DOJ's First 'Near Miss' Non-Prosecution Deal Costs Extreme Networks Up to $2.5M Over Russian Missile Maker Sales

Extreme Networks avoided criminal charges for selling networking gear to the Russian plant that builds S-300 and S-400 air-defense missiles, but the case shows how little credit a company gets when it reports misconduct only when a news outlet is about to publish it. The Justice Department's National Security Division announced on Oct. 27 a non-prosecution agreement with the North Carolina company, the first "near-miss" resolution under DOJ's 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy. Extreme agreed to criminal penalties of $975,721.84, made up of a $487,860.92 forfeiture and a $487,860.92 fine.

The Treasury Department's Office of Foreign Assets Control settled a parallel civil case the same day for $1,529,685. Together the two resolutions top $2.5 million, although OFAC will treat part of its penalty as paid up to the amount of the DOJ fine. Netting that credit out, Extreme's combined payment comes to roughly $2.0 million.

Why Extreme Got a Non-Prosecution Agreement Instead of a Declination

DOJ's policy is designed to encourage companies to voluntarily disclose misconduct, cooperate and remediate. Extreme did not qualify for a declination. The department said a near-miss case is one "that involved full cooperation and appropriate remediation but did not qualify for a declination of prosecution."

The timing of the disclosure made the difference. "While Extreme Networks’ disclosure to the National Security Division (NSD) was not timely because it occurred under imminent threat of disclosure by a news publication, Extreme Networks nonetheless fully cooperated with the Department’s investigation and timely and appropriately remediated the misconduct," the release stated.

DOJ credited Extreme with producing facts and documents promptly and making employees available for interviews. For remediation, the company terminated its contract with the third-party distributor it used for the sales, improved screening, hired more compliance staff and added diligence procedures for mergers and acquisitions. Citing those steps "and the lack of aggravating circumstances," the department agreed to enter into a non-prosecution agreement.

The FBI's Charlotte Field Office, the Commerce Department's Bureau of Industry and Security and Homeland Security Investigations investigated the case. Assistant Director Roman Rozhavsky of the FBI's Counterintelligence and Espionage Division used the announcement to warn others: "Let this announcement serve as a clear warning: if you attempt to arm our adversaries by violating U.S. law, justice will find you."

How Orders for MMZA Slipped Past a U.S. Compliance Team

The customer was Moscow Machinery Building Plant Avangard (MMZA), a producer of the S-300 and S-400 anti-aircraft missile systems. MMZA was majority owned by JSC Concern Almaz-Antey, which was added to OFAC's Specially Designated Nationals list in July 2014. OFAC said that made MMZA a blocked person at all relevant times.

According to DOJ, between about March 2018 and March 2022, Extreme's then-Russia-based subsidiary, Extreme Networks Rus LLC, processed and fulfilled 11 purchase orders for networking equipment and services to MMZA without the required OFAC license or authorization. Certain Russia-based employees hid MMZA's identity from Extreme's global trade compliance group, which led the company to file false electronic export information through the Automated Export System. DOJ put Extreme's revenue from the sales at about $487,860.92, the same figure used for the forfeiture and the fine.

OFAC counts the conduct differently. Its enforcement release cites nine apparent violations of 31 C.F.R. 589.201 of the Ukraine-/Russia-Related Sanctions Regulations, tied to nine additional purchase orders negotiated between September 2018 and September 2021 for hardware such as routing switches, ports and power supplies, plus software, with the exports running between September 2018 and March 2022.

The relationship came with an acquisition. In March 2018, Extreme Russia bought customer accounts and contracts from a Russian networking business, and one of those contracts named MMZA as the end user. OFAC said Extreme's U.S.-led compliance team reviewed the purchase agreement but did not do enough diligence to recognize that MMZA was blocked.

Later orders listed a different company, Dmitrovskiy Experimental Mechanical Plant (DEMZ), as end user, while the warning signs kept coming. OFAC said seven of the nine purchase orders included MMZA email addresses or gave MMZA's Moscow office as the final destination. In October and November 2020, Extreme asked its distributor for the end user's website and twice received MMZA's. When Extreme raised concerns about MMZA's military ties, the distributor supplied DEMZ's site and called the earlier answers a mistake. Extreme then approved the orders on the strength of the distributor's end-user statement.

What Drove OFAC's $1,529,685 Penalty

OFAC found the case egregious but voluntarily self-disclosed, which set the base penalty at half the statutory maximum: $1,699,650. The agency cited three aggravating factors: reckless disregard for U.S. sanctions, actual knowledge that Extreme fulfilled the nine orders along with reason to know MMZA was the real end user, and substantial harm to U.S. foreign policy objectives of denying Russia's ability to supply the military sectors of its economy.

On the mitigating side, Extreme had no OFAC enforcement action in the prior five years. It also took substantial remedial steps: better screening for entities majority owned by sanctioned parties or tied to militaries, wider end-user diligence, more sanctions compliance staff, more training, and M&A diligence that now screens target companies and their customers.

OFAC's compliance section reads like a warning to every exporter with foreign subsidiaries. "Inconsistent explanations and questionable end-user representations are red flags that should be cause for particular concern," the release said.

What It Means for Contractors

According to OFAC, Extreme employs over 2,800 people in 29 countries. Switches, routers and support services of the kind at issue here are standard products for networking and IT vendors, and the case sets out three expectations that apply to any such vendor with federal customers.

First, sanctions diligence has to come before an acquisition, including an asset-only deal. OFAC stressed that even when a buyer takes on only certain assets, an existing relationship with a blocked person can turn into multiple violations once the relationship continues. Contractors buying books of business overseas should screen the customers, not just the seller, including who owns those customers.

Second, a centralized compliance program only works if it follows up on what it sees. Extreme's U.S. team screened each of the nine orders under a company-wide policy to review Russia dealings, and the orders still went through. Mismatched email domains, shipping addresses that differ from the named end user, and distributors who change their story all warrant escalation, not a signed end-user statement.

Third, timing of a disclosure matters under DOJ's policy. A company that self-reports under imminent threat of a news story can still avoid charges with full cooperation and remediation, but it does not qualify for a declination and, in this case, paid a forfeiture and a fine. Contractors that find a sanctions or export problem internally gain the most by reporting it before anyone outside the company does.