Contract analysis

I. Purpose and Background This memorandum maps all repositories of potentially responsive data across Dunmore Energy Holdings Ltd. ("DEH" or "Dunmore" or the "Company") and its subsidiaries worldwide, and identifies key custodians for document collection in connection with the grand jury subpoena issued on April 19, 2022, by the United States District Court for the District of Columbia, Grand Jury 22-2, bearing refer

II. Dunmore Corporate Structure Overview Dunmore Energy Holdings Ltd. is a global energy company with operations spanning upstream exploration, commodity trading, renewables, and logistics. The Company's corporate structure consists of a Cayman Islands parent entity and four principal operating subsidiaries. The following is a summary of each entity relevant to this investigation: Dunmore Energy Holdings Ltd. ("DEH")

III. Jurisdictional Considerations The multinational nature of Dunmore's operations requires careful attention to the data protection, privacy, and blocking statute regimes in each jurisdiction where relevant data resides. The following is a summary of the key jurisdictional considerations for each location where data collection will be required. A. United States (Houston, TX / Wilmington, DE) The United States is th

IV. Data Sources by Entity The following sections identify and describe the data sources maintained by each Dunmore entity that are potentially responsive to the Subpoena. The data sources are organized by entity and location, and within each entity, by type of data source. A. Dunmore Energy Holdings Ltd. / Dunmore upstream Americas LLC (Houston, TX) DEH and DUA share IT infrastructure and office space at 1200 McKinn

1. Email Systems. Dunmore's Houston-based operations utilize a Ashgrove Software / Drayton Solutions environment. Email is centrally hosted in the cloud for all Houston-based personnel, with data residency in U.S.-based Ashbury Holdings data centers. Two principal email domains are in use: • @dunmoreenergy.com — The primary corporate email domain used by DEH personnel, including senior management, Legal, Compliance,

2. Shared Network Drives / File Servers. Dunmore maintains an on-premises file server at the Houston office at 1200 McKinney Street. The shared drive environment is organized by department, with the following directories identified as potentially containing responsive material: • Legal Department Shared Drive — Contains legal memoranda, contracts, regulatory correspondence, board materials, and litigation files. • Co

3. Enterprise Systems. The following enterprise systems are in use at the Houston office and may contain responsive data: • Harborline Software: Dunmore's enterprise resource planning ("ERP") system. The SAP platform is used across all Dunmore entities (with entity-specific instances and local charts of accounts) for financial accounting, procurement, logistics, and supply chain management. The Houston installation s

4. Financial / Accounting Systems. In addition to the SAP financial modules described above, the following financial data sources are potentially responsive: • SAP Financial Modules (Houston Instance): General ledger entries, accounts payable and receivable records, treasury management records, intercompany transaction records, and consolidated financial statements. • Meridian National Bank, N.A. Records: Dunmore mai

5. Compliance Systems. Dunmore's compliance function, historically led by former Chief Compliance Officer Gerald Fisk, maintains the following systems and records: • OFAC Screening Tool: Dunmore utilizes a third-party vendor-provided OFAC screening tool for sanctions compliance. This tool is used to screen counterparties, transactions, and other parties against the OFAC SDN List, the Entity List, and other restricted

6. Physical Records. The Houston office maintains hard-copy records in several departments: • Legal Department: Contracts (including original counterparty agreements), board materials, corporate governance records, and regulatory correspondence. • Compliance Department: Screening records, compliance training logs, hard-copy investigation files, and policy and procedure manuals. • Finance Department: Certain trade fin

1. Email Systems. DTI utilizes the same Ashgrove Software / Drayton Solutions environment as the broader Dunmore organization. DTI operates on a shared tenant with the Houston office but has a separate regional configuration to accommodate DIFC regulatory requirements and local operational needs. Two email domains are in use at DTI: • @dunmore-trading.ae — The primary domain used by DTI personnel for business communi

2. Instant Messaging / Chat Platforms. The DTI trading desk and operations personnel utilize multiple instant messaging and chat platforms, several of which are critical data sources for this investigation: • Westmark Services Inc. IB Chat: Westmark Services Inc. Instant Westmark Services Inc. chat is heavily used by the DTI trading desk for real-time communications with counterparties, brokers, and other market part

3. Trading Systems. DTI's trading operations are supported by the following systems, which contain structured data records of all commodity trading activity: • Allegro Horizon (Commodity Trading and Risk Management System, "CTRM"): Allegro Horizon is DTI's primary CTRM platform and records all crude oil and refined petroleum product trades executed by the DTI trading desk. This system contains the records of the 14 f

4. Financial / Accounting Systems. • SAP Financial Modules (DTI Instance): DTI maintains its own SAP instance with a local chart of accounts tailored to the entity's trading operations. The SAP financial data for DTI includes general ledger entries, accounts payable and receivable records, intercompany transactions with DEH and other Dunmore entities, and financial reporting data. • Crescent Commercial Bank PJSC Reco

5. Logistics / Shipping Systems. • Pinnacle Software: DTI uses the Pinnacle Software logistics and freight management system, operated by the team led by Yves Leclerc, Director of Logistics & Shipping. Drayton Solutions records of all logistics and freight activities managed by DTI, including the oilfield equipment shipments totaling approximately $12.4 million that were facilitated through Caspian Logistik GmbH. The

6. Physical Records. The DTI Dubai office at Level 14, Gate Building 3, DIFC maintains hard-copy records in the following categories: • Trade files organized by counterparty and transaction • Counterparty due diligence folders, including KYC documentation, beneficial ownership information, and sanctions screening printouts • Compliance screening printouts and manual compliance review files • Original contract files f

7. Personal Devices. Company-issued mobile phones have been identified for the following DTI personnel: • Derek Hargrave — President, DTI • Natasha Sorokin — Senior Trader • Omar Al-Rashidi — Head of Middle East Operations • Yves Leclerc — Director of Logistics & Shipping • Rajesh Malhotra — Controller, DTI In addition to company-issued devices, personal mobile devices may have been used for business communications b

1. Email Systems. Dunmore Renewables GmbH operates on the shared Ashgrove Software / Drayton Solutions tenant used by the broader Dunmore organization. The Hamburg entity uses the email domain @dunmore-renewables.de. The estimated mailbox count for relevant custodians is 2 to 3, with the primary custodian being Tobias Engel, Managing Director.

2. Enterprise / Financial Systems. • SAP Financial Modules (Renewables Instance): Dunmore Renewables GmbH maintains its own SAP instance with a local chart of accounts. The SAP data should be reviewed for any records of the suspect transaction involving Caspian Logistik GmbH, including purchase orders, invoices, payment records, and general ledger entries. • Records of Caspian Logistik GmbH Transaction: The investiga

3. Physical Records. The Hamburg office at Überseeallee 12 maintains limited hard-copy files related to the Caspian Logistik transaction, including contracts, correspondence, and logistics documentation. Physical records collection at the Hamburg office must be conducted in compliance with GDPR requirements, and potential works council consultation should be completed before collection activities commence. D. Dunmore

1. Email Systems. DEWA operates on the shared Ashgrove Software / Drayton Solutions tenant. The Lagos entity uses the email domain @dunmore-westafrica.com. The estimated mailbox count for relevant custodians is 1 to 2, with the focus on any DEWA personnel who communicated with DTI Dubai regarding crude oil sourcing or supply chain matters.

2. Enterprise Systems. • SAP Financial Modules (DEWA Instance): DEWA maintains its own SAP instance. The relevance of DEWA's SAP data is expected to be limited, and collection should focus on any records of transactions, communications, or financial flows connected to DTI's trading activities or to any of the counterparties identified in the Subpoena.

3. Physical Records. The Lagos office at 14B Kofo Abayomi Street maintains hard-copy files related to crude oil sourcing and logistics. These records are a lower priority for initial collection but may be escalated if the investigation identifies Nigeria-connected transactions that are relevant to the Subpoena. E. Cayman Islands (Registered Office — Harbour Place)

1. Corporate Records. The Cayman Islands registered office at Harbour Place, 4th Floor, 103 South Church Street, George Town, Grand Cayman maintains corporate governance records for DEH, including: • Board minutes and resolutions • Shareholder agreements and resolutions • Articles of association (memorandum and articles of association) • Corporate governance documents relevant to compliance program oversight, includi

V. Third-Party Data Sources In addition to the data sources maintained within the Dunmore corporate family, several categories of third-party data sources have been identified as potentially responsive to the Subpoena or otherwise relevant to the investigation. A. Banking Records The following banking institutions maintain records relevant to the investigation: Meridian National Bank, N.A. — 277 Park Avenue, New York

VI. Key Custodian List The following individuals have been identified as key custodians whose data should be collected, preserved, and reviewed in connection with the Subpoena. Custodians are organized into three tiers based on their proximity to the conduct at issue, the priority of their data for the investigation, and the anticipated timing of collection. Tier 1 — Priority Custodians (Immediate Collection) Tier 1

VII. Data Volume Estimates Based on preliminary assessments conducted with Dunmore's IT department and Nexagen Analytics, the following data volume estimates have been developed for the collection universe. These estimates are expressed in approximate document counts and are subject to refinement as collection activities proceed. Following processing, de-duplication, and technology-assisted review ("TAR") by Nexagen

VIII. Collection Methodology and Prioritization A. Collection Sequence Collection activities will be executed in four phases, sequenced to prioritize the highest-value data sources and the custodians most directly connected to the conduct under investigation. Phase 1 (Immediate — April 28 through May 7, 2022): Phase 1 is the highest-priority collection phase and will focus on the following data sources: • Tier 1 cust