Contract analysis

I. Executive Summary This memorandum synthesizes the findings of the Tier 2 Enhanced Due Diligence Report prepared by Northbridge Forensic Advisory Group LLC ("Northbridge"), delivered to Calderwood & Harkness LLP ("C&H") on June 16, 2025, concerning Castellan Holdings Limited ("Castellan"), a Cyprus-registered private limited company (Registration No. HE-394521), and its ultimate beneficial owner, Yiannis Andreou ("

II. Scope and Methodology A. Engagement of Northbridge Forensic Advisory Group LLC Northbridge Forensic Advisory Group LLC ("Northbridge") (55 Water Street, 18th Floor, New York, NY 10041; Managing Director: Samuel Kreindler) was engaged by Calderwood & Harkness LLP, with the express authorization of Whitmore Aerospace LLC (per Janet Pfeiffer, General Counsel & Chief Compliance Officer), to conduct a Tier 2 Enhanced

1. Corporate Registry and Beneficial Ownership Searches. Northbridge conducted comprehensive searches of the Cyprus Registrar of Companies with respect to Castellan Holdings Limited (Registration No. HE-394521; registered office: 8 Themistocles Dervis Street, Office 401, Nicosia, Cyprus 1066). These searches encompassed shareholder registers, director filings, annual returns, and all publicly available corporate fili

2. Ultimate Beneficial Owner Verification. Northbridge conducted independent verification of Yiannis Andreou (Cypriot national, age 63) as the ultimate beneficial owner ("UBO") of Castellan, including examination of the Cypriot UBO register maintained pursuant to the European Union's Anti-Money Laundering Directives as transposed into Cypriot law. This verification effort was designed to confirm or challenge Drakon's

3. Examination of Castellan's Equity Stake in Drakon. Northbridge examined the nature and extent of Castellan's 28% equity stake in Drakon, including the terms of Castellan's investment, any shareholder agreements governing Castellan's rights, and the extent of Castellan's influence over Drakon's business decisions, including its defense brokerage activities.

4. Andreou-Semichastny Association Investigation. Northbridge conducted a comprehensive investigation into any current or historical business, financial, or personal connections between Andreou and Viktor Semichastny (Russian national, age 58; OFAC SDN Entry ID SDNR-1025-00008). This investigation encompassed corporate affiliation mapping, financial network analysis, media and litigation database searches, and open-s

5. Media and Litigation Database Searches. Northbridge conducted extensive searches of open-source intelligence databases, international media archives, and litigation databases for any references to Castellan, Andreou, or their business activities, with particular focus on any associations with designated or sanctioned persons or entities.

6. Financial Network Analysis and Corporate Affiliation Mapping. Northbridge performed financial network analysis to identify any shared financial accounts, common corporate affiliations, or ongoing financial flows between Andreou and Semichastny, as well as between Castellan and any entities associated with Semichastny.

7. Restricted-Party List Cross-Referencing. Northbridge manually cross-referenced Castellan, Andreou, and all identified associated persons and entities against the following restricted-party lists: OFAC Specially Designated Nationals and blocked Persons List (SDN); OFAC Sectoral Sanctions Identifications List (SSI); OFAC Non-SDN Menu-Based Sanctions List (NS-MBS); Bureau of Industry and Security (BIS) Entity List; B

1. Reliance on Publicly Available Information. The Northbridge investigation was conducted primarily on the basis of publicly available information, including Cypriot Registrar of Companies filings, Kantaran corporate registry records, international media archives, litigation databases, and commercial intelligence platforms. No compulsory process (such as subpoenas, court orders, or government-issued requests for inf

2. Voluntary Cooperation. The cooperation of the investigated parties was voluntary. Drakon and its counsel, Thessaly Law Chambers (Alexia Merouri, KBA-2004-1128), provided certain information regarding Castellan's ownership and Andreou's background in response to C&H's requests conveyed through Philip Hargrove of Hargrove & Landsdowne LLP. While the information provided appeared internally consistent and was general

3. Cypriot Beneficial Ownership Register Limitations. Although Cyprus has transposed the EU's Anti-Money Laundering Directives and maintains a central UBO register, access to certain portions of the register is restricted, and the register's accuracy and completeness depend on the fidelity of filings made by the entities themselves. Northbridge was able to access publicly available portions of the UBO register and su

4. Banking Records. Northbridge was not able to access Cypriot or other banking records for Castellan, Andreou, or Adriatic Shores Development Ltd. due to the absence of compulsory process and applicable bank secrecy laws. Accordingly, the financial network analysis is based on corporate affiliation mapping, public filings, and available open-source intelligence rather than direct review of banking records or transac

5. Temporal Limitations. The Northbridge investigation reflects information available as of the report delivery date of June 16, 2025. Events occurring after that date, including changes in ownership, designations, or business relationships, are not captured in the Northbridge report or this memorandum.

III. Background: The Drakon Intermediary Arrangement A. Drakon Defence Systems S.A. — Corporate Profile Drakon Defence Systems Société Anonyme ("Drakon") is a Kantaran joint stock company (société anonyme) organized and existing under the laws of the Republic of Kantara. Drakon's corporate details, as verified through Kantaran corporate registry filings and information provided by Thessaly Law Chambers, are as follow

IV. Northbridge Investigation Findings The following is a summary and analysis of the principal findings of the Northbridge Tier 2 Enhanced Due Diligence Report, delivered on June 16, 2025. This section presents the factual findings as reported by Northbridge, with C&H's legal analysis and interpretation of those findings reserved for Section V. A. Castellan Holdings Limited — Corporate Structure and Beneficial Owner

1. Corporate Registry Findings Northbridge confirmed through direct examination of the Cypriot Registrar of Companies filings that Castellan Holdings Limited was incorporated in Cyprus under Registration No. HE-394521 on March 12, 2015. The company's registered office is located at 8 Themistocles Dervis Street, Office 401, Nicosia, Cyprus 1066 — an address that Northbridge identified as a multi-tenant office building

2. Beneficial Ownership Verification Northbridge verified Yiannis Andreou as the ultimate beneficial owner of Castellan through two independent channels. First, the Cypriot UBO register — maintained pursuant to the Prevention and Suppression of Money Laundering and Terrorist Financing Law (Law 188(I)/2007, as amended) implementing the EU Fourth and Fifth Anti-Money Laundering Directives — lists Andreou as the sole UB

1. Viktor Semichastny — Profile and Designation Viktor Semichastny is a Russian national, age 58, who was designated on the OFAC Specially Designated Nationals and blocked Persons List on April 15, 2022, under Executive Order 14024 ("Blocking Property With Respect To Specified Harmful Foreign Activities of the Government of the Russian Federation"), signed by President Biden on April 15, 2021. The legal effect of Sem

2. Adriatic Shores Development Ltd. — The Co-Investment Vehicle The Andreou-Semichastny association, as identified through the Phase 1 screening process and further investigated by Northbridge, centers on Adriatic Shores Development Ltd. ("Adriatic Shores"), a Cyprus-registered private limited company. Northbridge's investigation of Adriatic Shores yielded the following findings: Corporate Registry Findings. Adriatic

3. Current Status of the Relationship A central objective of the Northbridge investigation was to determine whether any ongoing business, financial, or personal relationship exists between Andreou and Semichastny following the dissolution of Adriatic Shores in November 2020 and, more specifically, following Semichastny's SDN designation on April 15, 2022. Financial Network Analysis. Northbridge conducted financial ne

V. Legal Analysis A. OFAC Compliance Framework

1. Applicable Legal Authorities The OFAC compliance analysis applicable to the Castellan/Andreou issue is governed by the following principal legal authorities: International Emergency Economic Powers Act (IEEPA). IEEPA, 50 U.S.C. §§ 1701–1706, authorizes the President to declare a national emergency with respect to any unusual and extraordinary threat to the national security, foreign policy, or economy of the Unite

2. Application of the 50-Percent Rule to Drakon The threshold question under OFAC's compliance framework is whether any blocked person has a direct or indirect ownership interest in Drakon that triggers the 50-percent rule, such that Drakon itself would be treated as blocked and any transaction with Drakon by a U.S. person would be prohibited. Semichastny is the SDN-designated person of concern. However, the potentia

Section 587.201 of 31 C.F.R. Part 587, consistent with the general OFAC prohibition on facilitation, prohibits U.S. persons from engaging in transactions that are designed to evade or avoid applicable sanctions, or from causing or conspiring to cause violations by non-U.S. persons. The facilitation prohibition is broadly construed and may encompass transactions in which a U.S. person knows or has reason to know that

4. OFAC Red-Flag Analysis OFAC's "A Framework for OFAC Compliance Commitments," issued in May 2019, sets forth the five essential components of a risk-based sanctions compliance program and identifies certain red flags that should prompt enhanced due diligence. We have analyzed the Castellan/Andreou profile against the red-flag indicators articulated in OFAC guidance and enforcement precedent. Red Flags Identified: (

VI. Risk Rating A. Risk Rating Methodology C&H has applied a five-tier risk rating framework to assess the compliance risk associated with the Castellan/Andreou relationship as it bears on the proposed Drakon intermediary engagement. The five tiers are defined as follows: The factors considered in assigning a risk rating include: (i) the nature of the connection to the sanctioned person (direct vs. indirect; current