On October 27, 2026, OFAC announced a $1,529,685 settlement with Extreme Networks, Inc., a North Carolina-based networking solutions provider, to resolve potential civil liability for nine apparent violations of the Ukraine-/Russia-Related Sanctions Regulations (“URSR”). This isn’t a case of some elaborate evasion scheme. Rather, this case represents how a routine acquisition of customer contracts handed a U.S. company a blocked end-user, and a centralized, apparently well-resourced compliance function still missed it for three years.
Extreme Russia Inherits a Blocked Customer Through a 2018 Purchase Agreement
Around 2009, Extreme established a Russian subsidiary, Extreme Networks Rus LLC (“Extreme Russia”), which sold Extreme-branded networking products and services in Russia and provided post-sale customer support until it ceased operations in March 2022. In March 2018, Extreme Russia purchased customer accounts and contracts from a Russian networking business to provide telecommunications equipment and services. Among the end users named in those contracts was Joint Stock Company (JSC) Moskovskiy Mashinostroitelniy Zavod Avangard (MMZA), a Russian defense manufacturer majority owned by Russian state-owned defense company JSC Concern Almaz Antey (“Almaz Antey”). Almaz Antey had been designated under Executive Order 13661 back in 2014, which meant MMZA was a blocked entity itself by operation of OFAC’s 50 Percent Rule. MMZA itself wasn’t independently added to the SDN List until 2022, when it was separately designated for operating in the defense and related material sector of the Russian economy, and specifically for producing missiles for Russia’s S-300 and S-400 anti-aircraft systems.
Extreme’s U.S.-led compliance team reviewed the March 2018 purchase agreement, including the contract naming MMZA as end-user, but did not conduct sufficient due diligence to recognize that MMZA was blocked, and did not question earlier purchases under the same contract that had sometimes listed a different company, Dmitrovskiy Experimental Mechanical Plant (“DEMZ”), as the end-user. That naming inconsistency turned out to be a critical red flag. Over the next three years, between September 2018 and September 2021, Extreme Russia maintained the MMZA relationship through nine additional purchase orders for hardware such as routing switches, ports, and power supplies, and software, dealing directly with MMZA staff through in-person meetings in Moscow and MMZA email addresses, and providing training and post-sales support to MMZA on multiple occasions. The settlement agreement adds that at least three of the emails Extreme Russia received from MMZA staff referenced Almaz Antey in the signature block, and the engagement included meetings held at MMZA’s own offices in Russia.
Extreme Compliance and the Red Flags
Extreme’s compliance function wasn’t absent from this process. Extreme’s U.S.-led centralized compliance function conducted sanctions and export controls screening for each of the nine POs under a company-wide policy to review all dealings involving Russia. However, it did not detect that it was dealing indirectly with a blocked entity, failing to appropriately respond to numerous indications that DEMZ was not the true end user. Red flags included seven of the nine POs referencing MMZA email addresses or MMZA’s Moscow office address as the ultimate destination, even though DEMZ was named as end-user.
The warning signs weren’t limited to the paperwork. In May 2018 and again in February 2019, Extreme’s Regional Director for Northern and Eastern Europe, who supervised Extreme Russia staff, received routine activity reports describing Extreme Russia’s dealings with MMZA. And when Extreme’s own diligence process surfaced the discrepancy directly, it still didn’t hold: on October 20, 2020 and again on November 10, 2020, Extreme asked its third-party distributor for the relevant end-user’s website, and the distributor responded twice with MMZA’s site before walking it back as a “mistake” once Extreme raised concerns about MMZA’s military affiliations. At this point, Extreme approved the POs based on an end-user statement from the distributor naming DEMZ, without further investigating the “mistake.”
Local staff compounded the problem rather than catching it. Extreme Russia personnel instructed MMZA employees to list DEMZ as their company name when registering for Extreme’s proprietary customer portal while continuing to use MMZA email addresses, and Extreme ultimately approved those registrations, even after an MMZA employee failed to respond to a due diligence request for basic company information. Separately, the settlement agreement notes Extreme had access to a due diligence and screening resource as early as 2020 that would have likely revealed Almaz Antey’s ownership of MMZA, but did not perform the inquiry necessary to identify that relationship until after the conduct at issue ceased. Extreme withdrew from Russia in March 2022 following the full-scale invasion of Ukraine, and in October 2022, Extreme became aware of the conduct at issue and submitted a disclosure to OFAC.
OFAC’s Findings
OFAC determined that Extreme voluntarily self-disclosed the apparent violations and that they constitute an egregious case. Under OFAC’s Economic Sanctions Enforcement Guidelines, the base civil monetary penalty equaled one-half of the statutory maximum, or $1,699,650, against a settlement amount of $1,529,685. OFAC coordinated the action with DOJ, which announced resolution of a parallel investigation the same day; Extreme’s obligation to pay a portion of the OFAC settlement is deemed satisfied up to an equal amount by its payment of a fine to DOJ arising from the same conduct, with the settlement agreement specifying that $487,861 of the OFAC penalty is offset against Extreme’s DOJ Non-Prosecution Agreement payment, leaving $1,041,824 payable directly to Treasury.
OFAC identified three aggravating factors: Extreme acted with reckless disregard for U.S. sanctions when it failed to conduct sufficient due diligence to recognize MMZA was blocked and failed to heed numerous warning signs that MMZA was the ultimate recipient of goods ostensibly sold to DEMZ; Extreme had actual knowledge that it fulfilled the nine POs and had reason to know MMZA was the actual end-user; and Extreme substantially harmed U.S. foreign policy objectives to deny Russia’s military sector and degrade its capacity to wage war against Ukraine by benefiting MMZA, a firm that describes itself as the sole supplier of Russia’s S-300 and S-400 mobile surface-to-air missile systems. On the other side of the ledger, OFAC credited Extreme with a clean five-year enforcement history and substantial remedial actions, including enhanced screening to identify entities majority owned by a sanctioned party or with military or government affiliations, expanded end-user diligence, additional compliance headcount, increased training, and updated M&A due diligence processes requiring comprehensive screening of a target’s customers.
Key Compliance Lessons
- Acquisition diligence has to reach customer books, not just corporate structure. Extreme’s exposure originated entirely in a contract it acquired, not one it originated. OFAC has repeatedly emphasized the importance of conducting sufficient sanctions diligence when considering a merger or acquisition, and even an asset-only deal requires diligence tailored to the full range of risks present.
- Action Item: Treat acquired customer and end-user lists as a standalone screening project before close, not an afterthought folded into general onboarding.
- A “review all Russia dealings” policy is not the same as effective screening. Extreme had a company-wide policy to flag Russia-related transactions and ran every PO through it, yet still missed the connection nine separate times. Policy existence without rigor is a false sense of security.
- Action Item: Audit whether your screening actually resolves naming discrepancies between contracting parties and ultimate end-users, not just whether a transaction gets flagged for review.
- Treat inconsistent end-user answers as an escalation trigger, not a box to check. Diligence should be redoubled in the presence of red flags, and inconsistent explanations and questionable end-user representations should be cause for particular concern. Here, a distributor flip-flopping on a website and then offering a paper end-user statement was treated as resolution rather than escalation.
- Action Item: Build a rule that a counterparty’s inconsistent or walked-back representation automatically triggers independent verification, not acceptance of a revised answer.
- Local staff can quietly defeat a centralized program. Ineffective oversight of foreign affiliates can create major risks for a U.S. parent, and even centralized or global compliance programs can be ensnared by foreign affiliates who are complicit in, or inattentive to, potential violations. Extreme Russia staff didn’t just fail to flag the MMZA relationship, they actively told MMZA personnel to misrepresent their company name on portal registrations.
- Action Item: Build periodic, independent testing of foreign subsidiary conduct into your audit plan, especially where local staff have direct customer relationships the home office doesn’t see firsthand.
- Self-disclosure still pays, even on an egregious finding. Voluntary self-disclosure generally reduces the likelihood OFAC will seek a penalty, and where a penalty is appropriate, the amount of any penalty — even when OFAC determines the conduct egregious. Extreme’s settlement came in meaningfully below the $1,699,650 base penalty despite the egregious finding and despite the DOJ offset doing some of that work.
- Action Item: Don’t let a bad internal finding deter disclosure; the VSD discount applies even when your own facts are ugly.