What's Happening?
The Department of Justice's (DOJ) National Security Division (NSD) announced a non-prosecution agreement (NPA) with Extreme Networks, Inc., a North Carolina-based networking equipment company. This marks the DOJ's first 'near miss' NPA under its Corporate
Enforcement and Voluntary Self-Disclosure Policy (CEP). Extreme Networks agreed to pay criminal penalties totaling $975,721.84 for sanctions and export control offenses, and an additional $1,529,685.00 in administrative penalties to the U.S. Treasury's Office of Foreign Assets Control (OFAC). The violations stemmed from illegal sales of advanced networking equipment and services to a Russian weapons manufacturer, Moscow Machinery Building Plant Avangard (MMZA), between March 2018 and March 2022. MMZA was owned by JSC Concern Almaz-Antey, which was designated in July 2014. The company's self-disclosure was deemed a 'near miss' because it occurred under the imminent threat of public disclosure by a news publication, rather than being fully voluntary and timely.
Why It's Important?
This case sets a precedent for how the DOJ will apply its Corporate Enforcement Policy, particularly the 'near miss' provision (Part II). It clarifies that while full cooperation and remediation are crucial, the timing of self-disclosure is decisive. Companies that delay disclosure until public exposure is imminent will not qualify for the most lenient outcomes, such as a declination, but can still receive significant credit. The resolution also highlights that regulatory penalties from agencies like OFAC can exceed criminal fines, emphasizing the need for a coordinated disclosure strategy across multiple government bodies. This serves as a critical warning to U.S. companies about the severe consequences of sanctions and export control violations, especially those involving entities linked to national security concerns, and underscores the importance of robust internal compliance programs and prompt, truly voluntary self-reporting.
What's Next?
Companies are now advised to adopt clear disclosure protocols, ensuring that credible allegations of potential criminal conduct are immediately escalated to legal and compliance leadership. This includes a documented, early assessment of whether CEP benefits are available, particularly within the 120-day window for self-reporting after a whistleblower reports internally and to the DOJ. The case also emphasizes the need for thorough due diligence in mergers and acquisitions, as inherited misconduct can lead to significant penalties. The DOJ's continued focus on identifying misconduct through its own data analytics and whistleblower incentives means that companies must maintain vigilance and proactive compliance measures. The 'near miss' NPA will likely serve as a template for future enforcement actions across various DOJ components, including the Fraud Division and U.S. Attorney's Offices.
Beyond the Headlines
The Extreme Networks case reveals the increasing scrutiny on corporate compliance in an era of heightened geopolitical tensions and complex international sanctions. The DOJ's emphasis on 'timeliness' in self-disclosure, even when a company has made good-faith efforts to investigate, suggests a stricter interpretation of voluntary cooperation. This could lead to companies feeling pressured to disclose potential misconduct earlier, even if internal investigations are incomplete, to avoid the 'near miss' category. The case also highlights the challenges of integrating acquired businesses, as legacy issues can quickly become current liabilities. Furthermore, the significant role of whistleblowers and investigative journalism in uncovering these violations underscores the importance of external oversight in corporate accountability. The outcome reinforces the idea that robust compliance is not just about avoiding penalties but also about maintaining corporate reputation and trust in a globalized marketplace.
