A Cautionary Tale for Global Trade Compliance: The Cost of Not Knowing What You Don’t Know

The Extreme Networks enforcement action offers an important lesson in global compliance oversight, corporate accountability, and why investing in prevention may be considerably less expensive than paying for remediation.

By Jamie Adams | October 28, 2026

There is an old saying that an ounce of prevention is worth a pound of cure. In international trade compliance, I suspect we could make a fairly compelling argument that an ounce of prevention might be worth several million dollars, a few years of investigation, and a significant amount of corporate disruption.

The recently announced enforcement action involving Extreme Networks is a timely reminder of just how quickly a compliance issue in one part of a multinational organization can become a much larger corporate problem. It also raises some important questions about how companies establish, implement, monitor, and assess their global trade compliance programs.

For those of us working in this field, the circumstances are not entirely unfamiliar. A foreign subsidiary, a third-party distributor, an undisclosed end user, a sanctioned ownership relationship, and a corporate compliance function that did not have a complete picture of what was actually happening. Individually, these are risks we regularly discuss. Collectively, they created a serious compliance failure.

But I think the more important story is not simply what went wrong. It is what the investigation tells us about the government’s expectations, the importance of meaningful compliance oversight, and the potential benefits of addressing weaknesses before they become enforcement actions.

What Happened at Extreme Networks?

On October 27, 2026, the U.S. Department of Justice (DOJ) and the Treasury Department’s Office of Foreign Assets Control (OFAC) announced separate resolutions involving Extreme Networks, a U.S.-based networking technology company.

According to the government, between 2018 and 2022, employees at the company’s Russian subsidiary facilitated sales of networking equipment and services through a distributor to Moscow Machinery Building Plant Avangard (MMZA), a Russian defense manufacturer associated with the production of S-300 and S-400 missile systems.

Although MMZA was not itself added to OFAC’s Specially Designated Nationals (SDN) List until 2022, it was already subject to blocking sanctions through its majority ownership by JSC Concern Almaz-Antey, which had been designated in 2014. This distinction is particularly important because it demonstrates why simply screening a customer’s name against a sanctions list may not be sufficient.

The DOJ described 11 purchase orders, while OFAC identified nine apparent sanctions violations involving exports of equipment and related services. The government also determined that certain employees at the Russian subsidiary had actively concealed the ultimate end user’s identity from corporate compliance personnel, including through inaccurate transaction information.

The financial consequences were substantial. The DOJ resolution included approximately $976,000 in criminal fines and forfeiture, while the OFAC settlement was approximately $1.53 million. The agreements included a crediting arrangement to avoid duplicative recovery of part of those amounts.

What makes these figures particularly striking is that the DOJ identified approximately $488,000 in revenue associated with the unlawful transactions. The financial consequences of the investigation far exceeded the revenue generated, even before considering legal expenses, internal investigations, operational disruption, and the resources required to implement corrective actions.

There is an important distinction worth acknowledging. The DOJ recognized that the misconduct was carried out by a small group of employees at the Russian subsidiary who concealed their activities from U.S.-based compliance personnel. The company subsequently cooperated with investigators, undertook corrective actions, and received a non-prosecution agreement.

That distinction matters because this is not simply a story about a company intentionally disregarding its compliance obligations at the corporate level. It is also a story about the challenges of maintaining effective controls across international operations.

The Root Cause: Having a Program Is Not the Same as Having Control

One of the most concerning aspects of this case is that Extreme Networks already had a global trade compliance function. The company was not operating without compliance resources or corporate oversight.

Yet the investigation demonstrated how weaknesses in information gathering, end-user identification, ownership diligence, escalation, and oversight can undermine even an established compliance program.

There were multiple contributing factors. Employees at the subsidiary concealed the actual end user. A third-party distribution structure created additional separation between the company and the ultimate customer. The ownership relationship created sanctions exposure that would not necessarily have been identified through name screening alone. And the government’s findings identified warning signs that warranted further investigation.

This brings us to a fundamental question that every multinational company should be asking: How confident are we that our compliance policies are actually being followed throughout our global organization?

It is one thing to establish a corporate policy requiring restricted party screening, export classification, licensing reviews, and end-use/end-user validation. It is quite another to ensure those activities are consistently performed across every subsidiary, division, sales office, and relevant third-party relationship.

And perhaps most importantly, can the organization demonstrate that those activities occurred?

A policy document is not evidence of execution. A completed training module does not necessarily demonstrate understanding. And a screening system is only as effective as the information entered into it, the rules governing its use, and the processes established to investigate and resolve potential concerns.

In my experience, some of the greatest compliance vulnerabilities exist not within the written policies themselves, but in the gaps between corporate expectations and day-to-day business operations.

Global Means GLOBAL

Multinational companies frequently operate across dozens of jurisdictions, with different regulatory requirements, commercial practices, languages, technology platforms, and organizational structures. Acquisitions can introduce additional systems, inherited business relationships, and legacy procedures that may not align with corporate standards.

This complexity is understandable. But complexity does not eliminate the need for effective oversight.

A global trade compliance program cannot simply be a collection of local compliance activities operating independently of one another. It needs an established framework that defines responsibilities, minimum control requirements, escalation procedures, reporting expectations, and accountability throughout the organization.

This does not mean every country or business unit must follow identical procedures. Local requirements and operational differences may justify different approaches. However, those differences should operate within a consistent corporate governance structure, with additional controls where risks warrant them.

Higher-risk jurisdictions, sensitive technologies, complex distribution networks, and transactions involving government or military end users should receive particular attention. But even lower-risk divisions need appropriate baseline controls and monitoring.

Corporate compliance personnel should have sufficient visibility into the underlying transactions to identify inconsistencies, evaluate potential risks, and intervene when necessary.

If a subsidiary can conceal the identity of an ultimate end user, bypass an established control, or release a transaction without appropriate oversight, the organization needs to understand how that was possible and what safeguards should prevent it from happening again.

Screening Is Important. Understanding the Transaction Is Essential.

Restricted party screening remains a foundational component of trade compliance, but the Extreme Networks case demonstrates why it cannot be the only component.

Organizations need to understand the parties involved throughout the transaction lifecycle, including buyers, sellers, intermediaries, consignees, ultimate end users, and other relevant participants. They also need to consider beneficial ownership, indirect ownership relationships, and indicators of control or sanctions evasion.

Under OFAC’s 50 Percent Rule, an entity owned 50% or more in the aggregate by one or more blocked persons is generally considered blocked, even if that entity does not independently appear on the SDN List. Ownership below that threshold does not automatically create the same blocked status under this rule, but minority ownership and other relationships may still present significant compliance concerns requiring further diligence.

The same principle applies to end-use and end-user validation. A company should understand not only who is purchasing a product, but who will ultimately receive it, what it will be used for, and whether additional restrictions or licensing requirements apply.

This becomes especially important in transactions involving distributors, resellers, intermediaries, and complex supply chains.

A successful screening result against the immediate customer does not necessarily mean the entire transaction is compliant.

Companies should also be reviewing whether their systems and procedures identify inconsistencies between purchase orders, shipping documentation, customer records, email domains, delivery addresses, and other transactional information.

Technology can play a significant role in supporting these activities, but technology alone will not solve a compliance problem. Systems must be supported by accurate data, appropriate controls, trained personnel, documented decision-making, and effective escalation procedures.

Documentation: If You Cannot Demonstrate It, How Do You Defend It?

Another important lesson from this investigation is the value of maintaining clear, consistent, and accessible compliance records.

Organizations should be able to demonstrate what was screened, what ownership and end-user diligence was performed, what information was reviewed, what concerns were identified, who made the decisions, and how those decisions were resolved.

That requires more than a corporate policy. It requires documented procedures and practical work instructions that employees can understand and follow.

It also requires a process for preserving the evidence of compliance activities, including screening results, supporting research, license determinations, escalation records, transaction approvals, and exception resolutions.

One particularly noteworthy aspect of Extreme Networks’ remediation was the implementation of improved screening procedures that required compliance personnel to document their reasons for releasing compliance holds. The company also implemented daily rescreening of counterparties in its customer database.

These are practical examples of how compliance processes can be strengthened through better controls, accountability, and documentation.

The objective should not be to create paperwork simply for the sake of paperwork. It should be to establish a reasonable, risk-based process that allows the organization to demonstrate how compliance decisions were made.

Monitor, Audit, Assess — and Then Do It Again

I have long believed that compliance programs need to be evaluated based on how effectively they operate, not simply how well they are written.

Regular monitoring, auditing, and independent assessments are essential to identifying weaknesses before those weaknesses become significant problems.

Monitoring can help identify unusual transactions, incomplete records, unresolved screening alerts, changes in ownership, or activity involving higher-risk jurisdictions. Periodic audits can evaluate whether established procedures are actually being followed. Independent assessments can provide an objective perspective on whether the overall program remains appropriate for the company’s operations and risk profile.

These activities should extend beyond corporate headquarters to include foreign subsidiaries, acquired businesses, and relevant third-party relationships.

Companies should also be evaluating whether employees understand their responsibilities, whether compliance personnel have sufficient authority and resources, and whether commercial pressures are creating incentives to circumvent established controls.

An effective compliance program should evolve as the business changes, as new risks emerge, and as regulatory expectations develop.

The time to discover that a control is not working is during your own monitoring and auditing process, not during a government investigation.

What Is the Government Telling Us?

Perhaps the most significant aspect of this enforcement action is the message contained in the government’s resolution.

The DOJ characterized this as its first near-miss non-prosecution agreement under its 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy.

In this context, the company received credit for cooperation and remediation but did not qualify for a declination of prosecution because its disclosure did not meet the policy’s timeliness requirements. The DOJ explained that the disclosure occurred when publication of the misconduct by a news organization was imminent.

Nevertheless, the government acknowledged the company’s investigation, cooperation, and substantial remediation efforts, ultimately agreeing not to prosecute under the terms of the agreement.

Those efforts included terminating the relevant distributor relationship, closing Russian operations, expanding compliance training, hiring additional personnel, improving screening and end-user diligence, introducing new screening procedures, conducting an independent compliance assessment, and strengthening merger-and-acquisition due diligence.

The government also determined that an independent compliance monitor was not necessary as part of the resolution, in light of the company’s remediation, demonstrated program effectiveness, and ongoing compliance commitments.

I think there are two important messages here.

The first is that regulators are prepared to look beyond individual transactions and examine the broader circumstances that allowed violations to occur. That includes corporate oversight, internal controls, the handling of warning signs, and the effectiveness of the compliance program.

The second is that the government’s treatment of a company can be influenced by how that company responds when potential violations are identified. Timely disclosure, meaningful cooperation, and demonstrable corrective action can make a significant difference.

This does not guarantee favorable treatment, and the applicable policies and circumstances matter. But it reinforces an important principle: organizations should have processes that encourage employees to raise concerns, allow those concerns to be investigated promptly, and support informed decisions about disclosure and remediation.

Waiting until a problem becomes public or until regulators begin asking questions may substantially limit the options available.

The Cost of Doing the Right Thing — and the Cost of Waiting

Trade compliance programs are frequently evaluated as cost centers. Additional personnel, screening tools, technology integrations, training, independent assessments, and periodic audits all require financial investment.

It is understandable that organizations want to manage those costs carefully.

But I would encourage corporate leadership to consider those expenses in the context of the potential costs of noncompliance.

In the Extreme Networks matter, the unlawful transactions generated less than half a million dollars in revenue. The resulting financial resolutions, investigation, remediation, and compliance commitments created a much larger burden.

And the financial penalties are only part of the equation. Organizations facing significant enforcement investigations may also incur substantial legal expenses, management distraction, business disruption, reputational concerns, and the cost of implementing corrective actions under regulatory scrutiny.

Compare that with the cost of conducting a proactive global compliance assessment, strengthening ownership screening, improving end-user validation, training personnel, and implementing consistent transaction controls.

Certainly, no compliance program can eliminate every risk, particularly where individuals deliberately conceal information or circumvent established procedures. But well-designed controls can make misconduct more difficult, improve the likelihood of early detection, and help organizations demonstrate that they took reasonable steps to prevent violations.

There is also a practical business benefit. Effective compliance processes can improve data quality, reduce unnecessary transaction delays, support consistent decision-making, and provide greater visibility across international operations.

Doing the right thing may require an investment today. Discovering that you failed to do the right thing several years from now can be considerably more expensive.

A Sign of Enforcement to Come?

I would hesitate to predict the precise direction or volume of future enforcement actions based on a single case. However, I do believe the Extreme Networks resolution provides an important indication of the types of issues that will continue to attract regulatory attention.

Sanctions evasion, sensitive technologies, military end users, indirect ownership, third-party intermediaries, and ineffective corporate oversight are not new concerns. What this case demonstrates is how those issues can intersect, and how government investigators can evaluate both the underlying misconduct and the effectiveness of the company’s response.

The resolution also provides a useful roadmap for companies looking to strengthen their programs. Many of the corrective actions credited by the government are the same practical measures organizations should be considering as part of their regular compliance management activities.

For corporate leadership, the question should not simply be whether the organization has a global trade compliance policy. It should be whether that policy is effectively implemented, whether the company has sufficient visibility into its global operations, and whether there is reliable evidence that the established controls are working.

For compliance professionals, this is an opportunity to revisit risk assessments, challenge assumptions, evaluate local practices, and make the business case for resources and improvements that may have been deferred.

And for companies operating in higher-risk markets or through complex distribution networks, this may be a particularly appropriate time to examine the relationship between corporate oversight and local execution.

Final Thoughts: Better to Find the Gaps Yourself

I don’t believe the most useful response to this enforcement action is to point fingers at Extreme Networks. The government’s findings are serious, but its acknowledgment of the company’s cooperation and remediation is also an important part of the story.

The more constructive response is to learn from what happened and consider whether similar vulnerabilities might exist within our own organizations.

Are we confident that our subsidiaries are following established procedures? Do we understand our customers’ ownership structures and ultimate end users? Are screening and transaction controls operating consistently? Can we demonstrate how compliance decisions were made? And are we regularly assessing whether our programs remain effective?

These are not always comfortable questions, particularly when the answers may reveal weaknesses that require additional resources, operational changes, or difficult conversations with business leadership.

But those conversations are considerably easier to have internally than during an enforcement investigation.

Ultimately, global trade compliance is not simply about establishing policies or implementing technology. It is about creating a culture of accountability, supported by practical controls, meaningful oversight, and a willingness to continually evaluate and improve.

Don’t just tell me you have a global trade compliance program. Show me that it is working, throughout the organization, and that you have the evidence to prove it.

Because finding the gaps yourself is almost always preferable to having the government find them for you.

Sources and Further Reading

1. U.S. Department of Justice, October 27, 2026 — National Security Division Announces First “Near Miss” Non-Prosecution Agreement Under the Department-wide Corporate Enforcement Policy.
   https://www.justice.gov/opa/pr/national-security-division-announces-first-near-miss-non-prosecution-agreement-under
2. U.S. Department of Justice — Extreme Networks Non-Prosecution Agreement and Statement of Facts.
   https://www.justice.gov/opa/media/1468856/dl?inline=
3. U.S. Department of the Treasury, OFAC, October 27, 2026 — Settlement Agreement between OFAC and Extreme Networks, Inc.
   https://ofac.treasury.gov/recent-actions/20261027
4. SDxCentral, October 28, 2026 — Extreme Networks Fined for Channeling Networking Equipment to Russian Missile Contractor.
   https://www.sdxcentral.com/news/extreme-networks-fined-for-channeling-networking-equipment-to-russian-missile-contractor/

This article provides general trade compliance commentary and should not be construed as legal advice. Regulatory obligations and appropriate compliance measures depend on the facts and circumstances of each transaction and organization.