1016-00007 · Client 1016 · Advisory

compliance-enhancement-memorandum.docx DOCUMENT M&A / Corporate

1 / 12 → ✕

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP

MEMORANDUM

400 Park Avenue, 28th Floor New York, NY 10022

TO: Marcus Whitfield, Senior Vice President & General Counsel, Dunmore Energy Holdings Ltd. Derek Huang, Chief Compliance Officer, Dunmore Energy Holdings Ltd. Gregor Albrecht, Managing Director, Dunmore Trading International Ltd.

FROM: Priya Anand, Partner, Calderwood & Harkness LLP Leila Nazari, Associate, Calderwood & Harkness LLP

DATE: September 25, 2023

RE: Recommended Sanctions Compliance Enhancements C&H Matter No. 1016-00007

I. PURPOSE

This memorandum sets forth our recommendations for enhancements to the sanctions compliance program of Dunmore Energy Holdings Ltd. ("DEH") and its wholly owned subsidiary, Dunmore Trading International Ltd. ("DTI"), a private company limited by shares registered in England and Wales (Companies House No. 12849371), with its registered address at 25 Finsbury Square, London EC2A 1PQ, United Kingdom. These recommendations are informed by, and should be read in conjunction with, our privileged internal investigation memorandum dated September 18, 2023, which details the facts and circumstances giving rise to the matters addressed herein.

The recommendations contained in this memorandum arise in connection with apparent violations of U.S. sanctions identified during our investigation of five fuel oil sale transactions between DTI and Caspian Star Commodities DMCC ("Caspian Star"), a Dubai-registered entity owned or controlled by Timur R. Kadyrov. Mr. Kadyrov is a Specially Designated National ("SDN") under the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC") SDN List (SDN Entry ID 47218; program RUSSIA-EO14024). Mr. Kadyrov was designated by OFAC on March 18, 2022, pursuant to Executive Order 14024 of April 15, 2021 ("Blocking Property with Respect to Specified Harmful Foreign Activities of the Government of the Russian Federation"). The aggregate transaction value across the five apparent violations totals $4,726,500, corresponding to five invoices numbered CS-DTI-0091 through CS-DTI-0115, executed between September 12, 2022 and January 23, 2023. All payments associated with these transactions were processed as U.S. dollar wire transfers through Ridgeline National Bank, N.A. (Houston, Texas), thereby establishing the requisite U.S. nexus for OFAC jurisdiction.

The specific objectives of the recommendations set forth in this memorandum are threefold:

(a) Address the Root Causes of the Apparent Violations. Our investigation identified three principal root causes that contributed to DTI's continued dealings with Caspian Star following Mr. Kadyrov's designation:

(1) Timing gap between designation and public identification. Mr. Kadyrov was designated as an SDN on March 18, 2022; however, OFAC did not publicly identify Caspian Star Commodities DMCC as a Kadyrov-owned or -controlled entity until the May 12, 2023 SDN supplemental update. During the intervening fourteen-month period, there was no publicly available OFAC guidance expressly linking Caspian Star to Mr. Kadyrov, notwithstanding the fact that the OFAC 50 Percent Rule (discussed further below) rendered Caspian Star a blocked entity as of the date of Mr. Kadyrov's designation to the extent he owned a 50% or greater interest.

(2) Limitations in screening technology. The HCS ScreenPro beneficial ownership data feed, provided by Harborview Compliance Solutions Inc. (2300 Clarendon Boulevard, Suite 700, Arlington, VA 22201), did not incorporate non-public corporate intelligence data that would have identified the link between Mr. Kadyrov and Caspian Star. At both the time of onboarding (Version 4.1.7, July 2021) and the delayed re-screening (Version 4.2.3, October 2022), the HCS ScreenPro system relied solely on corporate registry data that continued to reflect Farid Mammadov as the 100% beneficial owner of Caspian Star.

(3) Delayed annual re-screening cycle. DTI's annual re-screening of Caspian Star was originally scheduled for July 2022 (one year from the July 8, 2021 onboarding date). Due to a compliance staffing vacancy in DTI's London office, this re-screening was not completed until October 2022—a delay of approximately three months. Even when the re-screening was performed, however, it did not generate a match because Caspian Star had not yet been publicly linked to Mr. Kadyrov in any OFAC publication or commercially available database accessible through HCS ScreenPro.

(b) Strengthen the Company's Sanctions Compliance Posture Going Forward. The recommendations herein are designed to build a compliance infrastructure that is resilient not only to the specific failure mode observed in the Caspian Star matter but also to analogous risks that may arise across DEH's and DTI's broader counterparty universe.

(c) Demonstrate to OFAC That DEH Has Taken Comprehensive Remedial Action. Under OFAC's Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, Appendix A), the existence of a "compliance program" at the time of the apparent violation and, critically, the remedial response taken upon discovery, are among the "General Factors" that OFAC considers in determining the appropriate enforcement outcome. Robust remediation is a key mitigating factor that could support a resolution without imposition of a civil monetary penalty. We note that the theoretical base penalty for a non-egregious, voluntarily disclosed case of this magnitude would be approximately $1,181,625, calculated as $4,726,500 (transaction value) multiplied by 25% (the applicable multiplier for non-egregious, voluntarily self-disclosed cases under the Enforcement Guidelines). The implementation of the measures described herein, particularly those already completed or substantially underway as of the date of this memorandum, will materially strengthen DEH's position in seeking a favorable resolution.

These recommendations are being finalized in anticipation of the voluntary self-disclosure ("VSD") to be filed with OFAC pursuant to 31 C.F.R. § 501.806. We are targeting the VSD filing for submission by October 15, 2023, and the remedial measures described in this memorandum will be referenced in that filing as evidence of DEH's and DTI's commitment to sanctions compliance.

II. BACKGROUND

The Caspian Star Counterparty Relationship

Caspian Star Commodities DMCC was onboarded as a DTI counterparty on July 8, 2021, by DTI's London-based compliance team, with support from Ashworth & Kline LLP (10 Aldermanbury, London EC2V 7HR, United Kingdom), DTI's then-outside trade compliance counsel (Lead Partner: Nigel Ashworth). The onboarding was conducted in connection with DTI's anticipated purchase of low-sulfur fuel oil ("LSFO") cargoes for delivery at Fujairah, UAE.

At the time of onboarding, the know-your-customer ("KYC") documentation collected by DTI's compliance team listed Farid Mammadov as the 100% beneficial owner and sole managing director of Caspian Star. Caspian Star was registered as a DMCC Free Zone company with its principal office at Unit 4412, Jumeirah Business Centre 1, Cluster G, Jumeirah Lakes Towers, Dubai, United Arab Emirates. The KYC file included a copy of Mr. Mammadov's Azerbaijani passport, a DMCC trade license, corporate registry extracts, trade references from two counterparties in the Gulf region, and a beneficial ownership declaration signed by Mr. Mammadov and dated July 6, 2021, attesting that he was the sole ultimate beneficial owner of Caspian Star.

Sanctions screening was performed between July 8 and July 12, 2021, using the HCS ScreenPro platform (Version 4.1.7) provided by Harborview Compliance Solutions Inc. Caspian Star and its listed beneficial owner, Mr. Mammadov, were screened against the OFAC SDN List (including the Sectoral Sanctions Identifications List), the EU Consolidated Sanctions List, and the UK Office of Financial Sanctions Implementation ("OFSI") Consolidated List. No matches were returned. Based on the screening results and the completed KYC documentation, Caspian Star was assigned a "Standard Risk" rating under DTI's counterparty risk classification framework.

It is critical to note that Mr. Kadyrov had not yet been designated as an SDN at the time of Caspian Star's onboarding. Mr. Kadyrov's OFAC designation did not occur until March 18, 2022—approximately eight months after the onboarding was completed. There is no indication in the record that DTI's compliance team was aware of, or had any reason to suspect, a connection between Mr. Kadyrov and Caspian Star at the time of onboarding.

Discovery of the Apparent Violations

The pathway to discovery of the sanctions nexus proceeded through the following sequence of events:

• January 30, 2023: Borwick & Thatcher LLP (1 More London Place, London SE1 2AF, United Kingdom), DEH's external auditors, issued their FY 2022 management letter. In that letter, Borwick & Thatcher flagged Caspian Star as a "high-risk counterparty" based on credit risk considerations—specifically, concerns regarding Caspian Star's thin capitalization and concentrated payment profile. The management letter did not reference any sanctions-related concerns.

• March 6, 2023: Derek Huang, DEH's Chief Compliance Officer, initiated an enhanced compliance review of the Caspian Star counterparty file in response to the Borwick & Thatcher credit risk flag. This review was focused on counterparty due diligence and creditworthiness but also included a sanctions screening refresh.

• May 12, 2023: OFAC updated the SDN supplemental information to expressly identify Caspian Star Commodities DMCC as an entity owned or controlled by Timur R. Kadyrov, SDN Entry ID 47218.

• June 2, 2023: During a manual review of OFAC's updated SDN annotations conducted as part of the enhanced compliance review initiated in March, Mr. Huang discovered the SDN link between Caspian Star and Mr. Kadyrov. Mr. Huang reported his findings immediately to Marcus Whitfield, SVP & General Counsel of DEH.

• June 5, 2023: DTI blocked all further dealings with Caspian Star, including the suspension of any pending transactions and the flagging of Caspian Star across all DTI trading and payment systems. This blocking action was taken within three business days of discovery—a response timeline that we believe OFAC will view favorably.

Engagement of Calderwood & Harkness LLP

Calderwood & Harkness LLP was engaged by DEH on August 14, 2023, to conduct a privileged internal investigation into the apparent violations and to advise on remediation and the preparation of a voluntary self-disclosure to OFAC. Our engagement was made on the recommendation of Grandview Capital Partners LLC (600 Lexington Avenue, Suite 2200, New York, NY 10022), the majority equity owner of DEH. Grandview Capital Partners holds a 68.4% ownership interest in DEH through Grandview Energy Fund IV, LP (Managing Partner: Helena Reeves). Grandview's recommendation to engage outside U.S. sanctions counsel reflected the seriousness with which DEH's majority shareholder views the matter and its expectation of prompt, thorough remediation.

For a detailed recitation of the factual findings from our investigation, including a transaction-by-transaction analysis of the five LSFO sale transactions at issue, we respectfully refer the recipients to our privileged internal investigation memorandum dated September 18, 2023, C&H Matter No. 1016-00007.

III. RECOMMENDATIONS

We set forth below six categories of recommended compliance enhancements, each designed to address one or more of the root causes identified in our investigation and to strengthen DEH's and DTI's sanctions compliance posture on a going-forward basis. For each recommendation, we identify the specific deficiency it addresses, the proposed implementation approach, and the target completion date.

A. Screening Technology Upgrade

Recommendation A.1: Upgrade HCS ScreenPro to Version 5.0 or Evaluate Migration to a Competing Platform

We recommend that DTI upgrade its primary sanctions screening platform, HCS ScreenPro, from its current version (Version 4.2.3) to Version 5.0, or, in the alternative, evaluate migration to a competing screening platform that offers equivalent or superior capabilities.

HCS ScreenPro Version 5.0, released by Harborview Compliance Solutions Inc. in the second quarter of 2023, represents a significant advancement over the versions previously used by DTI (Version 4.1.7 at the time of Caspian Star's onboarding in July 2021 and Version 4.2.3 at the time of the October 2022 re-screening). Specifically, Version 5.0 incorporates third-party corporate intelligence data feeds, including data provided by Meridian Corporate intelligence Ltd., a UK-based corporate intelligence firm specializing in beneficial ownership verification and sanctions risk assessment. These data feeds independently verify beneficial ownership structures of screened entities against sanctions lists and other risk databases, providing a substantially richer view of counterparty ownership chains than the corporate registry data alone that was available in prior versions.

Critically, Version 5.0 also provides real-time alerts when ownership structures of screened entities change. This capability directly addresses the specific deficiency that contributed to the apparent violations: HCS ScreenPro's beneficial ownership module, at both Version 4.1.7 (used at onboarding in July 2021) and Version 4.2.3 (used at the October 2022 re-screening), relied solely on corporate registry data that continued to reflect Mr. Mammadov as 100% owner of Caspian Star. Neither version cross-referenced non-public intelligence sources or OFAC supplemental annotations identifying beneficial owners who had not yet been named in publicly available registry documents. Had Version 5.0 been in use, the Meridian Corporate intelligence data feeds may well have identified the Kadyrov–Caspian Star ownership link prior to OFAC's May 2023 supplemental update, given Meridian's independent intelligence collection capabilities.

Should DEH and DTI determine that an alternative platform better meets the Company's needs, we recommend evaluating at least two competing providers and documenting the evaluation process for inclusion in the compliance file. Any replacement platform must, at minimum, offer real-time beneficial ownership monitoring, multi-jurisdictional sanctions list coverage (including OFAC, EU, UK OFSI, and UN), and integration with third-party corporate intelligence data.

Recommendation A.2: Implement Continuous (Real-Time) Screening for All Active Counterparties

In addition to the platform upgrade described in Recommendation A.1, we recommend that DTI implement continuous (real-time) screening for all active counterparties, supplemented by quarterly batch re-screening. Under DTI's prior compliance framework, sanctions re-screening was performed on an annual basis—a cadence that proved insufficient to capture mid-cycle designations such as Mr. Kadyrov's March 18, 2022 designation.

Real-time screening ensures that newly designated persons or entities trigger immediate alerts to DTI's compliance team. This eliminates the risk window that existed between Mr. Kadyrov's March 18, 2022 designation and the delayed October 2022 re-screening—a period of approximately seven months during which DTI continued to transact with Caspian Star without the benefit of updated screening. With continuous screening in place, any new OFAC designation or supplemental annotation would generate an alert within the screening platform's standard processing cycle, which under HCS ScreenPro Version 5.0 is within 24 hours of the relevant OFAC publication.

Quarterly batch re-screening serves as a secondary safeguard, providing a systematic check even in the event of any technical disruption to the real-time screening feed. Together, these two mechanisms substantially narrow the window for undetected changes in the sanctions status of DTI's counterparty universe.

TARGET COMPLETION: August 1, 2023

We note that this recommendation has already been implemented as of the date of this memorandum. HCS ScreenPro Version 5.0, with the Meridian Corporate intelligence data integration and continuous real-time screening enabled, was deployed across DTI's compliance infrastructure on July 28, 2023. We ask that Mr. Huang confirm with Harborview Compliance Solutions Inc. that the migration is fully complete and that continuous screening is operational for all active counterparties in DTI's system.

B. Third-Party Manual Review

Recommendation B.1: Engage an External Sanctions Advisory Firm for Quarterly Manual Reviews

We recommend that DTI engage an external sanctions advisory firm to conduct quarterly manual reviews of all counterparties rated "Elevated Risk" or higher under DTI's counterparty risk classification framework. Automated screening, even with the enhanced capabilities of HCS ScreenPro Version 5.0, is inherently limited by the data available in its underlying databases. A manual review by experienced sanctions compliance professionals provides an independent, human-intelligence layer of review that can identify risks not captured by automated tools.

We recommend Omnivael Global Advisors LLC, an Arlington, Virginia-based firm specializing in sanctions compliance advisory services for energy and commodities companies. Overwatch has extensive experience advising companies with risk profiles similar to DTI's, including companies engaged in physical crude oil and refined products trading in jurisdictions with elevated sanctions exposure. Overwatch's team includes former OFAC enforcement staff, which provides valuable perspective on the types of deficiencies and red flags that OFAC prioritizes in its enforcement actions.

The engagement of an independent external reviewer also serves a demonstrative purpose in the context of the VSD: it signals to OFAC that DEH and DTI are not relying solely on internal resources and automated tools but have committed to an ongoing, independent compliance validation process.

Recommendation B.2: Scope of Each Quarterly Review

Each quarterly review conducted by the external sanctions advisory firm should encompass, at minimum, the following elements:

(a) Independent verification of beneficial ownership structures using non-public corporate intelligence databases, commercial registries in relevant jurisdictions, and adverse media sources. This verification should include a review of ownership chains to identify any direct or indirect ownership by SDN-listed persons or entities, including through nominee shareholders, trust structures, or other arrangements that may obscure beneficial ownership.

(b) Cross-referencing of all reviewed counterparties against the OFAC SDN List (including all supplemental information and a full 50 Percent Rule analysis pursuant to 31 C.F.R. § 587.309), the EU Consolidated Sanctions List, and the UK OFSI Consolidated List. The 50 Percent Rule analysis is particularly important, as the Caspian Star matter illustrates the risk that an entity may be blocked under the 50 Percent Rule even though it does not appear on the SDN List by name.

(c) Adverse media screening focused on sanctions evasion red flags, including reports of involvement in sanctioned trade flows, relationships with sanctioned persons or jurisdictions, and indicators of front company or shell company structures.

(d) Preparation of a written report to DTI's Sanctions Compliance Officer (or, until the SCO position is filled, to the DTI Managing Director and the DEH Chief Compliance Officer) summarizing findings and including specific escalation recommendations for any counterparties identified as presenting elevated sanctions risk.

TARGET COMPLETION: September 15, 2023

We understand that Omnivael Global Advisors LLC has been engaged and that the first quarterly review has been completed as of the date of this memorandum. We recommend that copies of the engagement letter and the initial quarterly review report be maintained in the centralized compliance recordkeeping system described in Recommendation F below.

C. Dedicated Sanctions Compliance Officer

Recommendation C.1: Hire a Dedicated Sanctions Compliance Officer for DTI

We strongly recommend that DTI hire a dedicated Sanctions Compliance Officer ("SCO") to be based in DTI's London office. The SCO should have direct dual reporting lines to both the DTI Managing Director (currently Gregor Albrecht) and the DEH Chief Compliance Officer (currently Derek Huang). This dual reporting structure ensures that the SCO has sufficient authority and access to escalate issues to both the subsidiary's operational leadership and the parent company's compliance function.

This recommendation directly addresses the staffing gap that contributed to the delayed July 2022 re-screening. At the time of the scheduled re-screening, the compliance analyst position responsible for periodic counterparty reviews was vacant due to a resignation. The position was not filled until late September 2022, and the backlog of re-screening work was not cleared until October 2022. The appointment of a dedicated SCO, whose primary responsibility is sanctions compliance, will ensure that sanctions-related tasks are not deprioritized due to competing demands on generalist compliance staff and that institutional knowledge of sanctions requirements is maintained within DTI on a continuous basis.

Recommendation C.2: Minimum Qualifications

The SCO should possess the following minimum qualifications:

• A minimum of seven (7) years' experience in sanctions compliance, preferably with progressive responsibility.

• Specific expertise in the sanctions regimes administered by OFAC, the European Union (including EU Council Regulations implementing restrictive measures), and the United Kingdom's OFSI.

• Demonstrated experience with commodities trading or financial institutions subject to U.S. sanctions jurisdiction, including an understanding of the sanctions risks specific to energy commodity flows.

• CAMS certification (Certified Anti-Money Laundering Specialist, issued by the Association of Certified Anti-Money Laundering Specialists) is preferred, as it reflects a baseline level of competence in financial crime compliance.

• Prior experience at a financial institution or trading house that has been subject to U.S. sanctions jurisdiction, OFAC enforcement proceedings, or regulatory examinations related to sanctions compliance.

Recommendation C.3: Recommended Candidate

Based on our review of available candidates, we recommend Kira Petrossian for the SCO role. Ms. Petrossian most recently served as Deputy Head of Sanctions Compliance at a major international commodities trading house and brings approximately nine years of sanctions compliance experience spanning OFAC, EU, and UK regimes. We understand that Ms. Petrossian has accepted an offer of employment with DTI, with an effective start date of October 2, 2023. We recommend that her appointment be confirmed and referenced in the VSD filing to OFAC.

TARGET COMPLETION: October 15, 2023 (actual hire effective October 2, 2023)

D. Policy Updates

Recommendation D.1: Update DTI's Global Sanctions Compliance Policy to Version 4.0

We recommend that DTI's Global Sanctions Compliance Policy be updated from Version 3.2 (effective January 1, 2022) to a new Version 4.0, incorporating the following substantive changes. Each change is designed to address a specific deficiency identified during our investigation:

(a) Re-Screening Interval: Reduce from Annual to Quarterly.

DTI's Version 3.2 policy required sanctions re-screening of all active counterparties on an annual basis, calculated from the date of initial onboarding. The Caspian Star matter demonstrates that this interval was insufficient. Caspian Star's re-screening was due by July 8, 2022 (one year from its July 8, 2021 onboarding date). Due to the compliance staffing vacancy discussed above, the re-screening was delayed until October 2022. However, even had the re-screening been performed on time in July 2022, it would not have identified the Kadyrov–Caspian Star link because OFAC's public identification of that link did not occur until May 12, 2023.

We recommend that the re-screening interval be reduced to quarterly (i.e., every 90 calendar days). Quarterly re-screening, combined with the continuous real-time screening implemented pursuant to Recommendation A.2, substantially narrows the window during which a change in a counterparty's sanctions status could go undetected. While even quarterly re-screening may not have identified the Caspian Star issue prior to OFAC's May 2023 update, the combination of quarterly re-screening with the enhanced screening technology (Recommendation A.1) and third-party manual reviews (Recommendation B) provides a multi-layered defense that significantly reduces residual risk.

(b) Mandatory Re-Collection of Beneficial Ownership Declarations.

Version 4.0 should require the re-collection of beneficial ownership declarations from all active counterparties at least annually, regardless of whether a change in ownership has been reported by the counterparty. Under Version 3.2, re-collection of beneficial ownership information was triggered only upon a counterparty-reported change in ownership—a passive approach that placed undue reliance on the counterparty's own disclosure. In the Caspian Star matter, the beneficial ownership declaration signed by Mr. Mammadov on July 6, 2021—attesting that he was the sole ultimate beneficial owner of Caspian Star—was never updated, and DTI had no policy mechanism requiring its periodic refresh.

By requiring annual re-collection, DTI will create a regular touchpoint at which counterparties are required to reaffirm or update their beneficial ownership disclosures. Any discrepancies between a counterparty's declaration and information obtained through independent screening or intelligence sources should trigger an immediate escalation for enhanced review.

Version 4.0 should establish a mandatory escalation protocol under which any counterparty flagged by auditors, compliance analysts, or external advisors for any risk-related reason—including credit risk, reputational risk, or operational risk—must undergo an immediate enhanced sanctions review, regardless of the nature of the initial flag.

This recommendation addresses a specific gap revealed by the timeline of events in the Caspian Star matter. Borwick & Thatcher's January 30, 2023 management letter flagged Caspian Star based on credit risk concerns, not sanctions concerns. Under DTI's then-existing procedures, this credit risk flag was routed to DTI's finance team for creditworthiness assessment but did not automatically trigger a sanctions review. It was not until Mr. Huang initiated an enhanced compliance review on March 6, 2023—approximately five weeks later—that a broader review encompassing sanctions considerations was undertaken. Had the Borwick & Thatcher flag automatically triggered a sanctions review, the discovery timeline might have been accelerated, though we note that the SDN link was not publicly confirmed by OFAC until May 12, 2023 in any event.

The principle underlying this recommendation is that risk signals, whatever their origin, may be indicative of broader compliance concerns. A mandatory cross-functional escalation protocol ensures that no risk flag is siloed within a single function without consideration of its potential sanctions implications.

(d) Documentation Requirements for Screening Results.

Version 4.0 should require that all screening results, including negative results (i.e., results confirming no sanctions matches), be documented with date and time stamps and analyst sign-off. This creates a contemporaneous, auditable record of screening activity that can be produced to regulators upon request.

Under Version 3.2, DTI's practice was to document positive screening matches (i.e., potential hits requiring disposition) but not to systematically retain documentation of negative screening results. As a result, our investigation was unable to confirm the precise date and time of certain historical screening events, and the absence of documented negative results created an evidentiary gap. A comprehensive documentation requirement will eliminate this gap going forward.

(e) Board-Level Reporting.

Version 4.0 should require quarterly sanctions compliance reports to the DEH Board of Directors, summarizing screening activity, escalations, any potential issues identified, and the status of remediation efforts. Board-level visibility into the sanctions compliance program serves two functions: it ensures appropriate governance oversight, and it demonstrates to regulators that sanctions compliance has the attention and support of the Company's senior leadership—a factor that OFAC considers favorably in enforcement determinations.

TARGET COMPLETION: November 1, 2023

We understand that the drafting of Version 4.0 is currently underway under Mr. Huang's supervision. Calderwood & Harkness LLP is available to review and comment on the draft policy prior to its adoption.

E. Training. Recommendation E.1: Mandatory Sanctions Compliance Training

We recommend that DTI implement mandatory sanctions compliance training for all DTI trading desk personnel, compliance staff, and senior management. Based on the current organizational structure of DTI's London, Dubai, and Singapore offices, we estimate that approximately 56 individuals fall within the scope of this training requirement.

Recommendation E.2: Training Curriculum

The training curriculum should be comprehensive and tailored to the specific sanctions risks applicable to DTI's business. At minimum, the curriculum should cover the following topics:

(a) An overview of OFAC sanctions programs, with particular emphasis on the RUSSIA-EO14024 program and Executive Order 14024. Given that the apparent violations at issue involve this program, training participants should have a thorough understanding of the scope of the Russia-related sanctions, the categories of persons and entities subject to blocking, and the prohibitions applicable to U.S. persons and non-U.S. persons engaged in transactions with a U.S. nexus.

(b) A detailed explanation of the OFAC 50 Percent Rule (31 C.F.R. § 587.309), which provides that entities owned 50% or more, individually or in the aggregate, by one or more SDN-listed persons are themselves blocked property, regardless of whether the entity appears on the SDN List by name. This rule is directly relevant to the Caspian Star matter: Caspian Star was not listed by name on the SDN List at the time of the transactions at issue, but was blocked by operation of the 50 Percent Rule by virtue of Mr. Kadyrov's ownership interest.

(c) Identification and discussion of red flags for sanctions evasion in commodities trading, including the use of intermediary trading companies, unusual payment routing, transactions involving free trade zones, last-minute changes to vessel names or discharge ports, and other typologies identified in OFAC advisories and enforcement actions.

(d) A focused module on beneficial ownership risks, including the use of nominee shareholders, shell entities, and complex corporate structures to obscure the involvement of sanctioned persons. The Caspian Star / Kadyrov / Mammadov structure should be used as a case study to illustrate how a sanctioned individual's ownership interest may be concealed behind a non-sanctioned nominee.

(e) A review of DTI's internal escalation procedures under the updated Global Sanctions Compliance Policy Version 4.0, including the mandatory escalation protocol for risk flags described in Recommendation D.1(c) above.

(f) An overview of the obligations and benefits of voluntary self-disclosure to OFAC under 31 C.F.R. § 501.806, including the significance of voluntary self-disclosure as a mitigating factor under OFAC's Enforcement Guidelines and the legal requirements for timely and accurate reporting.

Recommendation E.3: Training Provider

Training should be provided by Calderwood & Harkness LLP or, in the alternative, a qualified third-party training provider with demonstrated expertise in U.S. sanctions law and commodities trading compliance. If a third-party provider is engaged, Calderwood & Harkness LLP should review the training materials for accuracy and completeness prior to delivery.

Recommendation E.4: Annual Refresher Training

Following the initial training, DTI should implement annual refresher training for all personnel within the scope of the training requirement. Refresher training should incorporate updates to sanctions programs, enforcement trends, and any changes to DTI's internal policies and procedures.

TARGET COMPLETION: October 31, 2023

We understand that scheduling of the initial training sessions is currently in progress, with sessions planned for DTI's London, Dubai, and Singapore offices during the last two weeks of October 2023.

F. Recordkeeping. Recommendation F.1: Centralized Compliance Recordkeeping System

We recommend that DTI implement a centralized compliance recordkeeping system to maintain all compliance-related documentation in a single, auditable repository. The system should be capable of storing and organizing the following categories of records:

• Counterparty onboarding files, including KYC questionnaires, corporate registry extracts, passport copies or other identification documents, trade references, and beneficial ownership declarations.

• Sanctions screening results, both initial screening at onboarding and all subsequent re-screening events, including negative results (no matches).

• Re-screening logs with date and time stamps reflecting the date of each re-screening event, the screening platform and version used, the lists screened against, and the identity of the analyst who performed or reviewed the screening.

• Escalation records, documenting any instances in which a counterparty was escalated for enhanced review, the basis for the escalation, the analysis performed, and the disposition.

• Training certifications, confirming the completion of mandatory sanctions compliance training by each individual within the scope of the training requirement.

• Correspondence with regulators, including all communications with OFAC (including the VSD filing, any supplemental filings, and OFAC's responses), as well as any communications with the EU or UK OFSI.

Recommendation F.2: Record Retention Period

All records maintained in the centralized system must be retained for a minimum of five (5) years from the date of the last transaction with each counterparty. This retention period is consistent with OFAC's recordkeeping requirements under 31 C.F.R. § 501.601, which requires persons subject to OFAC's jurisdiction to maintain full and accurate records of each transaction subject to the regulations for a period of at least five years.

Recommendation F.3: Audit Trail and Regulatory Access

The recordkeeping system should support comprehensive audit trails, including the ability to track when records were created, modified, or accessed, and by whom. The system must be accessible for regulatory examination, including the ability to produce records in response to OFAC administrative subpoenas or information requests in a timely manner.

TARGET COMPLETION: December 31, 2023

IV. IMPLEMENTATION SUMMARY

The following table summarizes the six categories of recommendations, their target completion dates, and their status as of the date of this memorandum:

V. IMPLEMENTATION TRACKING

To ensure the timely and effective execution of these recommendations, we recommend the following implementation tracking procedures:

We recommend that Derek Huang, as DEH's Chief Compliance Officer, maintain a master implementation tracker documenting the status of each recommendation, key milestones, responsible persons, and any deviations from the target completion dates set forth herein. This tracker should be updated no less frequently than bi-weekly and should be stored in the centralized compliance recordkeeping system once that system is operational.

Monthly status reports should be provided by Mr. Huang to Marcus Whitfield (SVP & General Counsel, DEH) and to Calderwood & Harkness LLP. These monthly reports will serve as the basis for our ongoing assessment of remediation progress and will enable us to provide timely advice on any implementation issues that arise.

Calderwood & Harkness LLP will include a summary of the remediation status in the voluntary self-disclosure filing to OFAC, which is targeted for submission in October 2023. To the extent that remediation milestones are achieved after the initial VSD filing, we will provide supplemental filings to OFAC updating the agency on implementation progress. It is common practice in VSD proceedings for filers to submit one or more supplemental submissions over the course of the review period, and OFAC expects to receive updated information regarding remedial measures as they are completed.

We wish to emphasize that implementation progress will be a key factor cited as a mitigating consideration in OFAC's enforcement determination. Under OFAC's Economic Sanctions Enforcement Guidelines, the nature and effectiveness of a subject's compliance program, including remedial measures taken in response to an apparent violation, are among the most significant factors influencing OFAC's decision regarding the appropriate enforcement response. A demonstrated track record of prompt, thorough, and sustained remediation materially increases the likelihood of a favorable outcome, including the possibility of a cautionary letter or finding of no civil liability in lieu of a civil monetary penalty.

VI. CONCLUSION

The compliance enhancement measures outlined in this memorandum are specifically designed to address the root causes and contributing factors that led to the apparent violations involving the five LSFO sale transactions between DTI and Caspian Star Commodities DMCC. The transactions at issue represent an aggregate value of $4,726,500 across Invoices CS-DTI-0091 through CS-DTI-0115, executed between September 12, 2022 and January 23, 2023. Each of the six categories of recommendations—screening technology upgrades, third-party manual reviews, the appointment of a dedicated Sanctions Compliance Officer, comprehensive policy updates, mandatory training, and enhanced recordkeeping—targets one or more of the specific deficiencies identified during our investigation.

Our overarching goal is to assist DEH and DTI in establishing a best-in-class sanctions compliance program appropriate for an energy trading company with DTI's risk profile. DTI engages in physical crude oil and refined products trading across multiple jurisdictions, including the Gulf of Mexico, West Africa, Southeast Asia, and the United Arab Emirates—regions that present elevated sanctions compliance risks due to the complexity of trade flows, the involvement of intermediary entities, and the presence of sanctioned persons and jurisdictions in proximity to active trading routes. A compliance program calibrated to these risks is essential.

We believe that the enhancements described herein will be viewed favorably by OFAC and will significantly strengthen DEH's position in seeking a favorable resolution of the voluntary self-disclosure. Taking into account the totality of circumstances—including DEH's prompt voluntary self-disclosure, the swift blocking of Caspian Star within three business days of discovery, the significant remedial investments already made, and the comprehensive forward-looking compliance enhancements described in this memorandum—we are cautiously optimistic that OFAC may resolve this matter through the issuance of a cautionary letter or a no-action determination in lieu of the imposition of a civil monetary penalty.

We note that DEH's scale—with approximately $2.14 billion in annual revenue (FY 2022) and approximately 3,800 employees worldwide—necessitates a compliance infrastructure commensurate with the Company's size and geographic footprint. The measures described herein are designed to meet that standard and to reflect the expectations of Grandview Capital Partners LLC, DEH's majority shareholder (holding 68.4% of DEH's equity through Grandview Energy Fund IV, LP), which has communicated its expectation of robust compliance governance across all portfolio companies.

We are available to discuss the recommendations contained in this memorandum in further detail at the recipients' convenience and look forward to supporting DEH and DTI through the completion of the remediation process and the resolution of the VSD proceeding.

CALDERWOOD & HARKNESS LLP

Priya Anand, Partner Tel: (212) 555-0147 panand@calderwoodharkness.com

Leila Nazari, Associate Tel: (212) 555-0193 lnazari@calderwoodharkness.com

400 Park Avenue, 28th Floor New York, NY 10022

This memorandum is a privileged and confidential attorney-client communication and attorney work product. It is intended solely for the use of the individuals to whom it is addressed. Any disclosure, distribution, or copying of this memorandum or any portion thereof without the express prior written consent of Calderwood & Harkness LLP is strictly prohibited.

Recommendation	Description	Target Completion	Status as of September 25, 2023
A. Screening Technology Upgrade	Upgrade to HCS ScreenPro Version 5.0 with Meridian Corporate intelligence data feed integration; implement continuous real-time screening for all active counterparties	August 1, 2023	Implemented (deployed July 28, 2023)
B. Third-Party Manual Review	Engagement of Omnivael Global Advisors LLC for quarterly manual reviews of Elevated Risk and above counterparties	September 15, 2023	Implemented (first quarterly review completed)
C. Dedicated Sanctions Compliance Officer	Hire of Kira Petrossian as dedicated SCO for DTI, London-based, with dual reporting to DTI Managing Director and DEH Chief Compliance Officer	October 15, 2023 (actual start date: October 2, 2023)	In progress (offer accepted; start date confirmed)
D. Policy Updates	Update DTI Global Sanctions Compliance Policy from Version 3.2 to Version 4.0, incorporating quarterly re-screening, mandatory BO re-collection, cross-functional escalation protocol, enhanced documentation requirements, and board-level reporting	November 1, 2023	In drafting
E. Training	Mandatory sanctions compliance training for approximately 56 DTI personnel across London, Dubai, and Singapore offices	October 31, 2023	Scheduling in progress
F. Recordkeeping	Implementation of centralized compliance recordkeeping system with five-year retention, audit trail capability, and regulatory access	December 31, 2023	Planning phase

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP
MEMORANDUM
400 Park Avenue, 28th Floor New York, NY 10022
TO: Marcus Whitfield, Senior Vice President & General Counsel, Dunmore Energy Holdings Ltd. Derek Huang, Chief Compliance Officer, Dunmore Energy Holdings Ltd. Gregor Albrecht, Managing Director, Dunmore Trading International Ltd.
FROM: Priya Anand, Partner, Calderwood & Harkness LLP Leila Nazari, Associate, Calderwood & Harkness LLP
DATE: September 25, 2023
RE: Recommended Sanctions Compliance Enhancements C&H Matter No. 1016-00007
I. PURPOSE
This memorandum sets forth our recommendations for enhancements to the sanctions compliance program of Dunmore Energy Holdings Ltd. ("DEH") and its wholly owned subsidiary, Dunmore Trading International Ltd. ("DTI"), a private company limited by shares registered in England and Wales (Companies House No. 12849371), with its registered address at 25 Finsbury Square, London EC2A 1PQ, United Kingdom. These recommendations are informed by, and should be read in conjunction with, our privileged internal investigation memorandum dated September 18, 2023, which details the facts and circumstances giving rise to the matters addressed herein.
The recommendations contained in this memorandum arise in connection with apparent violations of U.S. sanctions identified during our investigation of five fuel oil sale transactions between DTI and Caspian Star Commodities DMCC ("Caspian Star"), a Dubai-registered entity owned or controlled by Timur R. Kadyrov. Mr. Kadyrov is a Specially Designated National ("SDN") under the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC") SDN List (SDN Entry ID 47218; program RUSSIA-EO14024). Mr. Kadyrov was designated by OFAC on March 18, 2022, pursuant to Executive Order 14024 of April 15, 2021 ("Blocking Property with Respect to Specified Harmful Foreign Activities of the Government of the Russian Federation"). The aggregate transaction value across the five apparent violations totals $4,726,500, corresponding to five invoices numbered CS-DTI-0091 through CS-DTI-0115, executed between September 12, 2022 and January 23, 2023. All payments associated with these transactions were processed as U.S. dollar wire transfers through Ridgeline National Bank, N.A. (Houston, Texas), thereby establishing the requisite U.S. nexus for OFAC jurisdiction.
The specific objectives of the recommendations set forth in this memorandum are threefold:
(a) Address the Root Causes of the Apparent Violations. Our investigation identified three principal root causes that contributed to DTI's continued dealings with Caspian Star following Mr. Kadyrov's designation:
(1) Timing gap between designation and public identification. Mr. Kadyrov was designated as an SDN on March 18, 2022; however, OFAC did not publicly identify Caspian Star Commodities DMCC as a Kadyrov-owned or -controlled entity until the May 12, 2023 SDN supplemental update. During the intervening fourteen-month period, there was no publicly available OFAC guidance expressly linking Caspian Star to Mr. Kadyrov, notwithstanding the fact that the OFAC 50 Percent Rule (discussed further below) rendered Caspian Star a blocked entity as of the date of Mr. Kadyrov's designation to the extent he owned a 50% or greater interest.
(2) Limitations in screening technology. The HCS ScreenPro beneficial ownership data feed, provided by Harborview Compliance Solutions Inc. (2300 Clarendon Boulevard, Suite 700, Arlington, VA 22201), did not incorporate non-public corporate intelligence data that would have identified the link between Mr. Kadyrov and Caspian Star. At both the time of onboarding (Version 4.1.7, July 2021) and the delayed re-screening (Version 4.2.3, October 2022), the HCS ScreenPro system relied solely on corporate registry data that continued to reflect Farid Mammadov as the 100% beneficial owner of Caspian Star.
(3) Delayed annual re-screening cycle. DTI's annual re-screening of Caspian Star was originally scheduled for July 2022 (one year from the July 8, 2021 onboarding date). Due to a compliance staffing vacancy in DTI's London office, this re-screening was not completed until October 2022—a delay of approximately three months. Even when the re-screening was performed, however, it did not generate a match because Caspian Star had not yet been publicly linked to Mr. Kadyrov in any OFAC publication or commercially available database accessible through HCS ScreenPro.
(b) Strengthen the Company's Sanctions Compliance Posture Going Forward. The recommendations herein are designed to build a compliance infrastructure that is resilient not only to the specific failure mode observed in the Caspian Star matter but also to analogous risks that may arise across DEH's and DTI's broader counterparty universe.
(c) Demonstrate to OFAC That DEH Has Taken Comprehensive Remedial Action. Under OFAC's Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, Appendix A), the existence of a "compliance program" at the time of the apparent violation and, critically, the remedial response taken upon discovery, are among the "General Factors" that OFAC considers in determining the appropriate enforcement outcome. Robust remediation is a key mitigating factor that could support a resolution without imposition of a civil monetary penalty. We note that the theoretical base penalty for a non-egregious, voluntarily disclosed case of this magnitude would be approximately $1,181,625, calculated as $4,726,500 (transaction value) multiplied by 25% (the applicable multiplier for non-egregious, voluntarily self-disclosed cases under the Enforcement Guidelines). The implementation of the measures described herein, particularly those already completed or substantially underway as of the date of this memorandum, will materially strengthen DEH's position in seeking a favorable resolution.
These recommendations are being finalized in anticipation of the voluntary self-disclosure ("VSD") to be filed with OFAC pursuant to 31 C.F.R. § 501.806. We are targeting the VSD filing for submission by October 15, 2023, and the remedial measures described in this memorandum will be referenced in that filing as evidence of DEH's and DTI's commitment to sanctions compliance.
II. BACKGROUND
The Caspian Star Counterparty Relationship
Caspian Star Commodities DMCC was onboarded as a DTI counterparty on July 8, 2021, by DTI's London-based compliance team, with support from Ashworth & Kline LLP (10 Aldermanbury, London EC2V 7HR, United Kingdom), DTI's then-outside trade compliance counsel (Lead Partner: Nigel Ashworth). The onboarding was conducted in connection with DTI's anticipated purchase of low-sulfur fuel oil ("LSFO") cargoes for delivery at Fujairah, UAE.
At the time of onboarding, the know-your-customer ("KYC") documentation collected by DTI's compliance team listed Farid Mammadov as the 100% beneficial owner and sole managing director of Caspian Star. Caspian Star was registered as a DMCC Free Zone company with its principal office at Unit 4412, Jumeirah Business Centre 1, Cluster G, Jumeirah Lakes Towers, Dubai, United Arab Emirates. The KYC file included a copy of Mr. Mammadov's Azerbaijani passport, a DMCC trade license, corporate registry extracts, trade references from two counterparties in the Gulf region, and a beneficial ownership declaration signed by Mr. Mammadov and dated July 6, 2021, attesting that he was the sole ultimate beneficial owner of Caspian Star.
Sanctions screening was performed between July 8 and July 12, 2021, using the HCS ScreenPro platform (Version 4.1.7) provided by Harborview Compliance Solutions Inc. Caspian Star and its listed beneficial owner, Mr. Mammadov, were screened against the OFAC SDN List (including the Sectoral Sanctions Identifications List), the EU Consolidated Sanctions List, and the UK Office of Financial Sanctions Implementation ("OFSI") Consolidated List. No matches were returned. Based on the screening results and the completed KYC documentation, Caspian Star was assigned a "Standard Risk" rating under DTI's counterparty risk classification framework.
It is critical to note that Mr. Kadyrov had not yet been designated as an SDN at the time of Caspian Star's onboarding. Mr. Kadyrov's OFAC designation did not occur until March 18, 2022—approximately eight months after the onboarding was completed. There is no indication in the record that DTI's compliance team was aware of, or had any reason to suspect, a connection between Mr. Kadyrov and Caspian Star at the time of onboarding.
Discovery of the Apparent Violations
The pathway to discovery of the sanctions nexus proceeded through the following sequence of events:
• January 30, 2023: Borwick & Thatcher LLP (1 More London Place, London SE1 2AF, United Kingdom), DEH's external auditors, issued their FY 2022 management letter. In that letter, Borwick & Thatcher flagged Caspian Star as a "high-risk counterparty" based on credit risk considerations—specifically, concerns regarding Caspian Star's thin capitalization and concentrated payment profile. The management letter did not reference any sanctions-related concerns.
• March 6, 2023: Derek Huang, DEH's Chief Compliance Officer, initiated an enhanced compliance review of the Caspian Star counterparty file in response to the Borwick & Thatcher credit risk flag. This review was focused on counterparty due diligence and creditworthiness but also included a sanctions screening refresh.
• May 12, 2023: OFAC updated the SDN supplemental information to expressly identify Caspian Star Commodities DMCC as an entity owned or controlled by Timur R. Kadyrov, SDN Entry ID 47218.
• June 2, 2023: During a manual review of OFAC's updated SDN annotations conducted as part of the enhanced compliance review initiated in March, Mr. Huang discovered the SDN link between Caspian Star and Mr. Kadyrov. Mr. Huang reported his findings immediately to Marcus Whitfield, SVP & General Counsel of DEH.
• June 5, 2023: DTI blocked all further dealings with Caspian Star, including the suspension of any pending transactions and the flagging of Caspian Star across all DTI trading and payment systems. This blocking action was taken within three business days of discovery—a response timeline that we believe OFAC will view favorably.
Engagement of Calderwood & Harkness LLP
Calderwood & Harkness LLP was engaged by DEH on August 14, 2023, to conduct a privileged internal investigation into the apparent violations and to advise on remediation and the preparation of a voluntary self-disclosure to OFAC. Our engagement was made on the recommendation of Grandview Capital Partners LLC (600 Lexington Avenue, Suite 2200, New York, NY 10022), the majority equity owner of DEH. Grandview Capital Partners holds a 68.4% ownership interest in DEH through Grandview Energy Fund IV, LP (Managing Partner: Helena Reeves). Grandview's recommendation to engage outside U.S. sanctions counsel reflected the seriousness with which DEH's majority shareholder views the matter and its expectation of prompt, thorough remediation.
For a detailed recitation of the factual findings from our investigation, including a transaction-by-transaction analysis of the five LSFO sale transactions at issue, we respectfully refer the recipients to our privileged internal investigation memorandum dated September 18, 2023, C&H Matter No. 1016-00007.
III. RECOMMENDATIONS
We set forth below six categories of recommended compliance enhancements, each designed to address one or more of the root causes identified in our investigation and to strengthen DEH's and DTI's sanctions compliance posture on a going-forward basis. For each recommendation, we identify the specific deficiency it addresses, the proposed implementation approach, and the target completion date.
A. Screening Technology Upgrade
Recommendation A.1: Upgrade HCS ScreenPro to Version 5.0 or Evaluate Migration to a Competing Platform
We recommend that DTI upgrade its primary sanctions screening platform, HCS ScreenPro, from its current version (Version 4.2.3) to Version 5.0, or, in the alternative, evaluate migration to a competing screening platform that offers equivalent or superior capabilities.
HCS ScreenPro Version 5.0, released by Harborview Compliance Solutions Inc. in the second quarter of 2023, represents a significant advancement over the versions previously used by DTI (Version 4.1.7 at the time of Caspian Star's onboarding in July 2021 and Version 4.2.3 at the time of the October 2022 re-screening). Specifically, Version 5.0 incorporates third-party corporate intelligence data feeds, including data provided by Meridian Corporate intelligence Ltd., a UK-based corporate intelligence firm specializing in beneficial ownership verification and sanctions risk assessment. These data feeds independently verify beneficial ownership structures of screened entities against sanctions lists and other risk databases, providing a substantially richer view of counterparty ownership chains than the corporate registry data alone that was available in prior versions.
Critically, Version 5.0 also provides real-time alerts when ownership structures of screened entities change. This capability directly addresses the specific deficiency that contributed to the apparent violations: HCS ScreenPro's beneficial ownership module, at both Version 4.1.7 (used at onboarding in July 2021) and Version 4.2.3 (used at the October 2022 re-screening), relied solely on corporate registry data that continued to reflect Mr. Mammadov as 100% owner of Caspian Star. Neither version cross-referenced non-public intelligence sources or OFAC supplemental annotations identifying beneficial owners who had not yet been named in publicly available registry documents. Had Version 5.0 been in use, the Meridian Corporate intelligence data feeds may well have identified the Kadyrov–Caspian Star ownership link prior to OFAC's May 2023 supplemental update, given Meridian's independent intelligence collection capabilities.
Should DEH and DTI determine that an alternative platform better meets the Company's needs, we recommend evaluating at least two competing providers and documenting the evaluation process for inclusion in the compliance file. Any replacement platform must, at minimum, offer real-time beneficial ownership monitoring, multi-jurisdictional sanctions list coverage (including OFAC, EU, UK OFSI, and UN), and integration with third-party corporate intelligence data.
Recommendation A.2: Implement Continuous (Real-Time) Screening for All Active Counterparties
In addition to the platform upgrade described in Recommendation A.1, we recommend that DTI implement continuous (real-time) screening for all active counterparties, supplemented by quarterly batch re-screening. Under DTI's prior compliance framework, sanctions re-screening was performed on an annual basis—a cadence that proved insufficient to capture mid-cycle designations such as Mr. Kadyrov's March 18, 2022 designation.
Real-time screening ensures that newly designated persons or entities trigger immediate alerts to DTI's compliance team. This eliminates the risk window that existed between Mr. Kadyrov's March 18, 2022 designation and the delayed October 2022 re-screening—a period of approximately seven months during which DTI continued to transact with Caspian Star without the benefit of updated screening. With continuous screening in place, any new OFAC designation or supplemental annotation would generate an alert within the screening platform's standard processing cycle, which under HCS ScreenPro Version 5.0 is within 24 hours of the relevant OFAC publication.
Quarterly batch re-screening serves as a secondary safeguard, providing a systematic check even in the event of any technical disruption to the real-time screening feed. Together, these two mechanisms substantially narrow the window for undetected changes in the sanctions status of DTI's counterparty universe.
TARGET COMPLETION: August 1, 2023
We note that this recommendation has already been implemented as of the date of this memorandum. HCS ScreenPro Version 5.0, with the Meridian Corporate intelligence data integration and continuous real-time screening enabled, was deployed across DTI's compliance infrastructure on July 28, 2023. We ask that Mr. Huang confirm with Harborview Compliance Solutions Inc. that the migration is fully complete and that continuous screening is operational for all active counterparties in DTI's system.
B. Third-Party Manual Review
Recommendation B.1: Engage an External Sanctions Advisory Firm for Quarterly Manual Reviews
We recommend that DTI engage an external sanctions advisory firm to conduct quarterly manual reviews of all counterparties rated "Elevated Risk" or higher under DTI's counterparty risk classification framework. Automated screening, even with the enhanced capabilities of HCS ScreenPro Version 5.0, is inherently limited by the data available in its underlying databases. A manual review by experienced sanctions compliance professionals provides an independent, human-intelligence layer of review that can identify risks not captured by automated tools.
We recommend Omnivael Global Advisors LLC, an Arlington, Virginia-based firm specializing in sanctions compliance advisory services for energy and commodities companies. Overwatch has extensive experience advising companies with risk profiles similar to DTI's, including companies engaged in physical crude oil and refined products trading in jurisdictions with elevated sanctions exposure. Overwatch's team includes former OFAC enforcement staff, which provides valuable perspective on the types of deficiencies and red flags that OFAC prioritizes in its enforcement actions.
The engagement of an independent external reviewer also serves a demonstrative purpose in the context of the VSD: it signals to OFAC that DEH and DTI are not relying solely on internal resources and automated tools but have committed to an ongoing, independent compliance validation process.
Recommendation B.2: Scope of Each Quarterly Review
Each quarterly review conducted by the external sanctions advisory firm should encompass, at minimum, the following elements:
(a) Independent verification of beneficial ownership structures using non-public corporate intelligence databases, commercial registries in relevant jurisdictions, and adverse media sources. This verification should include a review of ownership chains to identify any direct or indirect ownership by SDN-listed persons or entities, including through nominee shareholders, trust structures, or other arrangements that may obscure beneficial ownership.
(b) Cross-referencing of all reviewed counterparties against the OFAC SDN List (including all supplemental information and a full 50 Percent Rule analysis pursuant to 31 C.F.R. § 587.309), the EU Consolidated Sanctions List, and the UK OFSI Consolidated List. The 50 Percent Rule analysis is particularly important, as the Caspian Star matter illustrates the risk that an entity may be blocked under the 50 Percent Rule even though it does not appear on the SDN List by name.
(c) Adverse media screening focused on sanctions evasion red flags, including reports of involvement in sanctioned trade flows, relationships with sanctioned persons or jurisdictions, and indicators of front company or shell company structures.
(d) Preparation of a written report to DTI's Sanctions Compliance Officer (or, until the SCO position is filled, to the DTI Managing Director and the DEH Chief Compliance Officer) summarizing findings and including specific escalation recommendations for any counterparties identified as presenting elevated sanctions risk.
TARGET COMPLETION: September 15, 2023
We understand that Omnivael Global Advisors LLC has been engaged and that the first quarterly review has been completed as of the date of this memorandum. We recommend that copies of the engagement letter and the initial quarterly review report be maintained in the centralized compliance recordkeeping system described in Recommendation F below.
C. Dedicated Sanctions Compliance Officer
Recommendation C.1: Hire a Dedicated Sanctions Compliance Officer for DTI
We strongly recommend that DTI hire a dedicated Sanctions Compliance Officer ("SCO") to be based in DTI's London office. The SCO should have direct dual reporting lines to both the DTI Managing Director (currently Gregor Albrecht) and the DEH Chief Compliance Officer (currently Derek Huang). This dual reporting structure ensures that the SCO has sufficient authority and access to escalate issues to both the subsidiary's operational leadership and the parent company's compliance function.
This recommendation directly addresses the staffing gap that contributed to the delayed July 2022 re-screening. At the time of the scheduled re-screening, the compliance analyst position responsible for periodic counterparty reviews was vacant due to a resignation. The position was not filled until late September 2022, and the backlog of re-screening work was not cleared until October 2022. The appointment of a dedicated SCO, whose primary responsibility is sanctions compliance, will ensure that sanctions-related tasks are not deprioritized due to competing demands on generalist compliance staff and that institutional knowledge of sanctions requirements is maintained within DTI on a continuous basis.
Recommendation C.2: Minimum Qualifications
The SCO should possess the following minimum qualifications:
• A minimum of seven (7) years' experience in sanctions compliance, preferably with progressive responsibility.
• Specific expertise in the sanctions regimes administered by OFAC, the European Union (including EU Council Regulations implementing restrictive measures), and the United Kingdom's OFSI.
• Demonstrated experience with commodities trading or financial institutions subject to U.S. sanctions jurisdiction, including an understanding of the sanctions risks specific to energy commodity flows.
• CAMS certification (Certified Anti-Money Laundering Specialist, issued by the Association of Certified Anti-Money Laundering Specialists) is preferred, as it reflects a baseline level of competence in financial crime compliance.
• Prior experience at a financial institution or trading house that has been subject to U.S. sanctions jurisdiction, OFAC enforcement proceedings, or regulatory examinations related to sanctions compliance.
Recommendation C.3: Recommended Candidate
Based on our review of available candidates, we recommend Kira Petrossian for the SCO role. Ms. Petrossian most recently served as Deputy Head of Sanctions Compliance at a major international commodities trading house and brings approximately nine years of sanctions compliance experience spanning OFAC, EU, and UK regimes. We understand that Ms. Petrossian has accepted an offer of employment with DTI, with an effective start date of October 2, 2023. We recommend that her appointment be confirmed and referenced in the VSD filing to OFAC.
TARGET COMPLETION: October 15, 2023 (actual hire effective October 2, 2023)
D. Policy Updates
Recommendation D.1: Update DTI's Global Sanctions Compliance Policy to Version 4.0
We recommend that DTI's Global Sanctions Compliance Policy be updated from Version 3.2 (effective January 1, 2022) to a new Version 4.0, incorporating the following substantive changes. Each change is designed to address a specific deficiency identified during our investigation:
(a) Re-Screening Interval: Reduce from Annual to Quarterly.
DTI's Version 3.2 policy required sanctions re-screening of all active counterparties on an annual basis, calculated from the date of initial onboarding. The Caspian Star matter demonstrates that this interval was insufficient. Caspian Star's re-screening was due by July 8, 2022 (one year from its July 8, 2021 onboarding date). Due to the compliance staffing vacancy discussed above, the re-screening was delayed until October 2022. However, even had the re-screening been performed on time in July 2022, it would not have identified the Kadyrov–Caspian Star link because OFAC's public identification of that link did not occur until May 12, 2023.
We recommend that the re-screening interval be reduced to quarterly (i.e., every 90 calendar days). Quarterly re-screening, combined with the continuous real-time screening implemented pursuant to Recommendation A.2, substantially narrows the window during which a change in a counterparty's sanctions status could go undetected. While even quarterly re-screening may not have identified the Caspian Star issue prior to OFAC's May 2023 update, the combination of quarterly re-screening with the enhanced screening technology (Recommendation A.1) and third-party manual reviews (Recommendation B) provides a multi-layered defense that significantly reduces residual risk.
(b) Mandatory Re-Collection of Beneficial Ownership Declarations.
Version 4.0 should require the re-collection of beneficial ownership declarations from all active counterparties at least annually, regardless of whether a change in ownership has been reported by the counterparty. Under Version 3.2, re-collection of beneficial ownership information was triggered only upon a counterparty-reported change in ownership—a passive approach that placed undue reliance on the counterparty's own disclosure. In the Caspian Star matter, the beneficial ownership declaration signed by Mr. Mammadov on July 6, 2021—attesting that he was the sole ultimate beneficial owner of Caspian Star—was never updated, and DTI had no policy mechanism requiring its periodic refresh.
By requiring annual re-collection, DTI will create a regular touchpoint at which counterparties are required to reaffirm or update their beneficial ownership disclosures. Any discrepancies between a counterparty's declaration and information obtained through independent screening or intelligence sources should trigger an immediate escalation for enhanced review.
(c) Mandatory Escalation Protocol for Risk Flags.
Version 4.0 should establish a mandatory escalation protocol under which any counterparty flagged by auditors, compliance analysts, or external advisors for any risk-related reason—including credit risk, reputational risk, or operational risk—must undergo an immediate enhanced sanctions review, regardless of the nature of the initial flag.
This recommendation addresses a specific gap revealed by the timeline of events in the Caspian Star matter. Borwick & Thatcher's January 30, 2023 management letter flagged Caspian Star based on credit risk concerns, not sanctions concerns. Under DTI's then-existing procedures, this credit risk flag was routed to DTI's finance team for creditworthiness assessment but did not automatically trigger a sanctions review. It was not until Mr. Huang initiated an enhanced compliance review on March 6, 2023—approximately five weeks later—that a broader review encompassing sanctions considerations was undertaken. Had the Borwick & Thatcher flag automatically triggered a sanctions review, the discovery timeline might have been accelerated, though we note that the SDN link was not publicly confirmed by OFAC until May 12, 2023 in any event.
The principle underlying this recommendation is that risk signals, whatever their origin, may be indicative of broader compliance concerns. A mandatory cross-functional escalation protocol ensures that no risk flag is siloed within a single function without consideration of its potential sanctions implications.
(d) Documentation Requirements for Screening Results.
Version 4.0 should require that all screening results, including negative results (i.e., results confirming no sanctions matches), be documented with date and time stamps and analyst sign-off. This creates a contemporaneous, auditable record of screening activity that can be produced to regulators upon request.
Under Version 3.2, DTI's practice was to document positive screening matches (i.e., potential hits requiring disposition) but not to systematically retain documentation of negative screening results. As a result, our investigation was unable to confirm the precise date and time of certain historical screening events, and the absence of documented negative results created an evidentiary gap. A comprehensive documentation requirement will eliminate this gap going forward.
(e) Board-Level Reporting.
Version 4.0 should require quarterly sanctions compliance reports to the DEH Board of Directors, summarizing screening activity, escalations, any potential issues identified, and the status of remediation efforts. Board-level visibility into the sanctions compliance program serves two functions: it ensures appropriate governance oversight, and it demonstrates to regulators that sanctions compliance has the attention and support of the Company's senior leadership—a factor that OFAC considers favorably in enforcement determinations.
TARGET COMPLETION: November 1, 2023
We understand that the drafting of Version 4.0 is currently underway under Mr. Huang's supervision. Calderwood & Harkness LLP is available to review and comment on the draft policy prior to its adoption.
E. Training. Recommendation E.1: Mandatory Sanctions Compliance Training
We recommend that DTI implement mandatory sanctions compliance training for all DTI trading desk personnel, compliance staff, and senior management. Based on the current organizational structure of DTI's London, Dubai, and Singapore offices, we estimate that approximately 56 individuals fall within the scope of this training requirement.
Recommendation E.2: Training Curriculum
The training curriculum should be comprehensive and tailored to the specific sanctions risks applicable to DTI's business. At minimum, the curriculum should cover the following topics:
(a) An overview of OFAC sanctions programs, with particular emphasis on the RUSSIA-EO14024 program and Executive Order 14024. Given that the apparent violations at issue involve this program, training participants should have a thorough understanding of the scope of the Russia-related sanctions, the categories of persons and entities subject to blocking, and the prohibitions applicable to U.S. persons and non-U.S. persons engaged in transactions with a U.S. nexus.
(b) A detailed explanation of the OFAC 50 Percent Rule (31 C.F.R. § 587.309), which provides that entities owned 50% or more, individually or in the aggregate, by one or more SDN-listed persons are themselves blocked property, regardless of whether the entity appears on the SDN List by name. This rule is directly relevant to the Caspian Star matter: Caspian Star was not listed by name on the SDN List at the time of the transactions at issue, but was blocked by operation of the 50 Percent Rule by virtue of Mr. Kadyrov's ownership interest.
(c) Identification and discussion of red flags for sanctions evasion in commodities trading, including the use of intermediary trading companies, unusual payment routing, transactions involving free trade zones, last-minute changes to vessel names or discharge ports, and other typologies identified in OFAC advisories and enforcement actions.
(d) A focused module on beneficial ownership risks, including the use of nominee shareholders, shell entities, and complex corporate structures to obscure the involvement of sanctioned persons. The Caspian Star / Kadyrov / Mammadov structure should be used as a case study to illustrate how a sanctioned individual's ownership interest may be concealed behind a non-sanctioned nominee.
(e) A review of DTI's internal escalation procedures under the updated Global Sanctions Compliance Policy Version 4.0, including the mandatory escalation protocol for risk flags described in Recommendation D.1(c) above.
(f) An overview of the obligations and benefits of voluntary self-disclosure to OFAC under 31 C.F.R. § 501.806, including the significance of voluntary self-disclosure as a mitigating factor under OFAC's Enforcement Guidelines and the legal requirements for timely and accurate reporting.
Recommendation E.3: Training Provider
Training should be provided by Calderwood & Harkness LLP or, in the alternative, a qualified third-party training provider with demonstrated expertise in U.S. sanctions law and commodities trading compliance. If a third-party provider is engaged, Calderwood & Harkness LLP should review the training materials for accuracy and completeness prior to delivery.
Recommendation E.4: Annual Refresher Training
Following the initial training, DTI should implement annual refresher training for all personnel within the scope of the training requirement. Refresher training should incorporate updates to sanctions programs, enforcement trends, and any changes to DTI's internal policies and procedures.
TARGET COMPLETION: October 31, 2023
We understand that scheduling of the initial training sessions is currently in progress, with sessions planned for DTI's London, Dubai, and Singapore offices during the last two weeks of October 2023.
F. Recordkeeping. Recommendation F.1: Centralized Compliance Recordkeeping System
We recommend that DTI implement a centralized compliance recordkeeping system to maintain all compliance-related documentation in a single, auditable repository. The system should be capable of storing and organizing the following categories of records:
• Counterparty onboarding files, including KYC questionnaires, corporate registry extracts, passport copies or other identification documents, trade references, and beneficial ownership declarations.
• Sanctions screening results, both initial screening at onboarding and all subsequent re-screening events, including negative results (no matches).
• Re-screening logs with date and time stamps reflecting the date of each re-screening event, the screening platform and version used, the lists screened against, and the identity of the analyst who performed or reviewed the screening.
• Escalation records, documenting any instances in which a counterparty was escalated for enhanced review, the basis for the escalation, the analysis performed, and the disposition.
• Training certifications, confirming the completion of mandatory sanctions compliance training by each individual within the scope of the training requirement.
• Correspondence with regulators, including all communications with OFAC (including the VSD filing, any supplemental filings, and OFAC's responses), as well as any communications with the EU or UK OFSI.
Recommendation F.2: Record Retention Period
All records maintained in the centralized system must be retained for a minimum of five (5) years from the date of the last transaction with each counterparty. This retention period is consistent with OFAC's recordkeeping requirements under 31 C.F.R. § 501.601, which requires persons subject to OFAC's jurisdiction to maintain full and accurate records of each transaction subject to the regulations for a period of at least five years.
Recommendation F.3: Audit Trail and Regulatory Access
The recordkeeping system should support comprehensive audit trails, including the ability to track when records were created, modified, or accessed, and by whom. The system must be accessible for regulatory examination, including the ability to produce records in response to OFAC administrative subpoenas or information requests in a timely manner.
TARGET COMPLETION: December 31, 2023
IV. IMPLEMENTATION SUMMARY
The following table summarizes the six categories of recommendations, their target completion dates, and their status as of the date of this memorandum:
V. IMPLEMENTATION TRACKING
To ensure the timely and effective execution of these recommendations, we recommend the following implementation tracking procedures:
We recommend that Derek Huang, as DEH's Chief Compliance Officer, maintain a master implementation tracker documenting the status of each recommendation, key milestones, responsible persons, and any deviations from the target completion dates set forth herein. This tracker should be updated no less frequently than bi-weekly and should be stored in the centralized compliance recordkeeping system once that system is operational.
Monthly status reports should be provided by Mr. Huang to Marcus Whitfield (SVP & General Counsel, DEH) and to Calderwood & Harkness LLP. These monthly reports will serve as the basis for our ongoing assessment of remediation progress and will enable us to provide timely advice on any implementation issues that arise.
Calderwood & Harkness LLP will include a summary of the remediation status in the voluntary self-disclosure filing to OFAC, which is targeted for submission in October 2023. To the extent that remediation milestones are achieved after the initial VSD filing, we will provide supplemental filings to OFAC updating the agency on implementation progress. It is common practice in VSD proceedings for filers to submit one or more supplemental submissions over the course of the review period, and OFAC expects to receive updated information regarding remedial measures as they are completed.
We wish to emphasize that implementation progress will be a key factor cited as a mitigating consideration in OFAC's enforcement determination. Under OFAC's Economic Sanctions Enforcement Guidelines, the nature and effectiveness of a subject's compliance program, including remedial measures taken in response to an apparent violation, are among the most significant factors influencing OFAC's decision regarding the appropriate enforcement response. A demonstrated track record of prompt, thorough, and sustained remediation materially increases the likelihood of a favorable outcome, including the possibility of a cautionary letter or finding of no civil liability in lieu of a civil monetary penalty.
VI. CONCLUSION
The compliance enhancement measures outlined in this memorandum are specifically designed to address the root causes and contributing factors that led to the apparent violations involving the five LSFO sale transactions between DTI and Caspian Star Commodities DMCC. The transactions at issue represent an aggregate value of $4,726,500 across Invoices CS-DTI-0091 through CS-DTI-0115, executed between September 12, 2022 and January 23, 2023. Each of the six categories of recommendations—screening technology upgrades, third-party manual reviews, the appointment of a dedicated Sanctions Compliance Officer, comprehensive policy updates, mandatory training, and enhanced recordkeeping—targets one or more of the specific deficiencies identified during our investigation.
Our overarching goal is to assist DEH and DTI in establishing a best-in-class sanctions compliance program appropriate for an energy trading company with DTI's risk profile. DTI engages in physical crude oil and refined products trading across multiple jurisdictions, including the Gulf of Mexico, West Africa, Southeast Asia, and the United Arab Emirates—regions that present elevated sanctions compliance risks due to the complexity of trade flows, the involvement of intermediary entities, and the presence of sanctioned persons and jurisdictions in proximity to active trading routes. A compliance program calibrated to these risks is essential.
We believe that the enhancements described herein will be viewed favorably by OFAC and will significantly strengthen DEH's position in seeking a favorable resolution of the voluntary self-disclosure. Taking into account the totality of circumstances—including DEH's prompt voluntary self-disclosure, the swift blocking of Caspian Star within three business days of discovery, the significant remedial investments already made, and the comprehensive forward-looking compliance enhancements described in this memorandum—we are cautiously optimistic that OFAC may resolve this matter through the issuance of a cautionary letter or a no-action determination in lieu of the imposition of a civil monetary penalty.
We note that DEH's scale—with approximately $2.14 billion in annual revenue (FY 2022) and approximately 3,800 employees worldwide—necessitates a compliance infrastructure commensurate with the Company's size and geographic footprint. The measures described herein are designed to meet that standard and to reflect the expectations of Grandview Capital Partners LLC, DEH's majority shareholder (holding 68.4% of DEH's equity through Grandview Energy Fund IV, LP), which has communicated its expectation of robust compliance governance across all portfolio companies.
We are available to discuss the recommendations contained in this memorandum in further detail at the recipients' convenience and look forward to supporting DEH and DTI through the completion of the remediation process and the resolution of the VSD proceeding.
CALDERWOOD & HARKNESS LLP
Priya Anand, Partner Tel: (212) 555-0147 panand@calderwoodharkness.com
Leila Nazari, Associate Tel: (212) 555-0193 lnazari@calderwoodharkness.com
400 Park Avenue, 28th Floor New York, NY 10022
This memorandum is a privileged and confidential attorney-client communication and attorney work product. It is intended solely for the use of the individuals to whom it is addressed. Any disclosure, distribution, or copying of this memorandum or any portion thereof without the express prior written consent of Calderwood & Harkness LLP is strictly prohibited.
Recommendation | Description | Target Completion | Status as of September 25, 2023
A. Screening Technology Upgrade | Upgrade to HCS ScreenPro Version 5.0 with Meridian Corporate intelligence data feed integration; implement continuous real-time screening for all active counterparties | August 1, 2023 | Implemented (deployed July 28, 2023)
B. Third-Party Manual Review | Engagement of Omnivael Global Advisors LLC for quarterly manual reviews of Elevated Risk and above counterparties | September 15, 2023 | Implemented (first quarterly review completed)
C. Dedicated Sanctions Compliance Officer | Hire of Kira Petrossian as dedicated SCO for DTI, London-based, with dual reporting to DTI Managing Director and DEH Chief Compliance Officer | October 15, 2023 (actual start date: October 2, 2023) | In progress (offer accepted; start date confirmed)
D. Policy Updates | Update DTI Global Sanctions Compliance Policy from Version 3.2 to Version 4.0, incorporating quarterly re-screening, mandatory BO re-collection, cross-functional escalation protocol, enhanced documentation requirements, and board-level reporting | November 1, 2023 | In drafting
E. Training | Mandatory sanctions compliance training for approximately 56 DTI personnel across London, Dubai, and Singapore offices | October 31, 2023 | Scheduling in progress
F. Recordkeeping | Implementation of centralized compliance recordkeeping system with five-year retention, audit trail capability, and regulatory access | December 31, 2023 | Planning phase

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP

MEMORANDUM

I. PURPOSE

II. BACKGROUND

III. RECOMMENDATIONS

IV. IMPLEMENTATION SUMMARY

V. IMPLEMENTATION TRACKING

VI. CONCLUSION

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts