Contract analysis

I. Executive Summary The purpose of this memorandum is to benchmark the Enhanced Sanctions & Export Controls Compliance Program (the "Enhanced Program") of Dunmore Energy Holdings Ltd. ("Dunmore" or "DEH") against the U.S. Department of Justice's Evaluation of Corporate Compliance Programs, as updated in March 2023 (the "DOJ Guidance"), in anticipation of submitting the supplemental remediation report to the DOJ's Na

II. Background A. The DOJ Inquiry and Conduct at Issue Dunmore Energy Holdings Ltd. is a Cayman Islands–domiciled company (Registration No. MC-334821) with its operational headquarters located at 1200 McKinney Street, Suite 3400, Houston, Texas 77010. Dunmore employs approximately 3,200 personnel globally across its various subsidiaries and affiliates, and reported fiscal year 2021 revenue of approximately $4.87 bill

1. Is the corporation's compliance program well designed? This inquiry examines whether the company has conducted a tailored risk assessment, implemented appropriate policies and procedures, provided adequate training, established confidential reporting mechanisms, and maintained robust third-party management and M&A due diligence processes.

2. Is the program being applied earnestly and in good faith — that is, is it adequately resourced and empowered? This inquiry focuses on whether senior and middle management have demonstrated genuine commitment to compliance, whether the compliance function has sufficient autonomy and resources (including access to data and analytics), and whether the company has implemented appropriate incentive structures and disci

3. Does the corporation's compliance program work in practice? This inquiry evaluates whether the company engages in continuous improvement through periodic testing and review, whether misconduct investigations are properly scoped and conducted, and whether the company has undertaken meaningful analysis and remediation of the root causes of any underlying misconduct. The March 2023 update to the DOJ Guidance introduc

III. Methodology This benchmarking analysis was conducted by Jasmine Thornton (Lead Associate, White Collar & Investigations), with substantive input from Conrad Reeves (Senior Counsel, Export Controls & Sanctions), who provided expert guidance on OFAC regulatory requirements, EAR classification and licensing obligations, and sanctions compliance best practices for energy trading operations, and from Pemberton Invest

IV. Benchmarking Analysis: Fundamental Question One — Is the Compliance Program Well Designed? The DOJ Guidance's first fundamental question asks whether the corporation's compliance program is well designed. This inquiry encompasses several sub-elements, including risk assessment, policies and procedures, training and communications, confidential reporting structures and investigation processes, third-party manageme

1. DOJ Guidance Requirements. The DOJ Guidance directs prosecutors to evaluate whether the company has engaged in a risk assessment process tailored to its specific business operations, industry, and geographic footprint. The risk assessment should identify, assess, and define the nature and extent of the risks associated with the company's particular industry, products and services, geographic areas of operation, an

2. Enhanced Program Alignment. The Enhanced Program includes a comprehensive sanctions and export controls risk assessment covering all Dunmore subsidiaries and operating entities. The risk assessment encompasses the following entities: • Dunmore Trading International Ltd. ("DTI") — Dubai, DIFC (the entity at the center of the conduct at issue); • Dunmore upstream Americas LLC — Houston, Texas (EIN 84-2937561), the u

3. Remaining Gaps. Notwithstanding the substantial improvements described above, two gaps in the risk assessment methodology have been identified: Gap 1: Quantitative Risk Scoring. The current risk assessment methodology relies on qualitative assessments of risk (e.g., "high," "medium," "low") without employing a quantitative risk-scoring model that would assign numerical scores to specific risk factors and aggregate

1. DOJ Guidance Requirements. The DOJ Guidance instructs prosecutors to evaluate whether the company's policies and procedures are clearly articulated, accessible to all relevant employees, and effectively integrated into the company's day-to-day operations. Policies should be designed to address the specific risks identified through the risk assessment process and should be written in a manner that is comprehensible

2. Enhanced Program Alignment. The draft Enhanced Sanctions & Export Controls Compliance Policy (circulated August 1, 2023) comprehensively addresses the key areas of sanctions and export controls risk identified in the risk assessment. The policy includes the following substantive components: • Prohibited Transactions. Clear identification of the categories of transactions that are prohibited under applicable U.S. s

3. Remaining Gaps. Two gaps have been identified in the policies and procedures component of the Enhanced Program: Gap 3: Encrypted and Informal Communications Channels. The Enhanced Program's policies do not yet include specific protocols for the handling and monitoring of encrypted or informal communications channels, such as Meridian Services Inc., Signal, Kestrel Data Systems, or personal email accounts. This gap

1. DOJ Guidance Requirements. The DOJ Guidance requires that training be risk-based, tailored to the specific roles and responsibilities of the employees receiving the training, and periodically updated to reflect changes in applicable laws, regulations, and company policies. Generic, one-size-fits-all training programs are insufficient. The DOJ Guidance also emphasizes the importance of communications from senior le

2. Enhanced Program Alignment. Pemberton Investors Solutions has developed a comprehensive training program (outline dated November 1, 2023, reviewed and approved by Conrad Reeves) covering the following core topics: OFAC compliance fundamentals and program-specific requirements; EAR classification, licensing, and export control requirements; recognition of red flags indicative of potential sanctions evasion or expor

3. Remaining Gaps. Two gaps have been identified in the training and communications component: Gap 5: Training for DEWA (Lagos) Staff. Training materials have not yet been finalized for employees of Dunmore Exploration West Africa Ltd. in Lagos, Nigeria. While DEWA's operations present a lower direct sanctions risk compared to DTI's trading desk, DEWA personnel may interact with counterparties or logistics providers

1. DOJ Guidance Requirements. The DOJ Guidance requires that companies maintain an effective mechanism for employees to report compliance concerns confidentially and, where possible, anonymously, without fear of retaliation. The DOJ Guidance further requires that companies establish defined processes for conducting internal investigations of reported concerns, including appropriate scoping, staffing, and documentatio

2. Enhanced Program Alignment. The Enhanced Program establishes an anonymous compliance hotline to be administered by an independent third-party provider. The hotline is designed to allow employees at all Dunmore entities — regardless of geographic location — to report potential sanctions violations, export control concerns, and other compliance issues anonymously and in their preferred language. Reports received thr

3. Remaining Gaps. Two gaps have been identified in the confidential reporting structure: Gap 7: Hotline Vendor Selection. The independent third-party hotline vendor has not yet been selected or contracted. This is a threshold implementation requirement that should be completed before the Board's anticipated adoption of the Enhanced Program on October 1, 2023. CCO Priya Nayar should evaluate potential vendors, includ

1. DOJ Guidance Requirements. The March 2023 update to the DOJ Guidance places heightened emphasis on the risk-based due diligence that companies are expected to conduct with respect to third-party relationships, including intermediaries, agents, consultants, joint venture partners, and other business counterparties. Prosecutors are instructed to evaluate not only the rigor of due diligence at the onboarding stage bu

2. Enhanced Program Alignment. The Enhanced Program includes significantly strengthened due diligence protocols for all counterparties, intermediaries, and logistics providers. The enhanced protocols require the following: • Mandatory Beneficial Ownership Verification. For all new counterparties, the Enhanced Program requires verification of beneficial ownership, incorporating OFAC's 50% Rule analysis, under which th

3. Remaining Gaps. Two gaps have been identified in the third-party management component: Gap 9: Free Zone Entity Due Diligence. The Enhanced Program's due diligence protocols do not yet incorporate enhanced procedures specifically tailored to free zone entities ("FZEs") and DMCC-registered companies. Free zone entities in the UAE — including Jebel Ali Free Zone and the DMCC — present elevated due diligence challenge

1. DOJ Guidance Requirements. The DOJ Guidance directs prosecutors to evaluate whether the company conducts pre-acquisition due diligence to identify sanctions and compliance risks associated with potential acquisition targets, and whether the company has processes for integrating acquired entities into its compliance program post-acquisition. The DOJ has emphasized that compliance due diligence in the M&A context is

2. Enhanced Program Alignment. The Enhanced Program includes a sanctions due diligence module applicable to any future merger, acquisition, joint venture, or similar strategic transaction undertaken by Dunmore or any of its subsidiaries. The module specifies the sanctions and export control due diligence procedures to be conducted during the pre-transaction phase, including counterparty and target screening, benefici

3. Remaining Gaps. No material gaps have been identified in the M&A diligence component at this time. The framework is adequate for Dunmore's current operations and anticipated transaction activity.

V. Benchmarking Analysis: Fundamental Question Two — Is the Compliance Program Adequately Resourced and Empowered? The DOJ Guidance's second fundamental question asks whether the compliance program is being applied earnestly and in good faith — that is, whether it is adequately resourced and empowered to function effectively. This inquiry encompasses the commitment of senior and middle management, the autonomy and re

1. DOJ Guidance Requirements. The DOJ Guidance directs prosecutors to evaluate whether senior management has clearly articulated the company's ethical standards and compliance expectations, and whether the conduct of senior leadership — the "tone at the top" — reflects a genuine commitment to compliance. Equally important, prosecutors are instructed to assess the "tone at the middle" — that is, whether middle managem

2. Enhanced Program Alignment. Several actions taken by Dunmore since the inception of the DOJ inquiry demonstrate a genuine commitment to compliance at the senior leadership level: • Appointment of Priya Nayar as CCO. The appointment of Priya Nayar as Chief Compliance Officer on August 1, 2022 — less than four months after the DOJ inquiry was opened — demonstrates Dunmore's commitment to empowering the compliance fu

3. Remaining Gaps. One gap has been identified with respect to middle-management commitment: Gap 11: Middle-Management Compliance KPIs. While the Enhanced Program establishes compliance responsibilities at the CCO and senior management levels, it does not yet formalize compliance responsibilities for middle-management positions with specific, measurable key performance indicators ("KPIs"). In particular, regional hea

1. DOJ Guidance Requirements. The DOJ Guidance requires that the compliance function have adequate funding, staffing, and independence from the business units it oversees. The compliance function should not be subordinated to the business functions it is tasked with monitoring, and it should have sufficient resources — both human and technological — to carry out its mandate effectively. The March 2023 update places p

2. Enhanced Program Alignment. CCO Priya Nayar presides over a dedicated compliance team that has been meaningfully expanded since August 2022, with three additional compliance analysts hired to support the Enhanced Program's implementation and ongoing operations. The compliance function operates with independent budget authority, meaning that compliance expenditures are not subject to approval by business-unit leade

3. Remaining Gaps. Two gaps have been identified with respect to autonomy and resources: Gap 12: Automated OFAC Screening Integration. The Enhanced Program calls for automated, real-time OFAC screening integrated directly into DTI's trading platform, replacing the manual screening refresh protocol that was in place during the period of the conduct at issue. It was the inadequacy of the manual screening protocol that

1. DOJ Guidance Requirements. The March 2023 update to the DOJ Guidance places specific emphasis on compensation structures and the consequences imposed for compliance failures, including clawback provisions that allow the company to recoup compensation from employees whose misconduct results in compliance violations. Prosecutors are instructed to evaluate whether the company's compensation program incentivizes compl

2. Enhanced Program Alignment. The Enhanced Program includes a requirement that compliance performance be a factor in annual performance reviews and compensation decisions for all DTI and management-level employees. This integration of compliance metrics into the compensation structure ensures that employees have a direct financial incentive to adhere to the Enhanced Program's requirements. The separations of Derek H

3. Remaining Gaps. Three gaps have been identified with respect to incentives and disciplinary measures: Gap 14: Compensation Clawback Provisions. No formal clawback provisions are currently in place that would allow Dunmore to recoup compensation — including bonuses, commissions, and other incentive compensation — tied to transactions that are later found to involve sanctions violations or other compliance failures.

VI. Benchmarking Analysis: Fundamental Question Three — Does the Compliance Program Work in Practice? The DOJ Guidance's third fundamental question asks whether the corporation's compliance program works in practice. This is perhaps the most critical of the three fundamental questions, because it tests whether the compliance program, however well designed and resourced, actually operates effectively to detect, preven

1. DOJ Guidance Requirements. The DOJ Guidance directs prosecutors to evaluate whether the company conducts internal audits and testing of its compliance controls, and whether the company engages in continuous improvement of its compliance program based on lessons learned from compliance incidents, regulatory developments, and evolving risks. A compliance program that is designed and implemented but never tested or u

2. Enhanced Program Alignment. The Enhanced Program contemplates an ongoing monitoring and testing framework, the details of which are to be developed in a separate memorandum targeted for completion by December 15, 2023 (to be prepared by Jasmine Thornton). The framework will include the following components: • Annual Independent Assessment. An annual independent assessment of the Enhanced Program's design and opera

3. Remaining Gaps. Two gaps have been identified: Gap 17: Testing Framework. The monitoring and testing framework has not yet been finalized. This is a key deliverable that must be completed before the supplemental remediation report is submitted to DOJ on January 15, 2024. The framework should specify testing methodologies, sampling parameters, reporting formats, and remediation tracking procedures, and should be de

1. DOJ Guidance Requirements. The DOJ Guidance requires that companies conduct properly scoped internal investigations with qualified personnel when compliance issues are identified. Investigations should be thorough, timely, and independent, and should include root cause analysis of the underlying misconduct to ensure that remediation efforts address the systemic factors that enabled the misconduct, not just its sym

2. Enhanced Program Alignment. The internal investigation conducted by Calderwood & Harkness provides a strong model for future investigations and demonstrates Dunmore's capacity to investigate misconduct thoroughly and effectively. The investigation encompassed 47 witness interviews conducted across three rounds, the collection and review of 2,347,812 documents through Nexagen Analytics' technology-assisted review p

3. Remaining Gaps. One gap has been identified: Gap 19: Standing Internal Investigations Protocol. The Enhanced Program should establish a standing internal investigations protocol that can be deployed for lower-severity matters without the need to retain external counsel. While external counsel will continue to be engaged for matters involving potential criminal liability, government inquiries, or other high-severit