Microsoft Corp. has agreed to pay more than $3 million in fines for allegedly violating U.S. sanctions on Russia and other countries after its software and services ended up in the hands of blacklisted companies and persons in the Crimea region of Ukraine.

The U.S. Treasury and Commerce Departments on Thursday said they had reached a joint settlement with Microsoft over the apparent violations of U.S. sanctions and export controls rules, which the software giant voluntarily disclosed.

The sanctions violations, which occurred between July 2012 to April 2019, predate the larger Russian incursion into Ukraine that President Vladimir Putin launched in 2022. The U.S. and its allies have since significantly ratcheted up economic restrictions in response to the invasion.

The majority of the apparent violations involved blacklisted Russian entities in Crimea, but others were tied to blacklisted entities in Cuba, Iran and Syria, authorities said. Microsoft also allegedly violated regulations that seek to block sensitive technologies from reaching U.S. adversaries, according to the settlement.

“Microsoft takes export control and sanctions compliance very seriously, which is why after learning of the screening failures and infractions of a few employees, we voluntarily disclosed them to the appropriate authorities,” a Microsoft spokesman said.

The violations that led to Thursday’s settlement occurred in the context of Microsoft’s third-party distribution and reselling programs, according to the Treasury’s Office of Foreign Assets Control, which administers and enforces U.S. sanctions.

Microsoft used an indirect resale model in Russia to develop sales leads and negotiate bulk sales with end customers, according to the Treasury unit. The alleged violations came about after Microsoft failed to obtain accurate information about some of these end users, OFAC said.

At times, employees at Microsoft’s subsidiary in Russia appear to have intentionally circumvented the company’s screening controls, in an effort to prevent other Microsoft affiliates from knowing the identity of the ultimate customers, OFAC added.

After blacklisting Stroygazmontazh, a Russian company that builds infrastructure for the oil-and-gas industry, in 2014, for example, Microsoft initially rejected one of the entity’s subsidiaries as a potential customer, according to OFAC.

That didn’t stop Stroygazmontazh from getting Microsoft products, however. Using a pseudonym, Microsoft employees in Russia were ultimately able to arrange orders for the company, OFAC said.

The Microsoft employees involved in the misconduct have been subject to disciplinary action, up to and including termination, the company’s spokesman said Thursday.

Around the same period, there were also some shortcomings with Microsoft’s processes for screening restricted parties, OFAC said. In some cases, the company failed to screen for blacklisted companies or individuals’ Cyrillic or Chinese names, the Treasury unit said.

In total, Microsoft sold more than $12 million in products and services to blacklisted parties, according to OFAC.

The company’s export control violations occurred between December 2016 and December 2017, according to Commerce’s Bureau of Industry and Security.

On seven occasions, employees at Microsoft’s Russia subsidiary caused another Microsoft subsidiary to sell software to two companies on a U.S. restricted entities list, Commerce’s BIS unit said.

Russia and India have become so difficult to navigate that the Business Software Alliance has abandoned its enforcement programmes in those jurisdictions, attendees heard at the 2016 BRICS IP Forum in London.

Speaking at the forum, Sarah Coombes, managing director for Europe, the Middle East and Africa at the Business Software Alliance (BSA), said that copyright enforcement can be difficult for rights holders in certain jurisdictions.

Coombes revealed that the BSA has received up to 20,000 reports of piracy annually and has engaged in 7,000 legal cases and actions over the past year.

Looking at BSA’s enforcement actions by country, Coombes said that Russia has become “a more and more challenging market” when engaging in enforcement actions.

“Russia has become a very difficult commercial market for us, we are finding that IP rights are no longer a priority for law enforcement. Official case statistics for this year and last are reflecting that the number of IP infringement cases initiated, brought to court and resolved continues to decrease each year.”

“It has been so painful that our members have decided they do not want to be part of an enforcement programme in Russia, and as a result, we have had to close the programme. It is not longer a market the BSA wants to cover.”

Coombes also turned to India, stating that it was a “very similar market to Russia”.

“In our experience, the courts take too long, it’s too cumbersome. So once again a decision has been made to close the programme there,” she said.

“The biggest problem is that threatened litigation is not a ‘threat’, we do not want to become involved in long-term litigation.”

“We will still engage in educational activities in India, but enforcement is no longer a priority.”