The Department of Justice's (DOJ) National Security Division (NSD) on October 27, 2026, announced a non-prosecution agreement (NPA) with Extreme Networks, Inc., a North Carolina-based networking equipment company. The NPA resolves a criminal investigation into sanctions and export control violations arising from illegal sales of advanced networking equipment and services to a Russian weapons manufacturer. The DOJ described the resolution as its first "near miss" NPA under the Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP): a case in which the company fully cooperated and appropriately remediated but did not qualify for a declination because its self-disclosure occurred under imminent threat of disclosure by a news publication.
As discussed in DOJ Announces New, Centralized Corporate Enforcement Policy, the CEP applies to all corporate criminal matters handled by the DOJ other than antitrust violations, and it sets out three paths: a declination (Part I), a "near miss" resolution for companies that fall short of a declination for limited reasons (Part II), and prosecutorial discretion in all other cases (Part III). The Extreme Networks agreement is the first public illustration of what Part II looks like in practice, and its lessons extend well beyond export controls.
Extreme Networks agreed to pay criminal penalties totaling $975,721.84 to resolve the sanctions and export control offenses and, separately, $1,529,685.00 in administrative penalties imposed by the U.S. Treasury's Office of Foreign Assets Control (OFAC) for the sanctions violations.
Key Takeaways
- First "Near-Miss" Resolution: DOJ has now shown what a company receives when it cooperates and remediates fully but its self-report does not qualify as a "voluntary self-disclosure."
- Timing Is Decisive: A disclosure made under imminent threat of public exposure is not timely under the CEP, even when made in good faith.
- Good Faith Still Earns Credit: The DOJ gave "significant weight" to the company's earlier good faith effort to investigate incomplete allegations of misconduct.
- The Regulatory Bill Can Exceed the Criminal One: OFAC's penalty was larger than the DOJ's fine and forfeiture combined, bringing the total to more than $2.5 million.
The Underlying Conduct
Between approximately March 2018 and March 2022, Extreme Networks, through its then-Russia-based subsidiary, Extreme Networks Rus LLC, processed and fulfilled 11 purchase orders for networking equipment and services ultimately destined for Moscow Machinery Building Plant Avangard (MMZA), a primary producer of the S-300 and S-400 anti-aircraft missile systems. MMZA was owned by JSC Concern Almaz-Antey, which was added to the Specially Designated Nationals and Blocked Persons List in July 2014. Notably, MMZA itself was not designated until June 28, 2022, after the relevant conduct ended.
The problem was inherited. Extreme Networks acquired the Russian business from a U.S. company in Chapter 11 bankruptcy under a March 2017 asset purchase agreement that closed as to the Russian assets in March 2018. Legacy employees who had serviced MMZA carried the relationship over and concealed MMZA's identity from the company's U.S.-based Global Trade Compliance group by using a front customer name. Even so, the transaction documents still contained indications of MMZA's involvement, including an MMZA email domain, MMZA's street address on purchase orders, and an end-user certificate that misspelled the purported customer's name. After the compliance holds were lifted, Extreme Networks filed false electronic export information and shipped goods from the United States. The sales generated approximately $487,860.92 in revenue.
The company admitted to conspiracy under 18 U.S.C. § 371, willful violations of the Export Control Reform Act and the International Emergency Economic Powers Act, false export filings under 13 U.S.C. § 305, and smuggling under 18 U.S.C. § 554.
How Extreme Networks Missed a Deadline
Under the DOJ's CEP, a voluntary self-disclosure must, among other things, occur "prior to an imminent threat of disclosure or government investigation" and within a reasonably prompt time after the company learns of the misconduct, with the burden on the company to demonstrate timeliness. Extreme Networks received a whistleblower report in April 2022 and conducted a good faith, internal investigation with outside counsel. It later reopened and expanded the investigation after learning of additional allegations. In October 2022, while that work was ongoing, an investigative journalist contacted the company with new facts suggesting willful misconduct. The company submitted a written self-disclosure to NSD that preceded publication by a matter of days.
The DOJ concluded that the disclosure was not timely because it was made in anticipation of imminent public disclosure, but it gave "significant weight" to the evidence of the company's good faith efforts to investigate the earlier, incomplete allegations.
What "Near Miss" Treatment Looked Like
Part II of the CEP provides that, absent particularly egregious or multiple aggravating circumstances, the DOJ will offer an NPA, allow a term of fewer than three years, not require an independent compliance monitor, and reduce the fine by 50% to 75% off the low end of the U.S. Sentencing Guidelines range. Measured against those benchmarks, the Extreme Networks resolution reflects the following:
- Form: The DOJ entered an NPA, citing full cooperation, timely remediation, and the absence of aggravating circumstances.
- No Compliance Monitor: The DOJ found an independent compliance monitor unnecessary because the company's compliance program had "proven effective in practice," and the company has remained committed to maintaining its compliance program and reporting.
- Penalty: The company agreed to pay a criminal fine of $487,860.92 for sanctions and export control offenses and to forfeit the same amount, representing the proceeds of the sanctions and export control offenses.
- Term: The NPA carries a three-year term, extendable by up to one year and subject to possible early termination.
Despite the national security character of the conduct, the DOJ found no aggravating circumstances, emphasizing that a small group of employees in a Moscow office of fewer than 15 people concealed the conduct from U.S. compliance personnel, that the subsidiary was shut down, and that the conduct yielded less than half a million dollars in revenue.
Cooperation and Remediation That Earned Credit
The company received full cooperation credit for producing nearly 400,000 documents on a rolling basis with translations, making current and former employees (including foreign-based employees) available for interviews, presenting its internal investigation findings, and agreeing to toll the statute of limitations. Its remediation included shutting down the Russian subsidiary and terminating the distributor involved, moving trade compliance training for customer-facing roles from biennial to annual, retaining a third-party compliance consultant, hiring additional compliance personnel, adopting a denied-party screening tool that rescreens counterparties and requires documented reasons for releasing a compliance hold, and implementing merger and acquisition diligence procedures.
Continuing Obligations
During the term, the company must promptly report credible evidence or allegations of criminal export control or sanctions violations, submit annual compliance reports, and bind any acquirer of a substantial portion of its business to the agreement. Its CEO and trade compliance manager must certify near the end of the term that the company met its disclosure and compliance obligations. The NPA does not bind other agencies and offers no protection to individuals.
Why This Resolution Matters
The cost of a late self-report has a price tag. A CEP declination would have required disgorgement of the $487,860.92 in proceeds. Missing the timeliness requirement by a matter of days added a criminal fine of the same amount, admitted violations of five federal criminal statutes, and three years of reporting, certification, and cooperation obligations. For many companies, those non-monetary consequences will matter more than the fine.
The disclosure clock runs from the first credible allegation, not the end of the investigation. Extreme Networks had roughly six months between the whistleblower report and the investigative journalist's call. A third party - whether a reporter, a whistleblower who goes directly to the DOJ, or the DOJ's own data analytics - can totally collapse the window for disclosure without warning. Recent government announcements clearly demonstrate the current emphasis on identifying misconduct on its own or through whistleblower incentives. In effect, the play clock could be running totally unbeknownst to the relevant company.
A documented good faith investigation is the safety net. While not explicitly stated, it appears the government recognized the challenge Extreme Networks faced in uncovering committed criminal actors within their ranks. Even though it failed to uncover the entire scheme, the record of the company's earlier investigative steps made in good faith allowed it to remain on a Part II path.
Acquired businesses bring their customers, their employees, and their risk. The misconduct began with relationships inherited from a distressed seller and was carried forward by legacy employees. Due diligence review does not stop on the day an acquisition is finalized. Concerns that materialize after a deal is effectuated require immediate investigation and a corresponding plan of action.
Plan for every regulator, not just the DOJ. OFAC's $1,529,685.00 penalty exceeded the entire criminal penalty, and the NPA expressly does not bind other agencies. Disclosure strategy should be coordinated across the DOJ, OFAC, and the Commerce Department's Bureau of Industry and Security from the outset.
What Companies Should Do Now
Because the CEP applies Department-wide, this resolution is a template not only for NSD but for the Fraud Division, U.S. Attorney's Offices, and other DOJ components. Companies should consider:
Adopt a disclosure-decision protocol. Require that credible allegations of potential criminal conduct be escalated to legal and compliance leadership immediately, with a documented, early assessment of whether CEP benefits remain available, including the 120-day window to self-report after a whistleblower reports both internally and to the DOJ.
Undertake and document good faith investigative steps. Keep a contemporaneous record of how allegations were scoped, investigated, escalated, and reported to the board, because that record may determine which CEP path applies.
***
Baker Donelson's Government Enforcement and Investigations practice group continues to monitor DOJ's corporate enforcement policies, including developments involving voluntary self-disclosure, cooperation, and remediation. Questions about this resolution or the Corporate Enforcement and Voluntary Self-Disclosure Policy may be directed to Robert J. Higdon Jr., N. Tyler Lemons, K. Landin Johnston, or any member of Baker Donelson's Government Enforcement and Investigations practice group.