PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP White Collar & Investigations Practice Group 1750 Pennsylvania Avenue NW, Suite 800 Washington, DC 20006
MEMORANDUM
TO: Victoria Chambers, Responsible Partner, White Collar & Investigations, Calderwood & Harkness LLP (Washington, D.C.)
FROM: Jasmine Thornton, Lead Associate, White Collar & Investigations, Calderwood & Harkness LLP (Washington, D.C.)
CC: Howard Quinn, Billing Partner, Calderwood & Harkness LLP (New York); Conrad Reeves, Senior Counsel, Export Controls & Sanctions, Calderwood & Harkness LLP (Washington, D.C.); Liam Donahue, Working Associate, Calderwood & Harkness LLP (New York); Nicholas Ferreira, Associate, Calderwood & Harkness LLP (Houston)
DATE: October 1, 2022
RE: Summary of Ridgeline Advisory Group LLC Forensic Analysis — Payment Flows Through Crescent Commercial Bank PJSC (Dubai, UAE) — Dunmore Trading International Ltd.
MATTER NO.: 1016-00009
RIDGELINE ENGAGEMENT NO.: RAG-2022-0319
CLIENT: Dunmore Energy Holdings Ltd.
Right-click to update Table of Contents
I. Executive Summary
This memorandum summarizes the forensic accounting findings of Ridgeline Advisory Group LLC ("Ridgeline") (Engagement No. RAG-2022-0319; engagement lead Dr. Margaret Liu, CPA, CFE) regarding payment flows routed through Crescent Commercial Bank PJSC ("Crescent Bank" or "CCB"), a Dubai-based financial institution located in the Dubai International Financial Centre, in connection with Dunmore Trading International Ltd.'s ("DTI") transactions with counterparties linked to Volkhov Industrial Group JSC ("Volkhov"). Ridgeline was retained by Calderwood & Harkness LLP ("C&H") on May 2, 2022, at the direction of Victoria Chambers, to conduct forensic tracing of suspect transaction flows and to prepare financial analyses supporting the firm's ongoing internal investigation on behalf of our client, Dunmore Energy Holdings Ltd. ("Dunmore" or "DEH").
The core finding of Ridgeline's forensic analysis is as follows: Ridgeline identified approximately $34.2 million in payments across 127 individual wire transfer transactions between March 2020 and March 2022, routed through a series of intermediary accounts at Crescent Commercial Bank PJSC. The payment flows were structured in a manner that appeared designed to obscure the ultimate beneficial ownership of Volkhov-connected entities and to frustrate sanctions screening protocols at both the bank level and the DTI-subsidiary level.
These payments relate to a subset of the 14 crude oil swap transactions (totaling approximately $218.7 million notional) executed between DTI and two Dubai-based counterparties — Petronova Trading FZE ("Petronova") and Zenith Petroleum DMCC ("Zenith Petroleum") — as well as oilfield equipment exports (valued at approximately $12.4 million) facilitated through the German-based freight forwarder and logistics firm Caspian Logistik GmbH ("Caspian Logistik"). Ridgeline's analysis has determined that at least 9 of the 14 swap transactions ($156.3 million notional) involved crude oil that was ultimately sourced from or destined for Volkhov-controlled entities, in potential violation of OFAC Directive 2 under the sectoral sanctions regime established by Executive Order 13662 (Volkhov having been designated under Directive 2 on November 15, 2019) and, subsequently, the full blocking sanctions imposed when Volkhov was added to the Specially Designated Nationals and blocked Persons List ("SDN List") on April 6, 2022, pursuant to Executive Order 14024.
This memorandum is prepared as attorney work product in anticipation of litigation and in furtherance of the legal advice being rendered by Calderwood & Harkness LLP to Dunmore Energy Holdings Ltd. in connection with the Department of Justice ("DOJ") inquiry opened on April 19, 2022. That inquiry is evidenced by Grand Jury Subpoena GJ No. 22-418, issued by the U.S. District Court for the District of Columbia, Grand Jury 22-2, and directed to Dunmore Energy Holdings Ltd. and its subsidiaries. The findings presented herein are integral to the firm's assessment of potential criminal and civil liability exposure and to the cooperation and remediation strategy being implemented in coordination with the DOJ National Security Division and the Office of Foreign Assets Control ("OFAC") of the U.S. Department of the Treasury.
II. Background and Scope of Ridgeline Engagement
A. Retention and Engagement Terms
Ridgeline Advisory Group LLC, a forensic accounting and financial advisory firm headquartered at 1825 Connecticut Avenue NW, Suite 400, Washington, DC 20009, was retained by Calderwood & Harkness LLP on May 2, 2022, at the direction of Victoria Chambers, Responsible Partner for the Dunmore internal investigation. The retention was effected pursuant to a written engagement letter executed on that date, under which Ridgeline was engaged as a consulting expert retained at the direction of counsel for the purpose of providing forensic accounting and financial advisory services in connection with the internal investigation. As a consulting expert retained under the umbrella of the attorney-client relationship, Ridgeline's work product is protected by the attorney work product doctrine and, to the extent it reflects or incorporates legal strategy and analysis, by the attorney-client privilege.
Dr. Margaret Liu, CPA, CFE, a Managing Director at Ridgeline with over twenty years of experience in forensic accounting, financial investigations, and sanctions-related financial analysis, served as the engagement lead. Dr. Liu was supported by a team of five forensic analysts, including specialists in international wire transfer tracing, beneficial ownership analysis, and commodity trading settlement mechanisms. The Ridgeline engagement was assigned internal Engagement No. RAG-2022-0319.
The scope of Ridgeline's engagement encompassed the following workstreams:
(a) Forensic Tracing of Payment Flows: Comprehensive tracing and mapping of payment flows among Dunmore Trading International Ltd., Petronova Trading FZE, Zenith Petroleum DMCC, Caspian Logistik GmbH, and any other entities connected to Volkhov Industrial Group JSC, with particular focus on transactions routed through Crescent Commercial Bank PJSC.
(b) Analysis of Intermediary Account Structures: Identification and analysis of intermediary accounts and entities used as conduits in the payment flows, including assessment of the commercial purpose (or lack thereof) of each intermediary entity and its role in the overall transaction structure.
(c) Identification of Structuring or Layering Patterns: Detection of patterns consistent with transaction structuring, layering, or other techniques designed to evade sanctions screening, compliance monitoring, or regulatory detection, including but not limited to split transactions, circular payment flows, and use of nominee or shell entities.
(d) Preparation of Financial Summaries: Development of schedules, summaries, and demonstrative materials suitable for potential use in proffers to DOJ and in any voluntary self-disclosure to OFAC, including transaction-level detail sufficient to support a comprehensive accounting of the suspect payment flows.
B. Data Sources Analyzed
Ridgeline's forensic analysis drew upon a broad range of data sources, which were collected and produced to Ridgeline under the direction of Calderwood & Harkness LLP. The principal data sources analyzed by Ridgeline are described below:
1. Wire Transfer Records and SWIFT Messages from Crescent Commercial Bank PJSC. Ridgeline obtained and analyzed wire transfer records and SWIFT messages (MT103, MT202, and MT940/MT950 account statements) from Crescent Commercial Bank PJSC (Al Maktoum Tower, DIFC, P.O. Box 335102, Dubai, UAE). The bank records were produced through the designated relationship manager, Khalid Mansour, Vice President — Trade Finance at Crescent Commercial Bank. The records covered the period from January 1, 2019, through April 30, 2022, and included complete transaction details for all DTI accounts held at Crescent Bank, as well as records for certain intermediary accounts produced pursuant to applicable UAE banking disclosure requirements and voluntary cooperation by the bank. The bank records provided the foundational transactional data for the forensic tracing exercise.
2. DTI Internal Accounting Records. Ridgeline reviewed DTI's internal accounting records, including general ledger entries, accounts payable and accounts receivable sub-ledger detail, bank reconciliations, and trade finance documentation maintained by Rajesh Malhotra, Controller of DTI in Dubai. These records were critical to correlating the bank-level wire transfer data with DTI's internal recording of the underlying transactions and to identifying discrepancies between the characterization of transactions in the banking system and in DTI's internal books and records.
3. Invoices, Purchase Orders, and Shipping Documentation. Ridgeline analyzed invoices, purchase orders, bills of lading, certificates of origin, and other shipping and logistics documentation maintained by DTI's trading desk and logistics function, which was overseen by Yves Leclerc, Director of Logistics & Shipping at DTI. These documents were used to assess the commercial substance of the transactions underlying the suspect payment flows and to trace the physical movement of commodities and equipment associated with the financial settlements.
4. Counterparty Bank Account Information. Ridgeline obtained and reviewed bank account information for the principal counterparties, including account opening documentation, signatory cards, and transaction histories, to the extent available. The counterparties for which such information was obtained included:
• Petronova Trading FZE (Office 1407, Al Shafar Tower, Dubai Internet City, Dubai, UAE);
• Zenith Petroleum DMCC (Unit 2201, Jumeirah Bay Tower X2, Cluster X, Jumeirah Lakes Towers, Dubai, UAE); and
• Caspian Logistik GmbH (Mönckebergstraße 22, 20095 Hamburg, Germany).
5. Corporate Registry and Beneficial Ownership Records. Ridgeline obtained and reviewed corporate registry filings, beneficial ownership declarations, and other publicly available corporate records for Petronova Trading FZE (registered with the Jebel Ali Free Zone Authority), Zenith Petroleum DMCC (registered with the DMCC Authority), and Caspian Logistik GmbH (registered with the Hamburg Handelsregister). These records were used to analyze the corporate structures and ownership chains of the counterparties and to identify connections to Volkhov Industrial Group JSC or its principals.
6. Documents from Nexagen Analytics Inc. E-discovery Platform. Ridgeline also reviewed select financial records and communications identified through the e-discovery process managed by Nexagen Analytics Inc. (Project No. NX-DEH-2204; project manager Brian Cavanaugh). The Nexagen platform hosted the full corpus of 2,347,812 documents collected across six jurisdictions as part of the internal investigation. Ridgeline's review focused on documents tagged as responsive during technology-assisted review ("TAR"), particularly those containing financial data, payment instructions, counterparty communications regarding transaction terms, and internal DTI communications relating to payment routing and compliance screening.
C. Time Period Under Review
The primary forensic period for Ridgeline's analysis was March 2020 through March 2022, which corresponds to the period during which the suspect transactions were executed and the associated payment flows occurred. This primary period encompasses the inception of the first flagged crude oil swap transaction in March 2020 through the cessation of payments through the Crescent Bank intermediary network in approximately March 2022, shortly before the April 6, 2022, SDN designation of Volkhov Industrial Group.
In addition, Ridgeline conducted an extended lookback covering the period from January 1, 2019, through April 30, 2022. The extended lookback was designed to capture any pre-period structuring activity — such as the establishment of intermediary accounts, test transactions, or relationship-building payments — that may have predated the commencement of the suspect transaction flows. It was also intended to identify any post-period residual flows, including final settlements, residual margin adjustments, or other transactions that may have occurred after the primary transaction activity ceased. The January 1, 2019, start date for the extended lookback was selected to align with the temporal scope of Grand Jury Subpoena GJ No. 22-418, which requested documents and records from January 1, 2019, forward.
III. Overview of Crescent Commercial Bank PJSC Account Structure
A. Dunmore Trading International Ltd. Accounts
Dunmore Trading International Ltd. maintained multiple accounts at Crescent Commercial Bank PJSC, reflecting DTI's use of the bank as a primary banking partner for its Dubai-based commodity trading operations. DTI held DIFC License No. CL-4827, authorizing it to conduct commodity trading, trade finance, and related commercial activities within the Dubai International Financial Centre.
DTI's account structure at Crescent Bank included the following principal accounts:
(i) Principal Operating Account (USD). DTI maintained a U.S. dollar-denominated operating account at Crescent Bank that served as the primary account for commodity trading settlements, including payments to counterparties for crude oil purchases, receipts from counterparties for crude oil sales, and settlement of swap transaction margin and collateral flows. The vast majority of the 127 suspect wire transfers identified by Ridgeline originated from or were received into this account.
(ii) Letter of Credit / Trade Finance Facility Account. DTI maintained a separate account dedicated to its letter of credit and trade finance facility with Crescent Bank. This facility was used to support DTI's physical commodity trading operations through the issuance of documentary letters of credit and standby letters of credit. While this account was not the primary conduit for the suspect wire transfers, several transactions relating to the oilfield equipment exports involved draw-downs or payments channeled through this facility.
In addition to these accounts, DTI maintained minor operational accounts denominated in UAE dirhams and euros for local operational expenses and payroll. These accounts were not material to the forensic analysis and are not discussed further in this memorandum.
B. Intermediary Accounts Identified
Ridgeline identified a network of at least five intermediary accounts at Crescent Commercial Bank PJSC that were used as conduits between DTI and the ultimate Volkhov-connected beneficiaries. These intermediary accounts were held by the following entities:
(i) Petronova Trading FZE. Petronova maintained at least one U.S. dollar-denominated account at Crescent Bank, which served as the primary receiving and forwarding account in the intermediary payment chain. Petronova was managed by Sergei Volkov, a Russian national and UAE resident who served as Petronova's Managing Director. As discussed in Section IX below, the 50% Rule analysis conducted by Conrad Reeves indicates that Petronova is likely 50% or more owned, directly or indirectly, by Arkady Volkhov or persons connected to Volkhov Industrial Group JSC.
(ii) Zenith Petroleum DMCC. Zenith Petroleum maintained at least one U.S. dollar-denominated account at Crescent Bank. Zenith Petroleum was managed by Farhan Qureshi, a Pakistani national and UAE resident who served as the company's principal officer. Zenith Petroleum was involved both as a direct counterparty in certain crude oil swap transactions and as a secondary layering conduit through which funds were routed in connection with some Petronova-originated flows.
(iii) Two Additional Shell-Type Entities. Ridgeline identified at least two additional entities maintaining accounts at Crescent Bank that were used as intermediary conduits. Based on the available corporate registry information and the pattern of financial flows through these accounts, these entities exhibited the hallmarks of shell companies established for the purpose of facilitating the payment layering structure. Ridgeline's beneficial ownership analysis, while constrained by the limited disclosure requirements of the jurisdictions in which these entities were registered, identified connections between these entities and individuals or entities connected to Volkhov Industrial Group JSC. Volkhov Industrial Group is chaired by Arkady Volkhov and is headquartered at 12 Kutuzovsky Prospekt, Moscow 121248, Russia.
(iv) Unrelated Dubai-Based Trading Firm. One additional account at Crescent Bank was held by a Dubai-based trading firm that did not appear to have any direct corporate or ownership connection to Volkhov Industrial Group. However, this account appeared to serve purely as a pass-through conduit, with funds received into the account being re-transferred to other accounts — typically within one to two business days of receipt — with no apparent independent commercial purpose. The near-immediate re-transfer pattern and the absence of any other significant account activity suggest that this entity was used as an additional layering mechanism to further obscure the ultimate destination of funds.
C. Layering Structure
A critical finding of Ridgeline's forensic analysis is that payments between DTI and Volkhov-connected entities did not flow directly. Instead, funds were systematically routed through one or more intermediary accounts at Crescent Bank before reaching the end beneficiaries. This multi-hop payment routing structure — commonly referred to as "layering" in the context of anti-money laundering and sanctions evasion analysis — created transactional distance between DTI and Volkhov-connected entities and obscured the true counterparties to the underlying commercial transactions.
The typical payment chain identified by Ridgeline operated as follows:
Outbound payments (DTI to Volkhov-connected entities): DTI → Petronova Trading FZE → intermediary entity (shell company or pass-through) → Volkhov-connected entity.
Inbound payments (Volkhov-connected entities to DTI): Volkhov-connected entity → intermediary entity → Petronova Trading FZE → DTI.
In a number of transactions, this basic chain was further extended by the insertion of Zenith Petroleum DMCC as a second-hop intermediary. In these instances, funds would flow from DTI to Petronova, then to Zenith Petroleum, then to a shell intermediary, and finally to the Volkhov-connected end beneficiary — creating a four-layer payment chain with three intermediary hops between DTI and the ultimate counterparty.
Ridgeline's analysis concludes that the layering structure appeared to be designed with the specific purpose of inserting sufficient transactional distance between DTI and Volkhov-connected entities to frustrate sanctions screening and compliance processes. By routing payments through multiple intermediary accounts held by ostensibly unrelated entities, the payment structure ensured that no single wire transfer would identify both DTI and a Volkhov-connected entity as originator and beneficiary, thereby reducing the likelihood that automated sanctions screening tools — whether at the bank level or within DTI's own compliance function — would flag the transactions for further review.
IV. Summary of Payment Flows — Quantitative Findings
A. Aggregate Figures
Ridgeline's forensic tracing analysis identified the following aggregate payment flow data for the suspect transactions routed through Crescent Commercial Bank PJSC:
It is important to note that the $34.2 million figure represents settlement-related payments, margin flows, prepayments, and settlement differentials associated with the larger $218.7 million notional value of the 14 crude oil swap transactions, as well as payments related to oilfield equipment shipments valued at approximately $12.4 million. The $34.2 million does not represent the full economic value of the underlying transactions; rather, it reflects the subset of cash flows that were routed through the Crescent Bank intermediary account network. The balance of the economic activity associated with the swap transactions was settled through separate physical commodity delivery mechanisms and through accounts at other financial institutions not within the scope of this particular forensic analysis.
B. Breakdown by Counterparty
Ridgeline disaggregated the $34.2 million in total payments by counterparty, yielding the following breakdown:
1. Petronova Trading FZE: Approximately $22.6 million across 83 transactions. Petronova served as the primary intermediary in the payment flow structure, processing the largest volume and dollar amount of transactions. Sergei Volkov, Petronova's Managing Director, maintained direct and regular communication with Natasha Sorokin, DTI's Senior Trader, regarding transaction terms, pricing, and — critically — payment instructions and routing. Petronova's role as the primary intermediary is consistent with the documentary evidence reviewed by the investigation team, which indicates that Petronova functioned as the principal front entity through which Volkhov-connected counterparties conducted business with DTI.
2. Zenith Petroleum DMCC: Approximately $7.1 million across 29 transactions. Zenith Petroleum was directly involved as a named counterparty in 2 of the 14 flagged crude oil swap transactions and also served as a secondary layering conduit in certain Petronova-originated payment flows. The dual role of Zenith Petroleum — as both a direct counterparty and an intermediary — added complexity to the payment flow structure and further obscured the relationship between DTI and Volkhov-connected entities. Zenith Petroleum's involvement in the layering structure is notable because its managing officer, Farhan Qureshi, does not appear to have had any prior or independent commercial relationship with Volkhov Industrial Group, suggesting that Zenith Petroleum may have been recruited as a cooperative intermediary specifically for the purpose of facilitating the payment layering.
3. Caspian Logistik GmbH: Approximately $4.5 million across 15 transactions. These payments were associated with logistics, shipping, and freight forwarding fees for oilfield equipment exports and were distinct in character from the crude oil swap-related payment flows. The Caspian Logistik payments are discussed in greater detail in Section VII below.
4. Reconciliation: The counterparty-level figures reconcile to the aggregate totals: $22.6 million + $7.1 million + $4.5 million = $34.2 million; 83 + 29 + 15 = 127 transactions.
C. Breakdown by Time Period
Ridgeline's temporal analysis of the payment flows reveals a clear escalation pattern over the two-year primary forensic period, with transaction activity building steadily before ceasing abruptly in early 2022:
1. March 2020 – December 2020: Approximately $8.4 million across 31 transactions. Payment activity commenced at a modest level, with the initial transactions in March and April 2020 appearing to relate to the establishment of the trading relationship and the execution of the first one or two swap transactions. Activity increased notably in the third and fourth quarters of 2020, as additional swap transactions were initiated and settlement volumes grew. The average monthly transaction volume during this period was approximately $840,000.
2. January 2021 – December 2021: Approximately $19.3 million across 72 transactions. This twelve-month period represented the peak of activity in the payment flow structure. The majority of the crude oil swap transactions were executed during calendar year 2021, and the corresponding settlement, margin, and prepayment flows drove a significant increase in both the number and aggregate value of wire transfers. The average monthly transaction volume during this period was approximately $1.6 million, roughly double the rate observed in the initial period. Transaction frequency also increased markedly, with an average of six transactions per month compared to approximately three per month in the prior period.
3. January 2022 – March 2022: Approximately $6.5 million across 24 transactions. Transaction activity continued at an elevated pace in the first quarter of 2022 but came to an abrupt halt in March 2022. The cessation of activity predates the April 6, 2022, SDN designation of Volkhov Industrial Group JSC by approximately one to two weeks, which may suggest that DTI personnel or the intermediary entities received advance indication that heightened regulatory scrutiny or designation action was imminent. This timing is the subject of ongoing investigation and is addressed in related memoranda concerning the knowledge and intent of individual actors.
Note on post-SDN designation: No payments through the Crescent Commercial Bank intermediary structure were identified after March 2022. Ridgeline's analysis of the extended lookback period through April 30, 2022, confirmed that no further transactions matching the identified payment patterns occurred after the cessation in March 2022. The April 6, 2022, SDN listing appears to have prompted — or at least coincided with — the complete cessation of the payment pattern through this particular channel.
D. Correlation to the 9 Tainted Crude Oil Swap Transactions
Ridgeline performed a detailed correlation analysis to match the 127 individual payment flows to the specific underlying commercial transactions. Of the $34.2 million total, Ridgeline attributed approximately $26.8 million to the 9 tainted crude oil swap transactions (notional value $156.3 million) that have been specifically identified as involving Volkhov-connected entities as ultimate counterparties. These 9 transactions form the core of the potential sanctions violations identified in the investigation.
The remaining approximately $7.4 million relates to the 5 non-tainted swap transactions and to the oilfield equipment shipment payments routed through Caspian Logistik GmbH. However, Ridgeline noted — and we concur — that even these residual payment flows present sanctions compliance concerns, given that they were routed through the same intermediary account structure at Crescent Bank and utilized the same counterparties (particularly Petronova Trading FZE) that have been identified as Volkhov-connected. The use of the intermediary structure for these transactions raises the question whether the non-tainted transactions were intentionally commingled with the tainted transactions to provide commercial cover and to obscure the true nature of the payment flows.
The settlement flows attributable to the 9 tainted transactions consisted of margin payments, prepayments against future deliveries, and settlement differentials arising from the swap contracts. These flows did not represent the full notional value of the swap transactions, which was realized through separate physical commodity settlement mechanisms — including delivery of crude oil cargoes, title transfers, and payments through other banking channels — that are being analyzed separately.
V. Structuring Indicators and Red Flags
Ridgeline's forensic analysis identified multiple indicators of deliberate structuring and layering within the payment flows. These indicators, when considered individually and collectively, are consistent with a deliberate effort to design and execute a payment infrastructure intended to evade sanctions compliance controls. The principal structuring indicators are summarized below.
A. Transaction Splitting / Structuring Patterns
Ridgeline identified a recurring pattern of multiple wire transfers executed on the same date or within a two-to-three-day window, directed to or from the same intermediary entity, with individual amounts that appeared to be calibrated to remain below internal compliance review thresholds at both Crescent Bank and DTI.
Specifically, Ridgeline identified 14 instances of same-day multiple transfers to Petronova Trading FZE in which individual transfer amounts were each below $250,000 but which, in the aggregate, exceeded $500,000. This pattern is significant because DTI's internal compliance procedures — as documented in the DTI Operations Manual (Rev. 3, dated January 2020) — required enhanced compliance review for individual wire transfers exceeding $250,000 to counterparties classified as "Category B" (elevated risk). By splitting what would otherwise be a single large payment into multiple smaller payments, each below the $250,000 enhanced review threshold, the payment structure effectively bypassed DTI's own compliance controls.
In addition, Ridgeline noted the use of differing reference numbers and invoice descriptions for wire transfers that appeared to be components of a single underlying settlement. For example, on June 14, 2021, three wire transfers totaling $734,000 were directed from DTI to Petronova, each bearing a different invoice reference number and a different generic payment description, despite the fact that all three payments related to the same crude oil swap settlement. This practice of using varied reference numbers for components of a single settlement is inconsistent with standard commercial practice and is indicative of intentional obfuscation.
B. Circular Payment Flows
In at least 7 instances, Ridgeline identified circular payment flows in which funds moved from DTI to Petronova Trading FZE, then to a second intermediary entity, and then partially returned to a different DTI account at Crescent Commercial Bank within a period of 5 to 10 business days. These circular flows totaled approximately $3.8 million over the forensic period.
The circular nature of these flows is a significant red flag. In a legitimate commercial transaction, funds flow from a buyer to a seller in exchange for goods or services, and there is no expectation that the funds will return to the originator absent a refund, credit adjustment, or separate countervailing transaction. The circular flows identified by Ridgeline did not correspond to any documented refund, credit adjustment, or legitimate commercial reason for the return of funds. Instead, the circular flows appeared designed to create the appearance of arms-length commercial transactions — complete with invoices, payment references, and seemingly independent counterparties — where the economic substance was unclear or nonexistent.
Ridgeline noted that the circular flows may have served one or more of the following purposes: (i) providing an apparent commercial justification for payments to intermediary entities, thereby supporting their appearance as legitimate trading counterparties; (ii) generating transaction volume and revenue for intermediary entities to support their ongoing viability as apparently active commercial enterprises; and (iii) facilitating the commingling of tainted and non-tainted funds within the intermediary account structure.
C. Inconsistent or Vague Payment Descriptions
Ridgeline conducted a systematic analysis of the payment descriptions (SWIFT Field 70 and Field 72 remittance information) associated with the 127 suspect wire transfers. This analysis revealed that wire transfer descriptions in the suspect payment flows frequently used generic and vague terms such as "trade settlement," "commodity payment," "services fee," "consulting fee — Q3 2021," or "logistics support," without identifying the underlying transaction, contract number, cargo reference, or specific commodity involved.
This practice was strikingly inconsistent with DTI's payment practices for non-suspect counterparties during the same period. Ridgeline performed a control comparison of payment descriptions for DTI's wire transfers to counterparties that were not connected to the suspect payment flows and found that DTI's payments to non-suspect counterparties consistently included specific contract numbers (e.g., "DTI-Swap-2021-0472"), cargo references (e.g., "M/V Nordic Star, B/L No. NSBL-21-0814"), and commodity type identifications. The departure from this standard practice in the suspect payment flows reinforces the inference that the vague payment descriptions were deliberately chosen to minimize the information available to compliance personnel reviewing the transactions.
D. Nominee / Pass-Through Entity Indicators
At least two of the intermediary accounts identified by Ridgeline exhibited characteristics strongly consistent with nominee or pass-through entities established for the specific purpose of facilitating the payment layering structure. The indicators identified by Ridgeline include:
(i) Minimal capitalization: Both entities were capitalized at levels far below what would be expected for entities engaged in the volume and value of commodity trading activity reflected in the account flows.
(ii) No apparent independent business operations: Neither entity maintained a website, employed any identified staff beyond a single registered agent, or appeared to conduct any commercial activity other than the receipt and forwarding of funds through its Crescent Bank account.
(iii) Near-immediate forwarding of received funds: Both entities exhibited a pattern of forwarding received funds — typically within one to three business days of receipt — to other accounts, with minimal retention of funds and no apparent accumulation of working capital.
(iv) Registration in free zone jurisdictions with limited beneficial ownership disclosure: Both entities were registered in UAE free zone jurisdictions that, during the relevant period, imposed limited beneficial ownership disclosure requirements, making it difficult to identify the ultimate beneficial owners through publicly available registry information.
Ridgeline was unable to identify the ultimate beneficial owners of these two entities through publicly available corporate registry records. However, the 50% Rule analysis conducted by Conrad Reeves (set forth in the Memo re: Volkhov Designation History and 50% Rule Analysis, dated June 20, 2022) concluded that Petronova Trading FZE itself is likely 50% or more owned by Arkady Volkhov or by persons connected to Volkhov Industrial Group JSC. If this ownership analysis is correct, then under OFAC's 50% Rule, transactions with Petronova would be treated as transactions with Volkhov Industrial Group itself for sanctions compliance purposes, regardless of whether Petronova is separately designated.
E. Communication Evidence Corroborating Structuring
The structuring patterns identified through Ridgeline's quantitative forensic analysis are corroborated by documentary evidence identified during the document review process managed by Nexagen Analytics Inc. Specifically, the document review team identified communications between key individuals that explicitly reference the payment routing structure and the rationale for using intermediary accounts.
Communications between Natasha Sorokin (DTI Senior Trader) and Sergei Volkov (Petronova Managing Director), exchanged via encrypted messaging platforms and personal email accounts, include discussions of payment routing and the use of intermediary accounts. These communications contain references to avoiding "direct exposure" to Volkhov-connected entities and to the importance of "keeping layers" between DTI and the ultimate counterparties. The language in these communications is significant because it suggests an awareness on the part of both Sorokin and Volkov that direct transactional links between DTI and Volkhov-connected entities would create sanctions compliance risk, and a deliberate decision to structure payments through intermediaries to mitigate that risk.
Additional communications between Derek Hargrave (whose precise role and title within the DTI/Dunmore organization during the relevant period is the subject of ongoing factual development) and Sergei Volkov indicate that Hargrave was aware of and may have directed the use of intermediary payment routing. These communications reference the need to ensure that payments were "clean" and did not create a direct paper trail to Volkhov-connected entities.
The substance and significance of these communications are analyzed in detail in separate memoranda prepared by the investigation team. The reader is referred to the following memoranda for comprehensive treatment of the communication evidence:
• Memo re: Natasha Sorokin — Trading Activity Analysis (September 10, 2022, by Liam Donahue); and
• Memo re: Derek Hargrave — Role in Suspect Transactions (September 1, 2022, by Jasmine Thornton).
VI. Analysis of Rajesh Malhotra's Role
Rajesh Malhotra served as the Controller of Dunmore Trading International Ltd. in Dubai throughout the relevant period. In that capacity, Malhotra was responsible for the finance function at DTI, including the initiation, review, and approval of wire transfer instructions submitted to Crescent Commercial Bank PJSC for execution. Malhotra's role placed him at a critical juncture in the payment flow process: as the individual responsible for authorizing outgoing wire transfers, he was the last internal checkpoint within DTI before payments entered the Crescent Bank processing system.
Ridgeline's analysis shows that Malhotra personally authorized 94 of the 127 wire transfers identified in the forensic analysis, representing approximately 74% of all suspect transactions. The remaining 33 transactions were authorized by Malhotra's deputy or, in a small number of instances, by other members of the DTI finance team during periods when Malhotra was traveling or on leave. The high concentration of authorization activity with Malhotra is notable and raises questions regarding his knowledge of and involvement in the payment structuring described in Section V above.
Malhotra's knowledge of and involvement in the payment structuring is the subject of a separate, detailed memorandum: Memo re: Rajesh Malhotra — Controller's Knowledge of Payment Structuring (October 20, 2022, by Nicholas Ferreira). That memorandum addresses, among other things, the scope of Malhotra's communications with DTI's trading desk personnel regarding payment routing, his awareness of the intermediary account structure, and his failure to escalate red flags to DTI's compliance function or to Dunmore's corporate compliance organization.
In the context of this payment flow analysis, Ridgeline noted one additional finding of significance regarding Malhotra's role. Certain wire transfer instructions reviewed by Ridgeline bore handwritten annotations by Malhotra indicating "per DH" (believed to refer to Derek Hargrave) or "per NS" (believed to refer to Natasha Sorokin). These annotations appeared on the physical wire transfer instruction forms that were submitted to Crescent Bank and suggest that the payment routing reflected in those instructions — including the selection of intermediary accounts and the structuring of payment amounts — was directed by the trading desk rather than originating independently from the finance function. If this interpretation is correct, it supports the inference that Malhotra was acting at the direction of Hargrave and Sorokin in processing the suspect wire transfers, and that the payment structuring was driven by the commercial side of DTI's operations rather than by the finance and accounting function.
This finding has implications both for the allocation of individual culpability among DTI personnel and for the assessment of Dunmore's internal controls framework, as it suggests that the finance function's role in the payment process was reduced to a largely ministerial function, with the trading desk exercising effective control over payment routing decisions.
VII. Relationship to Oilfield Equipment Export Payments
Of the 127 transactions identified in Ridgeline's forensic analysis, 15 transactions totaling approximately $4.5 million related to payments made to Caspian Logistik GmbH for logistics, shipping, and freight forwarding fees. These payments were associated with the export of oilfield drilling equipment and components classified under Export Control Classification Numbers ECCN 2B350 and ECCN 2B999, with a total declared value of approximately $12.4 million. Caspian Logistik GmbH, managed by Klaus Weidemann, served as the freight forwarder and logistics coordinator for these shipments, which were routed from various origination points to end users in Russia.
Unlike the crude oil swap-related payment flows, which consistently utilized the multi-hop layering structure described in Section III.C above, the majority of the Caspian Logistik payments were direct transfers from DTI's Crescent Bank account to Caspian Logistik's account at Crescent Bank — that is, without the interposition of intermediary entities. This more straightforward payment routing is consistent with the commercial character of the underlying transactions, which involved documented logistics services with identifiable counterparties and deliverables.
However, Ridgeline identified an important exception to this pattern. Three of the 15 payments to Caspian Logistik, totaling approximately $1.2 million, were first routed through Petronova Trading FZE's Crescent Bank account before being forwarded to Caspian Logistik's account. There was no apparent commercial justification for this routing; Petronova had no documented role in the oilfield equipment logistics chain, and the interposition of Petronova as an intermediary for these specific payments suggests some degree of commingling of the oilfield equipment payment stream with the crude oil swap-related payment flows. This commingling may have served to obscure the source or purpose of the funds, or may reflect the use of Petronova as a general-purpose intermediary across multiple transaction types involving Volkhov-connected activities.
The export control implications of the oilfield equipment shipments — including analysis of whether the shipments required export licenses under EAR § 746.5 and whether the applicable ECCN classifications were properly applied — are analyzed in separate memoranda to which the reader is referred:
• Memo re: Export Control Analysis — EAR § 746.5 and ECCN Classifications (May 5, 2022, by Conrad Reeves); and
• Memo re: Caspian Logistik GmbH — Export Shipment Analysis (July 20, 2022, by Liam Donahue).
VIII. Compliance Program Deficiencies Revealed by Payment Flow Analysis
The payment flow analysis conducted by Ridgeline has highlighted several significant deficiencies in Dunmore's pre-existing sanctions compliance program as it related to the operations of DTI in Dubai. These deficiencies are assessed in full in a separate memorandum — Memo re: Assessment of Dunmore's Pre-Existing Sanctions Compliance Program (November 15, 2022, by Conrad Reeves and Jasmine Thornton) — but are summarized here to the extent they are directly illuminated by the forensic payment flow findings.
Inadequate OFAC Screening of Payment Counterparties. The payment flow analysis reveals that neither Crescent Commercial Bank PJSC's compliance function nor DTI's internal compliance screening identified Petronova Trading FZE, Zenith Petroleum DMCC, or the pass-through intermediary entities as sanctions-connected during the relevant period. Crescent Bank did not flag any of the 127 suspect wire transfers for enhanced review based on sanctions screening concerns. Similarly, DTI's own OFAC screening program — which was managed by Gerald Fisk, DTI's then-Chief Compliance Officer, based in the Houston office — did not extend beyond the immediate, named counterparty on each wire transfer to examine secondary or tertiary payment recipients. As a result, the layering structure described in Section III.C above effectively defeated the screening process: because no single wire transfer identified both DTI and a designated or Volkhov-connected entity, the sanctions screens produced no hits.
No Automated Monitoring for Structuring Patterns. DTI lacked automated transaction monitoring tools that could have detected the structuring patterns identified by Ridgeline, including split-payment patterns, circular payment flows, unusual payment routing through intermediary accounts, and anomalous concentration of payments to specific counterparties over defined time periods. While DTI maintained basic OFAC screening capabilities (through a commercially available sanctions list screening tool), it did not employ any form of behavioral analytics, transaction pattern analysis, or anomaly detection that might have identified the suspicious activity described in Section V above.
Absence of Enhanced Due Diligence on Dubai-Based Counterparties. Despite operating in a jurisdiction widely recognized as presenting elevated risk for sanctions evasion, trade-based money laundering, and the use of shell and front companies, DTI did not conduct enhanced beneficial ownership verification on Petronova Trading FZE, Zenith Petroleum DMCC, or the intermediary entities identified in the forensic analysis. DTI's counterparty onboarding procedures required only basic "know your customer" documentation — including corporate registration certificates, trade licenses, and authorized signatory identification — but did not require beneficial ownership declarations, independent verification of ownership through corporate registry searches, or enhanced due diligence reviews for counterparties connected to sanctioned jurisdictions or industries.
Failure of Gerald Fisk (Former CCO) to Escalate Red Flags. The forensic analysis has brought into sharp relief the failure of Gerald Fisk, who served as DTI's Chief Compliance Officer from January 2019 through his departure in May 2022, to identify and escalate the red flags associated with DTI's payment flows through Crescent Bank. Despite having nominal responsibility for DTI's sanctions compliance program, Fisk did not implement a transaction monitoring framework for the Dubai trading desk until after the April 6, 2022, SDN designation of Volkhov Industrial Group, at which point the suspect transaction activity had already ceased. Fisk's compliance failures — including his failure to conduct risk-appropriate counterparty due diligence, his failure to monitor transaction patterns for structuring indicators, and his failure to escalate concerns raised by members of the DTI finance team — are analyzed in detail in the Memo re: Gerald Fisk — Compliance Failures (August 15, 2022, by Nicholas Ferreira).
The compliance deficiencies identified through the payment flow analysis are directly relevant to the remediation workstream and to the assessment of mitigating and aggravating factors in any enforcement proceeding. OFAC's Economic Sanctions Enforcement Guidelines and the DOJ's Corporate Enforcement Policy both emphasize the quality of a company's compliance program as a factor in determining the appropriate resolution of sanctions violations. The deficiencies documented here — and in the comprehensive compliance assessment memorandum — will need to be acknowledged and addressed in any proffer, voluntary self-disclosure, or settlement discussion.
IX. Relevance to Sanctions Violations Analysis
A. OFAC Directive 2 (Sectoral Sanctions — E.O. 13662)
Volkhov Industrial Group JSC was designated under OFAC Directive 2 of Executive Order 13662 on November 15, 2019. Directive 2 prohibited U.S. persons from dealing in, providing financing for, or otherwise facilitating transactions involving new debt with a maturity of greater than 90 days (subsequently reduced to 60 days and then to 30 days by subsequent amendments) for entities identified as operating in the energy sector of the Russian Federation economy. While Directive 2 did not impose a comprehensive asset freeze or transaction prohibition, it restricted the types of financial dealings that U.S. persons could have with designated entities, including Volkhov.
The payment structuring through intermediaries identified in Ridgeline's analysis may have been designed specifically to circumvent the Directive 2 restrictions by interposing non-designated entities — Petronova Trading FZE, Zenith Petroleum DMCC, and the shell intermediaries — between DTI and Volkhov Industrial Group. By routing transactions through these intermediary entities, the architects of the payment structure created the appearance that DTI was transacting with unrelated, non-designated Dubai-based commodity trading firms rather than with a Directive 2-designated Russian energy sector entity.
Critically, to the extent that Petronova Trading FZE is 50% or more owned, directly or indirectly, by Volkhov Industrial Group JSC or by Arkady Volkhov personally, transactions with Petronova would be treated as transactions with Volkhov itself for OFAC compliance purposes, pursuant to OFAC's 50% Rule (31 C.F.R. § 544.311 and OFAC Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are blocked, dated August 13, 2014). The 50% Rule analysis conducted by Conrad Reeves, as set forth in the Memo re: Volkhov Designation History and 50% Rule Analysis (June 20, 2022), concludes that the available evidence — including corporate registry records, financial flow analysis, and communications between Sergei Volkov and Arkady Volkhov — supports a finding that Petronova is likely 50% or more owned by Volkhov-connected persons. If this finding is sustained, then the entirety of the Petronova payment flows ($22.6 million across 83 transactions) would constitute potential violations of the Directive 2 restrictions, regardless of whether Petronova itself was separately designated.
B. Full SDN blocking (E.O. 14024)
On April 6, 2022, Volkhov Industrial Group JSC was added to the SDN List pursuant to Executive Order 14024, which imposed comprehensive blocking sanctions on certain Russian entities and individuals in response to Russia's invasion of Ukraine. The SDN designation required the blocking of all property and interests in property of Volkhov Industrial Group that were in the United States or in the possession or control of U.S. persons, and prohibited U.S. persons from engaging in any transactions with or for the benefit of Volkhov.
As detailed in Section IV.C above, Ridgeline's forensic analysis shows that no payments through the Crescent Bank intermediary network occurred after March 2022, predating the April 6, 2022, SDN listing by approximately one to two weeks. However, transactions in the immediately preceding months — January through March 2022, totaling approximately $6.5 million across 24 transactions — may still implicate E.O. 14024 obligations to the extent that pre-designation conduct furthered ongoing contractual relationships with Volkhov or facilitated the economic benefit of Volkhov-connected entities in ways that are subject to the blocking requirements. Additionally, any property or interests in property of Volkhov that remained within the Crescent Bank account structure as of the April 6, 2022, designation date would have been subject to blocking obligations.
C. IEEPA Criminal Liability
The payment structuring pattern identified by Ridgeline, when combined with the communications evidence suggesting intent on the part of DTI personnel to obscure Volkhov's involvement in the underlying transactions, raises potential criminal liability under the International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. §§ 1701–1706. IEEPA provides for criminal penalties — including fines of up to $1 million and imprisonment of up to 20 years for individuals — for willful violations of executive orders issued under IEEPA authority, including the sanctions programs established by E.O. 13662 and E.O. 14024.
The key element distinguishing a criminal IEEPA violation from a civil enforcement action is willfulness — that is, a voluntary, intentional violation of a known legal duty. The evidence assembled to date, including the structuring patterns documented by Ridgeline and the communications evidence discussed in Section V.E above, provides a substantial evidentiary basis for concluding that at least certain DTI personnel acted with knowledge that their conduct violated, or was designed to evade, applicable sanctions restrictions. This evidence of willfulness is central to the criminal exposure analysis and to the cooperation and remediation strategy being pursued with the DOJ National Security Division.
The forensic payment flow analysis and its implications for the willfulness determination were presented to AUSA Meredith Calloway (DOJ National Security Division) in the initial proffer on July 15, 2022, and supplemented with additional findings in the supplemental proffer of November 20, 2022. The cooperation strategy, including the scope of information shared in the proffer sessions, is coordinated through Victoria Chambers as Responsible Partner.
X. Disgorgement Implications
The payment flow analysis conducted by Ridgeline directly informs the voluntary disgorgement calculation that is a component of the remediation strategy being implemented in connection with the DOJ and OFAC proceedings. Voluntary disgorgement of profits derived from sanctions-violating transactions is a recognized mitigating factor under both the DOJ Corporate Enforcement Policy and OFAC's Economic Sanctions Enforcement Guidelines, and is being pursued as an element of Dunmore's cooperation and remediation strategy.
The disgorgement calculation is based on the net profits derived from the 9 tainted crude oil swap transactions identified as involving Volkhov-connected entities. Ridgeline estimated the net profits from these transactions as follows:
The 5.6% net margin estimate was derived by Ridgeline from an analysis of DTI's trading desk profitability data for comparable crude oil swap transactions during the relevant period, adjusted for the specific commercial terms and pricing of the 9 tainted transactions. This margin figure accounts for commodity price risk, hedging costs, counterparty credit risk adjustments, and operational overhead allocable to the trading desk.
The $34.2 million payment flow through Crescent Commercial Bank represents the settlement mechanism through which a portion of these profits were realized. While the payment flows themselves exceed the net profit figure — because they include gross settlement amounts, margin flows, and prepayments, not merely net profits — the payment flow analysis is essential to tracing the economic benefit derived by DTI from the tainted transactions and to demonstrating the mechanism through which that benefit was realized.
The disgorgement calculation is further detailed in the separate Voluntary Disgorgement Calculation Worksheet prepared by this author in consultation with Dr. Margaret Liu of Ridgeline Advisory Group. That worksheet includes a transaction-by-transaction analysis of margins, costs, and net profits for each of the 9 tainted swap transactions.
Dunmore made a voluntary disgorgement payment of $8.75 million to the U.S. Treasury on November 30, 2023, in connection with the resolution of the investigation.
XI. Coordination with Dunmore's Outside Auditors
As part of the internal investigation, Ridgeline coordinated with Ashford & Whitmore LLP (engagement partner Kenneth Ashford), which serves as the independent outside auditor for Dunmore Energy Holdings Ltd. and its subsidiaries, including DTI. The coordination focused on the adequacy of internal controls over trade finance transactions at the DTI subsidiary level and on the implications of the forensic findings for Ashford & Whitmore's assessment of internal controls over financial reporting.
Ashford & Whitmore confirmed that the intermediary payment flows identified by Ridgeline were not flagged during the firm's audit of Dunmore Energy Holdings Ltd.'s financial statements for the fiscal year ended December 31, 2021 (FY 2021 revenue: $4.87 billion). The failure to identify the suspect payment flows during the audit process raises questions regarding the sufficiency of the audit procedures performed with respect to DTI's trade finance and treasury activities, including the extent to which Ashford & Whitmore tested the operating effectiveness of internal controls over wire transfer authorization, counterparty verification, and sanctions compliance screening at the subsidiary level.
This finding has been communicated to Sandra Whitfield, Chief Financial Officer of Dunmore Energy Holdings Ltd., and is being addressed as part of the broader remediation workstream. The remediation effort includes enhancements to internal controls over trade finance transactions at DTI, improvements to the subsidiary-level compliance infrastructure, and augmented audit committee reporting on sanctions compliance and transaction monitoring. Ashford & Whitmore has been engaged to perform additional procedures with respect to the DTI subsidiary's internal controls and is expected to issue a supplemental management letter addressing the control deficiencies identified in the investigation.
XII. Recommendations and Next Steps
Based on the forensic payment flow analysis summarized in this memorandum, I recommend the following actions:
1. Integration into Internal Investigation Report. The forensic findings of Ridgeline Advisory Group should be incorporated into the comprehensive internal investigation report being prepared by Calderwood & Harkness for submission to the Department of Justice. The report should include a detailed narrative of the payment flow structure, the quantitative findings, the structuring indicators, and the correlation to the underlying suspect transactions. The comprehensive internal investigation report was ultimately submitted to DOJ as a 176-page report on May 15, 2023.
2. Supplemental Proffer to DOJ. I recommend that the payment flow findings presented in this memorandum be included in the supplemental proffer to AUSA Meredith Calloway of the DOJ National Security Division. The payment structuring evidence is among the most compelling evidence of intent and willfulness identified in the investigation to date, and its disclosure in the proffer context demonstrates the depth and good faith of Dunmore's cooperation. The supplemental proffer incorporating these findings was subsequently submitted on November 20, 2022.
3. OFAC Voluntary Self-Disclosure. The payment structuring evidence should be disclosed in full in the voluntary self-disclosure ("VSD") to OFAC. Failure to disclose known structuring activity in a VSD could undermine the mitigating-factor credit that OFAC affords to entities that submit initial, timely, and complete voluntary self-disclosures. The structuring evidence is directly relevant to OFAC's assessment of the "willful or reckless" nature of the violations and to the determination of an appropriate civil monetary penalty. The voluntary self-disclosure was subsequently filed with OFAC on June 1, 2023.
4. Remediation — Enhanced Compliance Program. I recommend that Pemberton Investors Solutions LLC (retained December 15, 2022; lead consultant Dr. Anton Bremer) incorporate robust transaction monitoring and automated payment screening capabilities into the Enhanced Sanctions & Export Controls Compliance Program being designed for Dunmore and its subsidiaries. The compliance program should include, at a minimum: (a) automated screening of all wire transfer beneficiaries and intermediaries against the OFAC SDN and Sectoral Sanctions Identification Lists; (b) transaction pattern monitoring capable of detecting split payments, circular flows, and unusual routing patterns; (c) enhanced due diligence requirements for counterparties in high-risk jurisd