A whistleblower report arrives. The company investigates, consults outside counsel, and briefs its board. Additional allegations prompt more investigation. Then a journalist calls with information the company has not uncovered. Management moves quickly to disclose, but an important opportunity has already narrowed. That sequence sits at the center of the Extreme Networks enforcement action. For compliance professionals, it raises a difficult question: how do you investigate incomplete allegations while preserving the opportunity to disclose misconduct voluntarily and promptly?
In October, DOJ announced what it described as its first “near miss” non-prosecution agreement under the 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy. Extreme Networks received credit for cooperation and remediation, but its disclosure came under the imminent threat of publication. The case demonstrates how weaknesses in transaction controls can become weaknesses in corporate understanding, investigation, and disclosure.
Today I begin a two-part blog series on this matter. Today in Part 1, we focus on the DOJ Non-Prosecution Agreement. (NPA) Tomorrow in Part 2, we consider the OFAC Settlement Agreement.
The misconduct behind the disclosure decision
Extreme supplied networking equipment and services that reached Moscow Machinery Building Plant Avangard, known as MMZA, a Russian weapons manufacturer. MMZA was majority owned by Almaz Antey, which OFAC designated in July 2014. That ownership mattered. Under OFAC’s 50 Percent Rule, MMZA was blocked even before its own designation in June 2022. Screening only for a customer’s appearance on a sanctions list would therefore miss a central risk.
Extreme accepted responsibility for the conduct in its Statement of Facts and acknowledged that those facts constituted violations of law. OFAC, by contrast, resolved apparent violations without a finding of fault. Those distinctions matter when describing the case. The DOJ identified deliberate concealment by employees in Extreme’s Russian operation. They misrepresented the actual end user, causing false export filings and defeating controls intended to keep restricted transactions from proceeding. The scheme generated approximately $487,861 in revenue.
The relatively modest revenue did not make the conduct insignificant. The customer was a weapons manufacturer, and the transactions implicated United States sanctions, export controls, and national security.
An acquisition transferred an unresolved risk
The Russian networking assets transferred to Extreme in March 2018. Among the acquired relationships was a service contract that actually identified MMZA as the end user. OFAC found that Extreme approved the acquisition documentation without sufficient diligence to recognize MMZA’s blocked status through ownership. Other records associated the business with Dmitrovskiy Experimental Mechanical Plant, or DEMZ. That name continued to appear in transaction records even though MMZA received the products and services.
The acquisition therefore provided an early opportunity to reconcile customer identities, contracts, and ownership. Instead, an inherited discrepancy continued into the operating business. For the compliance professional, this is where the later investigation story begins. When customer records inaccurately describe the business, investigators who rely on those records can inherit the same distorted picture. Effective diligence must establish who actually receives the product, support, and commercial benefit.
Controls detected inconsistencies without resolving them
Extreme had a Global Trade Compliance function and placed Russian transactions on automatic compliance hold. The problem was how contradictory information was evaluated before those holds were released. MMZA employees communicated using MMZA email addresses. Purchase orders naming DEMZ included MMZA addresses or email information. Russian employees met with MMZA personnel and provided technical assistance directly.
OFAC reported that seven of the nine purchase orders in its account contained MMZA email addresses or MMZA’s Moscow office address. The evidence was embedded in ordinary business records. The portal registration process supplied another warning. An MMZA employee was instructed to register under DEMZ’s name while continuing to use an MMZA email address. A resubmitted application also supplied MMZA’s address. The hold was nevertheless lifted.
Later, personnel questioned the relationship between DEMZ and the MMZA domain. The distributor sought guidance from Extreme’s Russian employees before responding. Compliance was effectively relying on explanations routed through people involved in concealing the customer. In October 2020, further questions produced a different website and an end user certificate. The certificate contained discrepancies in the company name and address. Collecting additional paperwork did not resolve the underlying identity problem.
These events connect operational compliance to investigative effectiveness. The relevant evidence was spread across orders, portal registrations, distributor exchanges, support activity, and acquisition records. An investigation needed to connect those sources.
April 2022 brought an internal warning
Extreme withdrew from Russia in March 2022. In April, it received a whistleblower complaint concerning possible wrongdoing within its Russian operation. DOJ expressly credited the company with conducting a good-faith internal investigation, including consultation with outside counsel. The Statement of Facts also records a presentation to the board during summer 2022.
That acknowledgment prevents an oversimplified account. The company did investigate. DOJ did not describe six months of complete inaction. The agreement explains that additional allegations emerged several months later, causing Extreme to reopen and expand its investigation. By October, that work was still underway.
The critical issue is the relationship between investigative scope and disclosure timing. An investigation can be undertaken sincerely while leaving consequential facts undiscovered. Board awareness can coexist with unresolved questions about whether the inquiry reaches the relevant people, transactions, and evidence. The public record does not establish that an April disclosure would necessarily have secured a declination. It does show that the company’s opportunity to make a qualifying disclosure was affected by what happened next.
The October inquiry changed the circumstances
In October 2022, an investigative journalist contacted Extreme Networks seeking comment and supplied new facts concerning possible willful misconduct. The inquiry specifically identified business with MMZA. Extreme quickly retained external counsel, expanded its investigation, and disclosed to DOJ before the article appeared. The Statement of Facts describes evidence uncovered concerning efforts to obscure transaction information and meetings with MMZA. Once it uncovered that evidence, Extreme immediately notified Justice, Treasury, and Commerce. But publication was only days away.
DOJ concluded that disclosure did not satisfy the policy’s timeliness and voluntariness requirements because it occurred in anticipation of imminent public disclosure. Beating the publication date did not establish that the disclosure preceded an imminent threat that DOJ would learn of the misconduct. This was the “near miss.” The company had taken meaningful investigative steps and ultimately reported the conduct, but the circumstances of that report prevented it from qualifying under the policy’s voluntary disclosure standard.
DOJ’s 2026 policy encourages disclosure of potential wrongdoing before an internal investigation is complete. For present compliance planning, that is a reason to evaluate disclosure while investigating. It should not be confused with a claim that the 2026 policy governed the company’s decisions in 2022.
DOJ and OFAC reached different disclosure assessments
The same matter produced different agency assessments. DOJ found that Extreme Networks’ disclosure failed its policy requirements. OFAC determined that its apparent violations were voluntarily self-disclosed and egregious. Those findings should be read within each agency’s framework. OFAC’s treatment did not establish eligibility for DOJ’s disclosure benefits. DOJ’s conclusion did not prevent OFAC from recognizing voluntary disclosure.
The agreements establish the different outcomes without supplying a complete comparative explanation for every element of each agency’s assessment. Compliance teams should resist inventing one. The practical implication is straightforward: a company facing overlapping sanctions and criminal exposure needs separate disclosure assessments for the relevant authorities, coordinated around a common factual record. A single corporate label of “self-disclosed” cannot answer every agency’s questions.
Cooperation and remediation still changed the outcome
DOJ gave significant weight to Extreme Networks’ good-faith efforts to investigate incomplete allegations. It also awarded full cooperation credit, including for producing nearly 400,000 documents, presenting investigative findings, and making employees available for interviews. Remediation included ending the distributor relationship, improving screening and diligence, adding compliance personnel, and requiring documented reasons for releasing compliance holds. DOJ concluded that an independent monitor was unnecessary.
The criminal resolution required a $487,860.92 fine and equal forfeiture, totaling $975,721.84. OFAC’s settlement amount was $1,529,685, with a specified credit for payment under the DOJ agreement, leaving $1,041,824 payable to Treasury. Simply adding the headline amounts would overstate the combined payment. The NPA imposed a three-year term. OFAC required maintenance of specified compliance measures for at least five years. Cooperation improved the resolution, but meaningful financial and operational obligations remained.
Questions for the CCO and board
The central lesson is that investigative progress and disclosure eligibility require separate attention. A company needs to know what it has learned, what remains uncertain, and how changing circumstances affect its choices.
CCOs and directors should ask:
- Does an investigation connect the allegation to acquisition records, transaction exceptions, customer support, and ownership information?
- Who reassesses disclosure when new allegations arrive or evidence contradicts the original explanation?
- What unresolved questions accompany a board briefing, and who owns the next decision?
- Could an external inquiry expose material facts that our investigative scope has overlooked?
Tomorrow in Part Two we will take a deeper dive into the OFAC Settlement Agreement and translate these questions into controls, responsibilities, and evidence of effectiveness. Extreme Networks’ experience gives compliance leaders a concrete opportunity to examine how their organizations move from receiving a warning to making an informed decision while meaningful options remain. Your review should begin before the next allegation arrives, when leaders can improve escalation procedures with clear executive accountability without the pressure of imminent publication.