These questions surfaced in many compliance team discussions after the Extreme Networks settlement made headlines. The case involved a $2.5 million penalty split between the DOJ and OFAC for sanctions violations by a Russian subsidiary. It hinged on a timing decision that cost the company its chance at a declination. The violations were typical: an inherited subsidiary, overseas employees hiding end-use buyers, and a centralized compliance team that missed it for years. What set this case apart was the "near miss" on voluntary self-disclosure.
Here's what your team needs to know about self-disclosure timing and what the Extreme case teaches us.
What Counts as "Voluntary" Disclosure?
Under the DOJ's Corporate Enforcement Policy, your self-disclosure isn't voluntary if it's made under the "imminent threat" of someone else disclosing the same violation. In Extreme's case, the company investigated sanctions violations in summer 2022 but delayed action. When reporters contacted them in October 2022 with additional facts, Extreme disclosed to the DOJ just days before the story broke. This timing, disclosure made because a media outlet was about to publish, disqualified the company from voluntary self-disclosure credit.
You need to disclose before external pressure forces your hand. Once a journalist, whistleblower attorney, or regulatory inquiry creates an imminent threat of public disclosure, the voluntary element is lost.
Should We Disclose Immediately If a Reporter Calls?
No, and this is where it gets complicated. The policy shouldn't encourage over-disclosure every time someone asks a question. However, you can't use a reporter's inquiry as your deadline for a disclosure decision that should've been made earlier.
The timeline in Extreme's case is instructive. The company learned of violations in April 2022 through a whistleblower complaint. It conducted what the DOJ called a "good-faith investigation" and presented findings to the board in summer 2022. Nothing happened until October, when reporters called with new facts, prompting Extreme to reopen the investigation and disclose within days.
The four-month gap between the board presentation and disclosure is the issue. If you've completed an investigation and identified misconduct that meets your disclosure thresholds, waiting months to act puts you at risk of this scenario. The reporter's call didn't create the violation; it exposed your delay.
How Do We Know If Our Investigation Scope Was Wrong?
This is the honest mistake problem. Extreme conducted what the DOJ acknowledged was a good-faith investigation. But when reporters called in October with "new facts previously unknown to the company's counsel regarding the possibility of willful misconduct," Extreme had to reopen everything.
You can't predict every fact pattern an investigation might uncover, but you can build investigation protocols to reduce the risk of material gaps:
Define your investigation scope in writing before you start. Document the questions you're answering, the systems you're reviewing, and the interviews you're conducting. If new facts emerge later, you can show that your original scope was reasonable given what you knew at the time.
Use transaction testing, not just Policy Gap Analysis. Extreme's Russian employees weren't diligent in hiding MMZ Avangard's role as end-use buyer, according to the DOJ. Transaction-level testing could've caught the pattern earlier.
Involve external counsel early if the potential violation involves sanctions, export controls, or FCPA. These areas have specific disclosure frameworks, and getting the scope wrong has higher consequences than most compliance matters.
What Should We Do Between "Investigation Complete" and "Final Disclosure Decision"?
This is where Extreme's case leaves the most questions. The settlement documents don't detail what happened during those four months between the board presentation and the reporter's call. Did the board defer a final decision? Was management still evaluating remediation before disclosing? Did legal counsel recommend against disclosure based on the facts known at the time?
Whatever happened, here's what shouldn't happen: completing an investigation that identifies clear misconduct, then letting the matter sit without a documented decision and timeline. If you need more information before deciding whether to disclose, document what you're waiting for and set a deadline. If you've decided the misconduct doesn't meet your disclosure thresholds, document that analysis in detail, because if you're wrong, you'll need to show the DOJ why you reached that conclusion in good faith.
Don't let investigations end with a board presentation and no next steps. Either disclose, document why you're not disclosing, or define what additional work you need to complete before making that decision.
Does Every Whistleblower Complaint Trigger Immediate Disclosure?
No. Extreme's whistleblower complaint in April 2022 triggered an investigation, which is exactly what should happen. The problem wasn't the investigation; it was the inaction after confirming the violations.
Your whistleblower hotline will surface issues that don't rise to the level of regulatory disclosure. You need investigation protocols that can distinguish between policy violations, control failures, and misconduct that meets DOJ or OFAC disclosure thresholds. Once you've made that determination, act on it. The longer you wait, the higher the risk that external events will force your hand and cost you the voluntary self-disclosure credit.
What's the Difference Between a Declination and a Non-Prosecution Agreement?
Extreme paid $2.5 million, $975,000 to the DOJ and $1.53 million to OFAC, and entered a three-year non-prosecution agreement with the DOJ. A declination would've meant no prosecution agreement and likely lower penalties, though OFAC's settlement might've proceeded separately.
Beyond the dollar amounts, a non-prosecution agreement means three years of compliance monitoring, reporting obligations, and the risk that any subsequent violation during that period puts the original agreement at risk. It's not a conviction, but it's not walking away clean either.
The DOJ called this a "near miss" because Extreme did everything else right: cooperated fully, remediated the compliance program, and conducted a thorough investigation. The only missing element was timely voluntary self-disclosure. The timing decision alone was the difference between a declination and a three-year monitorship.
Next Steps for Your Team
Review your self-disclosure policy with this case in mind. Define clear timelines for moving from investigation completion to disclosure decision. Build investigation protocols that test transactions, not just policies. If you're sitting on completed investigation findings while debating next steps, document what you're waiting for and set a deadline.
The Extreme case shows what "imminent threat of disclosure" looks like in practice. Now the question is whether your team would recognize that moment before it costs you the voluntary self-disclosure credit.
