The Extreme Networks OFAC settlement: a blocked missile maker behind a stand-in end user

The Extreme Networks OFAC settlement is a 1,529,685 dollar civil resolution, announced on 27 October 2026, for nine exports to a Russian missile maker that was blocked because a sanctioned parent owned most of it. Screening ran on every order, yet the real customer sat behind another company's name. DOJ resolved a parallel criminal case the same day.

• OFAC found nine apparent violations of the Ukraine-/Russia-Related Sanctions Regulations between September 2018 and March 2022, and rated them egregious but voluntarily self-disclosed.
• The end user, JSC Moskovskiy Mashinostroitelniy Zavod Avangard (MMZA), was blocked at all relevant times because Almaz-Antey, designated in July 2014, owned a majority of it. MMZA was only listed in its own name in June 2022.
• The relationship arrived through a 2018 purchase of customer contracts that Extreme's compliance team reviewed without spotting the blocked owner.
• DOJ says Russia-based employees concealed MMZA's identity from Extreme's global trade compliance group.
• DOJ signed its first "near miss" non-prosecution agreement under its 2026 policy, with 975,721.84 dollars in forfeiture and fine.
• Extreme committed to five years of compliance undertakings, including screening of account contacts and, as relevant, acquired customer lists, with annual executive certification.

What did OFAC find in the Extreme Networks case?

OFAC found that Extreme Networks, a North Carolina networking company, exported hardware and software from the United States nine times to a blocked Russian defence manufacturer, dealing through its Russian subsidiary. The conduct ran from September 2018 to March 2022. OFAC rated it egregious, found reckless disregard, and still reduced the penalty for voluntary self-disclosure.

The enforcement release, dated 27 October 2026, names the customer as MMZA, which describes itself as the sole supplier of Russia's S-300 and S-400 surface-to-air missile systems. MMZA was majority owned by JSC Concern Almaz-Antey, designated on 16 July 2014 under Executive Order 13661. OFAC states that "at all relevant times" MMZA was therefore a blocked person, although it was only designated in its own name on 28 June 2022.

Extreme Russia, the subsidiary, bought customer accounts and contracts from a Russian networking business in March 2018. One contract named MMZA as the end user. Extreme's US-led compliance team reviewed that purchase agreement but, in OFAC's words, did not conduct "sufficient due diligence to recognize that MMZA was blocked."

The settlement agreement sets the credit and the net figure. The DOJ press release sets the criminal amounts. By our arithmetic from those two documents, Extreme pays about 2.02 million dollars across both agencies.

How did a stand-in end user beat screening on every order?

Extreme's screening checked the name on each order, and that name belonged to a different company. All nine purchase orders were screened under a policy to review every Russia deal. They named Dmitrovskiy Experimental Mechanical Plant (DEMZ) as end user, while the documents pointed to MMZA. OFAC lists ignoring those signs as an aggravating factor.

Extreme's purchase orders themselves carried the red flags. Seven of the nine included MMZA email addresses or gave MMZA's Moscow office as the final destination. In October and November 2020, Extreme asked its distributor twice for the end user's website and twice received MMZA's. The settlement agreement adds that the distributor "sought advice from Extreme Russia prior to responding", then called its answers a mistake and offered an end-use statement, which Extreme accepted.

DOJ says the concealment came from Extreme's own Russia-based staff. It states that "certain Russia-based Extreme Networks employees concealed the identity of MMZA" from the company's global trade compliance group, causing false electronic export information to be filed. Extreme Russia staff also told MMZA employees to register on Extreme's customer portal under the DEMZ name while using MMZA email addresses. Extreme approved those registrations, once after an MMZA user did not respond to a due diligence request for company name, address and corporate email.

Extreme also missed MMZA's ownership by Almaz-Antey. The settlement agreement records that Extreme had a due diligence resource from 2020 that "would have likely revealed" Almaz-Antey's ownership, but did not run that inquiry until the conduct had stopped. Under 31 CFR 589.411, an entity 50 percent or more owned by blocked persons is blocked "regardless of whether the name of the entity" is on the SDN List. A name-only screen cannot see that.

OFAC's release puts the lesson plainly: "Inconsistent explanations and questionable end-user representations are red flags that should be cause for particular concern."

How does the Extreme Networks OFAC settlement compare with other 2026 cases?

The Extreme Networks OFAC settlement is the tenth OFAC enforcement action of 2026 and a mid-sized one. OFAC's chart puts the year to date at 297,513,285 dollars across ten actions, a total dominated by one 275 million dollar case. Among the comparable cases below, only this one pairs an egregious finding with self-disclosure.

Sources: OFAC's 2026 civil penalties chart and the settlement notices for Rice Lake, TradeStation and IMG Academy.

Two readings follow. Self-disclosure set Extreme's starting point at half the statutory maximum even though the conduct was egregious, while non-egregious cases such as IMG Academy are based on transaction values, so the totals are not directly comparable. And the settlement landed at exactly 90 percent of the 1,699,650 dollar base: by our arithmetic a 10 percent reduction, which OFAC does not apportion between its listed mitigating factors, a clean five-year record and substantial remediation. Rice Lake, covered in our Rice Lake analysis, also turned on a foreign subsidiary selling through a distributor.

What does this mean for your compliance obligations?

The Extreme Networks OFAC settlement shows what OFAC already expects in practice: screening of owners as well as names, across the whole relationship. It tests five controls: ownership-based screening under the 50 percent rule, diligence on acquired customer books, escalation when documents contradict the file, identity checks on account users, and oversight of foreign affiliates.

Ownership screening. The 50 percent rule aggregates holdings of blocked persons, directly or indirectly. A UBO check built for AML, often at a 25 percent threshold, answers a different question. Sanctions teams need the full ownership chain resolved and every owner screened, then the blocked stakes added together. That is a KYB task, not a list lookup.

Acquired relationships. Extreme's new commitments include, "as relevant", requesting and screening "a complete list" of a target's customers, end users and banks. For a bank, payment firm or crypto platform buying a book of accounts, that maps to customer due diligence on every inherited relationship before the first post-closing transaction, not at the next periodic review.

Escalation on contradictions. When an email domain, delivery address or website does not match the stated customer, the record needs enhanced due diligence and a documented resolution, not a third-party attestation. For US banks, the same contradiction can also raise a Suspicious Activity Report question.

Identity of account users. Extreme now screens "accounts and account contacts" and is examining whether to add web and email domains. That makes user-level identity data an input to sanctions screening, not only to onboarding.

Oversight of foreign affiliates. OFAC warns that "ineffective oversight of foreign affiliates can create major risks for a U.S. parent company." Extreme's regional director received activity reports describing the MMZA dealings in May 2018 and February 2019, and OFAC found Extreme "had reason to know" MMZA was the real end user. In our reading, for groups with subsidiaries in or near high-risk jurisdictions, affiliate activity reports are compliance evidence, not only sales updates.

What is still uncertain, and what are the risks?

Four points remain unsettled: how two agencies graded the same disclosure differently, why their transaction counts differ, how far a partner's attestation still protects anyone, and whether screening can catch staff who help a customer hide. Each affects whether firms self-disclose and how they document diligence on distributors, partners and their own subsidiaries.

Disclosure credit. OFAC treated the case as voluntarily self-disclosed, noting Extreme disclosed in October 2022. DOJ said the disclosure to its National Security Division "was not timely" because it came under imminent threat of a news story, and gave partial credit by treating it as a "near miss", the first such non-prosecution agreement under its 2026 policy. A firm can therefore receive full disclosure credit from one agency and partial credit from another for the same facts.

Counting the conduct. DOJ describes 11 purchase orders from around March 2018. OFAC counts nine "additional" orders from September 2018 and separately mentions earlier purchases under the acquired contract that named DEMZ. Those earlier orders may explain DOJ's higher figure, but neither agency reconciles the two counts.

Reliance on intermediaries. Extreme accepted an end-user statement from a distributor that had pointed to MMZA and consulted Extreme Russia before answering. OFAC called the overall conduct reckless. The open question is how much independent evidence is enough when a partner's attestation conflicts with your own records. The 2023 Tri-Seal compliance note cited by OFAC already warned that sanctioned Russian parties often use third-party intermediaries to obscure their identities.

Insiders. Name and ownership screening assume your own staff report the real customer. When employees conceal the end user, as DOJ describes, testing, audit, whistleblower reports and data that contradicts the file are what surface it. OFAC's answer is in the commitments: five years of testing, audit and annual executive certification, even though the release is "without any finding of fault".

How should compliance teams respond?

The Extreme Networks OFAC settlement points to a starting place: the contradictions already in your data. Teams should test whether screening sees owners, whether acquired books were screened in full, and whether mismatched identity details on users trigger review. Each is checkable this quarter, without new regulation.

Resolve ownership for every counterparty in high-risk jurisdictions, screen each owner rather than only the legal entity, and add blocked stakes together against the 50 percent test. Re-screen customer books acquired in past deals against ownership data, since blocked status can predate a listing by years. Add email domain and delivery address mismatches to your alert rules, and route them to EDD rather than to the sales owner. Treat a distributor's end-user statement as one input, logged against the evidence that contradicts it. Our sanctions screening guide covers list and fuzzy-matching basics.

Zyphe resolves beneficial ownership recursively across 240+ corporate registries, with a threshold configurable per risk tier, so the ownership chain is mapped before owners are screened. Verified identity data stays encrypted in the user's own vault, not in a central store of customer PII. To see it on your own counterparties, book a demo.

The bottom line

The Extreme Networks OFAC settlement shows a screening programme that checked every order and still missed the customer, because it checked names rather than owners, took a partner's word over its own records, and did not catch staff who hid it. The lesson: resolve ownership fully, screen what you acquire, investigate mismatched identity details, and test what foreign staff report.

Cited sources

• OFAC enforcement release on Extreme Networks, 27 October 2026 (PDF)
• OFAC settlement agreement with Extreme Networks, Inc. (PDF)
• OFAC recent action notice, 27 October 2026
• DOJ press release on the Extreme Networks non-prosecution agreement, 27 October 2026
• 31 CFR 589.411, entities owned by blocked persons
• OFAC civil penalties and enforcement information, 2026 chart
• Tri-Seal Compliance Note on third-party intermediaries, 2 March 2023 (PDF)