What Happened

Extreme Networks, Inc. (Extreme), a North Carolina-based artificial intelligence and cloud networking solutions provider, agreed to pay $1,529,685 to settle nine apparent violations of the Ukraine-/Russia-Related Sanctions Regulations. Between September 2018 and March 2022, Extreme exported networking equipment and related services from the United States to a company that is majority owned by a designated Russian state-owned company. That state-owned parent makes air defense systems, missiles, and other war materiel.

OFAC says the action emphasizes three points: do sanctions diligence before acquiring a company or its assets, stay vigilant about sanctions risks afterward, and make sure foreign activities and operations are adequately overseen. OFAC coordinated the action with the Department of Justice (DOJ), which announced the resolution of its own parallel investigation the same day.

Description of the Apparent Violations

The customer Extreme acquired

Extreme and its affiliates employ more than 2,800 people in 29 countries. Around 2009, Extreme set up a Russian subsidiary, Extreme Networks Rus LLC (Extreme Russia), which sold Extreme-branded networking products and services in Russia and supported customers after the sale. Extreme Russia ceased operations in March 2022.

In March 2018, Extreme Russia bought customer accounts and contracts from a Russian business that specialized in networking for business communications. One of the end users named in those contracts was Joint Stock Company (JSC) Moskovskiy Mashinostroitelny Zavod Avangard (MMZA), a Russian defense manufacturer.

Since 2002, MMZA has been majority owned by JSC Concern Almaz Antey (Almaz Antey), a Russian state-owned defense company. OFAC designated Almaz Antey on July 16, 2014 under Executive Order (E.O.) 13661. Under OFAC’s 50 Percent Rule, a company owned 50 percent or more in the aggregate by blocked persons is itself blocked, even if OFAC has not named it on the SDN List. MMZA was therefore a blocked person at all relevant times, and U.S. persons were prohibited from dealing with it, directly or indirectly. The State Department separately designated MMZA on June 28, 2022 under E.O. 14024, specifically for producing missiles for Russia’s S-300 and S-400 anti-aircraft systems.

Extreme’s U.S.-led compliance team reviewed the March 2018 purchase agreement, including the contract that named MMZA as end user. It did not do enough diligence to recognize that MMZA was blocked. It also did not question earlier purchases under that contract that at times named a different Russian company, Dmitrovskiy Experimental Mechanical Plant (DEMZ), as the end user.

How the sales continued

From September 2018 to September 2021, Extreme Russia kept the MMZA relationship going, including nine further purchase orders (POs) for hardware such as routing switches, ports, and power supplies, along with cloud and software subscriptions and software. Extreme Russia dealt directly with MMZA staff to develop these orders. It met them in person, including at MMZA’s offices in Russia, and corresponded with them through MMZA email addresses. At least three of those emails carried Almaz Antey in the signature block. Extreme Russia also trained MMZA staff and supported them after the sale.

Even so, none of the nine POs or their business records named MMZA as the end user. Each one named DEMZ. Extreme Russia kept up that cover story in two ways. It entered DEMZ instead of MMZA in Extreme’s internal customer database. It also told MMZA staff to list DEMZ as their company name when they registered for Extreme’s online customer portal, which lets customers track contracts, open support cases, and use technical tools. The MMZA staff still registered with their MMZA email addresses.

The warning signs Extreme missed

Extreme’s U.S.-led central compliance function screened each of the nine POs for sanctions and export controls under a company-wide policy of reviewing every dealing that involved Russia. It still did not detect that Extreme was dealing indirectly with a blocked company. It either ignored or failed to act on numerous signs that DEMZ was not the real end user and that Extreme was supplying MMZA.

• Seven of the nine POs listed MMZA email addresses, or MMZA’s Moscow office address, as the final destination for the goods, even though DEMZ was named as the end user.
• In May 2018 and February 2019, Extreme’s Regional Director for Northern and Eastern Europe, who supervised Extreme Russia’s staff, received routine activity reports describing Extreme Russia’s dealings with MMZA, including meetings between the two in Moscow.
• On October 20 and November 10, 2020, while reviewing two of the POs, Extreme asked its third-party distributor for the end user’s website. Both times the distributor sent MMZA’s website. When Extreme raised concerns about MMZA’s apparent military ties, the distributor said the earlier answers were a mistake and supplied a DEMZ-affiliated website. The distributor had asked Extreme Russia for advice before replying, and it also suggested simply filing an end-user statement to settle Extreme’s concerns. Extreme accepted that and approved the POs without further investigation.
• Extreme’s company-wide Russia policy initially held up the MMZA portal registrations, but Extreme approved them anyway. In one case it approved the registration even though the MMZA employee never answered a diligence request for the company’s name, address, and corporate email.

In all, between September 2018 and March 2022, Extreme dealt in property in which a blocked person held an interest on nine occasions when it exported hardware and software from the United States to MMZA. These are the apparent violations of § 589.201 of the Ukraine-/Russia-Related Sanctions Regulations, 31 C.F.R. part 589.

The Penalty

OFAC treated this as an egregious case that Extreme voluntarily self-disclosed. Under OFAC’s Economic Sanctions Enforcement Guidelines (Enforcement Guidelines), 31 C.F.R. part 501, app. A, that combination sets the base penalty at one-half of the statutory maximum, which here is $1,699,650. The settlement agreement puts the statutory maximum for the nine violations at $3,399,300.

The settlement amount of $1,529,685 reflects OFAC’s weighing of the General Factors in the Enforcement Guidelines. It is $169,965, or 10 percent, below the base penalty. That percentage is simple arithmetic on the two figures. OFAC does not say how much each factor moved the number.

Extreme does not pay the full amount to OFAC. It owes Treasury $1,041,824. The other $487,861 is treated as paid through the fine Extreme is paying DOJ under its Non-Prosecution Agreement for the same conduct.

Aggravating factors

• Reckless disregard of sanctions. Extreme did not do enough diligence to recognize that MMZA was a blocked person, and it did not heed the many signs that MMZA was the real recipient of the goods in the nine POs that it said it was filling for DEMZ.
  • General Factor A (Willful or Reckless Violation of Law): OFAC treated the failure to follow up on obvious warning signs as a failure to exercise even a minimal degree of caution.
• Knowledge. Extreme knew it was filling the nine POs and had reason to know that MMZA was the actual end user.
  • General Factor B (Awareness of Conduct at Issue): Extreme knew about the transactions themselves, and the red flags in the POs and its own reviews gave it reason to know who the real customer was.
• Harm to U.S. foreign policy goals. By giving an economic benefit to MMZA, a blocked Russian defense firm that calls itself the sole supplier of Russia’s S-300 and S-400 mobile surface-to-air missile systems, Extreme substantially harmed U.S. efforts to deny Russia the ability to supply its military sector and to reduce its capacity to wage war against Ukraine.
  • General Factor C (Harm to Sanctions Program Objectives): The customer was a defense manufacturer at the center of the Russia sanctions program’s goals, so the conduct worked directly against them.

Mitigating factors

• Clean enforcement history. Extreme was not the subject of any OFAC enforcement action in the five years before the earliest of the transactions at issue.
  • General Factor D (Individual Characteristics): A company with no recent sanctions penalty or finding of violation gets credit for its sanctions history.
• Substantial remedial action. Extreme took steps to address the root cause of the violations. It improved its screening to better catch entities that are majority owned by a sanctioned party or have military or government ties. It expanded its end-user diligence, hired more sanctions compliance staff, increased training for compliance and customer-facing employees, and updated its merger and acquisition diligence to include full screening of the target and its customers. The settlement agreement adds detail on several of these steps. Extreme hired a Senior Product Counsel, or similar role, to lead its sanctions and export controls compliance. It gave its trade compliance and order management teams refresher training on OFAC sanctions, and it provides annual training to customer-facing staff such as sales, supply chain, and order management. It also bought new screening software and began collecting end-user certificates backed by additional independent research. Its screening now covers customer accounts and account contacts, and it is looking at adding web and email domains.
  • General Factor F (Remedial Response): Extreme acted on the root cause rather than only stopping the conduct, which is the kind of response the Enforcement Guidelines credit.

What Extreme agreed to do

In the settlement agreement, Extreme represents that it has ended the conduct and will maintain for at least five years a sanctions compliance program designed to prevent a repeat. The commitments follow the five components of OFAC’s Framework for OFAC Compliance Commitments: management commitment, risk assessment, internal controls, testing and audit, and training. Several stand out.

• In future mergers and acquisitions, Extreme will conduct reasonable sanctions diligence, including requesting and screening a complete list of the acquired company’s customers, end users, and other relevant relationships.
• Its testing and audit function must be independent of the activities it audits and accountable to senior management.
• Relevant employees will receive sanctions training at least once a year.
• A senior-level executive will certify to OFAC every year for five years, starting 180 days after the agreement is signed, that Extreme has kept these measures in place, with a written explanation of how it is meeting each commitment.

If OFAC concludes that Extreme breached the agreement, it can reopen the investigation and seek a penalty of up to the statutory maximum of $3,399,300.

What are the Takeaways?

• Sanctions diligence has to run through the whole life of a business relationship, not just the start. OFAC has repeatedly stressed diligence when a company is considering a merger or acquisition or starting a new business relationship. Even when a deal involves only certain assets, the diligence should fit the full range of risks. Here, a single risk, an acquisition target’s existing customer relationship with a blocked person, produced multiple apparent violations once the relationship continued after the acquisition.
• Red flags call for more diligence, not less. When the evidence suggests that a known counterparty is not the real or only interested party, a company should work to identify the sanctions risk, including the risk of dealing indirectly with a sanctioned person. Inconsistent explanations and questionable end-user representations deserve particular concern. OFAC and its interagency partners have warned that sanctioned Russian parties often use third-party intermediaries to hide their identities and evade U.S. sanctions and export controls.
• Weak oversight of foreign affiliates can create major risk for a U.S. parent company. Risks that start abroad often come home. Even a company with a centralized or global sanctions compliance program can be caught out by foreign affiliates that are either complicit in or inattentive to potential violations. Companies should build a strong culture of compliance across all operations worldwide and pay particular attention to affiliates that operate in or near high-risk jurisdictions such as Russia.
• Having compliance procedures is not enough if a company does not follow them or does not adequately investigate and resolve the sanctions risks they surface.
• Voluntary self-disclosure pays. OFAC weighs the totality of the circumstances, but self-disclosure generally lowers the chance that OFAC will seek a penalty at all, and, where a penalty is warranted, the size of that penalty, even when OFAC finds the conduct egregious.

Other resources

OFAC enforcement and compliance resources

On May 2, 2019, OFAC published A Framework for OFAC Compliance Commitments. It describes OFAC’s view of the essential parts of a sanctions compliance program, for organizations subject to U.S. jurisdiction and for foreign companies that deal with the United States, U.S. persons, or U.S.-origin goods and services. The Framework also explains how OFAC may factor those parts into its evaluation of apparent violations and settlements, and an appendix covers common root causes of violations that OFAC has seen in its investigations.

Information on the civil penalty process appears in the regulations for each sanctions program, the Reporting, Procedures, and Penalties Regulations (31 C.F.R. part 501), and the Enforcement Guidelines. These and recent enforcement information are on OFAC’s civil penalties and enforcement page.

Whistleblower program

The Financial Crimes Enforcement Network (FinCEN) runs a whistleblower incentive program covering violations of OFAC-administered sanctions, as well as violations of the International Emergency Economic Powers Act, the Foreign Narcotics Kingpin Designation Act, the Trading With the Enemy Act, and the Bank Secrecy Act. People in the United States or abroad who provide information leading to a successful enforcement action with penalties above $1,000,000 may be eligible for an award. The program covers potential violations in any commercial sector.