Catching a Rogue Subsidiary Before OFAC Does

Imagine this: your Moscow office processes nine purchase orders for a customer your trade compliance team screens every time. Seven of those orders use the customer's own email addresses or office address. Nobody stops the shipments.

This scenario mirrors the $2.5 million settlement Extreme Networks reached with the Office of Foreign Assets Control (OFAC) and the Justice Department. The misconduct ran from 2018 into 2022. Although the headquarters team screened each order, the clues were ignored. This guide shows how to build controls that turn those clues into action.

Understanding the Problem

Extreme's Moscow office acquired a bundle of customers in a 2018 contract acquisition. One customer, MMZ Avangard, was majority-owned by a state-owned Russian defense firm under U.S. sanctions since 2014. The acquisition review missed this ownership link, compounding the issue with every transaction.

Local employees disguised the customer by listing a local distributor as the end-user in the customer database and on every purchase order. Screening the name on the paperwork told headquarters nothing because the paperwork was false.

Three failures are evident: weak acquisition diligence, a subsidiary willing to disguise customers, and a screening process that checked fields instead of reading evidence. You can address all three.

Preparing for Action

• Data Access: Ensure you have access to your CRM, ERP order records, and customer portal registrations, including email domains and ship-to addresses.
• Beneficial Ownership Data Source: Use a commercial ownership database or your existing screening vendor's ownership module. Sanctions lists alone won't catch a company majority-owned by a listed entity.
• Local Accountability: Assign a named owner in each high-risk region responsible for the controls.
• Speak-Up Program Access: Confirm your Confidential Reporting channel is available in local languages and that Anti-Retaliation Safeguards are communicated at the subsidiary level.
• Executive Support: Have an executive sponsor who will back a shipment hold when sales objects.

Implementing the Solution

Step 1: Inventory High-Risk Subsidiaries

Rank every foreign affiliate by jurisdiction risk, sanctions exposure, and autonomy over customer onboarding. Affiliates in or near high-risk jurisdictions need the tightest controls. Document the ranking and review it at least annually, or whenever sanctions programs change.

Step 2: Enhance Acquisition Diligence

Treat any purchase of contracts, customer lists, or business units as a sanctions event. Before closing:

1. Extract every counterparty named in the underlying contracts, including end-users, resellers, and addresses.
2. Conduct ownership research, not just list screening. Apply the 50 percent rule: an entity owned 50 percent or more by blocked persons is itself blocked.
3. Record the ownership findings in the deal file with the reviewer's name and date.
4. Set a closing condition: no transactions with any flagged counterparty until compliance clears it in writing.

Extreme's own contracts named the problem customer as an end-user. The data was in the deal file, but the review didn't connect it to the parent.

Step 3: Screen on Evidence

Build automated cross-checks that compare the declared end-user against signals in the transaction:

• Email domains of contacts on the order or portal registration versus the declared company
• Ship-to and bill-to addresses versus the declared company's known addresses
• Portal registrants whose self-reported company differs from their email domain
• Customer master records created or edited by local staff without headquarters approval

Any mismatch becomes a hold, not a note. The order can't release until a compliance analyst resolves the discrepancy and documents the answer. Train analysts to ask why the email domain doesn't match the company name, not just whether the form is complete.

Step 4: Secure Customer Master Data

Remove local staff's ability to create or alter end-user records unilaterally. Require headquarters approval for new customers in high-risk regions, and log every edit with user and timestamp. Falsified master data was how the Moscow team kept the real customer hidden.

Step 5: Implement Local Verification

Paper controls fail when people route around them. Require periodic certifications from regional leaders that they know the end-users of their top accounts. Add unannounced sample reviews: pick orders, trace them to the actual customer through contracts, support tickets, and training records.

Step 6: Integrate the Speak-Up Program

An internal complaint in 2022 finally set Extreme's response in motion. Don't wait for luck. Brief subsidiary employees directly on how to report concerns confidentially, protect Whistleblower Confidentiality, and ensure sanctions-related reports reach trade compliance promptly. Publicize that Good-Faith Reporting is protected.

Step 7: Cultivate Compliance Culture

OFAC's settlement order emphasized cultivating a strong culture of compliance globally, especially in high-risk jurisdictions. This means:

• Compensation and sales targets that don't reward concealing a customer
• Regional leaders measured on compliance outcomes
• Training using real cases and local-language scenarios
• Visible consequences for misrepresenting an end-user

Validating Your Controls

Test the controls as an adversary would.

1. Red-team an order: Submit a test order in a sandbox with a mismatched email domain and end-user. Confirm it holds and routes to a human reviewer.
2. Back-test history: Run your new mismatch logic against past orders from high-risk subsidiaries. Investigate every hit.
3. Re-run your acquisitions: Take your most recent customer-book or business acquisition and redo the ownership research. Document any new findings.
4. Audit the holds: Sample released holds and confirm the resolution addresses the root discrepancy, not just the missing field.
5. Check the reporting channel: Confirm subsidiary employees can name the channel and believe it's safe. A short anonymous pulse survey works.

Ongoing Maintenance

• Quarterly: Refresh ownership data for active customers in high-risk regions. Ownership changes, and so do sanctions designations.
• Quarterly: Review hold metrics: volume, time to resolve, and quality of resolutions.
• Annually: Re-rank subsidiary risk and refresh local certifications.
• At every acquisition: Repeat Step 2 in full.
• After every incident or near miss: Update screening rules and share anonymized lessons across regions.

A written procedure isn't a control until someone follows it and you can prove they did. Build the evidence trail now, while it's your own team asking the questions.