The resolution highlights disclosure timing, end-user remediation, and approximately $2.02 million in payments after crediting the coordinated DOJ and OFAC penalties.
On October 27, 2026, the Department of Justice (DOJ) announced its first “near-miss” non-prosecution agreement (NPA) under the Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP), introduced in March 2026. The company at issue is a provider of networking equipment and software. DOJ determined that the company’s disclosure came too late to qualify for a declination under the CEP, but credited its cooperation, remediation, and earlier investigative efforts. The resulting NPA illustrates how those efforts can affect a resolution even when disclosure timing prevents a declination.
The Conduct: A Concealed Customer and Missed Warning Signs
According to the NPA’s statement of facts, employees in the company’s Russian subsidiary participated in a scheme involving sales to a Russian customer between March 2018 and March 2022. The customer was ineligible for export sales because the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) had placed its majority owner on the Specially Designated Nationals and Blocked Persons List. The customer was not added to the list until June 2022. The statement of facts identifies 11 purchase orders, two generating no revenue and covering software and cloud subscriptions, plus eight repair and maintenance transactions. Export filings named the distributor or another Russian company instead of the customer as the ultimate consignee.
The Disclosure Timeline: Good Faith Was Relevant, but Not Enough
According to paragraph 2(b) of the NPA, the company received a whistleblower report in April 2022 and investigated internally with advice from outside counsel. It later reopened and broadened the investigation after further allegations emerged. In October 2022, an investigative journalist contacted the company with facts previously unknown to its counsel suggesting possible willful misconduct. The company retained external counsel and submitted a written disclosure to DOJ’s National Security Division (NSD) days before the article appeared. DOJ found the disclosure untimely under the CEP because publication was imminent, while giving weight to the company’s earlier efforts to investigate incomplete allegations.
A parallel OFAC resolution announced at the same time as DOJ’s NPA treated the apparent violations as voluntarily self-disclosed, while also classifying the case as egregious. That contrasts with DOJ’s conclusion under the CEP. For companies evaluating a disclosure, the distinction supports considering each agency’s requirements separately. A documented investigation may affect the ultimate resolution without preserving eligibility for every available disclosure benefit.
Cooperation and Remediation: Factors DOJ Credited
In paragraph 2(c) of the NPA, DOJ awarded full cooperation credit, citing the company’s assistance, including:
- Producing almost 400,000 documents in stages in response to subpoenas;
- Broadening its searches voluntarily to locate further responsive material;
- Translating documents;
- Arranging voluntary interviews with employees, including former employees and personnel abroad; and
- Reporting its investigation findings to prosecutors and agreeing to toll the limitations period.
Under paragraph 2(d), DOJ also credited changes to the company’s operations and compliance controls:
- Terminating the Russian subsidiary and Russia-based personnel;
- Terminating the relevant distributor relationship;
- Moving customer-facing employees’ trade-compliance training from a two-year cycle to an annual cycle;
- Obtaining an external compliance assessment;
- Expanding end-user diligence;
- Adding staff to its trade-compliance function;
- Introducing a screening tool that records the basis for releasing a compliance hold; and
- Screening customer-database counterparties each day and adding procedures for diligence on acquisitions.
In paragraph 2(i), DOJ cited the remediation, the compliance program’s demonstrated effectiveness, and the company’s maintenance and reporting commitments in deciding not to appoint an independent monitor.
The Financial Consequences: Fines, Forfeiture, and Penalties
The NPA and OFAC settlement establish the following payment obligations:
- A $487,860.92 criminal fine;
- $487,860.92 in forfeiture; and
- An OFAC settlement of $1,529,685, with $487,861 credited for payments under the DOJ resolution, leaving $1,041,824 payable directly to Treasury under the OFAC agreement.
Continuing Oversight: Reporting and Certification Obligations
Although a monitor is not required under the agreement, the NPA and Attachment D provide for a three-year term, an initial review and report, and at least two subsequent reviews and reports. Prosecutors may add up to one year for specified failures to fulfill the agreement. Although Part II of the CEP allows a term shorter than three years, this agreement specifies three years without explaining that contrast.
Under paragraphs 7 and 8, the company is obligated during the NPA term to report promptly any credible evidence or credible allegations suggesting a criminal export-control or sanctions violation by it or its personnel. The CEO and trade compliance manager are to certify fulfillment of the disclosure obligations within 30 days after the term expires. A separate compliance certification, based on their knowledge following reasonable inquiry, is due 30 days before expiration. In addition, the OFAC settlement commits the company to maintaining a sanctions compliance program for at least five years.
Practical Takeaways
The resolution separates disclosure timing from cooperation and remediation. DOJ credited the company’s earlier investigative efforts without treating its disclosure as timely. The following considerations may be useful to teams evaluating similar risks:
- In-house counsel: May wish to consider documenting investigative milestones and reassessing disclosure options as new facts emerge, including whether an impending publication changes the available options. The differing DOJ and OFAC determinations also support evaluating each agency’s disclosure requirements separately.
- Trade-compliance teams: May wish to consider checking ownership relationships as well as listed names, comparing email domains and addresses against stated customer identities, and documenting the resolution of inconsistent end-user information. These controls respond to the risks described in OFAC’s enforcement release.
- Deal teams: May wish to consider sanctions diligence on acquired customer accounts and contracts, including asset transactions, and evaluate whether post-closing controls address inherited relationships. OFAC’s release identifies acquisition-related diligence as a central consideration.
- Executives and compliance leaders: May wish to consider tracking reporting deadlines, certification requirements, and overlapping agency commitments separately. The NPA and OFAC settlement illustrate why the absence of a monitor does not end oversight obligations.
Please contact your Husch Blackwell attorney or a member of our White Collar, False Claims and Investigations team to discuss the CEP or disclosure considerations.
Recent Comments