DOJ National Security Division Issues First “Near-Miss” Non-Prosecution Agreement Under Revised Corporate Enforcement Policy

On October 27, 2026, the Department of Justice (“DOJ”)’s National Security Division (“NSD”) and the U.S. Attorney’s Office for the Eastern District of North Carolina announced that they had entered into a non-prosecution agreement (“NPA”) with Extreme Networks, Inc. (“Extreme Networks” or the “Company”) to resolve an investigation into sanctions and export control violations involving sales of networking equipment and services to a Russian weapons manufacturer owned by a sanctioned entity. Under the NPA, Extreme Networks agreed to pay approximately $975,722, consisting of a $487,860.92 criminal fine and an equal amount in forfeiture.

The resolution marks DOJ’s first “near-miss” NPA under the revised department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (“CEP”), issued in March 2026, and follows NSD’s June 2026 declination involving Robert Bosch GmbH (“Bosch”). Although Extreme Networks did not qualify for a declination because its disclosure occurred in anticipation of imminent press coverage, DOJ credited the Company’s earlier good-faith investigative efforts, full cooperation, and remediation in resolving the matter through an NPA.

“Near-Miss” Resolutions Under DOJ’s Revised CEP

In March 2026, DOJ issued the revised CEP as a department-wide policy, replacing NSD’s prior division-specific guidelines. As discussed in ourJuly 2026 client alert, the CEP makes use of a two-part framework:

• Part I provides that DOJ will generally decline prosecution when a company voluntarily self-discloses, fully cooperates, and timely and appropriately remediates misconduct, absent aggravating circumstances. Prosecutors retain discretion to recommend a declination even where aggravating circumstances exist.
• Part II provides a separate pathway for companies that fully cooperate and timely and appropriately remediate misconduct but do not qualify for a declination because their good‑faith self-report fails to satisfy the CEP’s voluntary self-disclosure requirements, aggravating circumstances warrant a criminal resolution, or both. In these “near-miss” cases, DOJ will generally enter into an NPA, absent particularly egregious or multiple aggravating circumstances, with a term of fewer than three years, no independent compliance monitor, and a 50%–75% reduction from the low end of the applicable U.S. Sentencing Guidelines fine range.

The Extreme Networks resolution represents the first public application of this “near-miss” framework under Part II. Unlike in Bosch, where the company’s disclosure qualified as timely even though its internal investigation remained ongoing, Extreme Networks appears to have disclosed only after learning that an investigative journalist was preparing to report on the misconduct. Although DOJ found that this timing rendered Extreme Networks ineligible for a declination under the CEP, the Department nevertheless credited the Company’s earlier good-faith investigative efforts, full cooperation, and remediation in agreeing to an NPA.

Extreme Networks Investigation and Resolution

According to DOJ’s announcement and the accompanying NPA, between March 2018 and March 2022, Extreme Networks, through its then-existing Russian subsidiary, fulfilled 11 purchase orders for networking equipment and services destined for Moscow Machinery Building Plant Avangard (“MMZA”), a Russian weapons manufacturer owned by a sanctioned entity and a primary producer of anti-aircraft missile systems used by the Russian army. Certain Russia-based Extreme Networks employees allegedly concealed MMZA’s identity as the ultimate end user from the Company’s global trade compliance personnel, resulting in unauthorized transactions, false export filings, and smuggling of goods from the United States.

Extreme Networks first learned of allegations concerning aspects of the misconduct through a whistleblower report in April 2022 and conducted an internal investigation in consultation with outside counsel. Several months later, the Company received additional allegations and reopened and expanded its investigation. That second investigation was still underway when an investigative journalist contacted the Company in October 2022 with additional information suggesting possible willful misconduct by the Russia-based employees. Extreme Networks disclosed the potential violations to NSD just days before the article was published and further expanded its investigation.

Although DOJ determined that the disclosure did not satisfy the CEP’s timeliness requirements because it was made in anticipation of imminent public reporting, DOJ gave significant weight to the Company’s earlier good-faith efforts to investigate incomplete allegations of misconduct.

In agreeing to the NPA, DOJ also considered that: (1) the misconduct involved a small group of employees at an acquired subsidiary and generated less than $500,000 in sales revenue; (2) the Company fully cooperated, including by producing nearly 400,000 documents, providing translations, making employees available for interviews, and agreeing to toll the statute of limitations; and (3) the Company timely remediated by closing its Russian subsidiary, separating its Russia-based personnel, terminating the distributor relationship, increasing compliance staffing and training, and enhancing end-user diligence and denied-party screening.

In addition to the nearly $1 million criminal fine and forfeiture, Extreme Networks agreed to pay a $1,529,685 administrative penalty to the Department of the Treasury’s Office of Foreign Assets Control.

The NPA does not require an independent compliance monitor but imposes ongoing cooperation, compliance, reporting, and certification obligations over a three-year term, a departure from the CEP’s general guidance that “near-miss” NPAs will have a term of fewer than three years. As with the Bosch declination, the NPA does not provide protection from prosecution for individuals.

Key Takeaways

• Companies that do not qualify for a declination may still receive significant benefits under the revised CEP. The Extreme Networks resolution confirms that the CEP’s “near‑miss” pathway provides meaningful incentives for companies that fully cooperate and timely remediate misconduct, even when their disclosures do not satisfy the requirements for a declination. Although Extreme Networks agreed to pay criminal penalties and undertake ongoing compliance obligations, it avoided criminal prosecution and the imposition of an independent compliance monitor.
• The resolution signals that the Trump Administration is increasingly willing to resolve significant corporate misconduct through an NPA or deferred prosecution, even when national security interests are implicated. Together with the Bosch declination, the resolution suggests that this Administration is increasingly willing to resolve self‑disclosed corporate misconduct through declinations and negotiated resolutions where companies promptly self-disclose and meaningfully cooperate. Notably, in the Extreme Networks’ action, DOJ applied the revised CEP’s new “near‑miss” resolution despite the fact that the misconduct occurred between 2018 and 2022 and was disclosed to NSD in October 2022, almost three and a half years before DOJ issued the revised CEP. Companies with long-pending investigations should assess how the revised CEP’s framework may apply to their matters and consider raising it with the government before the terms of any resolution are finalized.

• The timing of voluntary self-disclosure remains critical. The contrasting outcomes for Extreme Networks and Bosch underscore the importance of evaluating voluntary disclosure before an internal investigation is complete or external developments make public disclosure imminent. Although DOJ credited Extreme Networks’ earlier investigative efforts, the Company’s decision to disclose in anticipation of press coverage ultimately precluded it from qualifying for a declination. Companies conducting internal investigations should establish procedures for promptly escalating potential violations and continually assessing whether an initial voluntary disclosure is appropriate as additional facts emerge.
• Effective sanctions and export control compliance requires oversight of foreign subsidiaries, distributors, and ultimate end users. The Extreme Networks matter illustrates the risks present when employees at foreign subsidiaries conceal restricted end users from centralized compliance personnel, particularly where transactions involve third‑party distributors. In the end, DOJ credited the Company’s remediation, including enhanced end-user diligence, denied-party screening, compliance staffing, and training. Companies with international operations should assess whether their compliance programs adequately identify ultimate end users and sanctioned ownership, independently verify information provided by foreign subsidiaries and distributors, and promptly escalate potential compliance concerns.

Haylee Levin, an associate in the Washington, D.C. office, contributed to the writing of this article.