OFAC Sanctions Non-Prosecution Agreement: Extreme Networks

Extreme Networks agreed on October 27, 2026 to pay $975,721.84 to the US Department of Justice and $1,529,685 to the US Treasury’s Office of Foreign Assets Control (OFAC) over sales of networking equipment to a Russian missile maker.

The OFAC sanctions non-prosecution agreement is the first “near-miss” deal the DOJ National Security Division has announced under its 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy. The two amounts add up to about $2.51 million, but $487,861 of the OFAC settlement may be credited against the DOJ payments, which brings the net total to about $2.02 million.

OFAC sanctions non-prosecution agreement: the amounts

The DOJ release sets a criminal fine of $487,860.92 and forfeiture of $487,860.92, matching the revenue Extreme Networks earned on the sales. Together they make up the $975,721.84 criminal penalty.

The OFAC settlement agreement is $1,529,685. OFAC said it treated the apparent violations as voluntarily self-disclosed and egregious, and the amount reflects that finding. After the $487,861 credit, $1,041,824 is payable to OFAC.

A non-prosecution agreement is a DOJ commitment not to charge a company if it meets set terms. It sits below a deferred prosecution agreement, which files charges and holds them in abeyance. The DOJ release does not state a percentage discount from the penalty range.

Extreme Networks is a cloud networking provider headquartered in North Carolina. The matter was handled by the National Security Division’s Counterintelligence and Export Control Section and the US Attorney’s Office for the Eastern District of North Carolina. The FBI Charlotte Field Office, the Commerce Department’s Bureau of Industry and Security and Homeland Security Investigations investigated.

How the Russian sales reached a missile producer

The buyer was Moskovskiy Mashinostroitelniy Zavod Avangard (MMZA), a Russian weapons manufacturer and a primary producer of S-300 and S-400 anti-aircraft missile systems. MMZA is majority owned by JSC Concern Almaz-Antey, which OFAC added to its Specially Designated Nationals (SDN) List in July 2014. That makes MMZA blocked by operation of law, and US persons may not deal with it without a license.

The DOJ said that from around March 2018 to March 2022 the company, through its then Russia-based subsidiary Extreme Networks Rus LLC, processed and fulfilled 11 purchase orders for MMZA. No OFAC license or authorization covered them. OFAC counted nine exports of equipment and related services from the United States between September 2018 and March 2022. The two agencies describe the same sales on different bases.

The DOJ said certain Russia-based employees hid MMZA’s identity from the company’s global trade compliance group. That led the company to file false electronic export information in the Automated Export System and to ship goods from the United States.

The sales went through a third-party distributor rather than direct from Extreme Networks to MMZA. The DOJ release does not mention resellers.

OFAC found that business records named another Russian company as the end user, while MMZA was the actual recipient. The agency also found that seven purchase orders carried MMZA email addresses or its Moscow office address.

Why the DOJ called it a near-miss

Under the policy, a company that voluntarily self-discloses, cooperates and remediates, with no aggravating factors, can expect a declination. Extreme Networks fell short on timing. The DOJ said the disclosure to the National Security Division was not timely because it came under imminent threat of disclosure by a news publication.

The company still cooperated fully and remediated in time, so the DOJ treated the disclosure as a “near miss” and resolved the case with a non-prosecution agreement instead of a declination, while OFAC settled the related sanctions violations separately.

The cooperation credit rested on two steps. Extreme Networks provided relevant facts and documents on time, and it made employees available for interviews.

The remediation credit covered four steps:

It terminated its contract with the third-party distributor.
It improved its screening procedures.
It hired additional compliance personnel.
It put diligence procedures in place for mergers and acquisitions.

The DOJ cited those steps and the lack of aggravating circumstances in agreeing to the deal. OFAC separately noted that Extreme Networks had no OFAC enforcement action in the five years before the earliest transaction.

What failed in sanctions due diligence

Both releases point to the same weak spot: knowing who the end user is. OFAC said Extreme Networks’ Russian subsidiary took on customer accounts and contracts in 2018 that included MMZA, without sufficient diligence on that relationship. Warning signs sat in the order records.

The DOJ’s account adds an internal control problem. The people closest to the customer were the ones who concealed it from the central compliance function. A screening tool cannot flag a party whose name never reaches it.

That points to a few places where controls matter. Vendor due diligence on distributors is one. Distributors act as the company’s eyes on the end customer, so reviews of them cover who they sell to and how orders are described.

Acquired customer books are another. The M&A diligence step the DOJ credited suggests that inherited accounts are screened before they are served. Where ownership is not obvious, enhanced due diligence is the tool that traces a customer to its parent, here a designated state-owned defense group. Matching names against a list does not do that on its own. Tests of how well large language models handle that kind of matching are covered in RegTech Post’s report on a sanctions screening accuracy benchmark.

The case also bears on board reporting. A subsidiary that conceals a customer from headquarters is a governance failure as well as a screening failure. DOJ officials have urged executives to fund compliance functions so they can catch this kind of conduct.

What the agencies said and what to watch

Roman Rozhavsky, Assistant Director of the FBI Counterintelligence and Espionage Division, said “if you attempt to arm our adversaries by violating U.S. law, justice will find you.” Jeremy Pierczynski, Acting Special Agent in Charge of Homeland Security Investigations in Detroit, said “These laws protect our national security and prevent U.S.-origin products and services from supporting adversaries’ military capabilities.”

Corporate counsel will now see how OFAC and the DOJ treat a late disclosure that is paired with full cooperation and prompt remediation. Because the DOJ called this the first near-miss non-prosecution agreement under the policy, later OFAC sanctions cases will show whether the outcome is repeated. The full OFAC enforcement release is posted on its site.