Extreme Networks pays OFAC $1.5 million after missing its real Russian customer

What happened

On 27 October 2026, the US Office of Foreign Assets Control (OFAC) announced that Extreme Networks, a North Carolina-based networking provider, had agreed to pay $1,529,685 to settle nine apparent violations of the Ukraine-/Russia-Related Sanctions Regulations. OFAC found the violations egregious and voluntarily self-disclosed. The Department of Justice resolved a parallel investigation through a non-prosecution agreement, and part of the OFAC amount can be satisfied by payments under it.

According to OFAC’s enforcement release, Extreme’s Russian subsidiary bought customer accounts and contracts from a Russian networking business in March 2018. One named end user was Moskovskiy Mashinostroitelniy Zavod Avangard (MMZA), a defence manufacturer majority owned by Almaz-Antey, which was designated in 2014. Under OFAC’s ownership rules, MMZA was blocked throughout. Extreme’s compliance team reviewed the purchase agreement naming MMZA but did not recognise it as blocked.

Between September 2018 and March 2022, Extreme exported hardware and software to MMZA on nine occasions. The purchase orders named a different company, Dmitrovskiy Experimental Mechanical Plant (DEMZ), as end user. Seven of them included MMZA email addresses or gave MMZA’s Moscow office as the destination. Each order went through Extreme’s sanctions and export controls screening.

OFAC describes further warnings. Twice in late 2020, when Extreme asked its third-party distributor for the end user’s website, the distributor sent MMZA’s. After Extreme raised concerns about MMZA’s military links, the distributor said the earlier references were a mistake, and Extreme approved the orders on the strength of an end-user statement naming DEMZ. OFAC also says staff at the Russian subsidiary told MMZA personnel to list DEMZ as their company when registering for Extreme’s customer portal.

Why it matters

Every order was screened, and the violations happened anyway. The failure OFAC describes sits in what happened after the screening: contradictions in the paperwork were settled by an end-user statement from the same distributor that had supplied the contradictory information.

The case also shows how exposure arrives through acquisitions. OFAC notes that Extreme took on a target’s existing customer relationship with a blocked person, and that the relationship quickly produced multiple violations once it continued after the purchase. That suggests an acquired customer book should be screened in full, with the same depth as new onboarding.

OFAC’s release also stresses oversight of foreign affiliates. It says the existence of compliance procedures alone is not sufficient where companies fail to follow them or to investigate and resolve potential sanctions risks.

Practitioner angle

• Screen ownership as well as names. MMZA was blocked because of who owned it, before it was ever designated in its own right.
• Treat any mismatch between the named end user and the email domains, delivery addresses, or website on an order as an escalation, and require independent evidence before closing it.
• Screen the customer lists of any business or book you acquire, before completion where possible.
• If you bank or finance exporters of technology to high-risk markets, ask how they verify end users and what they do when a distributor’s explanation changes.
• Check how activity reports from foreign subsidiaries reach the compliance function. OFAC says a regional director received two reports describing dealings with MMZA.

Start with the end-user mismatch rule. In this case, it was the red flag that appeared on most of the orders.