia. Extreme, however, did not detect that it was dealing indirectly with a blocked entity, either ignoring or failing to appropriately respond to numerous indications that DEMZ was not in fact the true end user, and that instead Extreme was providing goods and services to MMZA. These red flags appeared in the POs themselves, seven of which included MMZA email addresses or identified MMZA's office address in Moscow as the ultimate destination for the purchased items even though DEMZ was named as the end user.

Additionally, in May 2018 and again in February 2019, Extreme's Regional Director for Northern and Eastern Europe, who supervised Extreme Russia staff, received two routine activity reports that included descriptions of Extreme Russia's dealings with MMZA. Further, on October 20, 2020 and again on November 10, 2020, during due diligence reviews for two of the POs, Extreme asked its third-party distributor to provide the relevant end-user's website. Despite DEMZ being identified as the end-user in the PO, the third-party distributor responded twice with MMZA's website. After Extreme expressed concerns about MMZA's apparent military affiliations, the third-party distributor deflected by providing DEMZ's website, claiming its earlier references to MMZA website were a mistake. Extreme ultimately decided to approve the POs without further investigation based on an end-user statement provided by the third-party distributor identifying DEMZ as the end-user.

Extreme also failed to stop MMZA personnel from registering for its proprietary online portal, which enabled customers to track contracts, submit support cases, and engage with technical tools. Extreme Russia personnel in fact instructed MMZA personnel to list DEMZ as their company name when registering for portal access, while they still used their MMZA email addresses. Although the portal registrations were also initially held up by the blanket policy to review dealings involving Russia, Extreme ultimately approved the registration requests, including in one instance after one of the MMZA employees failed to respond to a due diligence request asking for their company's name, address, and corporate email.

Ultimately, between September 2018 and March 2022, Extreme dealt in property in which a blocked person held an interest on nine occasions when it exported hardware and software from the United States to MMZA, in apparent violation of § 589.201 of the Ukraine-/Russia-Related Sanctions Regulations, 31 C.F.R. part 589 (the "Apparent Violations").

OFAC determined that Extreme voluntarily self-disclosed the Apparent Violations and that the Apparent Violations constitute an egregious case. Accordingly, under OFAC's Economic Sanctions Enforcement Guidelines (the "Enforcement Guidelines"), 31 C.F.R. part 501, app. A., the base civil monetary penalty applicable in this matter equals one-half of the statutory maximum, which is $1,699,650.

The settlement amount of $1,529,685 reflects OFAC's consideration of the General Factors under the Enforcement Guidelines. Extreme's obligation to pay a portion of the settlement amount will be deemed satisfied up to an equal amount of its payment of a fine to DOJ arising out of the same conduct.

OFAC coordinated this action with the Department of Justice (DOJ), which today announced resolution of its parallel investigation. Extreme's obligation to pay a portion of the settlement amount will be deemed satisfied up to an equal amount of its payment of a fine to DOJ arising out of the same conduct.

Today's action emphasizes the importance of sanctions-related diligence before acquiring a company or its assets; remaining vigilant regarding sanctions risks thereafter; and ensuring adequate oversight of foreign activities and operations.

This case highlights the importance of treating sanctions-related diligence as a comprehensive and ongoing undertaking throughout a business relationship. OFAC has repeatedly emphasized the importance of conducting sufficient sanctions-related due diligence when companies are considering a merger or acquisition or beginning a new business relationship. Even if a transaction involves only the acquisition of certain assets, companies should tailor their diligence to the full range of specific risks that are present. In this case, one type of risk—an acquisition target's preexisting customer relationship with a blocked person—quickly gave rise to multiple apparent violations when the relationship continued post-acquisition.

Moreover, diligence should be redoubled in the presence of red flags. As this case demonstrates, entities encountering evidence indicating that a known counterparty is not the real or only interested party should work to identify sanctions-related risks, including that of dealing indirectly with a sanctioned person. Inconsistent explanations and questionable end-user representations are red flags that should be cause for particular concern. OFAC and its interagency partners have previously warned that sanctioned Russian parties often use third-party intermediaries to obscure their identities to evade U.S. sanctions and export controls.

Relatedly, this case illustrates how ineffective oversight of foreign affiliates can create major risks for a U.S. parent company. Given the interconnected nature of many global businesses, risks that hatch abroad often come home to roost. Even entities with centralized or global sanctions compliance programs can be ensnared by the conduct of foreign affiliates who are either complicit in, or inattentive to, potential sanctions violations. To avoid this, companies should actively cultivate a strong culture of compliance across all operations globally. Particularly careful attention should be paid to affiliates who operate in or near high-risk jurisdictions such as Russia. The existence of compliance procedures alone is not sufficient where, as here, companies fail to follow those procedures or adequately investigate and resolve potential sanctions risks.

Finally, this case underscores the substantial benefits of voluntarily self-disclosing sanctions violations to OFAC. While OFAC considers the totality of the circumstances when determining how to address sanctions violations, voluntary self-disclosure generally reduces the likelihood that OFAC will seek a penalty, and—where a penalty is appropriate—the amount of any penalty, even when the agency determines conduct to be egregious.

This page summarizes an OFAC enforcement case based on the document archived below. SanctionsLookup assumes no liability for errors, omissions, or inaccuracies in the original documents, this summary, or any changes made to the source documents at any time.

Provided for informational purposes only and does not constitute legal or compliance advice. Always consult the source document directly rather than relying on this summary.