Extreme Networks to Pay $1.53 Million Over Sanctions Violations Involving Russian Missile Manufacturer

Key Takeaways

• $1.53 Million Sanctions Settlement: Extreme Networks agreed to pay $1,529,685 to resolve nine apparent violations involving exports of networking hardware and software to a blocked Russian defense manufacturer between September 2018 and March 2022.
• Repeated Warnings Overlooked: Seven purchase orders contained MMZA email addresses or delivery information, while separate distributor communications and customer registrations raised further questions about the equipment's actual recipient.
• Acquisition Due Diligence Failures: Extreme inherited the customer relationship through its Russian subsidiary's 2018 acquisition of contracts but failed to identify MMZA's blocked status under U.S. sanctions ownership rules.
• Egregious Conduct Finding: OFAC determined that Extreme acted with reckless disregard for sanctions requirements, although voluntary self-disclosure and remedial measures contributed to a reduced settlement.

Deep Dive

Twice in the autumn of 2020, a distributor supplying networking equipment to Extreme Networks was asked for the website of its Russian customer. Twice, the distributor provided the website of a company that manufactured missiles for Russia's air defense systems. The purchase orders named someone else.

Extreme's compliance team noticed the discrepancy and raised concerns about the manufacturer's military connections. The distributor said it had made a mistake, supplied a different website and provided a statement identifying the company named in the paperwork. Extreme approved the orders.

The exchanges were among a number of warnings detailed by the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) in a $1.53 million settlement with Extreme Networks, a North Carolina-based provider of cloud networking and artificial intelligence technology.

According to OFAC, Extreme exported networking hardware and software from the United States to a sanctioned Russian defense manufacturer on nine occasions between September 2018 and March 2022. The agency classified the apparent violations as egregious, finding that the company had acted with reckless disregard for U.S. sanctions despite repeated evidence that its equipment was reaching a prohibited customer.

The customer was Joint Stock Company Moskovskiy Mashinostroitelniy Zavod Avangard, known as MMZA, a Russian manufacturer of missiles for the country's S-300 and S-400 air defense systems. Its majority owner, the state-owned defense company Almaz-Antey, had been sanctioned by Washington in July 2014. Under U.S. sanctions rules, that ownership was enough to make MMZA a blocked entity, even before the Treasury Department designated it independently in June 2022.

Extreme had a centralized compliance department, a company-wide policy requiring reviews of Russian transactions and employees assigned to sanctions screening. Each of the nine purchase orders passed through that process. The information available to reviewers repeatedly contradicted the identity of the customer named in the paperwork.

The relationship began in March 2018, when Extreme's Russian subsidiary purchased customer accounts and contracts from a local networking business. Among them was an agreement to supply telecommunications equipment and services to MMZA.

The acquisition agreement identified the defense manufacturer by name. Extreme's U.S.-led compliance team reviewed the agreement but failed to establish that MMZA was blocked because of its ownership by Almaz-Antey. The company also failed to investigate adequately earlier purchases under the contract that sometimes identified another Russian business, Dmitrovskiy Experimental Mechanical Plant, or DEMZ, as the end user.

The acquisition involved customer relationships and existing contracts rather than the purchase of an entire company. Among the assets Extreme acquired was a commercial relationship that U.S. sanctions prohibited it from continuing.

Over the following three years, Extreme's Russian subsidiary continued dealing with MMZA. Its employees negotiated orders for routing switches, ports, power supplies and software. They met with MMZA personnel at the manufacturer's Moscow offices and elsewhere, exchanged messages using company email addresses and provided training and technical support.

The subsidiary's employees dealt directly with the manufacturer. Yet the documents reaching Extreme's centralized compliance function frequently named DEMZ instead.

Seven of the nine purchase orders contained information pointing to MMZA. Some included the manufacturer's email addresses. Others listed its Moscow offices as the ultimate destination for the equipment. In May 2018 and February 2019, Extreme's regional director for Northern and Eastern Europe also received routine activity reports describing the subsidiary's dealings with MMZA.

The exchanges with the distributor in 2020 showed that Extreme had begun questioning the manufacturer's identity and military affiliations. On October 20 and November 10, during reviews of two purchase orders, the company requested the end user's website. The distributor responded with MMZA's website on both occasions.

Extreme raised concerns. The distributor subsequently supplied DEMZ's website, explaining that its previous answers had been mistakes. An end-user statement identifying DEMZ followed, and Extreme approved the orders without further investigation.

The customer-support system presented another opportunity to identify the relationship.

Extreme operated a proprietary online portal through which customers could track contracts, request technical assistance and use support tools. According to OFAC, employees of its Russian subsidiary instructed MMZA personnel to register under DEMZ's company name, although the employees continued using their MMZA email addresses.

The registrations were initially delayed by Extreme's policy requiring additional review of Russian business. They were eventually approved. In one instance, approval followed even though an MMZA employee had not responded to a due diligence request for the company's name, address and corporate email.

Information identifying MMZA appeared in acquisition documents, purchase orders, management reports, distributor correspondence and customer registrations. The company's Russian employees were dealing with the manufacturer directly, while its centralized compliance process continued approving transactions that identified DEMZ as the customer.

OFAC determined that Extreme had actual knowledge that it fulfilled the nine purchase orders and reason to know that MMZA was the ultimate recipient. The agency found that the company's failure to investigate the warnings amounted to reckless disregard for U.S. sanctions.

Treasury officials also concluded that the sales provided an economic benefit to a Russian defense manufacturer and substantially harmed American foreign policy objectives intended to restrict Russia's military capabilities and its ability to wage war against Ukraine.

MMZA describes itself as the sole supplier of Russia's S-300 and S-400 mobile surface-to-air missile systems, according to OFAC. The United States independently sanctioned the company in June 2022 for operating in Russia's defense sector, specifically citing its production of missiles for those systems.

A Compliance Program That Failed to Intervene

OFAC calculated a base civil penalty of $1,699,650 after determining that the apparent violations were egregious but had been voluntarily disclosed by Extreme. The final settlement of $1,529,685 reflected mitigating circumstances, including the company's lack of OFAC enforcement actions during the five years preceding the earliest transactions at issue.

The company also undertook substantial changes to its compliance program. It strengthened screening procedures to identify businesses majority owned by sanctioned entities or associated with military and government activities, expanded checks on end users and increased training for employees responsible for compliance and customer relationships.

Extreme hired additional sanctions compliance personnel and revised its acquisition procedures to require more comprehensive screening of prospective targets and their customers.

OFAC coordinated the settlement with the Department of Justice, which separately announced a resolution of its parallel investigation. Under the Treasury agreement, Extreme may receive credit toward its OFAC payment obligation for an equivalent amount paid as a DOJ fine arising from the same conduct.

The case is notable for the compliance infrastructure Extreme already had in place. The company maintained a centralized sanctions function, reviewed Russian transactions and required additional checks before granting customers access to its systems. Those procedures identified suspicious information on multiple occasions. They did not produce an effective intervention.

The acquisition had exposed an initial weakness. Extreme's compliance review examined the purchase agreement without adequately establishing the sanctions status of a customer named in it. Once the relationship entered the business, subsequent screening failed to resolve evidence that the customer identified in the purchase orders was not the company receiving the equipment.

The Russian subsidiary's conduct compounded the problem. Employees who dealt directly with MMZA understood the commercial relationship, while the centralized compliance function approved orders bearing another company's name. In the customer-support portal, Russian employees went further, instructing MMZA personnel to register under DEMZ's identity.

OFAC has repeatedly warned that sanctioned Russian companies may use intermediaries to conceal their involvement in commercial transactions. The agency emphasized that inconsistent explanations and questionable end-user representations warrant particular scrutiny, especially when a potential customer has military connections.

Extreme's distributor supplied conflicting information about the end user. The company's own records contained further evidence that MMZA was receiving the equipment. Its compliance team raised concerns about the manufacturer's military affiliations before accepting the distributor's explanation and allowing the transactions to proceed.

The settlement also addresses a risk associated with acquisitions that receive less attention than the screening of prospective buyers and sellers. Purchasing customer contracts or other business assets can bring existing relationships with sanctioned entities into the acquiring company's operations. Those relationships may continue generating transactions long after the acquisition itself has been reviewed and approved.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey