OFAC Fines Extreme Networks $1.53 Million Over Russia Sanctions Violations

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has reached a $1,529,685 settlement with Extreme Networks, Inc., a North Carolina-based networking and technology provider, over nine apparent violations of U.S. sanctions targeting Russia.

OFAC stated that between September 2018 and March 2022, the company exported networking equipment, software, and related services from the United States to Joint Stock Company Moskovskiy Mashinostroitelniy Zavod Avangard (MMZA), a Russian defence manufacturer. MMZA was majority-owned by JSC Concern Almaz-Antey, a designated Russian state-owned defence company. Resultantly MMZA was subject to U.S. blocking restrictions during the relevant period.

OFAC said the issue stemmed partly from a failure to identify the true end user of the products. In 2018, Extreme’s Russian subsidiary acquired customer accounts and contracts that included MMZA. However, the company did not carry out sufficient due diligence to identify the sanctions risk associated with that customer relationship.

The company later continued supplying equipment and services through nine purchase orders. Although another Russian company, Dmitrovskiy Experimental Mechanical Plant (DEMZ), was named as the end user in business records, OFAC found that MMZA was the actual recipient.

Several warning signs were present. Seven purchase orders contained MMZA email addresses or its Moscow office address, while communications and other records also pointed to MMZA. OFAC said the company failed to investigate these inconsistencies adequately and approved the orders despite concerns about the end user’s military links.

OFAC described the apparent violations as egregious and said Extreme voluntarily disclosed them. The settlement totals $1,529,685; under the agreement, $487,861 may be credited against payments arising from the related U.S. Department of Justice resolution, leaving $1,041,824 payable to OFAC under the agreement.

The company subsequently reported taking remedial steps, including improving sanctions screening, strengthening end-user checks, hiring additional compliance staff, expanding employee training, and enhancing due diligence for mergers and acquisitions.

Implications for compliance teams

This case shows that sanctions compliance must look beyond the name recorded on a purchase order. Companies should verify the ultimate end user, investigate inconsistencies in addresses and email domains, and assess whether ownership links connect a customer to a sanctioned entity.

Compliance teams should also review customer relationships inherited through acquisitions, strengthen oversight of overseas subsidiaries and distributors, and escalate unresolved warning signs before approving transactions. Screening systems are useful, but they cannot replace meaningful investigation and follow-up when information does not add up.