OFAC settlement binds Extreme Networks to five years of sanctions checks

Extreme Networks will run a sanctions compliance programme for at least five years and certify it to the US Treasury yearly under a $1,529,685 settlement over nine exports to a blocked Russian manufacturer, the Office of Foreign Assets Control (OFAC) said on 27 October.

The North Carolina networking company exported equipment and services between September 2018 and March 2022 to JSC Moskovskiy Mashinostroitelniy Zavod Avangard (MMZA), a Russian defence manufacturer majority owned by JSC Concern Almaz Antey, which the US designated on 16 July 2014; MMZA was therefore a blocked person at all relevant times, the release says. The relationship came with an acquisition: in March 2018 Extreme's Russian subsidiary bought customer accounts and contracts from a Russian networking business, and MMZA was among the end users named in them. Part 1 of this series set out the 14 OFAC and OFSI penalties published earlier in 2026; this part reads the commitments attached to the newest one.

How OFAC set the amount

OFAC judged the case egregious and voluntarily self-disclosed, so the base penalty was half the statutory maximum, $1,699,650. The settlement is 90 per cent of that base. OFAC listed three aggravating factors, including that Extreme "acted with reckless disregard for U.S. sanctions" when it did not recognise that MMZA was blocked, and two mitigating ones: no OFAC enforcement action in the five years before the first transaction, and remedial steps that included new screening for entities majority owned by sanctioned parties, more sanctions compliance staff and acquisition diligence that screens a target's customers.

The Department of Justice resolved a parallel investigation the same day with a non-prosecution agreement under which Extreme forfeits $487,860.92 and pays a criminal fine of the same amount, $975,721.84 in total, the department said. It called the agreement its first "near miss" non-prosecution agreement under its 2026 corporate enforcement policy: the disclosure to its National Security Division was not timely, but the company cooperated and remediated. The fine counts towards OFAC's amount: under the settlement agreement, $487,861 of it is deemed satisfied by the payments to the department, leaving $1,041,824 to be paid to the Treasury. The two documents count the conduct differently, nine apparent violations for OFAC and 11 purchase orders for the department.

Seven commitments over five years

The settlement agreement lists seven compliance commitments: management commitment, risk assessment, internal controls, testing and audit, training, cooperation with OFAC and an annual certification. The first five are the components of OFAC's 2019 Framework for OFAC Compliance Commitments. Several are written for this case. In future mergers or acquisitions Extreme agrees to conduct reasonable sanctions due diligence, including, as relevant, requesting and screening "a complete list of the purchased or merged entity's customers, end-users, and other relevant relationships". It collects end-user certificates, screens accounts and account contacts, trains staff in customer-facing roles every year and has hired a Senior Product Counsel to take a leading role in sanctions and export control compliance.

The certification is the item that reaches the top of the company. For five years, starting 180 days after the agreement is signed, a "senior-level executive" must certify to OFAC each year that the measures are in place and explain in writing how the company meets every commitment. If OFAC has reason to believe there is a breach or a misrepresentation, it gives written notice and at least 30 days to respond; if it then determines that a breach occurred, it may reopen the investigation and impose a penalty of up to the statutory maximum of $3,399,300.

What it gives an audit committee to check

The agreement makes the testing or audit function accountable to senior management and independent of the activities it audits, and Extreme agrees to identify to OFAC any apparent violation its audits find. Compliance units must have the authority, autonomy and resources to control sanctions risk. It is the second document this month to hand audit committees something specific to check, after Saudi Arabia's regulator routed its audit inspection findings to them. OFAC's release says a central programme is not enough on its own: "The existence of compliance procedures alone is not sufficient where, as here, companies fail to follow those procedures". Extreme's US-led compliance team screened each of the nine purchase orders, yet OFAC found warning signs in the orders themselves, seven of which carried MMZA email addresses or its Moscow office address. OFAC's advice to other companies is in the same release: even when a deal covers only certain assets, companies "should tailor their diligence to the full range of specific risks that are present". In a separate passage it says particularly careful attention should go to affiliates in or near high-risk jurisdictions such as Russia. Read by a board approving the purchase of a distributor or a customer book, that means screening the customers that come with the deal, not only the company being bought.