OFAC’s Extreme Networks Settlement: Why Screening Names Alone Is Not Enough 

On October 27, 2026, the Treasury Department’s Office of Foreign Assets Control (OFAC) announced a $1,529,685 settlement with Extreme Networks, Inc. for nine apparent violations of the Ukraine-/Russia-Related Sanctions Regulations. The customer was a Russian missile and air defense manufacturer that was not on the SDN List when the transaction closed, but was deemed a blocked person by OFAC at all times by virtue of its majority owner being a a designated entity. Exporters, acquirers, and any company selling through foreign distributors in high-risk markets should test whether their screening looks past the name on the order. 

KEY TAKEAWAYS 

• OFAC treated a Russian defense manufacturer as a blocked person at all relevant times because a designated Russian state-owned company held majority ownership, even though the manufacturer itself was not added to the SDN List until June 2022, after the conduct ended. 
• According to OFAC, Extreme Networks’ U.S.-led compliance function reviewed the 2018 purchase agreement that named the manufacturer as an end user, and screened all nine later purchase orders, without identifying the blocked party. 
• OFAC determined the nine apparent violations were egregious and voluntarily self-disclosed. The settlement is $1,529,685, against a base penalty of $1,699,650. 
• OFAC’s compliance guidance in this case centers on three areas: sanctions diligence in acquisitions (including asset purchases), escalation when red flags point to a different end user, and oversight of foreign affiliates. 

A Blocked Customer That Was Not on the List 

According to OFAC’s enforcement release and settlement agreement, Extreme’s Russian subsidiary, Extreme Networks Rus LLC, purchased customer accounts and contracts from another Russian networking business in March 2018. One acquired contract named Joint Stock Company Moskovskiy Mashinostroitelniy Zavod Avangard (MMZA) as the end user. 

MMZA has been majority owned since 2002 by JSC Concern Almaz-Antey, a Russian state-owned defense company that OFAC designated on July 16, 2014 under Executive Order 13661. OFAC stated that, as a result, MMZA was a blocked person at all relevant times, citing 31 C.F.R. § 589.411 and its August 13, 2014 guidance on entities owned by blocked persons. MMZA was separately designated on June 28, 2022 under Executive Order 14024, after the conduct had ended. 

OFAC stated that Extreme’s U.S.-led compliance team reviewed the March 2018 purchase agreement, including the contract naming MMZA, but did not conduct sufficient due diligence to recognize that MMZA was blocked. The settlement agreement adds that Extreme had access to a due diligence and screening resource as early as 2020 that would likely have revealed Almaz-Antey’s ownership, and that Extreme did not perform that inquiry until after the conduct ceased. 

Between September 2018 and March 2022, Extreme exported routing switches, ports, power supplies, software, and cloud and software subscriptions from the United States to fill nine purchase orders. OFAC found that MMZA was the ultimate recipient each time, while the order records named a different Russian company, Dmitrovskiy Experimental Mechanical Plant (DEMZ). 

The Red Flags OFAC Identified 

OFAC stated that Extreme’s centralized compliance function screened each of the nine purchase orders under a company-wide policy to review all Russia-related dealings. OFAC found that Extreme ignored or did not appropriately respond to numerous indications that DEMZ was not the true end user. The table below summarizes the indicators described in the release and settlement agreement. 

DTL’s read: none of these indicators depended on a name match against the SDN List. Each one sat in data the company already had: an email domain, a ship-to address, a signature block, a sales report, or a portal registration. 

How OFAC Weighed the Case 

OFAC determined that the apparent violations were voluntarily self-disclosed and constituted an egregious case. Under OFAC’s Economic Sanctions Enforcement Guidelines, the base penalty was one-half of the statutory maximum, or $1,699,650. The settlement agreement states the applicable statutory maximum as $3,399,300. 

OFAC identified three aggravating factors: reckless disregard for U.S. sanctions in failing to conduct sufficient diligence and heed warning signs; actual knowledge that Extreme fulfilled the orders and reason to know MMZA was the actual end user; and substantial harm to U.S. foreign policy objectives. OFAC identified two mitigating factors: no OFAC enforcement action in the five years before the earliest transaction, and substantial remedial measures. 

OFAC coordinated with the Department of Justice, which resolved a parallel investigation. The settlement agreement references a Non-Prosecution Agreement with DOJ and provides that $487,861 of the OFAC amount is deemed satisfied by payments under that agreement, leaving $1,041,824 payable to Treasury. 

OFAC also stated that voluntary self-disclosure generally reduces the likelihood that OFAC will seek a penalty and, where a penalty is appropriate, the amount, even when the agency determines conduct to be egregious. 

What OFAC Signaled for Exporters and Acquirers 

In the release’s compliance considerations, OFAC stated that: 

• Sanctions diligence should be comprehensive and ongoing throughout a business relationship, and companies acquiring only certain assets should tailor diligence to the full range of specific risks present. 
• Diligence should be redoubled when red flags appear. OFAC identified inconsistent explanations and questionable end-user representations as red flags that should be cause for particular concern. 
• Ineffective oversight of foreign affiliates can create major risks for a U.S. parent, including for companies with centralized compliance programs, and particular attention should go to affiliates operating in or near high-risk jurisdictions such as Russia. 
• The existence of compliance procedures alone is not sufficient where companies do not follow them or do not adequately investigate and resolve potential sanctions risks. 

Under the settlement agreement, Extreme agreed to maintain a sanctions compliance program for at least five years. Commitments include screening a complete list of an acquired entity’s customers, end users, and other relevant relationships in future mergers and acquisitions; collecting end-user certificates with additional independent research; screening accounts and account contacts; examining whether screening can extend to web and email domains; annual training for customer-facing staff; and an annual certification by a senior-level executive for five years. 

Action Items for Your Compliance Program 

The steps below are DTL’s recommendations based on this case and our experience advising exporters and importers on sanctions screening. 

• Screen ownership, not only names. For customers and end users in Russia and other high-risk jurisdictions, obtain ownership information and apply the 50 Percent Rule, including aggregated and indirect ownership. For background on the lists themselves, see our prior article on U.S. sanctions lists. 
• Screen every data point on the order. Compare email domains, ship-to addresses, signature blocks, and portal registrations against the named end user. A mismatch is a hold, not a footnote. 
• Treat a corrected answer as an escalation trigger. When a distributor changes its explanation, we recommend independent verification before relying on any end-user statement it provides. 
• Diligence the customer book in every acquisition. Asset purchases that transfer customer contracts transfer the sanctions profile of those customers. Request and screen the full customer and end-user list before closing. 
• Route field intelligence to compliance. Sales activity reports and regional updates that name customers should be reviewed against screening results, not only by business managers. 
• Evaluate disclosure early. If a review surfaces a possible blocked-party dealing, engage counsel promptly to assess a voluntary self-disclosure to OFAC. 

How Diaz Trade Law Can Help 

Diaz Trade Law advises U.S. exporters, importers, and acquirers on OFAC screening design, 50 Percent Rule ownership analysis, transactional sanctions diligence, internal investigations, and voluntary self-disclosures. If your screening program has not been tested against ownership and end-user red flags, contact us at 305-456-3830 or visit diaztradelaw.com. 

 

This article is attorney advertising. It is provided for general informational purposes only, does not constitute legal advice, and does not create an attorney-client relationship.