The Extreme Networks Department of Justice (DOJ) and Office of Foreign Assets Control  (OFAC) resolutions give compliance professionals an assignment: examine how information moves from a transaction, a customer interaction, or a whistleblower report to a decision that protects the business.

In Part One, we traced the company’s path from an April 2022 complaint through internal investigations, an October journalist inquiry, and disclosure days before publication. The DOJ credited good-faith investigative work, cooperation, and remediation but concluded that disclosure did not meet its policy requirements. OFAC separately recognized voluntary disclosure while treating the apparent violations as egregious.

The lesson for a chief compliance officer is to connect prevention, detection, investigation, and disclosure. Each function must deliver usable information to the next. The following actions translate that lesson into responsibilities and evidence that management and directors can evaluate.

Make acquisition diligence test the actual customer

Extreme Networks acquired Russian customer relationships that included documentation identifying MMZA. Transaction records nevertheless used DEMZ, and diligence failed to recognize MMZA’s blocked status through its sanctioned parent. A response begins with reconciling acquired contracts, customer records, purchase orders, and service obligations. Legal and compliance should identify the actual end users, examine relevant ownership, and investigate inconsistent identities before approving continued business.

Corporate development should own the delivery of complete acquisition data. Trade compliance should own sanctions analysis. The integration leader should ensure that unresolved accounts remain restricted until authorized reviewers approve them. The evidence of effectiveness is a documented reconciliation showing which relationships were reviewed, what discrepancies emerged, how they were resolved, and which accounts remain restricted. A completed acquisition questionnaire alone cannot demonstrate that the operating business understood its customers. Boards overseeing acquisitions should ask whether management has identified inherited relationships that require additional investigation before revenue, support, or renewals continue.

Verify end users through independent evidence

Extreme Networks’ Russian employees dealt directly with MMZA, while business records named another company. Email domains, physical addresses, support interactions, and meetings contradicted the nominal customer identity. Compliance teams should compare these data sources. A mismatch should trigger an inquiry tailored to the risk. Account contacts and service users can reveal relationships that screening the contracting entity alone will miss.

The distributor’s explanations also require attention. Here, questions were routed back to Russian employees involved in concealment. Asking the commercial chain to explain itself supplied insufficient independence.

Trade compliance should establish when independent research, ownership analysis, reliable translations, or direct verification is required. Sales operations and customer support should provide the underlying records. An end-user certificate should support an assessment. When it conflicts with other evidence, reviewers must resolve the contradiction. Testing should measure whether the company identifies the true recipient across sales and service systems, including transactions that generate no immediate revenue.

Require evidence before releasing a compliance hold

Extreme Networks had compliance holds. Yet transactions and portal access proceeded despite unresolved inconsistencies. That makes hold release a critical control point. Companies should define who can release a hold, what evidence supports that decision, and when a second reviewer is required. Unanswered questions should remain visible, with escalation deadlines and an accountable decision maker.

The reviewer should document the discrepancy, the work performed, the evidence obtained, and the basis for concluding that the transaction may proceed. Extreme Networks’ remediation included requiring documented reasons for terminating a compliance hold. Trade compliance should own the standard, with systems personnel implementing the workflow. Internal audit should sample released holds and independently reconstruct whether the recorded evidence supports approval.

Useful measures include unresolved exception age, repeated discrepancies involving the same intermediary, and approvals lacking independent corroboration. A fast release rate is meaningful only when the underlying decisions withstand review.

Investigate the business process surrounding the allegation

The DOJ credited Extreme Networks’ initial investigation as having been done in good faith. The later discovery of evidence nevertheless demonstrates why investigative scope deserves continuing scrutiny. An allegation about a subsidiary should prompt investigators to consider how that operation obtains customers, processes orders, provides support, records identities, and communicates with intermediaries. Those processes identify evidence sources beyond interviews and the customer master file.

The investigation leader should prepare an evidence map linking each material allegation to relevant custodians, systems, documents, and unresolved questions. When new allegations emerge, the team should reconsider its hypotheses and scope. The general counsel and CCO should agree on who can expand the inquiry, engage specialized expertise, and escalate findings. Board reporting should distinguish facts, provisional conclusions, and unanswered questions.

The evidence of effectiveness is a defensible explanation of what the inquiry tested and why. Closing an investigation should require support for the conclusion and a clear trigger for reopening it when additional information arrives.

Reassess disclosure while the investigation continues

Extreme Networks’ October disclosure preceded publication but followed the journalist’s inquiry. The DOJ treated the imminent prospect of public disclosure as disqualifying under its voluntary disclosure standard. The key lesson is that companies should establish a disclosure review alongside the investigation. The review should identify what is known, the potential legal exposure, relevant authorities, remaining uncertainty, and circumstances that could affect eligibility for cooperation or disclosure benefits.

Counsel should document the decision and specify when it will be revisited. New allegations, evidence of concealment, government contact, or an external inquiry should prompt immediate reassessment. A scheduled review should also prevent the issue from disappearing while investigative work continues. The DOJ’s 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy expressly encourages reporting potential wrongdoing before an internal investigation is complete. That does not require reporting every unsubstantiated accusation. It supports a process that evaluates disclosure using the available evidence while accurately explaining what remains unknown. The general counsel should coordinate the legal assessment, with your CCO participation and board oversight appropriate to the matter’s significance. No fixed internal deadline substitutes for assessing the actual circumstances.

Evaluate each authority separately

OFAC recognized voluntary disclosure; DOJ concluded that the disclosure did not meet its policy requirements. Compliance leaders should build that distinction into their response procedures. Counsel should maintain an assessment for each relevant authority covering the conduct, applicable disclosure standard, recipient, timing considerations, current decision, and next review. The factual account should remain consistent even when the legal analysis differs.

Management should receive an explanation of which benefits may remain available and which conditions remain uncertain. Reporting to one authority should never be treated as automatic satisfaction of another authority’s expectations. The DOJ and OFAC outcomes also show why misconduct severity and disclosure credit need separate treatment. OFAC’s egregiousness determination coexisted with voluntary disclosure credit. Neither label alone explains the complete resolution. The board needs an intelligible account of these differences so it can oversee decisions without assuming that “we self-reported” resolves every enforcement consideration.

Demonstrate remediation through actual performance

Extreme Networks changed screening procedures, added compliance personnel, increased training frequency for customer-facing roles, and improved acquisition diligence. The DOJ cited the effectiveness of its compliance program in deciding against an independent monitor.

For other companies, the practical assignment is to test whether improvements address the failure mechanism. Buying a screening tool or revising a policy should lead to observable changes in decisions. Compliance and internal audits can replay representative scenarios using conflicting domains, misleading customer names, ownership links, and inconsistent certificates. Reviewers should demonstrate that they identify the issue, obtain reliable evidence, and escalate when necessary.

Training should test judgment in these situations. Managers should reinforce that employees have authority to stop a transaction and seek guidance. Compensation and discipline should support those expectations. The DOJ agreement specifically addresses compliance incentives, consequence management, data access, and root cause analysis. OFAC’s commitments likewise address management support, risk assessment, controls, testing, and training. Together, they require attention to how the program operates across the business.

Give directors evidence they can challenge

Extreme Networks’ board received an investigative presentation in summer 2022. That fact illustrates why board engagement should include questions about scope, unresolved evidence, and decisions requiring further review. Directors do not need to conduct the investigation themselves. They need enough information to assess whether management has assigned appropriate resources, preserved independence, and identified the decisions that cannot wait for a final report.

A useful briefing should identify material facts, remaining investigative gaps, disclosure considerations, accountable executives, and the next decision date. Remediation reporting should connect each change to a root cause and a test of operating effectiveness. The NPA’s three-year term and OFAC’s requirement to maintain specified measures for at least five years also make clear that resolution creates continuing obligations. Someone must own delivery, testing, reporting, and escalation throughout those periods.

Actions to take now

Start by selecting several recently released compliance holds and tracing the supporting evidence. Then review one acquisition’s customer integration and one significant whistleblower investigation. Ask whether the organization connected the relevant information and made its consequential decisions explicitly. Bring the findings to management with named owners, completion dates, and tests to show whether improvements work. Directors should ask what changed in actual business decisions after each corrective action.

The objective is an organization that recognizes contradictory evidence, investigates it effectively, and reassesses disclosure while choices remain available. Extreme Networks provides a concrete basis for testing that capability. The CCO’s responsibility is to turn the enforcement lesson into a business process that can demonstrate its effectiveness.