Extreme Networks’ $1.53 million OFAC settlement: a blocked customer that was not on the SDN List

Extreme Networks’ U.S. trade compliance office screened every one of the nine purchase orders. Each named a Russian company called DEMZ as the end user. Seven of them also carried the email addresses or the Moscow address of a different company, MMZ Avangard, and at least three emails from MMZA staff to Extreme’s Russian subsidiary named its parent, Almaz Antey, in the signature block. Almaz Antey had been on OFAC’s SDN List since July 16, 2014.

On October 27, 2026, OFAC announced that Extreme had agreed to pay $1,529,685 to settle its potential civil liability for nine apparent violations of the Ukraine-/Russia-Related Sanctions Regulations. The Justice Department announced a non-prosecution agreement the same day. The case shows plainly what a name check cannot settle on its own: a company can be blocked without appearing on any list, because of who owns it.

What happened

Extreme Networks Rus LLC sold Extreme products and support in Russia until it closed in March 2022. In March 2018 it completed the purchase of customer accounts and contracts from the Russian subsidiary of a U.S. networking business. One of those contracts named MMZA as the end user. Extreme’s U.S.-led compliance team reviewed the purchase agreement, including that contract, but according to OFAC did not do enough diligence to recognize that MMZA was blocked under the 50 Percent Rule. Sales to MMZA before the acquisition had been booked in the name of another Russian company, Dmitrovskiy Experimental Mechanical Plant (DEMZ).

Between September 2018 and September 2021 the subsidiary took nine more orders, for routing switches, ports, power supplies, software and cloud subscriptions. MMZA was the real recipient each time, and the records named DEMZ each time. Subsidiary staff met MMZA staff, at least twice at MMZA’s offices, trained them and supported them after the sale.

Some of this reached the U.S. side, where every Russia order was held for compliance review. During reviews in October and November 2020, Extreme asked the distributor for the end user’s website and twice received MMZA’s. When Extreme raised MMZA’s apparent military ties, the distributor called that a mistake, supplied a DEMZ website and offered an end-user statement naming DEMZ. Extreme accepted it and approved the orders.

OFAC also found that from 2020 Extreme had access to a due diligence and screening resource that would likely have revealed Almaz Antey’s ownership of MMZA, and did not use it for that until after the conduct ended. A whistleblower raised allegations in April 2022. In October 2022, after a journalist asked for comment, Extreme expanded its investigation and disclosed to OFAC, the Justice Department and Commerce. MMZA had by then been designated in its own name, on June 28, 2022, three months after the last export.

Why ownership matters

OFAC’s 50 Percent Rule treats an entity as blocked when one or more blocked persons own 50 percent or more of it, directly or indirectly, individually or in the aggregate. The blocking happens by operation of law: OFAC does not have to list the entity. For the Russia program OFAC cited 31 CFR 589.411 and its August 2014 guidance, which FAQ 401 works through with examples. Our guide to the OFAC 50 Percent Rule and beneficial ownership covers the rule in more depth.

That is the distinction at the center of this case. Almaz Antey was a listed entity. MMZA was a blocked entity that had no SDN entry of its own until June 2022, so a search for MMZA’s name could not have found one. Whatever a name search returned, the fact that made MMZA blocked was its ownership.

Aggregation and chains are where ownership checks get harder. The example below is hypothetical, and it follows the logic of OFAC’s FAQ 401.

Supplier C is blocked although the listed holding owns only a quarter of it directly, and nothing on C’s own paperwork says so. Distributor D and Reseller E are not blocked under the rule, but that is not the same as clearing them. FAQ 398 says the rule turns on ownership, not control, and urges caution with entities in which a blocked person holds a significant stake below 50 percent or may have control by other means.

Where screening programs fail

OFAC named the failures in this case. The left column below is what the release and settlement agreement document. The right column is our reading of the control each one points to, not a finding OFAC made.

OFAC’s own lessons: do sanctions diligence before an acquisition, redouble it when red flags appear, oversee foreign affiliates, and remember that procedures do not help if they are not followed. Beyond this case, and not as findings about Extreme, weaknesses like these can appear in any screening program:

• A party cleared because its own name is not on a list.
• Ownership data that is missing or old, with no record of what was checked.
• Holds that lift without a written reason.
• Counterparty files screened once and never again. Our post on why the Consolidated Screening List alone is not enough covers the list side of this.
• Decision evidence scattered across email and spreadsheets.

What compliance officers should check

For each new customer, end user, distributor or acquired account, and again when something changes:

What the DOJ action adds

The Justice Department called this its first non-prosecution agreement in a “near miss” case under its 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy: a case with full cooperation and appropriate remediation that does not qualify for a declination. Extreme’s disclosure was not timely under that policy, because it came under the imminent threat of a news story. The agreement also records that Extreme had investigated an April 2022 whistleblower report in good faith with outside counsel, and disclosed in writing days before the article ran.

The two agencies weighed the disclosure differently. OFAC treated it as voluntary, which under its Enforcement Guidelines set the base penalty at half the statutory maximum even though the case was egregious. DOJ did not treat it as timely, but gave weight to the earlier good-faith investigation. A disclosure that counts with one agency may not count the same way with another.

DOJ credited full cooperation, including nearly 400,000 documents produced and employees made available for interviews, and remediation: closing the Russian subsidiary, ending the distributor relationship, more compliance staff and training, diligence procedures for acquisitions, and a new denied party screening process that requires staff to document why a compliance hold is lifted and rescreens every counterparty in the customer database daily. It did not require a monitor. None of that is a software outcome: the screening tool was one item in a list that also covered people, training and governance, and DOJ also pointed to the lack of aggravating circumstances.

How SecurePoint fits

SecurePoint is visitor management and restricted-party screening for regulated facilities, with a Screening API that SecurePoint turns on for approved customers. Some of it maps onto the gaps in this case, and some of the work in this case is outside what any screening product does.

In a case like this one, the ownership research and the follow-up on red flags are where the work is: registry extracts, ownership certifications, the next question to the distributor. SecurePoint can hold the record of what was screened, what came back, who decided and why. The screening overview lists which checks are on by default and which are not.

Frequently asked questions