A company can report possible misconduct before a news story appears and still miss the Department of Justice’s standard for a timely voluntary disclosure. Extreme Networks did. Its resolution is useful precisely because the chronology is more complicated than a company ignoring a warning until a reporter called.
DOJ’s October 27 announcement describes its first “near miss” non-prosecution agreement under the department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy. The agreement, dated October 20, 2026, resolves an investigation into sanctions and export-control offenses involving sales to a Russian weapons manufacturer. It credits the company’s cooperation, remediation and earlier good-faith investigation. It also finds that the eventual disclosure came under the imminent threat of public exposure.
For executives and counsel, the practical question is when the company’s response requires a disclosure decision, even while important facts remain uncertain.
An investigation was already underway
Paragraph 2(b) of the agreement begins with a whistleblower report in April 2022. Extreme Networks conducted an in-house investigation in consultation with outside counsel. Additional allegations emerged several months later, and the company reopened and expanded that inquiry.
The investigation was still in progress in October 2022 when an investigative journalist requested comment. According to the agreement, the journalist supplied facts previously unknown to company counsel about possible willful misconduct by employees in the Russian subsidiary. The company quickly retained external counsel, submitted a written disclosure to the National Security Division and expanded its investigation. The news article appeared days later.
DOJ nevertheless found the disclosure untimely because it anticipated imminent public disclosure. At the same time, prosecutors expressly gave significant weight to the company’s good-faith efforts to investigate the earlier, incomplete allegations. Those two judgments coexist. A credible investigation can help explain the company’s conduct and improve the eventual resolution without establishing eligibility for the policy’s strongest disclosure benefit. NPA, paragraph 2(b).
That distinction matters when reconstructing a response. “We investigated” and “we disclosed before publication” answer important questions. Neither, standing alone, establishes that a report met DOJ’s definition of voluntary self-disclosure.
The policy looks beyond the publication date
The current DOJ policy encourages disclosure at the earliest possible time, including before an internal investigation is complete. Appendix B requires, among other things, a good-faith report to the appropriate DOJ component, misconduct not previously known to DOJ, no preexisting obligation to report it, disclosure before an imminent threat of disclosure or government investigation, and a reasonably prompt report after learning of the misconduct. The company bears the burden of demonstrating timeliness.
There is no general number of days in that definition that converts every internal investigation into a timely disclosure. The policy contains a particular exception involving internal whistleblower reports and submissions under DOJ’s whistleblower program. That provision should not be turned into a blanket 120-day waiting period. The Extreme Networks chronology likewise does not create a universal six-month deadline.
A reporter’s inquiry can change the assessment because publication may be imminent. But a company cannot safely assume that the relevant clock begins only when someone asks for comment. Counsel needs to evaluate the allegations, their credibility, the applicable reporting rules and the risk of outside disclosure as the facts develop. The policy’s incentives are one part of that legal assessment; independent duties may require separate action.
A non-prosecution agreement carries obligations
Under Part I, the policy provides for a declination when its disclosure, cooperation, remediation and other conditions are met, while preserving discretion concerning aggravating circumstances. A policy declination can still require payments such as forfeiture or restitution. It is not a finding that no misconduct occurred.
Part II addresses companies that fully cooperate and timely remediate but miss the declination route because of a qualifying disclosure shortfall or aggravating factors. That is the framework DOJ invoked here. The result was an agreement with admissions and continuing duties, rather than a conviction or an unconditional clearance.
Extreme Networks admitted responsibility for the conduct in the statement of facts. The agreement describes 11 purchase orders processed and fulfilled between approximately March 2018 and March 2022 for Moscow Machinery Building Plant Avangard, a Russian weapons manufacturer owned by a sanctioned entity. Russia-based employees concealed the end user from the company’s trade-compliance personnel. The admitted conduct included false export information and unauthorized transactions. NPA, paragraphs 2–4 and Attachment A.
The criminal resolution requires a $487,860.92 fine and $487,860.92 in forfeiture, totaling $975,721.84. DOJ also identified a separate OFAC administrative resolution. That separate proceeding should not be folded into the criminal total. The agreement protects the company from prosecution for the specified conduct on its stated conditions; it does not resolve every possible exposure for every person.
The policy itself does not create enforceable substantive or procedural rights. Its eligibility criteria guide prosecutors, and case-specific discretion remains important. A company should evaluate the actual agreement and its obligations rather than treating a policy category as a guaranteed outcome.
Preserve evidence and make the decision visible
The most useful response begins before anyone can give a complete account of the misconduct. Preserve the whistleblower’s report, relevant communications, transaction records and the history of compliance decisions. Identify who knows what, including employees and intermediaries outside the United States. Address retention settings and messaging systems before relevant records disappear.
Next, put the disclosure question before the people authorized to decide it. Counsel should define the investigation’s scope, the client being represented, potential conflicts and the process for escalating new facts. A report involving incomplete information can still require prompt consideration. A later report that changes the apparent seriousness or intent should trigger a fresh assessment, with the reasons for the decision recorded accurately.
Preservation and legal review should support an honest account of both established facts and open questions. They should also support decisions about stopping ongoing conduct. In this case, DOJ credited ending the subsidiary and distributor relationships, strengthening screening, adding compliance personnel and improving acquisition diligence. Those were concrete changes to the mechanisms through which the conduct occurred. NPA, paragraph 2(d).
Missing the full disclosure benefit also does not make later cooperation pointless. DOJ credited rolling productions of nearly 400,000 documents, translations, employee interviews and an expanded internal inquiry. The company’s response continued to affect the disposition after the timeliness question had gone against it.
The lesson is to keep fact development, preservation, remediation and the disclosure decision connected. The investigation may take time. The decision about whether and how to report cannot simply wait for the investigation to feel finished.
For the separate problem of choosing among civil, regulatory and criminal reporting channels, see Healthcare self disclosure means choosing the right route. The firm’s federal investigations practice addresses investigations and subpoenas affecting individuals and businesses.