Contract analysis

I. Executive Summary This memorandum summarizes the forensic accounting findings of Ridgeline Advisory Group LLC ("Ridgeline") (Engagement No. RAG-2022-0319; engagement lead Dr. Margaret Liu, CPA, CFE) regarding payment flows routed through Crescent Commercial Bank PJSC ("Crescent Bank" or "CCB"), a Dubai-based financial institution located in the Dubai International Financial Centre, in connection with Dunmore Tradi

II. Background and Scope of Ridgeline Engagement A. Retention and Engagement Terms Ridgeline Advisory Group LLC, a forensic accounting and financial advisory firm headquartered at 1825 Connecticut Avenue NW, Suite 400, Washington, DC 20009, was retained by Calderwood & Harkness LLP on May 2, 2022, at the direction of Victoria Chambers, Responsible Partner for the Dunmore internal investigation. The retention was effe

1. Wire Transfer Records and SWIFT Messages from Crescent Commercial Bank PJSC. Ridgeline obtained and analyzed wire transfer records and SWIFT messages (MT103, MT202, and MT940/MT950 account statements) from Crescent Commercial Bank PJSC (Al Maktoum Tower, DIFC, P.O. Box 335102, Dubai, UAE). The bank records were produced through the designated relationship manager, Khalid Mansour, Vice President — Trade Finance at

2. DTI Internal Accounting Records. Ridgeline reviewed DTI's internal accounting records, including general ledger entries, accounts payable and accounts receivable sub-ledger detail, bank reconciliations, and trade finance documentation maintained by Rajesh Malhotra, Controller of DTI in Dubai. These records were critical to correlating the bank-level wire transfer data with DTI's internal recording of the underlyin

3. Invoices, Purchase Orders, and Shipping Documentation. Ridgeline analyzed invoices, purchase orders, bills of lading, certificates of origin, and other shipping and logistics documentation maintained by DTI's trading desk and logistics function, which was overseen by Yves Leclerc, Director of Logistics & Shipping at DTI. These documents were used to assess the commercial substance of the transactions underlying th

4. Counterparty Bank Account Information. Ridgeline obtained and reviewed bank account information for the principal counterparties, including account opening documentation, signatory cards, and transaction histories, to the extent available. The counterparties for which such information was obtained included: • Petronova Trading FZE (Office 1407, Al Shafar Tower, Dubai Internet City, Dubai, UAE); • Zenith Petroleum

5. Corporate Registry and Beneficial Ownership Records. Ridgeline obtained and reviewed corporate registry filings, beneficial ownership declarations, and other publicly available corporate records for Petronova Trading FZE (registered with the Jebel Ali Free Zone Authority), Zenith Petroleum DMCC (registered with the DMCC Authority), and Caspian Logistik GmbH (registered with the Hamburg Handelsregister). These reco

6. Documents from Nexagen Analytics Inc. E-discovery Platform. Ridgeline also reviewed select financial records and communications identified through the e-discovery process managed by Nexagen Analytics Inc. (Project No. NX-DEH-2204; project manager Brian Cavanaugh). The Nexagen platform hosted the full corpus of 2,347,812 documents collected across six jurisdictions as part of the internal investigation. Ridgeline's

III. Overview of Crescent Commercial Bank PJSC Account Structure A. Dunmore Trading International Ltd. Accounts Dunmore Trading International Ltd. maintained multiple accounts at Crescent Commercial Bank PJSC, reflecting DTI's use of the bank as a primary banking partner for its Dubai-based commodity trading operations. DTI held DIFC License No. CL-4827, authorizing it to conduct commodity trading, trade finance, and

IV. Summary of Payment Flows — Quantitative Findings A. Aggregate Figures Ridgeline's forensic tracing analysis identified the following aggregate payment flow data for the suspect transactions routed through Crescent Commercial Bank PJSC: It is important to note that the $34.2 million figure represents settlement-related payments, margin flows, prepayments, and settlement differentials associated with the larger $21

1. Petronova Trading FZE: Approximately $22.6 million across 83 transactions. Petronova served as the primary intermediary in the payment flow structure, processing the largest volume and dollar amount of transactions. Sergei Volkov, Petronova's Managing Director, maintained direct and regular communication with Natasha Sorokin, DTI's Senior Trader, regarding transaction terms, pricing, and — critically — payment ins

2. Zenith Petroleum DMCC: Approximately $7.1 million across 29 transactions. Zenith Petroleum was directly involved as a named counterparty in 2 of the 14 flagged crude oil swap transactions and also served as a secondary layering conduit in certain Petronova-originated payment flows. The dual role of Zenith Petroleum — as both a direct counterparty and an intermediary — added complexity to the payment flow structure

3. Caspian Logistik GmbH: Approximately $4.5 million across 15 transactions. These payments were associated with logistics, shipping, and freight forwarding fees for oilfield equipment exports and were distinct in character from the crude oil swap-related payment flows. The Caspian Logistik payments are discussed in greater detail in Section VII below.

4. Reconciliation: The counterparty-level figures reconcile to the aggregate totals: $22.6 million + $7.1 million + $4.5 million = $34.2 million; 83 + 29 + 15 = 127 transactions. C. Breakdown by Time Period Ridgeline's temporal analysis of the payment flows reveals a clear escalation pattern over the two-year primary forensic period, with transaction activity building steadily before ceasing abruptly in early 2022:

1. March 2020 – December 2020: Approximately $8.4 million across 31 transactions. Payment activity commenced at a modest level, with the initial transactions in March and April 2020 appearing to relate to the establishment of the trading relationship and the execution of the first one or two swap transactions. Activity increased notably in the third and fourth quarters of 2020, as additional swap transactions were in

2. January 2021 – December 2021: Approximately $19.3 million across 72 transactions. This twelve-month period represented the peak of activity in the payment flow structure. The majority of the crude oil swap transactions were executed during calendar year 2021, and the corresponding settlement, margin, and prepayment flows drove a significant increase in both the number and aggregate value of wire transfers. The ave

3. January 2022 – March 2022: Approximately $6.5 million across 24 transactions. Transaction activity continued at an elevated pace in the first quarter of 2022 but came to an abrupt halt in March 2022. The cessation of activity predates the April 6, 2022, SDN designation of Volkhov Industrial Group JSC by approximately one to two weeks, which may suggest that DTI personnel or the intermediary entities received advan

V. Structuring Indicators and Red Flags Ridgeline's forensic analysis identified multiple indicators of deliberate structuring and layering within the payment flows. These indicators, when considered individually and collectively, are consistent with a deliberate effort to design and execute a payment infrastructure intended to evade sanctions compliance controls. The principal structuring indicators are summarized b

VI. Analysis of Rajesh Malhotra's Role Rajesh Malhotra served as the Controller of Dunmore Trading International Ltd. in Dubai throughout the relevant period. In that capacity, Malhotra was responsible for the finance function at DTI, including the initiation, review, and approval of wire transfer instructions submitted to Crescent Commercial Bank PJSC for execution. Malhotra's role placed him at a critical juncture

VII. Relationship to Oilfield Equipment Export Payments Of the 127 transactions identified in Ridgeline's forensic analysis, 15 transactions totaling approximately $4.5 million related to payments made to Caspian Logistik GmbH for logistics, shipping, and freight forwarding fees. These payments were associated with the export of oilfield drilling equipment and components classified under Export Control Classification

VIII. Compliance Program Deficiencies Revealed by Payment Flow Analysis The payment flow analysis conducted by Ridgeline has highlighted several significant deficiencies in Dunmore's pre-existing sanctions compliance program as it related to the operations of DTI in Dubai. These deficiencies are assessed in full in a separate memorandum — Memo re: Assessment of Dunmore's Pre-Existing Sanctions Compliance Program (Nov

IX. Relevance to Sanctions Violations Analysis A. OFAC Directive 2 (Sectoral Sanctions — E.O. 13662) Volkhov Industrial Group JSC was designated under OFAC Directive 2 of Executive Order 13662 on November 15, 2019. Directive 2 prohibited U.S. persons from dealing in, providing financing for, or otherwise facilitating transactions involving new debt with a maturity of greater than 90 days (subsequently reduced to 60 d

X. Disgorgement Implications The payment flow analysis conducted by Ridgeline directly informs the voluntary disgorgement calculation that is a component of the remediation strategy being implemented in connection with the DOJ and OFAC proceedings. Voluntary disgorgement of profits derived from sanctions-violating transactions is a recognized mitigating factor under both the DOJ Corporate Enforcement Policy and OFAC'

XI. Coordination with Dunmore's Outside Auditors As part of the internal investigation, Ridgeline coordinated with Ashford & Whitmore LLP (engagement partner Kenneth Ashford), which serves as the independent outside auditor for Dunmore Energy Holdings Ltd. and its subsidiaries, including DTI. The coordination focused on the adequacy of internal controls over trade finance transactions at the DTI subsidiary level and

XII. Recommendations and Next Steps Based on the forensic payment flow analysis summarized in this memorandum, I recommend the following actions:

1. Integration into Internal Investigation Report. The forensic findings of Ridgeline Advisory Group should be incorporated into the comprehensive internal investigation report being prepared by Calderwood & Harkness for submission to the Department of Justice. The report should include a detailed narrative of the payment flow structure, the quantitative findings, the structuring indicators, and the correlation to th

2. Supplemental Proffer to DOJ. I recommend that the payment flow findings presented in this memorandum be included in the supplemental proffer to AUSA Meredith Calloway of the DOJ National Security Division. The payment structuring evidence is among the most compelling evidence of intent and willfulness identified in the investigation to date, and its disclosure in the proffer context demonstrates the depth and good

3. OFAC Voluntary Self-Disclosure. The payment structuring evidence should be disclosed in full in the voluntary self-disclosure ("VSD") to OFAC. Failure to disclose known structuring activity in a VSD could undermine the mitigating-factor credit that OFAC affords to entities that submit initial, timely, and complete voluntary self-disclosures. The structuring evidence is directly relevant to OFAC's assessment of the

4. Remediation — Enhanced Compliance Program. I recommend that Pemberton Investors Solutions LLC (retained December 15, 2022; lead consultant Dr. Anton Bremer) incorporate robust transaction monitoring and automated payment screening capabilities into the Enhanced Sanctions & Export Controls Compliance Program being designed for Dunmore and its subsidiaries. The compliance program should include, at a minimum: (a) au