Contract analysis

I. PURPOSE AND EXECUTIVE SUMMARY A. Purpose. This memorandum analyzes the document preservation obligations arising under the federal laws of the United Arab Emirates ("UAE") and the laws and regulations of the Dubai International Financial Centre ("DIFC") as they apply to Dunmore Trading International Ltd. ("DTI"), a limited company licensed and registered in the DIFC (License No. CL-4827), with its principal office

1. UAE federal law imposes certain record-keeping obligations on commercial entities. These obligations arise under the Commercial Companies Law, the Anti-Money Laundering and Combating the Financing of Terrorism Law, the Commercial Transactions Law, and other federal statutes. While DTI is registered in the DIFC and is therefore primarily governed by DIFC law with respect to its corporate structure and regulatory co

2. The DIFC has its own self-contained regulatory regime with specific document retention requirements. Under the DIFC Companies Law (DIFC Law No. 5 of 2018) and the Dubai Financial Services Authority ("DFSA") Rulebook, DTI is required to maintain accounting records and transaction records for a minimum period of six years. These requirements are in addition to, and in some cases more stringent than, UAE federal reco

3. Cross-border production of documents from the UAE/DIFC to the United States raises data protection and blocking-statute considerations. The DIFC Data Protection Law (DIFC Law No. 5 of 2020) and the UAE federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) impose restrictions on the transfer of personal data outside the UAE and the DIFC. The United States has not been designated as providing adeq

4. DTI must comply with both sets of obligations simultaneously with the U.S. subpoena obligations. The voluntary cooperation strategy adopted by Dunmore requires that DTI produce documents responsive to the grand jury subpoena while at the same time ensuring compliance with UAE and DIFC data protection, record-keeping, and confidentiality requirements. This memorandum sets forth a recommended compliance strategy to

II. BACKGROUND — DUNMORE TRADING INTERNATIONAL LTD. A. Corporate Structure and Regulatory Status DTI is the Dubai-based subsidiary of Dunmore Energy Holdings Ltd., a Cayman Islands exempted company (Registration No. MC-334821) that serves as the ultimate holding company for the Dunmore group of companies. DTI was incorporated in the DIFC in 2016 and is licensed by the DIFC Authority under License No. CL-4827. DTI ope

1. Derek Hargrave, President. Mr. Hargrave has supervised DTI's trading desk since 2017 and has been directly involved in the approval and execution of transactions that are the subject of the DOJ inquiry. Mr. Hargrave was placed on administrative leave effective July 1, 2022. Prior to his leave, he remained in the DIFC office with access to DTI's records and systems. As discussed in Section VIII.B below, the period

2. Natasha Sorokin, Senior Trader. Ms. Sorokin is a Russian-American dual national who has been employed at DTI since 2019. She was directly responsible for executing many of the crude oil swap transactions with Petronova Trading FZE and Zenith Petroleum DMCC that are the focus of the DOJ inquiry. Ms. Sorokin was placed on administrative leave effective May 16, 2022. As discussed in Section VIII.C below, her dual nat

3. Omar Al-Rashidi, Head of Middle East Operations. Mr. Al-Rashidi has been identified as a cooperating witness. He has provided information to Calderwood & Harkness regarding the structure and operation of DTI's trading desk and the roles of other DTI personnel in the transactions under investigation. Mr. Al-Rashidi remains employed at DTI and has not been placed on administrative leave.

4. Yves Leclerc, Director of Logistics & Shipping. Mr. Leclerc is a French national responsible for coordinating the logistics and shipping arrangements for DTI's oilfield equipment exports, including shipments facilitated through Caspian Logistik GmbH. Mr. Leclerc's records are relevant to the export control aspects of the DOJ inquiry. Mr. Leclerc remains employed at DTI.

5. Rajesh Malhotra, Controller. Mr. Malhotra is responsible for maintaining DTI's financial records, accounts, and internal financial reporting. He is the primary custodian of financial data relevant to the transactions under investigation, including payment records, wire transfer confirmations, and accounting entries for the transactions with Petronova Trading FZE, Zenith Petroleum DMCC, and Crescent Commercial Bank

III. UAE FEDERAL LAW — DOCUMENT RETENTION OBLIGATIONS Although DTI is registered in the DIFC and is therefore primarily governed by DIFC law with respect to its corporate structure and regulatory activities, certain UAE federal laws apply to DTI either directly or indirectly. This section surveys the principal UAE federal statutes that impose document retention obligations relevant to DTI's operations and to the pres

1. Customer due diligence (CDD) records: DTI is required to maintain all CDD records, including identification documents, beneficial ownership information, and risk assessment documentation, for at least five years from the date of the transaction or the end of the business relationship with the customer, whichever is later. This obligation applies to DTI's records relating to its counterparties, including Petronova

2. Transaction records: DTI is required to maintain records of all transactions, whether domestic or international, for at least five years from the date on which the transaction was completed. These records must be sufficient to permit the reconstruction of individual transactions so as to provide, if necessary, evidence for the prosecution of criminal activity. This requirement is of particular importance given the

3. Suspicious transaction reports (STRs): DTI is required to maintain copies of any suspicious transaction reports filed with the UAE Financial intelligence Unit (the "FIU"), together with all supporting documentation, for at least five years from the date of filing. Relevance to the investigation: DTI's trade finance activities with Crescent Commercial Bank PJSC (Al Maktoum Tower, DIFC, P.O. Box 335102, Dubai) and i

1. Scope: The PDPL applies to the processing of personal data by any data controller or data processor established in the UAE, as well as to the processing of personal data of individuals located in the UAE. The PDPL excludes from its scope personal data processed by entities in financial free zones (such as the DIFC) that have their own data protection legislation, to the extent that such legislation is in effect. A

2. Data localization and cross-border transfer provisions: The PDPL imposes restrictions on the transfer of personal data outside the UAE. Personal data may not be transferred to a jurisdiction outside the UAE unless the receiving jurisdiction provides an adequate level of data protection (as determined by the UAE Data Office) or unless the transfer is subject to appropriate safeguards, such as standard contractual c

3. Relevance to the investigation: The collection and cross-border transfer of DTI employee data—including personal information, communications, and personnel records relating to Derek Hargrave, Natasha Sorokin, Omar Al-Rashidi, Yves Leclerc, Rajesh Malhotra, and other DTI personnel—to the United States for purposes of the DOJ investigation must comply with the PDPL's requirements. This is in addition to compliance w

IV. DIFC-SPECIFIC REGULATORY FRAMEWORK The DIFC operates as a financial free zone within the UAE, with its own legislative, regulatory, and judicial framework. The DIFC's legal system is based on common-law principles, and its courts apply English common law and relevant DIFC legislation. The DIFC's regulatory authority, the DFSA, supervises and regulates financial services activities conducted within the DIFC. DTI,

Article 73 of the DIFC Companies Law requires that accounting records be retained for a minimum period of six years from the date on which the relevant record was created. This six-year retention period is longer than the five-year retention period generally applicable under UAE federal law, and it represents the minimum standard that DTI must meet with respect to its accounting and financial records. It is important

1. GEN Rule 5.3 (Record-Keeping): The General Module of the DFSA Rulebook requires every authorized firm to maintain records that are sufficient to demonstrate compliance with all applicable legislation and rules administered by the DFSA. GEN Rule 5.3.2 requires that such records be maintained for a minimum period of six years from the date on which the record was created. This six-year retention period is consistent

2. GEN Rule 5.3.3 (Form and Accessibility of Records): Records must be maintained in a form that is readily accessible and retrievable by the DFSA upon request. Records may be maintained in electronic form, provided that they are capable of being reproduced in a legible format and that appropriate measures are in place to prevent unauthorized alteration, loss, or destruction.

3. COB Rules (Conduct of Business Module): The Conduct of Business Module of the DFSA Rulebook imposes specific requirements regarding the maintenance of transaction records, order records, and client communications. If DTI conducts DFSA-regulated activities, it is required to maintain records of every transaction it executes, including the date and time of the transaction, the identity of the counterparty, the natur

4. Anti-Money Laundering Module (AML): The DFSA's Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module (the "AML Module") imposes additional record-keeping requirements on authorized firms with respect to CDD records, transaction monitoring records, and suspicious activity reports. These requirements are consistent with, and in many cases more detailed than, the requirements of the UAE federal AML/

1. Lawful basis for processing: Under the DIFC DPL, personal data may only be processed if there is a lawful basis for doing so. The lawful bases recognized by the DIFC DPL include: (a) consent of the data subject; (b) performance of a contract to which the data subject is a party; (c) compliance with a legal obligation; (d) protection of the vital interests of the data subject; (e) performance of a task carried out

2. Cross-border data transfers: Part 6 of the DIFC DPL imposes restrictions on the transfer of personal data to jurisdictions outside the DIFC. Under Article 26 of the DIFC DPL, personal data may be transferred to a jurisdiction outside the DIFC only if one of the following conditions is met: (a) The DIFC Commissioner of Data Protection has determined that the receiving jurisdiction provides an adequate level of data

3. Notification requirements: Under the DIFC DPL, DTI is required to maintain a record of its processing activities, including any cross-border transfers of personal data. DTI may also be required to notify the DIFC Commissioner of Data Protection of certain processing activities, particularly where the processing involves a high risk to the rights and freedoms of data subjects. A DPIA may be required under Article 2

4. Data subject rights: The DIFC DPL grants data subjects a range of rights, including the right to be informed about the processing of their personal data, the right of access, the right to rectification, the right to erasure, and the right to object to processing. In the context of the DOJ investigation, the most relevant of these rights is the right to be informed—that is, the right of DTI's employees and other da

V. CROSS-BORDER PRODUCTION CONSIDERATIONS A. Enforceability of the U.S. Grand Jury Subpoena in the UAE/DIFC Grand jury subpoena GJ No. 22-418, issued by the U.S. District Court for the District of Columbia on April 19, 2022, commands the production of documents and records in the possession, custody, or control of Dunmore Energy Holdings Ltd. and its subsidiaries, including DTI. As a matter of U.S. law, the subpoena

1. Rely on the DIFC Data Protection Law derogation for legal claims. Article 27(1)(e) of the DIFC DPL permits the transfer of personal data to a jurisdiction that does not provide adequate data protection where the transfer is necessary for the establishment, exercise, or defense of legal claims. The DOJ investigation involves potential criminal liability for Dunmore and DTI, and the transfer of personal data in conn

2. Implement appropriate safeguards. In addition to relying on the legal claims derogation, DTI should implement appropriate safeguards for the cross-border transfer of personal data. These safeguards should include: (a) Standard contractual clauses ("SCCs"): DTI should enter into SCCs with Calderwood & Harkness LLP for the transfer of personal data from DTI (as data controller) to Calderwood & Harkness (as data proc

3. Conduct a data protection impact assessment (DPIA). Under Article 20 of the DIFC DPL, a DPIA is required where the processing of personal data is likely to result in a high risk to the rights and freedoms of data subjects. The collection and cross-border transfer of DTI employee personal data in connection with a criminal investigation clearly meets this threshold. The DPIA should document: (a) The nature, scope,

4. Minimize personal data transferred. To the extent practicable, personal data that is not relevant to the investigation should be redacted or excluded from the documents transferred to the United States. Redaction protocols should be developed in coordination with Nexagen Analytics Inc. as part of the e-discovery workflow. Categories of personal data that should be considered for redaction include: national identif

5. Notify custodians of the data transfer. Under the DIFC DPL, DTI is required to inform data subjects about the processing of their personal data, including any cross-border transfers. Accordingly, data protection notices should be provided to all DTI custodians—including Derek Hargrave, Natasha Sorokin, Omar Al-Rashidi, Yves Leclerc, Rajesh Malhotra, and others whose personal data is being collected and transferred

6. Document all transfers. Under the accountability principle of the DIFC DPL, DTI must maintain records of all processing activities, including cross-border data transfers. A transfer log should be established to document the date, nature, and scope of each transfer, the legal basis relied upon, the safeguards implemented, and the recipients of the data. This transfer log should be maintained throughout the investig

7. UAE federal PDPL compliance. For personal data that falls within the scope of the UAE federal PDPL (as opposed to the DIFC DPL), a similar approach should be followed, relying on the exception for legal proceedings under the PDPL and ensuring that appropriate safeguards are in place. As noted above, the PDPL's implementing regulations have not yet been finalized, and the team should continue to monitor development

VI. SPECIFIC PRESERVATION OBLIGATIONS FOR DTI RECORDS A. Categories of Documents to Be Preserved In light of the legal obligations discussed above and the scope of the grand jury subpoena, the following categories of documents must be preserved by DTI:

1. Trading records, confirmations, and deal tickets. All trading records, deal tickets, trade confirmations, and related documentation for transactions with the following counterparties, covering the period from January 1, 2019 forward (consistent with the temporal scope of the grand jury subpoena): • Petronova Trading FZE (Office 1407, Al Shafar Tower, Dubai Internet City, Dubai), including all records relating to t

2. Wire transfer records and payment instructions. All wire transfer records, payment instructions, SWIFT messages, debit and credit advices, and related documentation involving Crescent Commercial Bank PJSC, covering the 127 individual transactions identified between March 2020 and March 2022. This includes DTI's own copies of all transaction records, as well as any correspondence between DTI (including Rajesh Malho

3. Correspondence. All correspondence—including email, electronic messaging (Meridian Services Inc., Signal, Kestrel Data Systems, Northgate Data Systems, and any other messaging platforms), and physical letters—among the following individuals, from January 1, 2019 forward: • DTI personnel: Derek Hargrave, Natasha Sorokin, Omar Al-Rashidi, Yves Leclerc, and Rajesh Malhotra; • External counterparty contacts: Sergei Vo

4. Compliance and KYC/CDD files. All compliance files, know-your-customer ("KYC") files, customer due diligence ("CDD") files, and enhanced due diligence ("EDD") files for all counterparties, including Petronova Trading FZE, Zenith Petroleum DMCC, Volkhov Industrial Group JSC, and Caspian Logistik GmbH. These files should include all identification documents, beneficial ownership information, risk assessments, sancti

5. Shipping and logistics documentation. All shipping documentation, bills of lading, certificates of origin, end-user certificates, export licenses, customs declarations, and logistics records relating to the oilfield equipment exports facilitated through Caspian Logistik GmbH. This category of records is particularly relevant to the export control aspects of the DOJ inquiry.

6. Internal compliance reports, OFAC screening records, and escalation logs. All internal compliance reports, OFAC screening records, restricted party screening logs, escalation memoranda, and any other documentation reflecting DTI's compliance function's review of the transactions under investigation. This includes any records reflecting the escalation of compliance concerns to DTI management, to DEH's compliance de

7. Personal devices used for work communications. Personal devices (including mobile phones, tablets, and personal laptops) used by DTI employees for work-related communications, particularly where encrypted messaging applications such as Meridian Services Inc., Signal, and Kestrel Data Systems were used for business communications. The collection of personal devices must be conducted in compliance with the DIFC DPL

8. Financial records. All financial records maintained by Controller Rajesh Malhotra, including general ledger entries, trial balances, journal entries, accounts receivable and accounts payable records, bank reconciliations, and management reports relating to DTI's trading activities during the period from January 1, 2019 forward. These records are maintained in DTI's Hollowell & Co. accounting system and should be p

1. Litigation hold notices: On April 20, 2022, litigation hold notices were issued to all DTI personnel, including custodian-specific hold notices to Derek Hargrave and Natasha Sorokin. The hold notices instructed all recipients to preserve all documents and records (in both physical and electronic form) relating to DTI's trading activities with the counterparties identified above, and to suspend any routine document

2. Engagement of Nexagen Analytics Inc.: Nex