What happened
Extreme Networks resolved a sanctions and export control investigation on 27 October with a non-prosecution agreement, the first the Justice Department has signed under its 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy in what it calls a near miss case. It was executed on 21 October with the National Security Division.
The conduct ran from March 2018 to March 2022. Extreme's Russian subsidiary had bought a book of customer accounts and contracts from a local networking business in 2018. One end user named in those contracts was a defense manufacturer majority owned by a Russian state company that was designated in 2014 and builds missiles for the S-300 and S-400 air defense systems. Sales continued through a third party distributor.
The money splits across two agencies. Extreme agreed to $975,721.84 in criminal penalties, made up of an equal fine and forfeiture. The Treasury's Office of Foreign Assets Control settled a parallel civil case the same day for $1,529,685 over nine apparent violations of the Ukraine and Russia related sanctions regulations. Together the resolutions exceed $2.5 million, though OFAC credits part of its penalty against the DOJ amount, bringing the net payment close to $2 million.
Why a near miss rather than a declination: the self disclosure was not timely, because it arrived under the imminent threat of a news article. DOJ still credited full cooperation and prompt remediation, which included terminating the distributor contract, tightened screening, additional compliance staff and diligence procedures for acquisitions. The result was a 50 percent fine reduction, a three year term, no independent monitor, and an admission that the agreed facts amounted to willful offenses. OFAC, working the same facts, did not allege willfulness but treated the case as egregious.
Why this is a GRC story
Timeliness has a price and now an example. The difference between a clean declination and a criminal resolution came down to who spoke first, the company or a journalist. A programme that waits for a legal opinion before escalating has already spent the discount.
Acquisition diligence is sanctions diligence. The blocked end user arrived inside a purchased book of customers. Buyers screen the seller and forget the seller's customers, and OFAC said so in terms.
A reviewed contract is not a diligence file. The compliance team saw the purchase agreement naming the end user. Seeing it and resolving it are separate steps, and only one leaves a record.
Local concealment defeats a US control. A small group of Russia based employees kept the arrangement away from US compliance staff. That is a monitoring design problem: who oversees the subsidiary, how often, and with what sampling of end users.
Two agencies, two characterisations. DOJ accepted willfulness while OFAC did not. One set of facts can carry both, and a board memo should state which one the company is managing to.
What to watch
Watch how DOJ applies the near miss category next, since a resolution that stops short of declination but avoids charges is exactly what most companies will want after discovering a problem late.
Then pull your own distributor list and ask one question per row: for each end user we cannot name, why not. If the answer is that the distributor handles it, the file is thinner than it looks.
Attribution: Analysis based on Compliance Week and related public reporting. This article is original commentary, not a repost of the source material.