The company did screen. A central compliance team in the United States reviewed every Russia order, under a policy to do exactly that. What OFAC’s release documents is how a customer inherited in an asset purchase kept buying for more than three years under another company’s name, and how each check that might have caught it accepted the name.
An inherited customer
In March 2018, Extreme’s Russian subsidiary bought a set of customer accounts and contracts from a Russian networking business. One of the end users named in those contracts was a Moscow defence manufacturer, majority owned by Almaz-Antey, which OFAC had designated in July 2014. Under OFAC’s ownership guidance the manufacturer was therefore blocked itself, years before it was designated in its own right in June 2022. Extreme’s US-led compliance team read the purchase agreement, including the contract naming that end user, and did not recognise it as blocked. Nor did anyone ask why earlier purchases under the same contract had at times named a different Russian company as end user.
Nine orders, and what they said
From September 2018 to September 2021 the subsidiary negotiated and received nine further purchase orders for hardware and software. It dealt directly with the manufacturer’s staff, met them at their Moscow offices, wrote to them at their own email addresses and trained them. Each order went to the central team, and each was cleared.
The orders named the other company as end user. But seven of the nine carried the manufacturer’s email addresses or gave its Moscow address as the ultimate destination. Regional management had twice received routine activity reports describing the subsidiary’s dealings with the manufacturer. In autumn 2020, during diligence on two of the orders, Extreme asked its third-party distributor for the named end user’s website; the distributor twice sent the manufacturer’s. After Extreme raised concern about that company’s military links, the distributor said the earlier references were a mistake and sent the named company’s site. Extreme approved the orders on the strength of an end-user statement from the same distributor.
The same pattern appeared on the customer portal. Subsidiary staff told the manufacturer’s employees to register under the other company’s name while keeping their own email addresses. The registrations were first held up by the Russia review policy, then approved, in one case after the applicant did not answer a request for their company’s name, address and corporate email.
What ties it together
An asset purchase brought in a customer relationship with a blocked party, the diligence on that purchase did not test it, and the relationship continued after the deal until each order looked routine. The release says as much: one inherited risk “quickly gave rise to multiple apparent violations.” The orders themselves also turned on a representation that nobody could check from inside: an end-user statement naming one company while the paperwork pointed to another. OFAC does not say who chose the name, and nothing in the release alleges the distributor acted deliberately. It records that Extreme accepted the statement when its own documents contradicted it.
The penalty
OFAC found the case egregious, because Extreme acted with reckless disregard and had actual knowledge that it filled the nine orders, and voluntarily self-disclosed. It set the base penalty at half the statutory maximum, $1,699,650, and settled for $1,529,685. It counted against Extreme that the manufacturer describes itself as the sole supplier of Russia’s S-300 and S-400 missile systems. It credited a clean record for the previous five years and remedial steps: better screening for entities majority owned by a sanctioned party, wider end-user diligence, more compliance staff and an acquisition process that screens the target’s customers.
What the record shows
- Buying a customer list is buying its sanctions exposure. The blocked party was named in a contract that the compliance team had in hand on the day of the deal.
- A name on a form is not an end user. The checks accepted a named company while seven of nine orders pointed at someone else. Documents that disagree with each other are the indicator; the distributor’s reversal on the website was the second.
- A central review is only as good as what it does with a bad answer. OFAC says the existence of compliance procedures “alone is not sufficient” where a company does not follow them or does not investigate and resolve the risks they surface.