TheCorporateCounsel.net

The DOJ has been focused on encouraging corporate self-reporting and holding the real “bad guys” accountable in the last few years. Over on Radical Compliance, Matt Kelly recently wrote about a technology company charged with violations of U.S. sanctions laws through its Russian subsidiary, where the timing of the self-reporting didn’t do the company any favors.

The sanctions violations finally came to the attention of Extreme’s legal and compliance team in April 2022 thanks to a whistleblower complaint. (Yay for internal reporting!) The company then conducted what the Justice Department readily admits was a “good-faith investigation,” complete with outside counsel and a presentation to Extreme’s board in summer 2022 [. . .] The issue stayed dormant until October 2022, when a news media outlet contacted Extreme to say it was working on a story about the Moscow office selling goods to Russian military contractors.

The news reporters “cited new facts previously unknown to the company’s counsel regarding the possibility of willful misconduct by the company’s Russia-based employees,” the Justice Department said. That prompted Extreme to reopen its original investigation and submit a self-disclosure to the Justice Department just days before the news report was published.

Now we get to the key point. Since Extreme made its self-disclosure in anticipation of the media disclosing the matter anyway, that decision did not qualify as a voluntary self-disclosure under the Justice Department’s Corporate Enforcement Policy.

This is all known as a “near miss” under the latest incarnation of the Corporate Enforcement Policy, unveiled last March. A company’s self-disclosure doesn’t qualify as voluntary if that company makes its disclosure under “imminent threat” of some other party disclosing the same violation — like, say, a media outlet about to blast news of your sanctions violations across the interwebs.

To be clear, Extreme Networks did everything else right, such as cooperating with the Justice Department’s investigation and improving its sanctions compliance program. But without the voluntary self-disclosure prong, the best Extreme (or any other company) could hope for is a non-prosecution agreement rather than a declination. Which is exactly what Extreme received.

To quote directly from the Justice Department’s press release on the case:

While Extreme Networks’ disclosure to the National Security Division was not timely because it occurred under imminent threat of disclosure by a news publication, Extreme Networks nonetheless fully cooperated with the department’s investigation and timely and appropriately remediated the misconduct. As a result, its disclosure qualified as a near-miss Voluntary Self-Disclosure under the policy.

Matt says, “Now the compliance community knows what a near-miss situation looks like.”

– Meredith Ervine