Microsoft Corp. has agreed to pay more than $3 million in fines for allegedly violating U.S. sanctions on Russia and other countries after its software and services ended up in the hands of blacklisted companies and persons in the Crimea region of Ukraine.

The U.S. Treasury and Commerce Departments on Thursday said they had reached a joint settlement with Microsoft over the apparent violations of U.S. sanctions and export controls rules, which the software giant voluntarily disclosed.

The sanctions violations, which occurred between July 2012 to April 2019, predate the larger Russian incursion into Ukraine that President Vladimir Putin launched in 2022. The U.S. and its allies have since significantly ratcheted up economic restrictions in response to the invasion.

The majority of the apparent violations involved blacklisted Russian entities in Crimea, but others were tied to blacklisted entities in Cuba, Iran and Syria, authorities said. Microsoft also allegedly violated regulations that seek to block sensitive technologies from reaching U.S. adversaries, according to the settlement.

“Microsoft takes export control and sanctions compliance very seriously, which is why after learning of the screening failures and infractions of a few employees, we voluntarily disclosed them to the appropriate authorities,” a Microsoft spokesman said.

The violations that led to Thursday’s settlement occurred in the context of Microsoft’s third-party distribution and reselling programs, according to the Treasury’s Office of Foreign Assets Control, which administers and enforces U.S. sanctions.

Microsoft used an indirect resale model in Russia to develop sales leads and negotiate bulk sales with end customers, according to the Treasury unit. The alleged violations came about after Microsoft failed to obtain accurate information about some of these end users, OFAC said.

At times, employees at Microsoft’s subsidiary in Russia appear to have intentionally circumvented the company’s screening controls, in an effort to prevent other Microsoft affiliates from knowing the identity of the ultimate customers, OFAC added.

After blacklisting Stroygazmontazh, a Russian company that builds infrastructure for the oil-and-gas industry, in 2014, for example, Microsoft initially rejected one of the entity’s subsidiaries as a potential customer, according to OFAC.

That didn’t stop Stroygazmontazh from getting Microsoft products, however. Using a pseudonym, Microsoft employees in Russia were ultimately able to arrange orders for the company, OFAC said.

The Microsoft employees involved in the misconduct have been subject to disciplinary action, up to and including termination, the company’s spokesman said Thursday.

Around the same period, there were also some shortcomings with Microsoft’s processes for screening restricted parties, OFAC said. In some cases, the company failed to screen for blacklisted companies or individuals’ Cyrillic or Chinese names, the Treasury unit said.

In total, Microsoft sold more than $12 million in products and services to blacklisted parties, according to OFAC.

The company’s export control violations occurred between December 2016 and December 2017, according to Commerce’s Bureau of Industry and Security.

On seven occasions, employees at Microsoft’s Russia subsidiary caused another Microsoft subsidiary to sell software to two companies on a U.S. restricted entities list, Commerce’s BIS unit said.