PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
MEMORANDUM
TO: Victoria Chambers, Responsible Partner Jasmine Thornton, Lead Associate
FROM: Liam Donahue, Associate, White Collar & Investigations
DATE: September 10, 2022
RE: Natasha Sorokin — Trading Activity Analysis & Personal Communications Review
MATTER: Dunmore Energy Holdings Ltd. — DOJ Sanctions & Export Controls Inquiry (Calderwood & Harkness Matter No. 1016-00009)
CLASSIFICATION: Attorney-Client Privileged / Work Product — Do Not Distribute Outside Counsel Team Without Prior Approval of Victoria Chambers
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to provide a comprehensive analysis of the trading activity of Natasha Sorokin, former Senior Trader at Dunmore Trading International Ltd. ("DTI"), the Dubai-based trading subsidiary of Dunmore Energy Holdings Ltd. ("DEH" or "Dunmore"), and to summarize the results of our review of her personal communications relevant to the investigation being conducted in connection with the inquiry opened by the U.S. Department of Justice ("DOJ") on April 19, 2022. The DOJ inquiry was initiated by the issuance of grand jury subpoena GJ No. 22-418, returnable before Grand Jury 22-2 of the U.S. District Court for the District of Columbia. This memorandum is prepared in anticipation of litigation and in connection with the provision of legal advice to Dunmore Energy Holdings Ltd. and is protected by the attorney-client privilege and the work product doctrine.
Natasha Sorokin is a Russian-American dual national who was employed by DTI from approximately 2018 as a Senior Trader based in DTI's offices at the Dubai International Financial Centre. During her tenure, Sorokin was responsible for originating and executing crude oil and refined products trades in the Middle East, Caspian, and Russian markets, and she reported directly to Derek Hargrave, President of DTI. Sorokin was placed on administrative leave on May 16, 2022, following the preliminary identification of her central role in the flagged transactions described herein, and was formally separated from Dunmore on September 15, 2022. Sorokin has retained personal counsel: Philip Keane of Wexford Keane LLP, located at 2000 K Street NW, Suite 650, Washington, D.C.
The key findings of this memorandum are as follows:
Sorokin was the primary point of contact between DTI and Sergei Volkov, Managing Director of Petronova Trading FZE ("Petronova"), and she personally executed or directed the substantial majority of the 14 flagged crude oil swap transactions totaling approximately $218.7 million in notional value that were executed between June 2020 and February 2022. Of those 14 transactions, at least 9 — representing approximately $156.3 million in aggregate notional value — involved crude oil ultimately sourced from or destined for entities controlled by Volkhov Industrial Group JSC ("Volkhov" or "Volkhov Industrial Group"), a Russian energy conglomerate chaired by Arkady Volkhov. Volkhov Industrial Group was designated by the Office of Foreign Assets Control ("OFAC") under Directive 2 of the sectoral sanctions program on November 15, 2019, pursuant to Executive Order 13662, and was subsequently added to the Specially Designated Nationals and blocked Persons List ("SDN List") on April 6, 2022, pursuant to Executive Order 14024.
In addition to the Petronova transactions, our analysis addresses Sorokin's involvement in at least two crude oil swap transactions with Zenith Petroleum DMCC ("Zenith Petroleum"), a Dubai-based commodity trading firm managed by Farhan Qureshi, which has also been the subject of counterparty due diligence findings by the investigation team.
Our review of Sorokin's personal communications reveals a significant and troubling pattern: Sorokin communicated extensively with Sergei Volkov via end-to-end encrypted messaging applications rather than through DTI's corporate email system. Recovered encrypted messaging data contains direct evidence of Sorokin's awareness of Petronova's connections to Volkhov Industrial Group, her involvement in structuring trades to avoid compliance detection, and discussions of payment routing designed to obscure beneficial ownership. These communications raise both evidentiary concerns — including the deletion of certain messages by Sorokin prior to surrendering her devices — and compliance concerns relating to DTI's inability to monitor and screen business communications conducted outside corporate channels.
The sources for this memorandum include: (i) the interview of Natasha Sorokin conducted on June 2, 2022, in Dubai, by Jasmine Thornton and Liam Donahue (the "Sorokin Interview"); (ii) document review conducted through our engagement of Nexagen Analytics Inc. ("Nexagen"), Project No. NX-DEH-2204, which involved technology-assisted review ("TAR") of 2,347,812 documents collected across six jurisdictions; (iii) the forensic accounting analysis prepared by Ridgeline Advisory Group LLC ("Ridgeline"), Engagement No. RAG-2022-0319, under the direction of engagement lead Dr. Margaret Liu, CPA, CFE; (iv) DTI trading records obtained from DTI's internal trading management system; (v) wire transfer records obtained from Crescent Commercial Bank PJSC ("Crescent Commercial Bank"); and (vi) Sorokin's company email account, company-issued devices, and recovered personal messaging data from her personal mobile device, which was voluntarily surrendered pursuant to the litigation hold notice dated April 20, 2022.
II. Background on Natasha Sorokin
A. Employment History and Role at DTI
Natasha Sorokin served as a Senior Trader at Dunmore Trading International Ltd., the principal commodity trading subsidiary of Dunmore Energy Holdings Ltd. DTI is based at Level 14, Gate Building 3, Dubai International Financial Centre, P.O. Box 506774, Dubai, United Arab Emirates, and holds Dubai International Financial Centre License No. CL-4827. DTI operates as Dunmore's primary vehicle for the origination, execution, and management of physical and financial commodity trades in the Middle East, Caspian, North African, and Russian markets.
During her tenure at DTI, Sorokin reported directly to Derek Hargrave, President of DTI, who in turn reported to Callum Renshaw, Chief Executive Officer of Dunmore Energy Holdings Ltd., headquartered in Houston, Texas. Sorokin was responsible for originating and executing crude oil and refined products trades with a particular focus on the Middle East, Caspian, and Russian markets. Her trading book was among the largest at DTI in terms of both volume and notional value, and she held primary responsibility for managing DTI's relationships with several key counterparties operating in the Russian and Caspian crude oil markets.
Sorokin is a Russian-American dual national and is fluent in both Russian and English. Her dual nationality and language capabilities made her particularly well-suited to managing DTI's Russian-facing trading activity and provided her with market knowledge and industry contacts that were valuable to DTI's operations. According to her personnel file, Sorokin was hired by DTI in approximately 2018, following prior experience in commodity trading at other firms. The specific details of her prior employment history, educational background, and personal circumstances are set forth in her personnel file, which has been collected and reviewed as part of the document collection process.
Throughout the relevant period of conduct — from approximately March 2020 through April 2022 — Sorokin functioned as the primary trader responsible for DTI's relationships with both Petronova Trading FZE and Zenith Petroleum DMCC, the two counterparties involved in the flagged transactions that are the focus of the DOJ inquiry. As discussed in detail below, Sorokin served as the sole DTI point of contact for Sergei Volkov, Managing Director of Petronova, and was the executing or co-executing trader on all 14 of the flagged crude oil swap transactions.
B. Administrative Leave and Separation
Following the issuance of the grand jury subpoena on April 19, 2022, and the initiation of Calderwood & Harkness's internal investigation, a preliminary review of DTI's trading records and email correspondence identified Sorokin as a central figure in the flagged transactions. On the basis of this preliminary identification, Sorokin was placed on administrative leave effective May 16, 2022. The decision to place Sorokin on administrative leave was made in consultation with this firm and was communicated to Sorokin by Derek Hargrave and by letter from Dunmore's General Counsel. Sorokin was advised that her placement on administrative leave was a precautionary measure pending the outcome of the internal investigation and did not constitute a determination of fault or wrongdoing.
Sorokin was formally separated from Dunmore on September 15, 2022. The separation was effectuated following the completion of our initial review of her trading activity and personal communications, which confirmed her central role in the flagged transactions and the existence of the encrypted messaging communications discussed in Section IV below. The terms of Sorokin's separation are governed by her employment contract with DTI and the applicable provisions of DIFC employment law.
Following her separation, Sorokin retained personal counsel: Philip Keane of Wexford Keane LLP, located at 2000 K Street NW, Suite 650, Washington, D.C. Keane entered his appearance and communicated with this firm regarding the terms of the representation. On September 20, 2022, Victoria Chambers sent a letter to Wexford Keane LLP on behalf of Calderwood & Harkness acknowledging Keane's representation of Sorokin, confirming information-sharing protocols, and establishing the boundaries of communications between counsel. That letter set forth the firm's position that information obtained during the Sorokin Interview is the property of the corporate client and subject to the company's privilege, and that the company reserves the right to disclose such information to the government or other third parties at its discretion.
Sorokin's defense costs are being advanced by Dunmore Energy Holdings Ltd. pursuant to the indemnification obligations set forth in Sorokin's employment agreement and in the articles of association of DEH, which is incorporated in the Cayman Islands. As of the date of this memorandum, Dunmore has advanced a total of approximately $3.4 million in individual counsel fees for the three individuals who have retained personal counsel in connection with the DOJ inquiry: Gerald Fisk (former Chief Compliance Officer), Natasha Sorokin, and Derek Hargrave. The indemnification obligations and the potential grounds for forfeiture of indemnification rights are analyzed in Jasmine Thornton's Memorandum re: Indemnification Obligations, dated May 5, 2022.
C. Interview Summary
On June 2, 2022, Natasha Sorokin was interviewed in Dubai by Jasmine Thornton, Lead Associate, and Liam Donahue, Associate. The interview was conducted at the offices of Calderwood & Harkness's local counsel in the Dubai International Financial Centre. The interview was conducted in English. Sorokin was not accompanied by personal counsel at the time of the interview, as she had not yet retained separate representation. The interview lasted approximately three hours and forty-five minutes.
Prior to the commencement of the substantive interview, Sorokin was administered an Upjohn corporate Miranda warning in accordance with the witness interview protocol dated April 18, 2022, prepared by Victoria Chambers. Specifically, Sorokin was advised of the following:
(a) Calderwood & Harkness LLP represents Dunmore Energy Holdings Ltd. and its subsidiaries, including Dunmore Trading International Ltd. The firm does not represent Sorokin individually.
(b) The purpose of the interview is to gather facts in connection with the firm's internal investigation on behalf of the company.
(c) The attorney-client privilege with respect to the interview and its contents belongs to the company, not to Sorokin individually.
(d) The company may, in its sole discretion, choose to waive the privilege and disclose the contents of the interview, including Sorokin's statements, to third parties, including the United States Department of Justice, OFAC, or other governmental authorities.
(e) Sorokin was encouraged to consult with personal counsel if she wished to obtain independent legal advice.
Sorokin acknowledged that she understood each of these advisements and confirmed her willingness to proceed with the interview. Her acknowledgment was documented in the written record of the interview.
The key admissions, denials, and other statements made by Sorokin during the interview are discussed in the relevant sections of this memorandum, particularly in Sections III.E and IV below, and are set forth in detail in the separate Interview Memorandum — Natasha Sorokin, dated June 2, 2022, which is incorporated herein by reference.
III. Trading Activity Analysis
A. Overview of Sorokin's Trading Book
During the period of conduct at issue — approximately March 2020 through April 2022 — Natasha Sorokin managed DTI's largest crude oil trading book focused on Russian-origin and Caspian-basin crude oil. Sorokin's trading book encompassed both physical and financial crude oil trades, including swaps, forward contracts, and spot transactions, with a concentration in crude grades originating from or associated with production assets in the Russian Federation and the Caspian region, including but not limited to Urals crude, ESPO (Eastern Siberia-Pacific Ocean) blend, CPC (Caspian Pipeline Consortium) blend, and various Caspian-origin grades.
During this approximately two-year period, Sorokin originated or executed the substantial majority of DTI's crude oil trades with the two counterparties at the center of the DOJ inquiry: Petronova Trading FZE and Zenith Petroleum DMCC. According to DTI's internal trading records — which were extracted from DTI's proprietary trading management system and provided to Ridgeline Advisory Group for forensic accounting analysis — the total notional value of Sorokin's trading book during the period under review was substantial, making her one of the highest-volume traders at DTI during this period. The precise total notional value of Sorokin's full trading book during this period is detailed in the Ridgeline Advisory Group's forensic accounting workpapers, but the trades of concern for purposes of this memorandum are the 14 flagged crude oil swap transactions discussed below, which represent a subset of Sorokin's overall trading activity.
Sorokin's trading book was managed with a high degree of autonomy, consistent with the operating culture at DTI under Derek Hargrave's leadership. While Hargrave was required to approve trades above certain notional value thresholds, the day-to-day origination, negotiation, and execution of trades was conducted by individual traders, including Sorokin, with limited oversight from DTI's compliance function. As discussed in Nicholas Ferreira's Memorandum re: Gerald Fisk — Compliance Failures & Supervisory Deficiencies, dated August 15, 2022, DTI's compliance infrastructure during the relevant period was materially deficient, with no effective sanctions screening mechanism for counterparties, no formalized trade approval process incorporating compliance review, and no systematic monitoring of trader communications.
B. The 14 Flagged Crude Oil Swap Transactions
Between June 2020 and February 2022, DTI executed 14 crude oil swap transactions with Petronova Trading FZE and Zenith Petroleum DMCC that have been identified as transactions of concern in the internal investigation. These 14 transactions have an aggregate notional value of approximately $218.7 million. The transactions are referred to throughout this memorandum and in the broader investigation materials as the "flagged transactions."
Natasha Sorokin was the executing trader or co-executing trader on all 14 of the flagged transactions. Her initials and DTI trader identification number appear on the trade tickets and trade confirmations recovered from DTI's internal trading management system. In several instances, Sorokin was the sole trader identified on the trade documentation; in others, a junior trader's initials also appear, but in each such case, the evidence indicates that Sorokin was the responsible senior trader who originated the trade, negotiated the terms, and directed the execution.
Each of the 14 flagged transactions has been documented in the companion Transaction Summary Schedule (Attachment A to this memorandum), which sets forth for each transaction the following information: (i) trade date; (ii) counterparty (Petronova Trading FZE or Zenith Petroleum DMCC); (iii) notional value; (iv) crude grade; (v) delivery terms, including loading port and discharge port; (vi) pricing basis; (vii) Sorokin's involvement (sole executing trader or co-executing trader); and (viii) classification as "tainted" or "non-tainted" based on the Ridgeline Advisory Group's determination of whether the underlying crude oil was sourced from or destined for Volkhov Industrial Group-controlled entities. The Transaction Summary Schedule is maintained as a companion Excel workbook and is updated as additional information becomes available.
The 14 flagged transactions were identified through a multi-step process involving: (a) initial screening of DTI's trading records by Ridgeline Advisory Group to identify all transactions with Petronova Trading FZE and Zenith Petroleum DMCC during the period of conduct; (b) cross-referencing those transactions against OFAC sanctions lists, beneficial ownership records, and shipping documentation to determine which transactions involved sanctioned parties or their controlled entities; and (c) review of trade documentation, payment records, and communications to assess the nature and purpose of each transaction. The methodology employed by Ridgeline is described in greater detail in the Ridgeline Advisory Group's forensic accounting workpapers and is summarized in Jasmine Thornton's Memorandum re: Crescent Commercial Bank Payment Flow Analysis — Summary of Ridgeline Forensic Findings, dated October 1, 2022.
C. The 9 Tainted Transactions ($156.3 Million Notional)
Ridgeline Advisory Group, under the direction of Dr. Margaret Liu, CPA, CFE, determined that at least 9 of the 14 flagged transactions — with an aggregate notional value of approximately $156.3 million — involved crude oil that was ultimately sourced from or destined for entities controlled by Volkhov Industrial Group JSC. These 9 transactions are referred to throughout this memorandum and in the broader investigation materials as the "tainted transactions."
Volkhov Industrial Group JSC is a major Russian energy conglomerate headquartered at 12 Kutuzovsky Prospekt, Moscow 121248, Russia, and chaired by Arkady Volkhov. Volkhov Industrial Group controls a network of upstream production companies, midstream pipeline and storage operators, and downstream refining and export entities operating primarily in the Russian Federation. Volkhov Industrial Group was designated by OFAC under Directive 2 of the sectoral sanctions program applicable to the energy sector of the Russian Federation on November 15, 2019, pursuant to Executive Order 13662. Directive 2, as issued and subsequently amended, prohibited U.S. persons from dealing in new debt of longer than 60 days' maturity or new equity issued by Volkhov Industrial Group or its 50-percent-or-more-owned subsidiaries. On April 6, 2022, in connection with the escalation of sanctions following Russia's invasion of Ukraine, Volkhov Industrial Group was added to the SDN List pursuant to Executive Order 14024, resulting in full blocking sanctions that prohibit virtually all transactions by U.S. persons with Volkhov or any entity 50 percent or more owned by Volkhov.
All 9 tainted transactions were executed with Petronova Trading FZE as the counterparty. Petronova is a free zone entity registered in Dubai, United Arab Emirates, with offices at Office 1407, Al Shafar Tower, Dubai Internet City, Dubai, UAE. Petronova's Managing Director is Sergei Volkov, a Russian national and UAE resident. The beneficial ownership analysis of Petronova — including its equity ownership structure, its operational and financial connections to Volkhov Industrial Group, and the application of OFAC's 50 Percent Rule — is set forth in detail in my separate Memorandum re: Petronova Trading FZE — Beneficial Ownership Analysis, dated June 15, 2022, and in Conrad Reeves's Memorandum re: Volkhov Industrial Group — OFAC Designation History & 50% Rule Analysis, dated June 20, 2022. In summary, the evidence strongly supports the conclusion that Petronova was beneficially owned or controlled by Volkhov Industrial Group or its principals and functioned as a trading intermediary for Volkhov-connected crude oil flows.
As noted above, Sorokin was the sole DTI point of contact for Sergei Volkov in connection with these 9 tainted transactions. All trade negotiations, pricing discussions, delivery coordination, and commercial communications between DTI and Petronova were conducted by or through Sorokin. No other DTI trader maintained a direct relationship with Volkov or conducted independent negotiations with Petronova. While Hargrave approved the trades at the executive level, the operational relationship with Petronova was exclusively managed by Sorokin.
The specific mechanics by which the tainted transactions involved Volkhov-controlled crude oil are detailed in the Ridgeline forensic accounting analysis and in the companion Transaction Summary Schedule. In general, the tainted transactions involved crude oil swap arrangements in which DTI would enter into a financial swap with Petronova, with the underlying physical crude oil being sourced from or delivered to entities that Ridgeline identified — through shipping records, bills of lading, port authority documentation, and financial flow analysis — as affiliates or subsidiaries of Volkhov Industrial Group. In several transactions, the crude oil was loaded at Russian ports associated with Volkhov-controlled terminal operations and discharged at ports in India, China, or Turkey.
D. Transactions Involving Zenith Petroleum DMCC
At least two of the 14 flagged crude oil swap transactions involved Zenith Petroleum DMCC as the counterparty. Zenith Petroleum is a commodity trading company organized under the laws of the Dubai Multi Commodities Centre ("DMCC") free zone, with offices at Unit 2201, Jumeirah Bay Tower X2, Cluster X, Jumeirah Lakes Towers, Dubai, UAE. Zenith Petroleum's Managing Director is Farhan Qureshi, a Pakistani national and UAE resident.
Sorokin originated both of these transactions and served as the primary DTI contact for Qureshi in connection with DTI's trading relationship with Zenith Petroleum. Our review of Sorokin's communications with Qureshi — conducted through both corporate email and, to a lesser extent, encrypted messaging platforms — has been completed, and the relevant findings are summarized below and in the companion documents.
The potential connections between Zenith Petroleum DMCC and Volkhov-controlled entities have been analyzed by Amara Osei in her Memorandum re: Zenith Petroleum DMCC — Counterparty Due Diligence Findings, dated July 5, 2022. That memorandum examines Zenith Petroleum's corporate structure, its trading patterns, and the extent to which the two flagged transactions involving Zenith Petroleum may have involved Volkhov-connected crude oil flows. While the evidence linking Zenith Petroleum to Volkhov is less direct than the evidence connecting Petronova to Volkhov, the investigation has identified several indicators warranting further scrutiny, including overlapping shipping arrangements and shared intermediary banking relationships at Crescent Commercial Bank PJSC.
E. Sorokin's Awareness of Volkhov Connections
A central question in assessing Sorokin's individual culpability is the extent to which she knew or should have known that Petronova Trading FZE was beneficially owned or controlled by Volkhov Industrial Group and that the trades she was executing on behalf of DTI with Petronova involved Volkhov-connected crude oil. The evidence bearing on this question can be grouped into two categories: evidence indicating actual knowledge or willful blindness, and evidence potentially mitigating the inference of knowledge.
Evidence Indicating Knowledge or Willful Blindness
Several categories of evidence support the conclusion that Sorokin was aware of — or at a minimum was willfully blind to — the connection between Petronova and Volkhov Industrial Group:
First, the trade documentation itself contained indicators that the crude oil involved in the Petronova transactions was sourced from Volkhov-controlled production assets. The crude grades specified in the trade tickets — particularly certain Urals crude specifications and blends — are grades typically associated with production assets known to be controlled by Volkhov Industrial Group. Sorokin's expertise in Russian-origin crude oil markets would have made her familiar with the production sources associated with these grades. While the mere identification of a crude grade is not, standing alone, conclusive evidence of knowledge regarding beneficial ownership, it is a relevant data point when considered in the context of the totality of the evidence.
Second, email correspondence recovered from DTI's corporate email server includes exchanges in which Sorokin discusses delivery logistics involving specific Russian ports that are connected to Volkhov Industrial Group's terminal operations. These emails reference loading ports and terminal facilities that are publicly known to be operated by Volkhov-controlled entities. In at least two email exchanges, Sorokin references specific terminal operators by name — entities that are identified in OFAC's public designations materials as Volkhov subsidiaries.
Third, Sorokin's personal relationship with Sergei Volkov predates her employment at DTI. Recovered communications — including both email and encrypted messages — and statements made by Sorokin during her June 2, 2022, interview indicate that Sorokin and Volkov were acquainted prior to Sorokin's joining DTI in 2018 and that their relationship involved both personal and professional dimensions. Sorokin acknowledged during her interview that she had known Volkov for "many years" and that she had been introduced to the Petronova trading opportunity by Volkov. This pre-existing relationship increases the likelihood that Sorokin was aware of Volkov's connections to the broader Volkhov business network.
Fourth, internal DTI communications — specifically, email chains between Sorokin and Derek Hargrave — contain references that suggest awareness of the Russian-side connections underlying the Petronova trades. In several emails, Sorokin and Hargrave refer to "Sergei's people" and "the Moscow side" in connection with Petronova trade negotiations and delivery logistics. These references, while not explicitly identifying Volkhov Industrial Group by name, suggest an understanding that the Petronova trades involved a broader network of Russian entities beyond Petronova itself.
Fifth, and most significantly, the encrypted messaging communications discussed in detail in Section IV.C below contain direct evidence that Sorokin was aware of the Volkhov connection. These messages include discussions between Sorokin and Volkov in which Volkov references "Arkady" — assessed to be Arkady Volkhov, Chairman of Volkhov Industrial Group — and in which Sorokin and Volkov discuss structuring trades through Petronova to obscure the ultimate connection to Volkhov Industrial Group.
Evidence Potentially Mitigating Knowledge
Two categories of evidence may mitigate the inference of knowledge:
First, Sorokin stated during her June 2, 2022, interview that she understood Petronova to be an independent Dubai-based commodity trading company and that she did not believe Sergei Volkov was acting on behalf of Volkhov Industrial Group. She characterized Petronova as a "normal counterparty" and stated that she had "no reason to believe" that Volkov was connected to sanctioned entities. She further stated that she had never been told by anyone at DTI or elsewhere that Petronova was owned or controlled by Volkhov Industrial Group. As discussed in Section IV.C below, however, Sorokin's interview statements are directly contradicted by the encrypted messaging evidence, significantly undermining the credibility of these denials.
Second, DTI's compliance files did not contain formal Know Your Customer ("KYC") or Customer Due Diligence ("CDD") documentation linking Petronova to Volkhov Industrial Group. The absence of such documentation reflects the broader compliance failures at DTI under the supervision of Gerald Fisk, who served as Chief Compliance Officer during the relevant period and who is the subject of Nicholas Ferreira's Memorandum re: Gerald Fisk — Compliance Failures & Supervisory Deficiencies, dated August 15, 2022. The absence of formal documentation linking Petronova to Volkhov does not, in our assessment, negate the other evidence of Sorokin's knowledge, particularly given the encrypted messaging evidence and the broader factual context; however, it does provide a factual basis upon which Sorokin or her counsel could argue that DTI's compliance function did not flag the relationship and that Sorokin was not put on formal notice through internal compliance processes.
Assessment
On balance, the weight of the available evidence suggests that Sorokin was aware of Petronova's connections to Volkhov Industrial Group or, at a minimum, was willfully blind to those connections. The encrypted messaging evidence is particularly probative on this point and significantly undermines the mitigating force of Sorokin's interview denials and the absence of formal compliance documentation. We assess that the DOJ, if presented with the encrypted messaging evidence, would likely conclude that Sorokin had actual knowledge of the Volkhov connection or, alternatively, that she deliberately avoided acquiring such knowledge in circumstances where the connection was apparent.
F. Sorokin's Role vis-à-vis Derek Hargrave
A related question is the extent to which Sorokin acted independently in executing the tainted transactions or, alternatively, acted under the direction and authorization of Derek Hargrave, President of DTI. This question is relevant both to Sorokin's individual culpability and to the broader allocation of responsibility among DTI's senior personnel.
Derek Hargrave, as President of DTI, was required to approve trades above certain notional value thresholds. The evidence indicates that Hargrave approved the Petronova and Zenith Petroleum trades that are the subject of this memorandum and that he was aware of DTI's ongoing trading relationship with both counterparties. The nature and extent of Hargrave's knowledge and involvement are analyzed in Jasmine Thornton's Memorandum re: Derek Hargrave — Role in Suspect Transactions & Knowledge Assessment, dated September 1, 2022, which should be read in conjunction with this memorandum.
Email evidence recovered from DTI's corporate email server shows that Sorokin regularly reported trade details to Hargrave — including counterparty identity, trade size, pricing, and delivery logistics — and that she received explicit authorization from Hargrave to proceed on larger transactions with Petronova. In several email exchanges, Hargrave affirmatively approved proposed trade terms and directed Sorokin to execute trades. These email chains demonstrate that Hargrave was not merely a passive supervisor but was actively involved in approving and directing the Petronova trading relationship.
At the same time, the evidence also indicates that Sorokin possessed a degree of operational autonomy in managing the Petronova relationship that went beyond mere execution. Sorokin was the sole DTI contact for Volkov, she conducted trade negotiations independently, and — as discussed in Section IV.C — she communicated with Volkov via encrypted messaging channels to which Hargrave did not appear to have access. The encrypted messaging evidence suggests that certain aspects of the Petronova relationship — including discussions of structuring trades to avoid compliance detection and payment routing to obscure the Volkhov connection — were not shared with Hargrave through formal channels, although the "Sergei's people" and "Moscow side" email references suggest that Hargrave had at least a general awareness of the Russian-side connections.
The question of whether Sorokin acted independently or under Hargrave's direction on the most problematic aspects of the Petronova trades remains an open one. While Hargrave clearly approved the trades at a high level, the encrypted messaging evidence suggests that Sorokin may have taken independent steps to facilitate the trades and conceal their true nature that went beyond what Hargrave directed or authorized. The resolution of this question will be important both for the assessment of individual culpability and for the company's cooperation narrative with the DOJ.
IV. Personal Communications Review
A. Scope of Communications Reviewed
The personal communications review for Natasha Sorokin encompassed materials from the following four sources:
(i) DTI Corporate Email Account (Strathmore Data Systems): Sorokin's corporate email account on DTI's Strathmore Data Systems email server, which was preserved pursuant to the litigation hold notice issued on April 20, 2022, and from which all emails for the relevant period were collected by Nexagen Analytics Inc.
(ii) DTI-Issued Mobile Device: Sorokin's company-issued smartphone, which was collected from Sorokin upon her placement on administrative leave on May 16, 2022. The device was forensically imaged by Nexagen Analytics.
(iii) Personal Mobile Device: Sorokin's personal mobile device (smartphone), which she voluntarily surrendered to Calderwood & Harkness pursuant to the litigation hold notice dated April 20, 2022. The device was forensically imaged by Nexagen Analytics. As discussed below, forensic imaging revealed that certain encrypted messaging data had been deleted from the device prior to surrender; partial recovery of deleted data was achieved through forensic techniques.
(iv) Cloud-Based Messaging Application Data: Data from cloud-based messaging applications recovered from Sorokin's company-provisioned laptop computer. This data included local caches and backup files for encrypted messaging applications that Sorokin had installed on the laptop.
The review of these materials was conducted as part of the broader document review process managed by Nexagen Analytics Inc., Project No. NX-DEH-2204, under the supervision of project manager Brian Cavanaugh. The Nexagen engagement involved the collection, processing, and technology-assisted review of 2,347,812 documents collected from custodians and non-custodial data sources across six jurisdictions (United States, United Kingdom, United Arab Emirates, Cayman Islands, Germany, and Switzerland). Sorokin's custodial data — encompassing her corporate email, devices, and personal messaging data — constituted a significant subset of the total document collection and was prioritized for early review given her central role in the flagged transactions.
In addition to the TAR process managed by Nexagen, manual review of flagged and prioritized communications from Sorokin's custodial data was conducted by Liam Donahue and Jasmine Thornton. This manual review focused on communications involving the key counterparties (Petronova Trading FZE, Zenith Petroleum DMCC), key individuals (Sergei Volkov, Farhan Qureshi, Derek Hargrave, Rajesh Malhotra), and key topics (sanctions, compliance, payment routing, Volkhov Industrial Group).
B. Corporate Email Communications
Approximately 14,380 emails to and from Sorokin's DTI corporate email address for the period March 2020 through May 2022 were reviewed as part of the TAR process, with approximately 2,740 emails flagged for manual review based on relevance criteria. The following categories of key communications were identified:
Email Exchanges with Sergei Volkov (Petronova). Sorokin's corporate email account contains numerous exchanges with Sergei Volkov, primarily at Volkov's Petronova email address. These emails address trade terms, pricing benchmarks, delivery schedules, and logistical arrangements for the Petronova trades. The content of these emails is generally consistent with routine commodity trading communications and, standing alone, would not necessarily raise sanctions concerns. Notably, however, the volume and substance of trade-related communications in Sorokin's corporate email are significantly less than what would be expected for a trading relationship of this magnitude — a disparity that is explained by the extensive use of encrypted messaging for business communications, as discussed in Section IV.C below.
Internal Email Chains with Derek Hargrave. As discussed in Section III.F above, Sorokin's corporate email contains multiple email chains with Derek Hargrave in which Sorokin reports trade details, seeks approval for proposed transactions, and discusses the Petronova relationship. These communications include the references to "Sergei's people" and "the Moscow side" noted above. In addition, several emails from Hargrave to Sorokin contain directives to execute specific trades at specific price levels, confirming Hargrave's active role in approving and directing the trading activity.
Emails with Rajesh Malhotra (Controller, DTI). Sorokin's corporate email contains a series of exchanges with Rajesh Malhotra, DTI's Controller, regarding payment routing for Petronova and Zenith Petroleum trades through Crescent Commercial Bank PJSC, Dubai. In these emails, Sorokin provides Malhotra with wire transfer instructions, beneficiary account details, and in certain instances, specific instructions regarding intermediary bank accounts to be used for payment routing. The emails with Malhotra regarding payment routing are of particular concern because they suggest that Sorokin was actively involved in directing the payment mechanics for the tainted transactions, rather than simply executing trades and leaving the payment logistics to DTI's finance function. The Crescent Commercial Bank relationship was managed through Khalid Mansour, the bank's relationship manager for DTI. The implications of the payment routing instructions are discussed further in Section V below and are cross-referenced to Nicholas Ferreira's Memorandum re: Rajesh Malhotra — Controller's Knowledge of Payment Structuring, dated October 20, 2022.
Emails with Yves Leclerc (Director of Logistics & Shipping). Sorokin communicated with Yves Leclerc, DTI's Director of Logistics & Shipping, regarding the physical delivery logistics associated with certain Petronova trades. These emails address vessel nominations, loading port schedules, bills of lading, and discharge port arrangements. The Leclerc communications are relevant to the analysis of shipping routes and physical crude oil flows that Ridgeline Advisory Group has used to trace the connection between the Petronova trades and Volkhov-controlled production and terminal assets. The full analysis of Leclerc's role is set forth in Amara Osei's Memorandum re: Yves Leclerc — Role in Logistics & Shipping Arrangements, dated September 20, 2022.
Communications with Gerald Fisk (Former CCO). Notably, very few corporate emails between Sorokin and Gerald Fisk were identified in the review. Despite Fisk's role as DTI's Chief Compliance Officer, the email record reflects a near-total absence of compliance-related communications between Sorokin and Fisk regarding the screening or approval of Petronova Trading FZE or Zenith Petroleum DMCC as counterparties. There are no emails in which Sorokin requests or receives compliance clearance for trades with either counterparty, no emails in which Fisk raises questions or concerns about the Petronova or Zenith Petroleum relationships, and no emails reflecting any compliance review or sanctions screening of the flagged transactions. This absence of compliance-related communications between the executing trader and the CCO is consistent with the broader pattern of compliance failures at DTI documented in Nicholas Ferreira's memorandum regarding Fisk.
C. Encrypted Messaging Communications
The most significant finding of the personal communications review is that Natasha Sorokin communicated extensively with Sergei Volkov via end-to-end encrypted messaging applications, rather than through DTI's corporate email system, for a substantial volume of business-related communications. This finding has profound implications for both the evidentiary record and the assessment of Sorokin's culpability.
The encrypted messaging data was recovered from Sorokin's personal mobile device and from cached data on her company-provisioned laptop. The recovery and processing of this data was conducted by Nexagen Analytics as part of the forensic imaging of Sorokin's devices. Forensic analysis confirmed that Sorokin had deleted a portion of her encrypted messaging history prior to surrendering her personal mobile device on or about May 18, 2022, approximately two days after being placed on administrative leave. Notwithstanding the deletions, Nexagen's forensic team achieved partial recovery of the deleted messages through analysis of device storage, backup files, and local application caches. The recovered messages, combined with messages that had not been deleted, provide a substantial — though likely incomplete — record of Sorokin's encrypted communications with Volkov.
The recovered encrypted messaging data includes the following categories of communications of evidentiary significance:
Trade Structuring and Counterparty Identities. Multiple messages between Sorokin and Volkov discuss the structuring of specific crude oil swap transactions, including the identification of counterparties, the specification of crude grades and volumes, and the negotiation of pricing terms. These communications parallel — and in many cases supplement — the trade-related discussions found in the corporate email record, confirming that Sorokin and Volkov conducted a significant portion of their business communications outside DTI's official channels.
Discussions of Volkhov Connections. Several recovered messages contain direct references to "Arkady," assessed to be Arkady Volkhov, Chairman of Volkhov Industrial Group. In these messages, Volkov references Arkady Volkhov in the context of production volumes, delivery schedules, and commercial terms, indicating that Petronova's trading activity was being directed or coordinated by Volkhov or his representatives. Sorokin's responses in these exchanges do not express surprise or confusion regarding the Volkhov references, suggesting familiarity with the connection between Petronova and Volkhov Industrial Group.
Efforts to Avoid Compliance Detection. Several messages between Sorokin and Volkov discuss the routing of trades through Petronova specifically to obscure the ultimate connection to Volkhov Industrial Group. In these messages, Sorokin and Volkov discuss the importance of ensuring that Petronova — rather than any Volkhov-affiliated entity — appears as the counterparty on trade documentation, and they discuss structuring trade flows to avoid triggering sanctions screening at DTI or at financial institutions. These messages are among the most probative items in the evidentiary record and, if credited, would support a finding that Sorokin knowingly participated in a scheme to evade U.S. sanctions.
Payment Structuring. Certain recovered messages discuss the routing of payments through intermediary accounts at Crescent Commercial Bank PJSC. These messages are directly relevant to Ridgeline Advisory Group's finding that $34.2 million in payments were routed through intermediary accounts at Crescent Commercial Bank and structured to obscure the ultimate beneficial ownership of the recipient entities. The payment structuring discussions in the encrypted messages corroborate the email evidence discussed in Section IV.B above and provide additional detail regarding Sorokin's knowledge of and involvement in the payment routing scheme.
The evidentiary significance of the encrypted messaging content cannot be overstated. The messages provide direct evidence that Sorokin was aware that Petronova functioned as a front or intermediary for Volkhov Industrial Group, directly contradicting the statements she made during her June 2, 2022, interview in which she characterized Petronova as an independent Dubai-based trader and denied knowledge of any connection to Volkhov. The messages also provide evidence of affirmative steps taken by Sorokin and Volkov to structure transactions and communications so as to evade compliance detection — conduct that, if proven, would support a charge of willful violation of IEEPA.
The deletion of encrypted messages by Sorokin prior to surrendering her personal mobile device is independently significant. While the deletion does not constitute an independent violation (and Sorokin's counsel may argue that the deletion was unrelated to the investigation), the timing of the deletion — approximately two days after Sorokin was placed on administrative leave and advised of the investigation — strongly suggests consciousness of guilt and an effort to destroy potentially incriminating evidence. The deletion also raises questions about what additional messages may have existed that were not recovered through forensic techniques, and it underscores the evidentiary limitations inherent in cases involving encrypted communications.
From a compliance perspective, Sorokin's use of encrypted personal messaging applications for business communications violated DTI's internal communications policy, which required that all business-related communications be conducted through approved corporate channels. Sorokin's circumvention of this requirement effectively deprived DTI of the ability to monitor, screen, and archive a significant portion of the business communications conducted in connection with the Petronova trades, thereby undermining the company's compliance program and its ability to detect potential sanctions violations. This compliance failure is addressed in the remediation recommendations set forth in Section IX below.
D. Communications with Other DTI Personnel
In addition to the communications with Volkov, Qureshi, Hargrave, Malhotra, Leclerc, and Fisk discussed above, our review of Sorokin's communications encompassed her interactions with other DTI and Dunmore personnel of interest to the investigation:
Omar Al-Rashidi (Head of Middle East Operations). Al-Rashidi is a cooperating witness who has provided debriefings to the investigation team. Our review identified limited direct communications between Sorokin and Al-Rashidi regarding the flagged trades. Al-Rashidi appears to have had minimal involvement in Sorokin's Petronova trading activity, and the limited communications identified are consistent with routine operational coordination rather than involvement in the substantive trading decisions at issue. This finding is consistent with Al-Rashidi's debriefing statements, as summarized in Victoria Chambers's Memorandum re: Omar Al-Rashidi — Cooperation Assessment & Debriefing Summary, dated August 25, 2022.
Sandra Whitfield (CFO, Dunmore Energy Holdings Ltd., Houston). Our review identified no direct communications between Sorokin and Sandra Whitfield regarding the flagged transactions or the Petronova or Zenith Petroleum trading relationships. This finding is consistent with the organizational structure of Dunmore, in which DTI's day-to-day trading operations were managed by Hargrave in Dubai with limited direct oversight from the Houston-based corporate headquarters.
Callum Renshaw (CEO, Dunmore Energy Holdings Ltd., Houston). Similarly, our review identified no direct communications between Sorokin and Callum Renshaw. Sorokin's communications were directed through the DTI organizational structure to Hargrave, and there is no evidence that Sorokin had direct contact with Dunmore's CEO regarding the trading activity at issue.
E. Communications with External Parties Other Than Volkov and Qureshi
Klaus Weidemann (Managing Director, Caspian Logistik GmbH). Our review identified limited communications between Sorokin and Klaus Weidemann, Managing Director of Caspian Logistik GmbH, located at Mönckebergstraße 22, 20095 Hamburg, Germany. Caspian Logistik GmbH is a logistics and freight forwarding company that was involved in certain oilfield equipment shipments that are a secondary focus of the DOJ inquiry. The $12.4 million in oilfield equipment exports that are the subject of potential Export Administration Regulations ("EAR") violations appear to have been managed primarily by Yves Leclerc and Derek Hargrave, with Sorokin's involvement being peripheral at most. The limited communications identified between Sorokin and Weidemann relate to general logistics coordination and do not suggest that Sorokin played a material role in the equipment export transactions.
Tobias Engel (Managing Director, Dunmore Renewables GmbH). No communications between Sorokin and Tobias Engel were identified in the review. Engel's role at Dunmore Renewables GmbH — a separate Dunmore subsidiary focused on renewable energy investments — appears to be unrelated to the trading activity at issue, and the absence of communications between Sorokin and Engel is consistent with the expected separation of business functions within the Dunmore corporate group.
V. Payment Flow Analysis Relevant to Sorokin
The payment flow analysis conducted by Ridgeline Advisory Group LLC under the direction of Dr. Margaret Liu has identified a pattern of payments routed through intermediary accounts at Crescent Commercial Bank PJSC, Dubai, that were structured to obscure the ultimate beneficial ownership of the recipient entities and, specifically, to conceal the flow of funds to and from Volkhov Industrial Group-controlled entities. The detailed findings of the Ridgeline payment flow analysis are set forth in Jasmine Thornton's Memorandum re: Crescent Commercial Bank Payment Flow Analysis — Summary of Ridgeline Forensic Findings, dated October 1, 2022, which should be read in conjunction with this section.
In summary, Ridgeline identified $34.2 million in payments routed through intermediary accounts at Crescent Commercial Bank PJSC that were structured in a manner consistent with the deliberate obfuscation of beneficial ownership. These payments comprised 127 individual transactions occurring between March 2020 and March 2022, and involved the use of multiple intermediary entities and layered account structures to obscure the connection between DTI's payments and the ultimate Volkhov-controlled beneficiaries.
Sorokin's role in the payment structuring is supported by both the email evidence and the encrypted messaging evidence discussed above. With respect to the email evidence, Sorokin's corporate email contains instructions to Rajesh Malhotra, DTI's Controller, regarding specific payment routing for certain Petronova trades, including the identification of intermediary bank accounts and beneficiary account details. With respect to the encrypted messaging evidence, Sorokin's recovered messages with Volkov include discussions of payment routing through intermediary accounts at Crescent Commercial Bank. In addition, Sorokin communicated directly with Khalid Mansour, the Crescent Commercial Bank relationship manager for DTI, on at least three occasions regarding account details for Petronova-related payments. These direct communications with the bank — conducted outside the normal finance function channels — suggest that Sorokin was actively involved in directing the payment mechanics for the tainted transactions.
Taken together, the evidence indicates that Sorokin was aware that the payment structuring was intended to obscure the connection between the Petronova trades and Volkhov Industrial Group and that she played an active role in facilitating that structuring. This finding is consistent with the broader conclusion that Sorokin was aware of or willfully blind to Petronova's status as a front or intermediary for Volkhov.
VI. Applicable Legal Framework (Summary)
This section provides a brief summary of the legal framework applicable to Sorokin's conduct. A comprehensive analysis of the applicable sanctions and export control frameworks is set forth in Conrad Reeves's Memorandum re: Applicable Sanctions Framework — OFAC Programs, E.O. 14024, Directive 2, dated April 27, 2022.
OFAC-Administered Sanctions Programs. The primary sanctions programs at issue are those administered by OFAC under Executive Order 14024 (signed April 15, 2021, as amended), which authorizes the imposition of blocking sanctions on persons operating in specified sectors of the Russian Federation economy, and Directive 2 under Executive Order 13662, which imposes sectoral sanctions on certain entities in the energy sector of the Russian Federation. The implementing regulations are codified at 31 C.F.R. Part 589. As noted above, Volkhov Industrial Group was designated under Directive 2 on November 15, 2019, and was subsequently placed on the SDN List on April 6, 2022, under E.O. 14024. The applicability of OFAC's 50 Percent Rule — which extends sanctions prohibitions to entities that are 50 percent or more owned by a designated person — is analyzed in Conrad Reeves's Memorandum re: Volkhov Industrial Group — OFAC Designation History & 50% Rule Analysis, dated June 20, 2022.
International Emergency Economic Powers Act (IEEPA). The criminal enforcement authority for violations of the OFAC-administered sanctions programs derives from the International Emergency Economic Powers Act, 50 U.S.C. §§ 1701–1706. IEEPA provides for criminal penalties for willful violations of sanctions prohibitions, including fines of up to $1 million and imprisonment of up to 20 years per violation. The "willfulness" requirement under IEEPA has been interpreted by courts to require proof that the defendant knew that his or her conduct was unlawful or that the defendant acted with reckless disregard of a known legal obligation. The DOJ's burden in establishing willfulness in this context is analyzed in the applicable sanctions framework memorandum referenced above.
U.S. Person Analysis. Sorokin's status as a U.S. citizen — notwithstanding her dual Russian nationality and her physical location in Dubai during the relevant period — makes her a "U.S. person" as defined by OFAC regulations and subjects her to the full range of OFAC prohibitions regardless of the geographic location of her conduct. This analysis is confirmed in Jasmine Thornton's Memorandum re: Corporate Structure & Jurisdictional Nexus — U.S. Person Analysis, dated May 10, 2022. Sorokin's U.S. person status is a critical jurisdictional element that establishes the basis for individual criminal liability under IEEPA and for OFAC enforcement authority.
Potential Individual Criminal Liability Under IEEPA. Based on the evidence summarized in this memorandum — particularly the encrypted messaging evidence demonstrating awareness of the Volkhov connection and the deliberate structuring of trades and payments to evade sanctions compliance — Sorokin faces potential individual criminal liability under IEEPA for willful violations of the OFAC-administered sanctions programs. The strength of the case for individual criminal liability is assessed in Section VII below.
Export Control Reform Act (ECRA) and EAR. Sorokin may also face potential exposure under the Export Control Reform Act, 50 U.S.C. §§ 4801–4852, and the Export Administration Regulations, specifically 15 C.F.R. § 746.5, in connection with the $12.4 million in oilfield equipment exports to Russia. However, as noted in Section IV.E above, Sorokin's involvement in the equipment export transactions appears to have been limited, with Yves Leclerc and Derek Hargrave more directly involved in those arrangements. Accordingly, while the ECRA/EAR exposure cannot be entirely excluded, it is not the primary basis for concern regarding Sorokin's individual liability.
VII. Assessment of Sorokin's Culpability
A. Factors Suggesting Knowledge and Intent
The following factors, considered in their totality, support the conclusion that Sorokin possessed the knowledge and intent necessary to establish willful violation of the IEEPA-enforced sanctions prohibitions:
1. Pre-Existing Personal Relationship with Sergei Volkov. Sorokin's personal relationship with Volkov predated her employment at DTI. This long-standing relationship provided Sorokin with familiarity with Volkov's business activities and connections, including his relationship with Volkhov Industrial Group. The pre-existing relationship also suggests that Sorokin's decision to bring the Petronova trading relationship to DTI was informed by personal knowledge of Volkov and his business network.
2. Encrypted Messaging Content. The recovered encrypted messaging communications constitute the strongest evidence of Sorokin's knowledge and intent. The messages contain direct discussions of Volkhov connections, references to "Arkady" (Arkady Volkhov), and explicit discussions of structuring trades and payments to avoid compliance detection. This evidence, if credited, would establish that Sorokin knowingly participated in a scheme to evade U.S. sanctions.
3. Sole Point of Contact for Volkov. Sorokin served as the sole DTI point of contact for Sergei Volkov on all 9 tainted transactions. This exclusive relationship gave Sorokin unique access to information about Petronova's operations and its connections to Volkhov, and it ensured that no other DTI personnel would independently develop knowledge of those connections through direct contact with Volkov.
4. Payment Routing Instructions. Sorokin provided specific instructions to Controller Rajesh Malhotra regarding payment routing for Petronova trades through intermediary accounts at Crescent Commercial Bank, and she communicated directly with the bank's relationship manager regarding account details. These actions go beyond the normal responsibilities of a trader and indicate active involvement in the payment structuring scheme identified by Ridgeline Advisory Group.
5. Deletion of Encrypted Messages. Sorokin deleted encrypted messages from her personal mobile device prior to surrendering the device pursuant to the litigation hold notice. The timing of the deletion — approximately two days after being placed on administrative leave — strongly suggests consciousness of guilt and an effort to destroy incriminating evidence.
6. Language Skills and Market Expertise. Sorokin's status as a Russian-American dual national, fluent in Russian and with extensive experience in Russian commodity markets, suggests a level of familiarity with Russian industrial entities — including Volkhov Industrial Group — that would make ignorance of the Volkhov connection implausible.
B. Factors Potentially Mitigating Culpability
The following factors may, to some degree, mitigate the inference of culpability:
1. Supervision and Authorization by Derek Hargrave. Sorokin operated under Derek Hargrave's supervision and authorization. Hargrave, as P