• DOJ's first "near miss" resolution under its Department-wide Corporate Enforcement Policy demonstrates that companies can receive substantial credit even when their self-disclosure does not qualify as voluntary. Extreme Networks secured a non-prosecution agreement without an independent compliance monitor after DOJ credited its good-faith disclosure, extensive cooperation, and remediation, notwithstanding the company's failure to qualify for a declination.
• The resolution underscores the importance of prompt self-disclosure-and the significant consequences of missing the window for a declination. DOJ deemed Extreme Networks' disclosure involuntary on the ground that public exposure was imminent, even though OFAC treated the same disclosure as voluntary. The company ultimately agreed to pay approximately $2 million in combined criminal and civil penalties and remains subject to ongoing compliance and reporting obligations.
• The parallel DOJ and OFAC resolutions highlight the risks of sanctions violations involving foreign subsidiaries and third-party distributors, including potential criminal exposure even where misconduct is concealed from U.S. compliance personnel. The resolutions reinforce the importance of effective end-user diligence, sanctions screening, and compliance controls capable of detecting misconduct by local personnel.

On October 20, 2026, the Department of Justice (“DOJ” or the “Department”) entered into its first “near miss” non-prosecution agreement (“NPA”) under its Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (“CEP” or the “Policy”). Extreme Networks, Inc. (“Extreme Networks” or the “company”), a North Carolina-based networking technology company, agreed to pay approximately $976,000 in criminal fines and forfeiture to resolve an investigation into violations of U.S. sanctions and export controls arising from sales to a Russian weapons manufacturer. In a parallel civil settlement with the Treasury Department’s Office of Foreign Assets Control (“OFAC”), the company agreed to pay an additional $1.04 million penalty.

Although Extreme Networks self-reported to DOJ and OFAC, DOJ found that the disclosure did not qualify as voluntary under the Policy, on the ground that disclosure by a third-party was imminent, and the matter therefore did not qualify for a declination. By contrast, OFAC treated the disclosure as voluntary in its parallel settlement. DOJ nonetheless credited the company’s self-report, good-faith investigative efforts, full cooperation, and remediation, finding that those efforts justified an NPA even in the absence of a “voluntary” self-report. This resolution demonstrates that companies may still receive substantial credit under the Policy for prompt self-reporting and thorough remediation even where the disclosure is not considered voluntary.

Background: DOJ’s Corporate Enforcement Policy and “Near Miss” Framework. In March 2026, DOJ introduced the Department-wide CEP, establishing a uniform framework for corporate criminal enforcement. Under the Policy, companies that voluntarily self-disclose misconduct, fully cooperate, and timely and appropriately remediate qualify for a declination, absent aggravating circumstances. To qualify as voluntary, a self-disclosure must relate to misconduct not previously known to DOJ, that the company had no preexisting obligation to disclose to DOJ, and the disclosure must occur before an imminent threat of disclosure or government investigation, reasonably promptly after the company becomes aware of it.

The Policy also establishes a “near miss” category for situations where a company fully cooperates and remediates but does not qualify for a declination because its good-faith disclosure fails to satisfy the Policy’s voluntary disclosure requirements or because aggravating circumstances are present. Under this framework, DOJ will (i) provide a non-prosecution agreement with a term of under three years, (ii) not require an independent compliance monitor, and (iii) recommend a reduction of the fine between 50–75% below the Sentencing Guidelines range.

Alleged Conduct. Between March 2018 and March 2022, Extreme Networks allegedly used a Russia-based subsidiary to provide networking equipment and services to a Russian weapons manufacturer owned by an entity on OFAC’s Specially Designated Nationals and Blocked Persons (“SDN”) List. According to DOJ, certain employees of the Russian subsidiary concealed the weapons manufacturer’s identity from Extreme Networks’ U.S.-based trade compliance personnel. Despite this, the company’s compliance function allegedly overlooked multiple indications that the weapons manufacturer was the ultimate end-user.

Application of the “Near Miss” Framework and NPA Terms. According to DOJ, Extreme Networks first learned of potential violations through a whistleblower report in April 2022 and initiated an internal investigation. However, prior to disclosure of the potential misconduct to DOJ and OFAC, the company was contacted by a news outlet investigating allegations concerning certain Russia-based employees. DOJ concluded that the company’s disclosure was not voluntary under the CEP because the disclosure occurred under an imminent threat of public exposure by the news outlet. The Department nonetheless gave “significant weight” to the company’s investigative efforts and affirmative disclosure.

DOJ noted that Extreme Networks cooperated following the self-disclosure, earning it “full credit” under the Policy, which involved producing nearly 400,000 documents in response to multiple subpoenas, making current and former employees available for interviews, presenting internal investigation findings to the Department, and agreeing to toll the statute of limitations during the investigation. In addition, DOJ credited the company’s remediation, including terminating its Russian subsidiary and a distributor involved in the transactions, enhancing screening procedures, hiring additional compliance personnel, and strengthening mergers and acquisitions diligence procedures.

Under the NPA, Extreme Networks agreed to forfeit approximately $488,000 in revenue generated by the alleged offenses and to pay a criminal fine of the same amount. The NPA requires continued cooperation and annual compliance reporting and certifications, but it does not impose an independent compliance monitor. The NPA has a three-year term.

Parallel OFAC Settlement. OFAC’s parallel settlement with Extreme Networks addressed nine apparent sanctions violations involving exports to the Russian weapons manufacturer. OFAC deemed the conduct egregious but considered Extreme Networks’ disclosure voluntary. In the accompanying enforcement release, OFAC credited the company’s remediation, including enhanced screening, end-user diligence, and acquisition-related compliance procedures.

The settlement permits the DOJ criminal fine to satisfy a portion of the approximately $1.53 million OFAC penalty, leaving approximately $1.04 million payable to Treasury. The penalty reflects a voluntary self-disclosure credit, which halved the base amount—demonstrating that proactive reporting can substantially reduce liability. The settlement requires five years of sanctions compliance, which a senior executive must annually certify and detail in a written explanation.

Practical Implications for Companies. This resolution provides the first indication of how the “near miss” provisions of the CEP may be applied in practice. It illustrates that, even where a self-disclosure does not qualify as voluntary, a company may avoid prosecution by fully cooperating and thoroughly remediating. Such cooperation may entail extensive investigative assistance, including voluminous document production, facilitating interviews with current and former employees across the globe, and undertaking substantial compliance enhancements.

An NPA nonetheless carries significant repercussions; Extreme Networks remains subject to substantial financial penalties, ongoing reporting and certification obligations, and potential prosecution if it fails to fulfill its obligations under the NPA. Given these consequences, a company that becomes aware of potential misconduct should consider promptly self-reporting so as to maintain eligibility for a declination, which avoids a negotiated criminal resolution and its associated criminal fines, reporting requirements, and certification obligations.

To be eligible for a declination, a company should immediately investigate any allegations of misconduct and consider from the start whether self-disclosure is appropriate. This will enable it to self-report promptly if it determines that it is appropriate to do so, before a threat of disclosure by a third party or of a government investigation becomes imminent—at which point the disclosure will be considered involuntary and the company will no longer qualify for a declination.

The resolutions also underscore that sanctions violations can lead to criminal penalties even in the absence of clear corporate willfulness. In the NPA, Extreme Networks acknowledged that the agreed facts constituted willful sanctions and export-control offenses based on acts of its employees and agents, notwithstanding DOJ’s description of a small group of Russia-based employees who concealed the scheme from U.S. compliance personnel. However, OFAC did not allege willfulness. Instead, it asserted (in the enforcement release accompanying the settlement) that the company acted “with reckless disregard” for U.S. sanctions by failing to act on warning signs that the ultimate end user was an SDN-listed entity. In actions where OFAC does not allege willfulness, civil enforcement is the most common resolution, making it especially notable that DOJ pursued and obtained criminal penalties.

This publication is for general information purposes only. It is not intended to provide, nor is it to be used as, a substitute for legal advice. In some jurisdictions it may be considered attorney advertising.