Export controls: from Iran in 2006 to Taiwan in 2026

analysisThe earliest export-control case in the records dates from 2006. According to a Justice Department release of October 28, 2008, Super Micro Computer, Inc. was first charged on September 1, 2006 and pleaded guilty on September 18, 2006 to illegally exporting to Iran motherboards controlled for national security reasons; its January 2007 registration statement describes the plea as covering one count of shipping 300 motherboards to Dubai knowing that they would be transshipped to Iran. The company was sentenced to a criminal fine of $150,000 and agreed to pay an administrative fine of $125,400 to settle twelve charged violations of the Export Administration Regulations in a case conducted by the Commerce Department's Bureau of Industry and Security (BIS). An individual who financed export transactions by Super Micro pleaded guilty on December 17, 2007 to failing to report a suspicious transaction and was sentenced on April 28, 2008 in the Northern District of California to probation and a $10,000 fine. ^{1 2}

analysisSupermicro has said that the violations occurred between 2001 and 2003 and that, after receiving BIS subpoenas in 2004, it retained special export control counsel, conducted an internal investigation, ended its relationship with the distributor concerned and instituted a new export compliance program. ^{1 2}

analysisSupermicro's annual reports state that it sold products into Russia before broad sanctions were imposed, last recorded revenue from Russia on February 23, 2022 and no longer sells products or provides services there. In its fiscal 2023 annual report, in a disclosure required by Section 13(r) of the Exchange Act, it said that before Russia's Federal Security Service (FSB) was designated a blocked party on March 2, 2021 it had authorised third parties to file notifications with, or apply for import licences from, the FSB on its behalf so that its products could be imported into Russia, and that during fiscal 2023 third parties filed notifications, applied for licences or received approvals on its behalf — dealings that OFAC's General License No. 1B authorises, subject to limitations. In the same disclosure the company said that no sales occurred in Russia in fiscal 2023, that the filings produced no revenue, that it believes it has terminated the authorisations and that it does not sell to or serve the FSB. ^{1 2}

analysisThe short seller Hindenburg Research alleged something different in its report on Supermicro: from a review of more than 45,000 import and export transactions, it said that exports of Supermicro components to Russia had roughly tripled since the February 2022 invasion of Ukraine in apparent violation of U.S. export bans, moving first through a California distributor and later through newly formed Turkish and Hong Kong companies, and that at least 46 companies that handled Supermicro products bound for Russia were under OFAC sanctions or on U.S. government watch lists. The report rests on third-party customs data that are not among the records reviewed, and it describes Supermicro products reaching Russia through other companies, not sales Supermicro recorded to Russian customers. Supermicro answers that it no longer sells products or provides services to Russia and last recorded revenue there in February 2022, and its board's Special Committee reported in December 2024 that it did not identify products sold to Russian customers or shipped to Russia in violation of export controls or sanctions in place when they were shipped. ^{3 4}

analysisSupermicro's annual report for fiscal 2025, the year ended June 30, 2025, attributes 59.4% of that year's revenue to the United States and 10.9% to Thailand; in fiscal 2024 and fiscal 2023 the United States accounted for 68.0% and 67.9% and no other country reached 10%. The report does not identify the customers behind the Thailand revenue. ¹

analysisBecause it exports restricted graphics processing units (GPUs), Supermicro says it routinely receives subpoenas and other requests from the Office of Export Enforcement (OEE) for information about customers or contemplated transactions. It reports that it was responding to a number of such requests, that several earlier ones remained open and that it had not been informed it was the target of any of them; if it became a target, it says, OEE could pursue a civil enforcement action, seek monetary or other penalties or require changes to its compliance program. ¹

analysisOn March 19, 2026 the U.S. Attorney's Office for the Southern District of New York unsealed an indictment of three individuals for an alleged conspiracy to commit export control violations. Neither the indictment nor the Justice Department release names the manufacturer; Supermicro's annual report for fiscal 2026 states that the three were “either employed or associated with the Company at the time” and calls them “three former associates”. Supermicro itself is not charged. It received a grand jury subpoena from the same office for documents on the individuals and the facts in the indictment and on its compliance program and internal controls. ¹

analysisSupermicro gave its own account of the Taiwan investigation in a July 1, 2026 letter to customers signed by Chief Revenue Officer Matt Thauberger. It said that on June 29, 2026 four Supermicro Taiwan employees were detained for questioning in a Taiwanese investigation of its sale of products to a technology company in Taiwan; two were held pending a hearing and two released on bail, and all four were placed on administrative leave. The letter said that the authorities had confirmed Supermicro was not a target of the investigation, that the company had been cooperating with Taiwanese authorities for several months, as described in a May 28, 2026 press release, and that its Taiwan offices had not been raided. ^{1 2}

analysisA Taiwanese technology news outlet gave a different account on June 30, 2026. It reported that on June 29 the Keelung prosecutors, in a second wave of their investigation into suspected illegal exports of AI servers with Nvidia GPUs to China, Hong Kong and Macau, searched Supermicro's Taiwan branch and two other companies, a listed technology company and a data-centre operator, and questioned managers, after a first wave in May 2026 had searched 12 locations linked to three people. Supermicro's letter said its Taiwan offices were not raided and that it gave the authorities access to the detained employees' desks and devices; the records reviewed do not resolve the difference. ^{3 1}

analysisOn August 24, 2026 the Taiwan Keelung District Prosecutors Office announced that it had concluded its investigation into the unlawful export of high-end AI servers, indicted nine people and set out its sentencing requests to the court. Its release masks names: the U.S. server maker appears as “美○微”, described as a U.S. partner of the GPU designer that integrates its GPUs into AI servers and has a Taiwan subsidiary, a description that matches Supermicro, whose Chinese name is 美超微; Supermicro's July 1 letter had referred to a Taiwanese investigation of its sale of products to a technology company in Taiwan. Those charged include two senior sales directors of the server maker's Taiwan subsidiary, a manager at the Taiwan branch of the GPU designer, the general manager of an over-the-counter-listed distributor of the subsidiary's products, the general manager of the buying company, a data-centre operator's project manager and the heads of a trading firm and a customs-brokerage firm; the buyer's de facto head is listed as wanted. In the export part eight defendants are charged with breach of trust and forgery of documents under the Criminal Code, and a ninth person is charged only in a related asset-stripping part. Neither Supermicro nor its subsidiary is a defendant, and the records reviewed contain no court ruling on the charges. ^{2 1}

analysisAccording to the prosecutors, a Taiwanese technology company that had obtained whitelist status bought 130 Nvidia B300 servers from Supermicro's Taiwan subsidiary in three deliveries from September 2025, using false end-use and end-user declarations that gave Taiwan as the installation country, a staged data-centre inspection and funding from the listed distributor. Seventy-four servers were exported in early 2026 to customers in China, directly or through Indonesia, Japan and Hong Kong; 56 were stopped when customs required an export licence, and the licence application filed for them was supported by fabricated pages from Supermicro's website. The prosecutors put the organisers' illegal profit at US$21,205,531 and say the two sales directors received sales bonuses of US$62,804 and US$83,872 from the Taiwan subsidiary for the order. These are allegations in the prosecutors' release; no court has ruled on them. ²

analysisThe prosecutors also charged one of the two sales directors, the distributor's general manager and a third person with special breach of trust under the Securities and Exchange Act, alleging that between January and April 2026 four false invoices caused the listed distributor to pay NT$39,158,514 to a company that provided no services. They asked the court to impose the statutory maximum of five years' imprisonment on both sales directors for the export conduct and six years on the first director for the asset-stripping charge. No court has ruled on these charges or requests. ²

analysisThe prosecutors present the U.S. server maker and the GPU designer as harmed by the defendants' conduct: they say the server maker's reputation suffered, its share price fell, its export products were placed under mandatory inspection and delayed deliveries forced it to pay penalties to customers, and they describe both companies as maintaining strict internal controls on buyers' qualifications and product end use. This is the prosecutors' characterisation; neither company is a party to the indictment, and the damage is not quantified. ²