What Happened
Extreme Networks agreed to pay over $2.5 million in penalties after the US Department of Justice (DOJ) and the Office of Foreign Assets Control (OFAC) alleged multiple sanctions violations. Both agencies pointed to a lack of compliance due diligence at the company. The DOJ resolved its portion through a non-prosecution agreement (NPA), as announced in a news release.
While the public record doesn't detail specific counterparties, jurisdictions, or transactions, we can examine the failure highlighted by the agencies: insufficient due diligence. This analysis will map it to what a sanctions compliance program should include.
Timeline
Here's the brief sequence of events:
- Conduct period: OFAC and the DOJ allege multiple sanctions violations. Specific dates are not disclosed.
- Investigation and resolution: The company engaged with both agencies. The DOJ opted for an NPA instead of prosecution.
- Announcement: The DOJ publicly announced the NPA, with penalties exceeding $2.5 million.
An NPA indicates that prosecutors considered factors like cooperation and remediation, deciding on a negotiated resolution. It's a warning, not a clean slate. The company still faced penalties, and the agreement is public.
Which Controls Failed or Were Missing
The agencies identified one root failure: inadequate compliance due diligence. This can be broken down into several key areas your team should evaluate:
Counterparty screening: Conduct due diligence on customers, distributors, resellers, and end users. Gaps often occur when screening is done only at onboarding, not during transactions, shipments, or renewals.
Indirect-party visibility: When selling through channel partners, the contracted party isn't always the end recipient. Ensure due diligence extends beyond the first tier to address end-use and end-user questions.
Escalation and stop-ship authority: A screening hit is useless if no one can halt a transaction, and if the halt isn't enforced in the order-to-cash workflow.
Entity-Level Controls: The tone, resources, and ownership of the sanctions compliance program are crucial. If sanctions risk isn't explicitly owned and reported to senior management, transaction-level controls can degrade.
These are general insights into due diligence failures, not specific findings about Extreme Networks. Use them as a checklist for your own compliance program.
What the Relevant Standard Requires
OFAC's framework for sanctions compliance programs outlines five essential components, each relevant to the due diligence failure:
- Management commitment: Senior leadership must review and approve the program, ensure resources and authority for compliance personnel, and promote a compliance culture.
- Risk assessment: Conduct a routine, comprehensive assessment of sanctions exposure, including customers, products, supply chain, intermediaries, and geographic footprint. Design due diligence based on this assessment.
- Internal controls: Policies and procedures must be clear, enforced, and updated with risk or regulatory changes. Screening, review, and escalation are key, along with recordkeeping to support decision reconstruction.
- Testing and auditing: Independently test the program for accuracy and effectiveness. Audit fieldwork should confirm that screening occurs as policy dictates, with findings driving remediation.
- Training: Personnel in sales, logistics, finance, and channel management must understand the sanctions obligations relevant to their roles.
OFAC notes that a risk-based, well-designed program can mitigate violations, while a weak or absent program can aggravate them. This underscores the importance of due diligence quality.
Lessons and Action Items for Your Team
Map your regulatory obligations to control owners. Add sanctions to your regulatory inventory and assign each obligation to an accountable owner. If no one knows who owns end-user screening for indirect sales, you've identified a gap.
Run the risk assessment before redesigning controls. Document where your products, services, and partners interact with sanctioned jurisdictions or parties. Use a risk prioritization matrix to rank exposures and tailor due diligence accordingly.
Extend due diligence past the first tier. Ensure your control design captures resellers, distributors, and end users. Require contractual flow-down of sanctions compliance and end-use certifications where appropriate.
Screen continuously, not just at onboarding. Sanctions lists change. Ensure existing counterparties are rescreened on list updates and at key transaction events. Consider automated control testing to verify ongoing screening and hit disposition.
Prove the stop mechanism works. Review past screening hits and trace each to its outcome. Confirm that blocked transactions were indeed blocked and that any approved exceptions have documented rationale and authority.
Define a key control indicator set for sanctions. Track metrics like screening coverage, alert aging, and escalation closure time. Report these on your GRC dashboard to demonstrate management commitment.
Prepare your voluntary disclosure and cooperation posture in advance. An NPA isn't planned, but how a company responds to issues affects prosecutorial decisions. Establish who decides on disclosure, engages counsel, and preserves evidence.
Treat the resolution as a compliance program trigger, not a closing event. If your organization enters an NPA, expect scrutiny on remediation. Document improvements to control design, testing, and training before they're requested.
The core takeaway for compliance officers is clear: insufficient due diligence led to over $2.5 million in penalties and a public agreement. Due diligence is a testable control, and your team can test it now, before anyone else does.
