1016-00009 · Dunmore Energy Holdings · Internal Investigation

memo-pre-existing-compliance-program.docx DOCUMENT Litigation

30 / 88 ← → ✕

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

MEMORANDUM

TO: Victoria Chambers, Responsible Partner Howard Quinn, Billing Partner

FROM: Conrad Reeves, Senior Counsel, Export Controls & Sanctions Jasmine Thornton, Lead Associate, White Collar & Investigations

DATE: November 15, 2022

RE: Assessment of Dunmore Energy Holdings Ltd. Pre-Existing Sanctions and Export Controls Compliance Program (as of April 2022)

MATTER NO.: 1016-00009

CONFIDENTIALITY LEGEND: This memorandum constitutes attorney-client privileged communication and attorney work product prepared in connection with Calderwood & Harkness LLP's representation of Dunmore Energy Holdings Ltd. in the matter of the U.S. Department of Justice inquiry. This memorandum contains the mental impressions, conclusions, opinions, and legal theories of counsel and is protected from disclosure under the attorney work product doctrine. This memorandum is not to be disclosed, disseminated, or distributed to any person or entity without the express, prior written authorization of Victoria Chambers, Responsible Partner. All recipients are instructed to maintain this document in a secure manner consistent with the preservation of applicable privileges.

Right-click to update Table of Contents

I. Executive Summary

This memorandum presents the results of a comprehensive assessment of the sanctions and export controls compliance program maintained by Dunmore Energy Holdings Ltd. ("Dunmore" or "DEH") as it existed on April 19, 2022, the date on which the U.S. Department of Justice ("DOJ") inquiry was initiated through the issuance of grand jury subpoena GJ No. 22-418 by the U.S. District Court for the District of Columbia (Grand Jury 22-2). The assessment was conducted as part of Calderwood & Harkness LLP's broader internal investigation on behalf of Dunmore and is intended to inform the investigation team's evaluation of the company's potential exposure, the development of the remediation workstream, and the preparation of Dunmore's submissions to the DOJ and the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC").

The scope of this assessment encompasses all material components of Dunmore's pre-existing compliance infrastructure as applied across the company's global operations, including: written policies and procedures; sanctions and restricted party screening tools and processes; export control classification and licensing practices; third-party and counterparty due diligence; employee training and awareness programs; escalation and reporting mechanisms; organizational structure and resourcing of the compliance function; internal audit and testing; and recordkeeping practices. The assessment covers the compliance program as implemented at each of Dunmore's principal operating entities: Dunmore Energy Holdings Ltd. (Cayman Islands), Dunmore Trading International Ltd. ("DTI") (Dubai, UAE), Dunmore upstream Americas LLC ("DUA") (Houston, TX), Dunmore Renewables GmbH (Hamburg, Germany), and Dunmore Exploration West Africa Ltd. ("DEWA") (Lagos, Nigeria).

The methodology underlying this assessment involved multiple parallel workstreams. First, we reviewed all internal compliance policies, manuals, procedures, forms, and guidance documents maintained by Dunmore and its subsidiaries. Second, we conducted or directed three rounds of witness interviews, encompassing forty-seven (47) current and former employees across six jurisdictions (Round 1: 22 interviews; Round 2: 15 interviews; Round 3: 10 interviews). Third, we reviewed approximately 438,916 responsive documents (out of a total collection of 2,347,812 documents) processed and reviewed with the assistance of Nexagen Analytics Inc. (Project No. NX-DEH-2204), which provided technology-assisted review, predictive coding, and analytics support. Fourth, we incorporated the findings of forensic accounting analysis performed by Ridgeline Advisory Group LLC (Engagement No. RAG-2022-0319), led by Dr. Margaret Liu, CPA, CFE, which analyzed payment flows, transaction patterns, and financial records relevant to the sanctions compliance assessment. Fifth, we obtained expert input from Pemberton Investors Solutions LLC, specifically Dr. Anton Bremer, a recognized expert in OFAC compliance program design and evaluation, who provided benchmarking analysis and advisory opinions on industry standards applicable to companies of Dunmore's size and risk profile.

Key Conclusion. Based on the totality of the evidence reviewed, the witness testimony obtained, and the expert analysis performed, it is our assessment that Dunmore's pre-existing sanctions and export controls compliance program suffered from significant structural and operational deficiencies that directly contributed to the company's failure to detect and prevent transactions involving counterparties connected to Volkhov Industrial Group JSC ("Volkhov"), a Russian industrial conglomerate that was first designated under OFAC Directive 2 (sectoral sanctions, Executive Order 13662) on November 15, 2019, and subsequently added to the OFAC Specially Designated Nationals and blocked Persons List ("SDN List") (full blocking, Executive Order 14024) on April 6, 2022.

The program, taken as a whole, fell materially short of the standards articulated in the DOJ's Evaluation of Corporate Compliance Programs (the "DOJ Evaluation") and OFAC's "A Framework for OFAC Compliance Commitments" (the "OFAC Framework"), the two principal benchmarks used by the U.S. government to evaluate the adequacy of corporate sanctions compliance programs.

The deficiencies identified in this assessment span eight interconnected categories:

1. Organizational structure and resourcing — The compliance function was critically understaffed, underfunded, structurally subordinated, and lacked adequate authority and Board-level oversight.

2. OFAC and sanctions screening — Screening was performed using an inadequate tool, applied only at counterparty onboarding, and failed to incorporate the SSI List, the 50% Rule, or any non-U.S. sanctions lists.

3. Export control classification and licensing — No formal export control classification or licensing program existed, resulting in the shipment of controlled oilfield equipment to Russia without required BIS authorization.

4. Third-party and counterparty due diligence — Onboarding procedures were superficial, risk-tiering was absent, beneficial ownership verification was not performed, and ongoing monitoring was nonexistent.

5. Training and awareness — Training was generic, infrequent, not mandatory for the highest-risk personnel, and failed to address the specific sanctions and export risks facing Dunmore's trading operations.

6. Escalation and reporting — Escalation procedures were vague and informal, no red flag identification framework existed, and whistleblower mechanisms were ineffective at the most exposed subsidiary.

7. Internal audit and testing — No sanctions-specific audit or testing program existed; the internal audit function did not include sanctions compliance within its scope.

8. Recordkeeping — Compliance records were maintained in an ad hoc fashion without centralized systems, standardized formats, or retention protocols aligned with OFAC requirements.

These deficiencies, individually and collectively, allowed the conduct at issue — fourteen (14) crude oil swap transactions (approximately $218.7 million in aggregate notional value, of which nine transactions, approximately $156.3 million in notional value, involved Volkhov-connected entities), oilfield equipment exports (approximately $12.4 million via Caspian Logistik GmbH), and structured payments (approximately $34.2 million across 127 transactions through Crescent Commercial Bank PJSC) — to proceed without detection from approximately March 2020 through April 2022, a period of approximately two years.

The balance of this memorandum sets forth the factual findings, analysis, and conclusions supporting this assessment in detail.

II. Background

A. Dunmore Energy Holdings Ltd. — Corporate Overview

Dunmore Energy Holdings Ltd. ("DEH" or "Dunmore") is a Cayman Islands exempted company (Registration No. MC-334821) with its operational headquarters located at 1200 McKinney Street, Suite 3400, Houston, Texas 77010. Dunmore operates in the oil and gas exploration, production, and trading sectors, with an expanding renewable energy development business. For the fiscal year ending December 31, 2021, Dunmore reported annual revenue of approximately $4.87 billion, as reflected in audited financial statements prepared by Ashford & Whitmore LLP (engagement partner: Kenneth Ashford).

Dunmore employs approximately 3,200 individuals globally, distributed across its corporate headquarters in Houston and its operating subsidiaries in Dubai, Hamburg, Lagos, and other locations. The company's operations span the upstream, midstream, and trading segments of the energy value chain, with significant commodity trading activity concentrated at its Dubai-based subsidiary.

Dunmore's equity ownership is concentrated among three groups. The majority shareholder is Greystone Capital Partners Fund IV, L.P., which holds approximately 62.5% of the company's equity. Dunmore's management team holds approximately 22.5% of equity, and Thornbury Infrastructure Fund II, L.P. holds the remaining 15%. The company's senior leadership during the relevant period consisted of: Callum Renshaw, Chief Executive Officer (appointed 2018, based in Houston); Marcus Wellbourne, Esq., General Counsel; and Sandra Whitfield, Chief Financial Officer.

B. Key Subsidiaries

Dunmore operates through several principal subsidiaries, each of which is relevant to this assessment to varying degrees:

Dunmore Trading International Ltd. ("DTI"). DTI is the subsidiary at the center of the DOJ inquiry. DTI holds DIFC License No. CL-4827 and is located at Level 14, Gate Building 3, Dubai International Financial Centre, Dubai, United Arab Emirates. DTI is Dunmore's primary commodity trading vehicle, responsible for the execution of crude oil, refined products, and derivatives transactions with counterparties across the Middle East, North Africa, and Eurasia. During the relevant period, DTI was led by Derek Hargrave, who served as President until he was placed on administrative leave effective July 1, 2022, and whose employment was subsequently terminated effective October 1, 2022. DTI's trading desk, under Hargrave's supervision and with the direct involvement of Senior Trader Natasha Sorokin, was responsible for the transactions under investigation.

Dunmore upstream Americas LLC ("DUA"). DUA is a Delaware limited liability company (EIN: 84-2937561) co-located with Dunmore's corporate headquarters at 1200 McKinney Street, Suite 3400, Houston, Texas. DUA manages Dunmore's U.S.-based exploration and production operations, including assets in the Permian Basin and the Gulf of Mexico.

Dunmore Renewables GmbH. Dunmore Renewables is organized under German law and is located at Überseeallee 12, 20457 Hamburg, Germany. Its Managing Director is Tobias Engel. The entity is principally engaged in the development and financing of wind and solar energy projects in Northern Europe. While not a primary subject of the DOJ inquiry, Dunmore Renewables is tangentially involved by virtue of one suspect transaction involving Caspian Logistik GmbH, a Hamburg-based logistics intermediary that was recommended to Dunmore Renewables by DTI's Dubai desk.

Dunmore Exploration West Africa Ltd. ("DEWA"). DEWA is located at 14B Kofo Abayomi Street, Victoria Island, Lagos, Nigeria, and manages Dunmore's upstream exploration and production activities in the Niger Delta and offshore West Africa. DEWA is not a direct subject of the suspect transactions but is relevant to the assessment of the global reach (or lack thereof) of Dunmore's compliance program.

C. The Conduct at Issue — Brief Summary

The DOJ inquiry concerns a pattern of potentially sanctioned transactions conducted by DTI's Dubai-based trading desk over a period of approximately two years, from March 2020 through April 2022. Based on the investigation to date — including the document review, witness interviews, and forensic accounting analysis referenced in Section I — the conduct at issue falls into three distinct but related categories.

First: Crude Oil Swap Transactions. Between approximately March 2020 and April 2022, DTI's trading desk entered into fourteen (14) crude oil swap transactions with an aggregate notional value of approximately $218.7 million. The counterparties to these transactions were Petronova Trading FZE (Managing Director: Sergei Volkov) and Zenith Petroleum DMCC (Managing Director: Farhan Qureshi), both Dubai-based entities. Of the fourteen transactions, nine (9) — with an aggregate notional value of approximately $156.3 million — involved counterparties with beneficial ownership ties to Volkhov Industrial Group JSC, in potential violation of the prohibitions set forth in OFAC Directive 2 under Executive Order 13662 (which, during the relevant period, prohibited certain dealings in the debt and equity of Volkhov as a designated entity under sectoral sanctions).

Second: Oilfield Equipment Exports. Between approximately August 2020 and January 2022, DTI arranged for the export of oilfield drilling equipment and components with a total value of approximately $12.4 million. These goods were classified under Export Administration Regulations ("EAR") Export Control Classification Numbers ("ECCN") 2B350 and 2B999, classifications that required license review for Russia-destined exports under EAR §746.5. The shipments were routed through Caspian Logistik GmbH (Managing Director: Klaus Weidemann, Hamburg, Germany), a logistics intermediary that provided end-user certifications identifying non-Russian end users. Subsequent analysis conducted by Liam Donahue (memorandum dated July 20, 2022) identified evidence suggesting that the end-user certifications were potentially false and that the ultimate destination of the goods was Russia, in potential violation of EAR §746.5 and applicable OFAC prohibitions.

Third: Structured Payments. Between approximately March 2020 and March 2022, DTI directed approximately $34.2 million in payments across 127 separate transactions routed through intermediary accounts at Crescent Commercial Bank PJSC (Relationship Manager: Khalid Mansour). Forensic analysis by Ridgeline Advisory Group LLC determined that these payments were structured in a manner consistent with an intent to obscure the beneficial ownership of the receiving parties — specifically, to obscure the fact that the ultimate beneficiary of a significant portion of these funds was Volkhov Industrial Group JSC or entities controlled by Volkhov.

The Principal Sanctioned Entity. Volkhov Industrial Group JSC (Chairman: Arkady Volkhov, 12 Kutuzovsky Prospekt, Moscow, Russia) is a major Russian industrial conglomerate with interests spanning oil and gas, mining, metals, and industrial manufacturing. Volkhov was designated under OFAC Directive 2 (sectoral sanctions, Executive Order 13662) on November 15, 2019, subjecting it to specific prohibitions on transactions involving the entity's debt and equity. On April 6, 2022 — shortly before the issuance of the grand jury subpoena — Volkhov was added to the OFAC SDN List under Executive Order 14024, subjecting it to full blocking sanctions.

D. Applicable Legal and Regulatory Framework

This assessment evaluates Dunmore's compliance program against the requirements of the U.S. sanctions and export control regulatory framework, which includes the following principal authorities:

OFAC-Administered Sanctions Programs. The relevant OFAC programs include Executive Order 14024 (issued April 15, 2021, as amended), which authorizes blocking sanctions against persons determined to operate or have operated in specified sectors of the Russian Federation economy, as well as persons determined to be owned or controlled by, or to have acted or purported to act for or on behalf of, persons blocked under the order. Additionally, Directive 2 under Executive Order 13662 imposes sectoral sanctions on specified entities, prohibiting U.S. persons from transacting in, providing financing for, or otherwise dealing in new debt of longer than 14 days maturity or new equity of persons determined to be subject to the directive. The implementing regulations are codified at 31 C.F.R. Part 589 (Ukraine/Russia-Related Sanctions Regulations).

Export Administration Regulations. The EAR (15 C.F.R. Parts 730–774) establish a comprehensive regulatory framework governing the export, re-export, and in-country transfer of items subject to U.S. jurisdiction. Relevant provisions include EAR §746.5, which imposes license requirements for exports and re-exports of specified items to Russia and Belarus. The ECCNs at issue in this matter — 2B350 (chemical manufacturing facilities and equipment) and 2B999 (specific processing equipment not controlled by 2B350) — are subject to these license requirements. During the relevant period, the license review policy for Russia-destined exports of items classified under these ECCNs was a policy of denial.

Criminal Statutes. The International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. §§ 1701–1706, provides criminal penalties for willful violations of sanctions imposed under IEEPA-based executive orders, including imprisonment for up to twenty years and fines of up to $1 million per violation. The Export Control Reform Act ("ECRA"), 50 U.S.C. §§ 4801–4852, provides the statutory authority for the EAR and establishes criminal penalties for willful violations of export control requirements, including imprisonment for up to twenty years and fines of up to $1 million per violation (or five times the value of the exports involved, whichever is greater).

OFAC Compliance Framework. OFAC's "A Framework for OFAC Compliance Commitments" (published May 2, 2019) (the "OFAC Framework") identifies five essential components of a risk-based sanctions compliance program: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training. OFAC has stated that it will consider the existence and adequacy of a sanctions compliance program as a factor in determining appropriate enforcement actions and that the Framework provides "a set of guiding principles" that organizations — regardless of their size, sophistication, or industry — should consider when developing and implementing sanctions compliance programs.

DOJ Compliance Program Guidance. The DOJ's "Evaluation of Corporate Compliance Programs" (the "DOJ Evaluation," most recently updated September 2022 and March 2023) sets forth the criteria DOJ prosecutors apply when evaluating the effectiveness of a company's compliance program in the context of criminal investigations and enforcement actions. The DOJ Evaluation examines three fundamental questions: (i) "Is the corporation's compliance program well designed?"; (ii) "Is the program being applied earnestly and in good faith? In other words, is the program being implemented effectively?"; and (iii) "Does the corporation's compliance program work in practice?" Additionally, the DOJ's Corporate Enforcement Policy (updated September 2022) provides that a company may be eligible for a declination of prosecution if it voluntarily self-discloses misconduct, fully cooperates, and timely and appropriately remediates — factors that make the pre-existing compliance program's adequacy a central issue in the disposition of this matter.

E. Benchmarking Standards Used in This Assessment

In evaluating Dunmore's compliance program, this assessment applies the following benchmarking standards:

First, the five essential components of the OFAC Framework, as described above, which provide the primary substantive benchmark for evaluating each element of the sanctions compliance program.

Second, the hallmarks of an effective compliance program as set forth in the DOJ Evaluation, including the adequacy of program design, the rigor of implementation, the sufficiency of resources, the autonomy and authority of compliance personnel, and the program's demonstrated effectiveness in practice.

Third, industry best practices for global commodity trading companies of comparable size and risk profile. For benchmarking purposes, Dr. Anton Bremer of Pemberton Investors Solutions LLC identified a peer group of energy and commodity trading companies with annual revenues exceeding $1 billion and operations in high-risk jurisdictions, including the UAE and Russia-adjacent markets. Industry standards within this peer group were used to assess the adequacy of Dunmore's compliance staffing ratios, budgets, screening protocols, due diligence procedures, and training programs.

Fourth, the compliance program guidelines published by the Bureau of Industry and Security ("BIS") of the U.S. Department of Commerce, which provide supplementary guidance on export control compliance program design and implementation.

Together, these benchmarks provide the analytical framework within which each component of Dunmore's compliance program is evaluated in the sections that follow.

III. Organizational Structure and Compliance Resourcing

The organizational structure, resourcing, and governance of a company's compliance function are foundational to the effectiveness of any sanctions and export controls compliance program. Both the OFAC Framework and the DOJ Evaluation identify "management commitment" and "adequate resources and empowerment" as threshold requirements. A compliance program that lacks adequate staffing, budget, authority, and reporting lines to senior leadership and the Board of Directors cannot be expected to function effectively, regardless of the quality of its written policies or procedures. As set forth below, Dunmore's compliance function suffered from profound structural deficiencies in each of these areas.

A. Compliance Function Reporting Structure

During the relevant period, Dunmore's Chief Compliance Officer ("CCO") was Gerald Fisk, who was based in Houston, Texas. Fisk joined Dunmore in 2016 and served as CCO until his departure from the company on June 10, 2022. Fisk has retained personal counsel, Catherine Blackthorn of Blackthorn & Associates LLP, Houston, in connection with the DOJ inquiry and this internal investigation.

Fisk reported to General Counsel Marcus Wellbourne, who in turn reported to CEO Callum Renshaw. This reporting structure — in which the CCO reported to the General Counsel rather than directly to the CEO, the Board of Directors, or a dedicated Board-level compliance committee — constitutes a significant structural deficiency under both the OFAC Framework and the DOJ Evaluation. The OFAC Framework's "management commitment" component emphasizes the importance of direct reporting lines from the senior compliance officer to the Board or a Board-level committee, which ensures that compliance matters receive adequate attention at the highest governance levels and that the compliance function operates with sufficient independence from business units. The DOJ Evaluation similarly examines whether compliance personnel have "sufficient stature" within the organization and a "direct line to the board" or an appropriate committee thereof.

At Dunmore, no such direct reporting line existed. Fisk did not report to the Board of Directors in any capacity. Moreover, there was no dedicated compliance committee at the Board level. The Board of Directors of DEH received periodic reports from General Counsel Wellbourne that included, at most, cursory references to compliance matters, but the Board did not exercise active oversight of the sanctions compliance program.

The absence of a direct CCO-to-Board reporting line had practical consequences. It meant that the Board received limited, if any, information about the specific sanctions and export risks facing Dunmore's trading operations, the adequacy of the compliance program's resources, or the emerging regulatory developments — including the significantly expanded Russia-related sanctions authorities introduced by Executive Order 14024 in April 2021 — that materially affected the company's risk profile. It also meant that Fisk's ability to escalate concerns or request additional resources was mediated through the General Counsel, creating a structural barrier to effective compliance governance.

B. Compliance Team Size and Geographic Coverage

As of April 2022, Dunmore's compliance function consisted of approximately four (4) full-time equivalent ("FTE") employees globally. This team comprised Gerald Fisk, as CCO, plus three junior compliance analysts, all of whom were based in the Houston office. The three junior analysts were generalists with responsibilities spanning anti-corruption, trade compliance, anti-money laundering, and general regulatory matters; none held specialized sanctions or export control certifications or possessed relevant subject-matter expertise.

Critically, no dedicated compliance personnel were stationed at DTI in Dubai — notwithstanding that DTI was Dunmore's highest-risk operating subsidiary by virtue of its commodity trading activities in the Middle East, its exposure to Russian and Russian-connected counterparties, and the nature of the transactions it executed daily. DTI's trading desk operated without any on-site compliance presence, compliance review of transactions, or real-time compliance oversight.

Similarly, no compliance personnel were located at Dunmore Renewables GmbH in Hamburg, DEWA in Lagos, or any other non-U.S. subsidiary. The entire compliance function was centralized in Houston, with no mechanism for providing timely, on-the-ground compliance support to the company's international operations.

The resulting staffing ratio was approximately one (1) compliance FTE per 800 employees. According to the benchmarking analysis provided by Dr. Bremer of Pemberton Investors Solutions, the industry benchmark for energy and commodity trading companies of comparable size and risk profile — particularly those with operations in high-risk jurisdictions and exposure to Russia-related sanctions programs — is approximately one (1) compliance FTE per 200 to 300 employees. Dunmore's compliance staffing was therefore approximately three to four times below the industry norm for companies with similar risk exposure.

Furthermore, Fisk served as the sole senior compliance professional within the organization. There was no deputy CCO, no succession plan, and no individual with the qualifications or experience to assume Fisk's responsibilities in the event of his absence, departure, or incapacitation. The concentration of institutional knowledge and decision-making authority in a single individual created a single point of failure for the entire compliance function — a risk that materialized when Fisk departed the company in June 2022.

C. Budget and Resources

Dunmore's annual compliance budget for fiscal year 2021 was approximately $1.2 million. This figure included personnel costs for Fisk and the three junior analysts, the licensing fees for the company's commercial sanctions screening platform, training materials and administration, and miscellaneous operational expenses. Notably, there was no dedicated budget line item for export control compliance; export control matters were handled informally by Fisk, with ad hoc consultation from outside counsel that did not possess a recognized sanctions or export control specialty. Prior outside counsel engaged on these matters have not been identified in the document review as having held themselves out as specialists in sanctions or export control law.

The compliance budget was wholly inadequate for a company of Dunmore's size, global footprint, and risk profile. According to Dr. Bremer's benchmarking analysis, companies of Dunmore's revenue scale (approximately $4.87 billion) and risk profile — particularly those engaged in global commodity trading with exposure to Russia-related sanctions — typically allocate between $3 million and $5 million annually for sanctions and export control compliance. This industry benchmark encompasses personnel costs, screening and monitoring technology, training program development and delivery, third-party due diligence tools, external expert advisors, and compliance program testing and auditing. Dunmore's $1.2 million budget was therefore approximately 25% to 40% of the expected allocation.

Furthermore, the document review revealed no allocation for compliance technology upgrades in either the FY 2020 or FY 2021 budgets. The company's sanctions screening platform, discussed in detail in Section IV below, was an outdated, off-the-shelf product that lacked critical capabilities, yet no investment was made to upgrade or replace it during the relevant period. Requests by Fisk for additional compliance resources have not been identified in the documentary record, raising the question — explored further in Section XII (Root Cause Analysis) — of whether Fisk perceived that such requests would be futile, whether he failed to appreciate the inadequacy of his resources, or whether such requests were made informally and not documented.

D. Management Commitment Assessment

The OFAC Framework and the DOJ Evaluation both emphasize the importance of "tone at the top" — the degree to which an organization's senior leadership demonstrates a genuine commitment to compliance as a core corporate value, communicates that commitment to employees at all levels, and allocates adequate resources to support the compliance function. Our assessment of management commitment at Dunmore revealed a pattern of indifference to sanctions compliance at the senior leadership level.

Interviews with Dunmore's three most senior executives produced the following findings:

In his interview on May 23, 2022, CEO Callum Renshaw stated that compliance matters were "handled by Gerald [Fisk] and Marcus [Wellbourne]" and that he was not routinely briefed on sanctions developments affecting the company's trading operations. Renshaw could not identify any specific sanctions regulatory developments that he had been briefed on during the 2020–2022 period, including the issuance of Executive Order 14024 in April 2021 or the SDN designation of Volkhov in April 2022 (which he learned of only after the issuance of the grand jury subpoena). Renshaw acknowledged that compliance was not a regular agenda item at senior management team meetings and that he could not recall any instance in which sanctions compliance was discussed at a Dunmore Board meeting during his tenure as CEO.

In her interview on May 30, 2022, CFO Sandra Whitfield confirmed that the internal audit function, which reported to her, did not include sanctions compliance within its audit scope. Whitfield stated that she viewed sanctions compliance as a "legal matter" under the purview of the General Counsel's office and that she had not requested or received reports on the effectiveness of the sanctions compliance program. Whitfield further confirmed that the compliance budget was set by the General Counsel's office and that she did not recall any requests for increased compliance funding being submitted through the normal budgetary process.

In his interview on May 25, 2022, Derek Hargrave, President of DTI, stated that he was aware that DTI did not have dedicated compliance personnel but had not viewed this as a material concern. Hargrave stated that compliance screening of counterparties "was supposed to be handled by Houston" and that he relied on the assumption that Houston headquarters would flag any issues with DTI's counterparties or transactions. Hargrave acknowledged that he had never requested compliance support for DTI's trading operations and that he did not recall receiving any communications from Gerald Fisk regarding sanctions developments or compliance requirements specific to DTI's business activities.

Taken together, these interview findings demonstrate that the tone at the top regarding sanctions compliance at Dunmore was, at best, neutral — and more accurately characterized as negligent. There was no affirmative messaging from senior leadership emphasizing sanctions compliance as a corporate priority, no visible engagement by the CEO or CFO with the compliance function, and no allocation of the resources necessary to build and maintain a program commensurate with Dunmore's risk profile. This failure of management commitment is, in our assessment, a root cause of the programmatic deficiencies documented throughout this memorandum.

IV. OFAC and Sanctions Screening

Sanctions screening — the process by which an organization identifies whether its counterparties, transaction participants, and other relevant persons are the subject of sanctions designations or otherwise restricted — is a cornerstone of any effective sanctions compliance program. The OFAC Framework identifies screening as a core "internal controls" component and states that organizations should implement screening processes that are "risk-based" and calibrated to "the sanctions risks they face." The DOJ Evaluation similarly examines whether a company has implemented controls sufficient to ensure that prohibited transactions are identified and blocked before they are executed. As set forth below, Dunmore's screening practices were deficient in virtually every material respect.

A. Screening Tools and Processes

Our review of Dunmore's compliance technology infrastructure, as supplemented by interviews with Gerald Fisk and the three Houston-based compliance analysts, established that Dunmore utilized a single commercial sanctions screening platform for all screening purposes. The document review identified the platform as a basic, off-the-shelf product that provided limited functionality relative to the risks inherent in Dunmore's business operations.

Specifically, the platform lacked the following critical capabilities: customizable risk-scoring algorithms that would permit calibration of screening sensitivity to Dunmore's particular risk profile; fuzzy-matching algorithms capable of accurately matching transliterated Russian, Arabic, or Cyrillic names, which is essential for a commodity trading company transacting with Middle Eastern and Russian-adjacent counterparties; integration with OFAC's Sectoral Sanctions Identification ("SSI") List; integration with non-U.S. sanctions lists (EU, UK, UAE); and configurable alert management and audit trail functionality.

The screening process suffered from a fundamental limitation: screening was conducted only at the time of onboarding new counterparties. Once a counterparty passed the initial onboarding screen, no periodic or event-driven rescreening was performed. There was no automated or scheduled process for rescreening existing counterparties against updated sanctions lists, and no protocol for triggering rescreening in response to regulatory developments (e.g., new executive orders, list updates, or designation changes).

Additionally, the screening platform was not integrated with any of Dunmore's operational systems. There was no connection between the screening tool and the company's trading system, its enterprise resource planning ("ERP") software, or its accounts payable and accounts receivable systems. This lack of integration meant that transactions could be — and were — executed, invoiced, and settled without any automated sanctions check at the transaction level. Wire transfer instructions and payment beneficiaries were not screened against sanctions lists before payments were processed, a deficiency that is directly relevant to the $34.2 million in structured payments routed through Crescent Commercial Bank PJSC.

B. Rescreening Deficiencies

The absence of a rescreening protocol was perhaps the single most consequential deficiency in Dunmore's screening program. Sanctions lists are dynamic; OFAC updates the SDN List, the SSI List, and other restricted party lists on a frequent and sometimes unpredictable basis. A compliance program that screens counterparties only at onboarding and fails to rescreen when lists are updated is inherently incapable of detecting sanctions exposure that arises after the initial onboarding screen.

Dunmore's compliance team performed an annual OFAC list update refresh, but our review established that this process was manual and ad hoc. The annual refresh consisted of Fisk or one of the junior analysts downloading the most recent version of the OFAC SDN List, comparing it to the version loaded in the screening platform, and updating the platform accordingly. There was no documented procedure for this process, no quality assurance or verification step, and no record of whether the annual refresh was completed each year.

The consequences of this deficiency are starkly illustrated by the facts of this case. When Volkhov Industrial Group JSC was designated under OFAC Directive 2 on November 15, 2019, no rescreening of Dunmore's existing counterparty database was triggered. As a result, no systematic review was conducted to determine whether any of Dunmore's existing counterparties — including Petronova Trading FZE, which was onboarded in approximately early 2020 — had connections to Volkhov.

Gerald Fisk addressed this issue directly in his June 8, 2022 interview, conducted by Victoria Chambers with Catherine Blackthorn present as Fisk's personal counsel. Fisk acknowledged that the November 2019 Directive 2 designation of Volkhov "did not result in a systematic review of Dunmore's counterparty database." Fisk stated that he was generally aware of the Volkhov designation at the time it occurred but did not take specific steps to identify Dunmore counterparties with potential connections to Volkhov because the screening tool did not support SSI List screening and because he did not consider the Directive 2 designation to be directly relevant to DTI's trading operations. This assessment — which reflected a misunderstanding of the scope and application of Directive 2 — contributed to the failure to identify Petronova's Volkhov connections.

It was not until April 11, 2022 — five days after the full SDN blocking of Volkhov on April 6, 2022 — that Fisk conducted a rescreening refresh. Upon running the updated SDN List through the screening platform, Fisk identified a potential match for Volkhov and, through further manual research, identified potential historical exposure through Petronova Trading FZE. Fisk notified General Counsel Marcus Wellbourne on the same date. The grand jury subpoena was issued eight days later, on April 19, 2022.

The approximately two-and-a-half-year gap between Volkhov's initial Directive 2 designation (November 15, 2019) and Dunmore's identification of its exposure (April 11, 2022) represents a critical and fundamental failure of the rescreening process. During this period, nine of the fourteen crude oil swap transactions at issue were executed without any sanctions screening having identified the Volkhov connection.

C. SDN List, Sectoral Sanctions Identification (SSI) List, and Consolidated Screening

Our review established that Dunmore's screening program was limited to the OFAC SDN List. The OFAC Sectoral Sanctions Identification ("SSI") List — which identifies entities subject to sectoral sanctions under Directives 1 through 4 of Executive Order 13662 — was not integrated into the screening platform as a separate screening criterion and was not applied as part of the screening process.

This omission is particularly significant because Volkhov Industrial Group was listed on the SSI List (Directive 2) from November 15, 2019 through its addition to the SDN List on April 6, 2022. Had Dunmore screened its counterparties against the SSI List, the screening process could have identified Volkhov-connected entities at the onboarding stage or during a rescreening cycle, potentially preventing or detecting the transactions at issue.

Beyond the SSI List, Dunmore's screening did not incorporate any of the following restricted party lists, each of which is relevant to a company with Dunmore's global footprint and the nature of its operations:

• BIS Entity List (15 C.F.R. Part 744, Supplement No. 4) — a list of entities subject to specific license requirements under the EAR, which is directly relevant to Dunmore's export of controlled oilfield equipment.

• BIS Denied Persons List — a list of individuals and entities denied export privileges.

• BIS Unverified List (15 C.F.R. Part 744, Supplement No. 6) — a list of entities for which BIS has been unable to verify the bona fides (legitimacy and reliability) of parties to export transactions.

• EU Consolidated Financial Sanctions List — relevant to Dunmore Renewables GmbH's operations in Germany and DTI's potential EU nexus through Caspian Logistik GmbH (Hamburg).

• UK Office of Financial Sanctions Implementation ("OFSI") Consolidated List — relevant to transactions with UK-nexus counterparties and financial institutions.

• UAE sanctions lists — relevant to DTI's operations in Dubai.

The failure to screen against these additional lists exposed Dunmore to the risk of transacting with restricted parties across multiple jurisdictional regimes and further compounded the deficiencies in the company's screening program.

D. 50% Rule Analysis Failures

OFAC's 50% Rule provides that the property and interests in property of entities owned, directly or indirectly, fifty percent (50%) or more, individually or in the aggregate, by one or more blocked persons are also considered blocked, regardless of whether the entity itself appears on the SDN List. The 50% Rule is a critical component of OFAC compliance because it extends the reach of blocking sanctions beyond the specifically named SDN to encompass entities within the SDN's ownership and control structure.

Dunmore did not incorporate the 50% Rule into its counterparty screening or due diligence procedures in any form. There was no process for determining or verifying the beneficial ownership of counterparties and comparing the results against SDN-listed entities. There was no written policy, procedure, or guidance document addressing the 50% Rule. The screening platform did not have the capability to perform ownership chain analysis or cross-reference counterparty ownership structures against the SDN List.

This gap was a root cause of the failure to identify Petronova Trading FZE as a Volkhov-connected entity. As detailed in Liam Donahue's June 15, 2022 memorandum regarding Petronova's beneficial ownership and Conrad Reeves's June 20, 2022 memorandum regarding Volkhov's designation history and 50% Rule analysis, Petronova was managed by Sergei Volkov, who maintained beneficial ownership ties to Volkhov Industrial Group JSC sufficient to trigger the 50% Rule. Had Dunmore maintained a procedure for verifying the beneficial ownership of counterparties and analyzing that ownership against the SDN List under the 50% Rule, the Volkhov connection could have been identified at the time Petronova was onboarded or, at the latest, upon the Volkhov Directive 2 designation in November 2019.

The absence of any 50% Rule capability represents a fundamental gap in Dunmore's compliance program and one that is particularly egregious given the company's substantial exposure to Russian-connected counterparties through its Middle East trading operations.

V. Export Control Classification and Licensing

In addition to its sanctions compliance deficiencies, Dunmore lacked a meaningful export control compliance program. Export controls — administered primarily by BIS under the EAR — impose licensing requirements on the export, re-export, and in-country transfer of controlled items, including dual-use goods, technology, and software. For a company engaged in the global trade of oilfield equipment and technology, export control compliance is an essential element of the overall trade compliance framework. As set forth below, Dunmore had no formal export control classification program, no licensing procedures, and no personnel dedicated to EAR compliance.

A. Export Administration Regulations Compliance

Our review found no evidence that Dunmore maintained a formal export control classification program for the goods, technology, or software that it exported, re-exported, or transferred through its subsidiaries. No written procedure existed for classifying items against the Commerce Control List ("CCL") to determine whether they were subject to EAR jurisdiction, what their applicable ECCN was (if any), and whether a BIS export license was required for the intended destination, end user, and end use.

This deficiency had direct consequences. The oilfield drilling equipment and components shipped through Caspian Logistik GmbH between approximately August 2020 and January 2022 were classified under EAR ECCNs 2B350 and 2B999. These classifications — which correspond to chemical manufacturing equipment and specific processing equipment, respectively — triggered license requirements for Russia-destined exports under EAR §746.5. During the relevant period, the license review policy for items classified under these ECCNs destined for Russia was a policy of denial, meaning that BIS would presumptively deny any license application for the export of such items to Russia.

Despite the clear applicability of these license requirements, our review identified no evidence that any license applications were filed with BIS for the approximately $12.4 million in oilfield equipment exports during the relevant period. The goods were shipped without any export control review, license determination, or BIS authorization.

No export control compliance officer or designated responsible individual for EAR compliance was appointed at DTI, DUA, Dunmore Renewables GmbH, or any other subsidiary. Gerald Fisk, as CCO, handled export control matters on an informal, ad hoc basis, but Fisk had no formal training or certification in export control compliance and did not consider export controls to be a primary focus of his responsibilities. Fisk consulted from time to time with outside counsel on export control questions, but the outside counsel engaged by Dunmore for these purposes was not identified in the document review as possessing a recognized export control specialty.

B. End-User and End-Use Verification

The oilfield equipment shipments routed through Caspian Logistik GmbH were accompanied by end-user certifications provided by Caspian Logistik that identified non-Russian end users for the goods. These certifications were accepted at face value; no independent verification of their accuracy was performed by Dunmore or any of its subsidiaries.

Yves Leclerc, Director of Logistics & Shipping at DTI (based in Dubai), was responsible for handling shipping documentation for the oilfield equipment transactions. In his interview on June 22, 2022 (conducted by Amara Osei), Leclerc stated that he "relied entirely on Caspian Logistik's representations regarding end users" and that he had "no reason to question" the accuracy of the end-user certifications. Leclerc further stated that he had not received any training on export control requirements, red flags for diversion, or end-user verification procedures, and that he was not aware that the goods in question were subject to EAR licensing requirements.

No "know your customer" or enhanced due diligence process existed for logistics intermediaries handling controlled goods. The due diligence performed on Caspian Logistik GmbH — which, as discussed in Section VI.D below, was minimal — did not include any assessment of the intermediary's practices regarding end-user verification, its history of export control compliance, or the reliability of the end-user certifications it provided.

Liam Donahue's July 20, 2022 memorandum on Caspian Logistik GmbH documented evidence suggesting that the end-user certifications provided by Caspian Logistik were potentially false. Specifically, Donahue's analysis identified discrepancies between the stated end users and the actual shipping destinations, as well as evidence of transshipment patterns consistent with diversion of the goods to Russia. The full findings of that analysis are set forth in Donahue's memorandum and are incorporated here by reference.

C. Deemed Export Controls

The EAR's deemed export rules (15 C.F.R. § 734.13) provide that the release of controlled technology or source code to a foreign person in the United States (or, under the deemed re-export rule, in a third country) is "deemed" to be an export to the foreign person's country or countries of nationality. Compliance with deemed export rules requires organizations to assess the nationality of individuals who may have access to controlled technology and to obtain licenses where required.

No assessment of deemed export risks was performed for technology shared with foreign national employees at DTI or other non-U.S. subsidiaries. DTI employed a multinational workforce that included, among others, Natasha Sorokin (a Russian-American dual national), Yves Leclerc (a French national), and other non-U.S. persons who may have had access to controlled technology, technical data, or software in the course of their employment. No Technology Control Plan ("TCP") was in place at DTI or at any other Dunmore entity to govern access to controlled technology by foreign nationals.

The absence of a deemed export compliance framework is a significant gap, particularly given the nature of Dunmore's business (which involves technical aspects of oilfield equipment, drilling technology, and energy sector technology) and the composition of its workforce at non-U.S. locations.

VI. Third-Party and Counterparty Due Diligence

Effective third-party and counterparty due diligence is a critical safeguard against sanctions violations. The use of intermediaries, front companies, and opaque corporate structures to evade sanctions is a well-documented typology, and both OFAC and the DOJ have consistently emphasized the importance of robust due diligence as a means of detecting and preventing indirect sanctions violations. The OFAC Framework identifies "risk-based" due diligence as a core internal control, and the DOJ Evaluation examines the rigor and comprehensiveness of a company's third-party management processes. As set forth below, Dunmore's third-party and counterparty due diligence program was fundamentally inadequate.

A. Onboarding Procedures

Dunmore's counterparty onboarding procedure consisted of a basic "know your counterparty" ("KYC") form that required the following information: entity name, jurisdiction of registration, contact information, principal shareholders (self-reported by the counterparty), and a single-pass sanctions screening against the SDN List. The KYC form did not require, and the onboarding process did not involve, any of the following elements:

• Verified corporate registry documents (e.g., certificates of incorporation, commercial register extracts, or equivalent documents authenticated by an independent source);

• Audited financial statements or evidence of the counterparty's financial standing;

• Independent beneficial ownership verification (i.e., verification of beneficial ownership through sources independent of the counterparty's self-reporting);

• Risk-tiering of the counterparty based on geography, industry, sanctions exposure, or other relevant risk factors;

• Enhanced due diligence for higher-risk counterparties (e.g., entities domiciled in sanctioned or high-risk jurisdictions, newly incorporated entities, entities with Russian-national principals, or entities involved in commodity trading with Russian nexus);

• Adverse media screening or public-source intelligence review;

• Site visits, reference checks, or independent background investigations.

Dubai-based counterparties — including Petronova Trading FZE and Zenith Petroleum DMCC, the two principal counterparties at issue in this matter — were onboarded through DTI's local process. The DTI onboarding process was, if anything, even less rigorous than the Houston-based process. In the absence of any dedicated compliance personnel at DTI, the onboarding of new counterparties was performed by trading desk personnel or administrative staff, without compliance review or approval.

B. Petronova Trading FZE — Case Study in Due Diligence Failure

The onboarding of Petronova Trading FZE exemplifies the deficiencies in Dunmore's counterparty due diligence program. Petronova Trading FZE was registered in the Jebel Ali Free Zone Authority ("JAFZA"), UAE, with a registered address at Office 1407, Al Shafar Tower, Dubai Internet City. Petronova was onboarded as a counterparty to DTI in approximately early 2020, shortly before the first crude oil swap transaction was executed.

Our review of Petronova's KYC file — maintained as a paper file at DTI's Dubai office — revealed that the file contained only three documents: (1) a copy of Petronova's JAFZA trade license; (2) a self-reported shareholder declaration naming Sergei Volkov as the sole shareholder; and (3) basic sanctions screening results showing no hits against the SDN List. As noted in Section IV above, the SDN screening missed Volkov's connections to Volkhov Industrial Group because the screening did not incorporate the SSI List or the 50% Rule.

No independent verification of Sergei Volkov's identity, background, or associations was performed. No check was made of publicly available databases, corporate registries, adverse media sources, or open-source intelligence to determine whether Volkov had connections to sanctioned entities or individuals. No inquiry was made into the corporate structure of Petronova beyond the self-reported shareholder declaration. No assessment was made of the source of Petronova's crude oil supply or the ultimate origins of the commodities to be traded.

The onboarding of Petronova presented multiple red flags that, under industry best practices, should have triggered enhanced due diligence and, potentially, a decision not to proceed with the counterparty relationship:

(a) Newly incorporated entity. Petronova was incorporated shortly before the first transactions with DTI, a common indicator of a potential front company established for the purpose of evading sanctions.

(b) Russian-national managing director. Sergei Volkov, Petronova's sole shareholder and managing director, is a Russian national. In the post-2014 Crimea sanctions environment, a Russian-national principal of a commodity trading entity in the UAE is a well-recognized risk indicator.

(c) Commodity trading in Russian-origin crude oil. The transactions contemplated with Petronova involved crude oil with Russian-origin or Russian-destination characteristics, a further indicator of sanctions risk.

(d) Opaque corporate structure. Petronova's corporate structure was opaque, with limited publicly available information and a single-shareholder FZE structure that is commonly used in the UAE to shield beneficial ownership.

Industry best practices for Dubai-based commodity trading firms — as confirmed by Dr. Bremer's benchmarking analysis — require enhanced KYC for any counterparty with a Russian nexus, particularly in the post-2014 Crimea sanctions era. Enhanced KYC typically includes: independent verification of beneficial ownership through corporate registry searches and third-party databases; background checks on principals; adverse media screening; assessment of source of funds and source of commodities; and, where warranted, site visits or direct engagement with the counterparty to assess legitimacy. None of these measures were taken with respect to Petronova.

C. Zenith Petroleum DMCC — Similar Deficiencies

Zenith Petroleum DMCC (Unit 2201, Jumeirah Bay Tower X2, Cluster X, Jumeirah Lakes Towers, Dubai; Managing Director: Farhan Qureshi) was a counterparty to DTI in two of the fourteen flagged crude oil swap transactions. Zenith Petroleum's involvement in the transactions at issue raises similar concerns regarding the adequacy of Dunmore's counterparty due diligence.

Our review of Zenith Petroleum's KYC file revealed deficiencies substantially identical to those identified in the Petronova file. The KYC documentation was minimal, consisting of basic corporate formation documents and a self-reported ownership declaration. No red flag analysis was conducted, despite the entity's involvement in Russian-origin crude transactions. No enhanced due diligence was performed.

Amara Osei's July 5, 2022 memorandum detailed the counterparty due diligence failures with respect to Zenith Petroleum DMCC, including the absence of beneficial ownership verification, the failure to conduct adverse media screening, and the failure to assess the entity's role in the broader transaction structure involving Volkhov-connected parties. The findings of that memorandum are incorporated here by reference.

D. Caspian Logistik GmbH — Logistics Intermediary Due Diligence

Caspian Logistik GmbH (Mönckebergstraße 22, 20095 Hamburg, Germany; Managing Director: Klaus Weidemann) served as the logistics intermediary for the approximately $12.4 million in oilfield equipment exports at issue. Caspian Logistik handled the physical shipment of goods, arranged transportation, prepared shipping documentation, and provided end-user certifications.

Dunmore's due diligence process did not distinguish between direct trading counterparties and logistics or shipping intermediaries. No separate due diligence framework existed for intermediaries handling controlled goods — a significant gap, given that logistics intermediaries occupy a critical position in the supply chain and are frequently used as conduits for diversion and sanctions evasion.

The due diligence performed on Caspian Logistik was minimal. No verified corporate registry documents were obtained from German commercial registers. No assessment was made of Caspian Logistik's export control compliance history, its customer base, its geographic areas of operation, or its practices for verifying end users and end uses. No requirement was imposed on Caspian Logistik to provide independently verified end-user documentation — the company's self-generated end-user certifications were accepted without question.

Tobias Engel, Managing Director of Dunmore Renewables GmbH in Hamburg, confirmed in his interview that Caspian Logistik was "recommended by DTI's Dubai desk" and that the Hamburg operations performed "minimal vetting" before engaging the intermediary. Engel stated that he "assumed DTI had done its homework" on Caspian Logistik and that he had no reason to conduct independent due diligence on the intermediary.

E. Ongoing Monitoring

Dunmore maintained no program for the ongoing monitoring, periodic refresh, or event-triggered reassessment of existing counterparties. Once a counterparty was onboarded, no further due diligence was performed absent an ad hoc request — and no such requests were identified in the documentary record during the relevant period.

There was no adverse media screening or public-source intelligence monitoring for counterparties. No automated alerts were established to flag news reports, regulatory actions, or other developments that could indicate sanctions exposure or other compliance risks associated with existing counterparties.

There was no process for monitoring changes in sanctions designations that could affect existing business relationships. As discussed in Section IV.B above, the November 2019 Directive 2 designation of Volkhov — which directly implicated DTI's relationship with Petronova — did not trigger any review or reassessment of Dunmore's counterparty portfolio.

The absenc

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
MEMORANDUM
TO: Victoria Chambers, Responsible Partner Howard Quinn, Billing Partner
FROM: Conrad Reeves, Senior Counsel, Export Controls & Sanctions Jasmine Thornton, Lead Associate, White Collar & Investigations
DATE: November 15, 2022
RE: Assessment of Dunmore Energy Holdings Ltd. Pre-Existing Sanctions and Export Controls Compliance Program (as of April 2022)
MATTER NO.: 1016-00009
CONFIDENTIALITY LEGEND: This memorandum constitutes attorney-client privileged communication and attorney work product prepared in connection with Calderwood & Harkness LLP's representation of Dunmore Energy Holdings Ltd. in the matter of the U.S. Department of Justice inquiry. This memorandum contains the mental impressions, conclusions, opinions, and legal theories of counsel and is protected from disclosure under the attorney work product doctrine. This memorandum is not to be disclosed, disseminated, or distributed to any person or entity without the express, prior written authorization of Victoria Chambers, Responsible Partner. All recipients are instructed to maintain this document in a secure manner consistent with the preservation of applicable privileges.
Right-click to update Table of Contents
I. Executive Summary
This memorandum presents the results of a comprehensive assessment of the sanctions and export controls compliance program maintained by Dunmore Energy Holdings Ltd. ("Dunmore" or "DEH") as it existed on April 19, 2022, the date on which the U.S. Department of Justice ("DOJ") inquiry was initiated through the issuance of grand jury subpoena GJ No. 22-418 by the U.S. District Court for the District of Columbia (Grand Jury 22-2). The assessment was conducted as part of Calderwood & Harkness LLP's broader internal investigation on behalf of Dunmore and is intended to inform the investigation team's evaluation of the company's potential exposure, the development of the remediation workstream, and the preparation of Dunmore's submissions to the DOJ and the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC").
The scope of this assessment encompasses all material components of Dunmore's pre-existing compliance infrastructure as applied across the company's global operations, including: written policies and procedures; sanctions and restricted party screening tools and processes; export control classification and licensing practices; third-party and counterparty due diligence; employee training and awareness programs; escalation and reporting mechanisms; organizational structure and resourcing of the compliance function; internal audit and testing; and recordkeeping practices. The assessment covers the compliance program as implemented at each of Dunmore's principal operating entities: Dunmore Energy Holdings Ltd. (Cayman Islands), Dunmore Trading International Ltd. ("DTI") (Dubai, UAE), Dunmore upstream Americas LLC ("DUA") (Houston, TX), Dunmore Renewables GmbH (Hamburg, Germany), and Dunmore Exploration West Africa Ltd. ("DEWA") (Lagos, Nigeria).
The methodology underlying this assessment involved multiple parallel workstreams. First, we reviewed all internal compliance policies, manuals, procedures, forms, and guidance documents maintained by Dunmore and its subsidiaries. Second, we conducted or directed three rounds of witness interviews, encompassing forty-seven (47) current and former employees across six jurisdictions (Round 1: 22 interviews; Round 2: 15 interviews; Round 3: 10 interviews). Third, we reviewed approximately 438,916 responsive documents (out of a total collection of 2,347,812 documents) processed and reviewed with the assistance of Nexagen Analytics Inc. (Project No. NX-DEH-2204), which provided technology-assisted review, predictive coding, and analytics support. Fourth, we incorporated the findings of forensic accounting analysis performed by Ridgeline Advisory Group LLC (Engagement No. RAG-2022-0319), led by Dr. Margaret Liu, CPA, CFE, which analyzed payment flows, transaction patterns, and financial records relevant to the sanctions compliance assessment. Fifth, we obtained expert input from Pemberton Investors Solutions LLC, specifically Dr. Anton Bremer, a recognized expert in OFAC compliance program design and evaluation, who provided benchmarking analysis and advisory opinions on industry standards applicable to companies of Dunmore's size and risk profile.
Key Conclusion. Based on the totality of the evidence reviewed, the witness testimony obtained, and the expert analysis performed, it is our assessment that Dunmore's pre-existing sanctions and export controls compliance program suffered from significant structural and operational deficiencies that directly contributed to the company's failure to detect and prevent transactions involving counterparties connected to Volkhov Industrial Group JSC ("Volkhov"), a Russian industrial conglomerate that was first designated under OFAC Directive 2 (sectoral sanctions, Executive Order 13662) on November 15, 2019, and subsequently added to the OFAC Specially Designated Nationals and blocked Persons List ("SDN List") (full blocking, Executive Order 14024) on April 6, 2022.
The program, taken as a whole, fell materially short of the standards articulated in the DOJ's Evaluation of Corporate Compliance Programs (the "DOJ Evaluation") and OFAC's "A Framework for OFAC Compliance Commitments" (the "OFAC Framework"), the two principal benchmarks used by the U.S. government to evaluate the adequacy of corporate sanctions compliance programs.
The deficiencies identified in this assessment span eight interconnected categories:
1. Organizational structure and resourcing — The compliance function was critically understaffed, underfunded, structurally subordinated, and lacked adequate authority and Board-level oversight.
2. OFAC and sanctions screening — Screening was performed using an inadequate tool, applied only at counterparty onboarding, and failed to incorporate the SSI List, the 50% Rule, or any non-U.S. sanctions lists.
3. Export control classification and licensing — No formal export control classification or licensing program existed, resulting in the shipment of controlled oilfield equipment to Russia without required BIS authorization.
4. Third-party and counterparty due diligence — Onboarding procedures were superficial, risk-tiering was absent, beneficial ownership verification was not performed, and ongoing monitoring was nonexistent.
5. Training and awareness — Training was generic, infrequent, not mandatory for the highest-risk personnel, and failed to address the specific sanctions and export risks facing Dunmore's trading operations.
6. Escalation and reporting — Escalation procedures were vague and informal, no red flag identification framework existed, and whistleblower mechanisms were ineffective at the most exposed subsidiary.
7. Internal audit and testing — No sanctions-specific audit or testing program existed; the internal audit function did not include sanctions compliance within its scope.
8. Recordkeeping — Compliance records were maintained in an ad hoc fashion without centralized systems, standardized formats, or retention protocols aligned with OFAC requirements.
These deficiencies, individually and collectively, allowed the conduct at issue — fourteen (14) crude oil swap transactions (approximately $218.7 million in aggregate notional value, of which nine transactions, approximately $156.3 million in notional value, involved Volkhov-connected entities), oilfield equipment exports (approximately $12.4 million via Caspian Logistik GmbH), and structured payments (approximately $34.2 million across 127 transactions through Crescent Commercial Bank PJSC) — to proceed without detection from approximately March 2020 through April 2022, a period of approximately two years.
The balance of this memorandum sets forth the factual findings, analysis, and conclusions supporting this assessment in detail.
II. Background
A. Dunmore Energy Holdings Ltd. — Corporate Overview
Dunmore Energy Holdings Ltd. ("DEH" or "Dunmore") is a Cayman Islands exempted company (Registration No. MC-334821) with its operational headquarters located at 1200 McKinney Street, Suite 3400, Houston, Texas 77010. Dunmore operates in the oil and gas exploration, production, and trading sectors, with an expanding renewable energy development business. For the fiscal year ending December 31, 2021, Dunmore reported annual revenue of approximately $4.87 billion, as reflected in audited financial statements prepared by Ashford & Whitmore LLP (engagement partner: Kenneth Ashford).
Dunmore employs approximately 3,200 individuals globally, distributed across its corporate headquarters in Houston and its operating subsidiaries in Dubai, Hamburg, Lagos, and other locations. The company's operations span the upstream, midstream, and trading segments of the energy value chain, with significant commodity trading activity concentrated at its Dubai-based subsidiary.
Dunmore's equity ownership is concentrated among three groups. The majority shareholder is Greystone Capital Partners Fund IV, L.P., which holds approximately 62.5% of the company's equity. Dunmore's management team holds approximately 22.5% of equity, and Thornbury Infrastructure Fund II, L.P. holds the remaining 15%. The company's senior leadership during the relevant period consisted of: Callum Renshaw, Chief Executive Officer (appointed 2018, based in Houston); Marcus Wellbourne, Esq., General Counsel; and Sandra Whitfield, Chief Financial Officer.
B. Key Subsidiaries
Dunmore operates through several principal subsidiaries, each of which is relevant to this assessment to varying degrees:
Dunmore Trading International Ltd. ("DTI"). DTI is the subsidiary at the center of the DOJ inquiry. DTI holds DIFC License No. CL-4827 and is located at Level 14, Gate Building 3, Dubai International Financial Centre, Dubai, United Arab Emirates. DTI is Dunmore's primary commodity trading vehicle, responsible for the execution of crude oil, refined products, and derivatives transactions with counterparties across the Middle East, North Africa, and Eurasia. During the relevant period, DTI was led by Derek Hargrave, who served as President until he was placed on administrative leave effective July 1, 2022, and whose employment was subsequently terminated effective October 1, 2022. DTI's trading desk, under Hargrave's supervision and with the direct involvement of Senior Trader Natasha Sorokin, was responsible for the transactions under investigation.
Dunmore upstream Americas LLC ("DUA"). DUA is a Delaware limited liability company (EIN: 84-2937561) co-located with Dunmore's corporate headquarters at 1200 McKinney Street, Suite 3400, Houston, Texas. DUA manages Dunmore's U.S.-based exploration and production operations, including assets in the Permian Basin and the Gulf of Mexico.
Dunmore Renewables GmbH. Dunmore Renewables is organized under German law and is located at Überseeallee 12, 20457 Hamburg, Germany. Its Managing Director is Tobias Engel. The entity is principally engaged in the development and financing of wind and solar energy projects in Northern Europe. While not a primary subject of the DOJ inquiry, Dunmore Renewables is tangentially involved by virtue of one suspect transaction involving Caspian Logistik GmbH, a Hamburg-based logistics intermediary that was recommended to Dunmore Renewables by DTI's Dubai desk.
Dunmore Exploration West Africa Ltd. ("DEWA"). DEWA is located at 14B Kofo Abayomi Street, Victoria Island, Lagos, Nigeria, and manages Dunmore's upstream exploration and production activities in the Niger Delta and offshore West Africa. DEWA is not a direct subject of the suspect transactions but is relevant to the assessment of the global reach (or lack thereof) of Dunmore's compliance program.
C. The Conduct at Issue — Brief Summary
The DOJ inquiry concerns a pattern of potentially sanctioned transactions conducted by DTI's Dubai-based trading desk over a period of approximately two years, from March 2020 through April 2022. Based on the investigation to date — including the document review, witness interviews, and forensic accounting analysis referenced in Section I — the conduct at issue falls into three distinct but related categories.
First: Crude Oil Swap Transactions. Between approximately March 2020 and April 2022, DTI's trading desk entered into fourteen (14) crude oil swap transactions with an aggregate notional value of approximately $218.7 million. The counterparties to these transactions were Petronova Trading FZE (Managing Director: Sergei Volkov) and Zenith Petroleum DMCC (Managing Director: Farhan Qureshi), both Dubai-based entities. Of the fourteen transactions, nine (9) — with an aggregate notional value of approximately $156.3 million — involved counterparties with beneficial ownership ties to Volkhov Industrial Group JSC, in potential violation of the prohibitions set forth in OFAC Directive 2 under Executive Order 13662 (which, during the relevant period, prohibited certain dealings in the debt and equity of Volkhov as a designated entity under sectoral sanctions).
Second: Oilfield Equipment Exports. Between approximately August 2020 and January 2022, DTI arranged for the export of oilfield drilling equipment and components with a total value of approximately $12.4 million. These goods were classified under Export Administration Regulations ("EAR") Export Control Classification Numbers ("ECCN") 2B350 and 2B999, classifications that required license review for Russia-destined exports under EAR §746.5. The shipments were routed through Caspian Logistik GmbH (Managing Director: Klaus Weidemann, Hamburg, Germany), a logistics intermediary that provided end-user certifications identifying non-Russian end users. Subsequent analysis conducted by Liam Donahue (memorandum dated July 20, 2022) identified evidence suggesting that the end-user certifications were potentially false and that the ultimate destination of the goods was Russia, in potential violation of EAR §746.5 and applicable OFAC prohibitions.
Third: Structured Payments. Between approximately March 2020 and March 2022, DTI directed approximately $34.2 million in payments across 127 separate transactions routed through intermediary accounts at Crescent Commercial Bank PJSC (Relationship Manager: Khalid Mansour). Forensic analysis by Ridgeline Advisory Group LLC determined that these payments were structured in a manner consistent with an intent to obscure the beneficial ownership of the receiving parties — specifically, to obscure the fact that the ultimate beneficiary of a significant portion of these funds was Volkhov Industrial Group JSC or entities controlled by Volkhov.
The Principal Sanctioned Entity. Volkhov Industrial Group JSC (Chairman: Arkady Volkhov, 12 Kutuzovsky Prospekt, Moscow, Russia) is a major Russian industrial conglomerate with interests spanning oil and gas, mining, metals, and industrial manufacturing. Volkhov was designated under OFAC Directive 2 (sectoral sanctions, Executive Order 13662) on November 15, 2019, subjecting it to specific prohibitions on transactions involving the entity's debt and equity. On April 6, 2022 — shortly before the issuance of the grand jury subpoena — Volkhov was added to the OFAC SDN List under Executive Order 14024, subjecting it to full blocking sanctions.
D. Applicable Legal and Regulatory Framework
This assessment evaluates Dunmore's compliance program against the requirements of the U.S. sanctions and export control regulatory framework, which includes the following principal authorities:
OFAC-Administered Sanctions Programs. The relevant OFAC programs include Executive Order 14024 (issued April 15, 2021, as amended), which authorizes blocking sanctions against persons determined to operate or have operated in specified sectors of the Russian Federation economy, as well as persons determined to be owned or controlled by, or to have acted or purported to act for or on behalf of, persons blocked under the order. Additionally, Directive 2 under Executive Order 13662 imposes sectoral sanctions on specified entities, prohibiting U.S. persons from transacting in, providing financing for, or otherwise dealing in new debt of longer than 14 days maturity or new equity of persons determined to be subject to the directive. The implementing regulations are codified at 31 C.F.R. Part 589 (Ukraine/Russia-Related Sanctions Regulations).
Export Administration Regulations. The EAR (15 C.F.R. Parts 730–774) establish a comprehensive regulatory framework governing the export, re-export, and in-country transfer of items subject to U.S. jurisdiction. Relevant provisions include EAR §746.5, which imposes license requirements for exports and re-exports of specified items to Russia and Belarus. The ECCNs at issue in this matter — 2B350 (chemical manufacturing facilities and equipment) and 2B999 (specific processing equipment not controlled by 2B350) — are subject to these license requirements. During the relevant period, the license review policy for Russia-destined exports of items classified under these ECCNs was a policy of denial.
Criminal Statutes. The International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. §§ 1701–1706, provides criminal penalties for willful violations of sanctions imposed under IEEPA-based executive orders, including imprisonment for up to twenty years and fines of up to $1 million per violation. The Export Control Reform Act ("ECRA"), 50 U.S.C. §§ 4801–4852, provides the statutory authority for the EAR and establishes criminal penalties for willful violations of export control requirements, including imprisonment for up to twenty years and fines of up to $1 million per violation (or five times the value of the exports involved, whichever is greater).
OFAC Compliance Framework. OFAC's "A Framework for OFAC Compliance Commitments" (published May 2, 2019) (the "OFAC Framework") identifies five essential components of a risk-based sanctions compliance program: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training. OFAC has stated that it will consider the existence and adequacy of a sanctions compliance program as a factor in determining appropriate enforcement actions and that the Framework provides "a set of guiding principles" that organizations — regardless of their size, sophistication, or industry — should consider when developing and implementing sanctions compliance programs.
DOJ Compliance Program Guidance. The DOJ's "Evaluation of Corporate Compliance Programs" (the "DOJ Evaluation," most recently updated September 2022 and March 2023) sets forth the criteria DOJ prosecutors apply when evaluating the effectiveness of a company's compliance program in the context of criminal investigations and enforcement actions. The DOJ Evaluation examines three fundamental questions: (i) "Is the corporation's compliance program well designed?"; (ii) "Is the program being applied earnestly and in good faith? In other words, is the program being implemented effectively?"; and (iii) "Does the corporation's compliance program work in practice?" Additionally, the DOJ's Corporate Enforcement Policy (updated September 2022) provides that a company may be eligible for a declination of prosecution if it voluntarily self-discloses misconduct, fully cooperates, and timely and appropriately remediates — factors that make the pre-existing compliance program's adequacy a central issue in the disposition of this matter.
E. Benchmarking Standards Used in This Assessment
In evaluating Dunmore's compliance program, this assessment applies the following benchmarking standards:
First, the five essential components of the OFAC Framework, as described above, which provide the primary substantive benchmark for evaluating each element of the sanctions compliance program.
Second, the hallmarks of an effective compliance program as set forth in the DOJ Evaluation, including the adequacy of program design, the rigor of implementation, the sufficiency of resources, the autonomy and authority of compliance personnel, and the program's demonstrated effectiveness in practice.
Third, industry best practices for global commodity trading companies of comparable size and risk profile. For benchmarking purposes, Dr. Anton Bremer of Pemberton Investors Solutions LLC identified a peer group of energy and commodity trading companies with annual revenues exceeding $1 billion and operations in high-risk jurisdictions, including the UAE and Russia-adjacent markets. Industry standards within this peer group were used to assess the adequacy of Dunmore's compliance staffing ratios, budgets, screening protocols, due diligence procedures, and training programs.
Fourth, the compliance program guidelines published by the Bureau of Industry and Security ("BIS") of the U.S. Department of Commerce, which provide supplementary guidance on export control compliance program design and implementation.
Together, these benchmarks provide the analytical framework within which each component of Dunmore's compliance program is evaluated in the sections that follow.
III. Organizational Structure and Compliance Resourcing
The organizational structure, resourcing, and governance of a company's compliance function are foundational to the effectiveness of any sanctions and export controls compliance program. Both the OFAC Framework and the DOJ Evaluation identify "management commitment" and "adequate resources and empowerment" as threshold requirements. A compliance program that lacks adequate staffing, budget, authority, and reporting lines to senior leadership and the Board of Directors cannot be expected to function effectively, regardless of the quality of its written policies or procedures. As set forth below, Dunmore's compliance function suffered from profound structural deficiencies in each of these areas.
A. Compliance Function Reporting Structure
During the relevant period, Dunmore's Chief Compliance Officer ("CCO") was Gerald Fisk, who was based in Houston, Texas. Fisk joined Dunmore in 2016 and served as CCO until his departure from the company on June 10, 2022. Fisk has retained personal counsel, Catherine Blackthorn of Blackthorn & Associates LLP, Houston, in connection with the DOJ inquiry and this internal investigation.
Fisk reported to General Counsel Marcus Wellbourne, who in turn reported to CEO Callum Renshaw. This reporting structure — in which the CCO reported to the General Counsel rather than directly to the CEO, the Board of Directors, or a dedicated Board-level compliance committee — constitutes a significant structural deficiency under both the OFAC Framework and the DOJ Evaluation. The OFAC Framework's "management commitment" component emphasizes the importance of direct reporting lines from the senior compliance officer to the Board or a Board-level committee, which ensures that compliance matters receive adequate attention at the highest governance levels and that the compliance function operates with sufficient independence from business units. The DOJ Evaluation similarly examines whether compliance personnel have "sufficient stature" within the organization and a "direct line to the board" or an appropriate committee thereof.
At Dunmore, no such direct reporting line existed. Fisk did not report to the Board of Directors in any capacity. Moreover, there was no dedicated compliance committee at the Board level. The Board of Directors of DEH received periodic reports from General Counsel Wellbourne that included, at most, cursory references to compliance matters, but the Board did not exercise active oversight of the sanctions compliance program.
The absence of a direct CCO-to-Board reporting line had practical consequences. It meant that the Board received limited, if any, information about the specific sanctions and export risks facing Dunmore's trading operations, the adequacy of the compliance program's resources, or the emerging regulatory developments — including the significantly expanded Russia-related sanctions authorities introduced by Executive Order 14024 in April 2021 — that materially affected the company's risk profile. It also meant that Fisk's ability to escalate concerns or request additional resources was mediated through the General Counsel, creating a structural barrier to effective compliance governance.
B. Compliance Team Size and Geographic Coverage
As of April 2022, Dunmore's compliance function consisted of approximately four (4) full-time equivalent ("FTE") employees globally. This team comprised Gerald Fisk, as CCO, plus three junior compliance analysts, all of whom were based in the Houston office. The three junior analysts were generalists with responsibilities spanning anti-corruption, trade compliance, anti-money laundering, and general regulatory matters; none held specialized sanctions or export control certifications or possessed relevant subject-matter expertise.
Critically, no dedicated compliance personnel were stationed at DTI in Dubai — notwithstanding that DTI was Dunmore's highest-risk operating subsidiary by virtue of its commodity trading activities in the Middle East, its exposure to Russian and Russian-connected counterparties, and the nature of the transactions it executed daily. DTI's trading desk operated without any on-site compliance presence, compliance review of transactions, or real-time compliance oversight.
Similarly, no compliance personnel were located at Dunmore Renewables GmbH in Hamburg, DEWA in Lagos, or any other non-U.S. subsidiary. The entire compliance function was centralized in Houston, with no mechanism for providing timely, on-the-ground compliance support to the company's international operations.
The resulting staffing ratio was approximately one (1) compliance FTE per 800 employees. According to the benchmarking analysis provided by Dr. Bremer of Pemberton Investors Solutions, the industry benchmark for energy and commodity trading companies of comparable size and risk profile — particularly those with operations in high-risk jurisdictions and exposure to Russia-related sanctions programs — is approximately one (1) compliance FTE per 200 to 300 employees. Dunmore's compliance staffing was therefore approximately three to four times below the industry norm for companies with similar risk exposure.
Furthermore, Fisk served as the sole senior compliance professional within the organization. There was no deputy CCO, no succession plan, and no individual with the qualifications or experience to assume Fisk's responsibilities in the event of his absence, departure, or incapacitation. The concentration of institutional knowledge and decision-making authority in a single individual created a single point of failure for the entire compliance function — a risk that materialized when Fisk departed the company in June 2022.
C. Budget and Resources
Dunmore's annual compliance budget for fiscal year 2021 was approximately $1.2 million. This figure included personnel costs for Fisk and the three junior analysts, the licensing fees for the company's commercial sanctions screening platform, training materials and administration, and miscellaneous operational expenses. Notably, there was no dedicated budget line item for export control compliance; export control matters were handled informally by Fisk, with ad hoc consultation from outside counsel that did not possess a recognized sanctions or export control specialty. Prior outside counsel engaged on these matters have not been identified in the document review as having held themselves out as specialists in sanctions or export control law.
The compliance budget was wholly inadequate for a company of Dunmore's size, global footprint, and risk profile. According to Dr. Bremer's benchmarking analysis, companies of Dunmore's revenue scale (approximately $4.87 billion) and risk profile — particularly those engaged in global commodity trading with exposure to Russia-related sanctions — typically allocate between $3 million and $5 million annually for sanctions and export control compliance. This industry benchmark encompasses personnel costs, screening and monitoring technology, training program development and delivery, third-party due diligence tools, external expert advisors, and compliance program testing and auditing. Dunmore's $1.2 million budget was therefore approximately 25% to 40% of the expected allocation.
Furthermore, the document review revealed no allocation for compliance technology upgrades in either the FY 2020 or FY 2021 budgets. The company's sanctions screening platform, discussed in detail in Section IV below, was an outdated, off-the-shelf product that lacked critical capabilities, yet no investment was made to upgrade or replace it during the relevant period. Requests by Fisk for additional compliance resources have not been identified in the documentary record, raising the question — explored further in Section XII (Root Cause Analysis) — of whether Fisk perceived that such requests would be futile, whether he failed to appreciate the inadequacy of his resources, or whether such requests were made informally and not documented.
D. Management Commitment Assessment
The OFAC Framework and the DOJ Evaluation both emphasize the importance of "tone at the top" — the degree to which an organization's senior leadership demonstrates a genuine commitment to compliance as a core corporate value, communicates that commitment to employees at all levels, and allocates adequate resources to support the compliance function. Our assessment of management commitment at Dunmore revealed a pattern of indifference to sanctions compliance at the senior leadership level.
Interviews with Dunmore's three most senior executives produced the following findings:
In his interview on May 23, 2022, CEO Callum Renshaw stated that compliance matters were "handled by Gerald [Fisk] and Marcus [Wellbourne]" and that he was not routinely briefed on sanctions developments affecting the company's trading operations. Renshaw could not identify any specific sanctions regulatory developments that he had been briefed on during the 2020–2022 period, including the issuance of Executive Order 14024 in April 2021 or the SDN designation of Volkhov in April 2022 (which he learned of only after the issuance of the grand jury subpoena). Renshaw acknowledged that compliance was not a regular agenda item at senior management team meetings and that he could not recall any instance in which sanctions compliance was discussed at a Dunmore Board meeting during his tenure as CEO.
In her interview on May 30, 2022, CFO Sandra Whitfield confirmed that the internal audit function, which reported to her, did not include sanctions compliance within its audit scope. Whitfield stated that she viewed sanctions compliance as a "legal matter" under the purview of the General Counsel's office and that she had not requested or received reports on the effectiveness of the sanctions compliance program. Whitfield further confirmed that the compliance budget was set by the General Counsel's office and that she did not recall any requests for increased compliance funding being submitted through the normal budgetary process.
In his interview on May 25, 2022, Derek Hargrave, President of DTI, stated that he was aware that DTI did not have dedicated compliance personnel but had not viewed this as a material concern. Hargrave stated that compliance screening of counterparties "was supposed to be handled by Houston" and that he relied on the assumption that Houston headquarters would flag any issues with DTI's counterparties or transactions. Hargrave acknowledged that he had never requested compliance support for DTI's trading operations and that he did not recall receiving any communications from Gerald Fisk regarding sanctions developments or compliance requirements specific to DTI's business activities.
Taken together, these interview findings demonstrate that the tone at the top regarding sanctions compliance at Dunmore was, at best, neutral — and more accurately characterized as negligent. There was no affirmative messaging from senior leadership emphasizing sanctions compliance as a corporate priority, no visible engagement by the CEO or CFO with the compliance function, and no allocation of the resources necessary to build and maintain a program commensurate with Dunmore's risk profile. This failure of management commitment is, in our assessment, a root cause of the programmatic deficiencies documented throughout this memorandum.
IV. OFAC and Sanctions Screening
Sanctions screening — the process by which an organization identifies whether its counterparties, transaction participants, and other relevant persons are the subject of sanctions designations or otherwise restricted — is a cornerstone of any effective sanctions compliance program. The OFAC Framework identifies screening as a core "internal controls" component and states that organizations should implement screening processes that are "risk-based" and calibrated to "the sanctions risks they face." The DOJ Evaluation similarly examines whether a company has implemented controls sufficient to ensure that prohibited transactions are identified and blocked before they are executed. As set forth below, Dunmore's screening practices were deficient in virtually every material respect.
A. Screening Tools and Processes
Our review of Dunmore's compliance technology infrastructure, as supplemented by interviews with Gerald Fisk and the three Houston-based compliance analysts, established that Dunmore utilized a single commercial sanctions screening platform for all screening purposes. The document review identified the platform as a basic, off-the-shelf product that provided limited functionality relative to the risks inherent in Dunmore's business operations.
Specifically, the platform lacked the following critical capabilities: customizable risk-scoring algorithms that would permit calibration of screening sensitivity to Dunmore's particular risk profile; fuzzy-matching algorithms capable of accurately matching transliterated Russian, Arabic, or Cyrillic names, which is essential for a commodity trading company transacting with Middle Eastern and Russian-adjacent counterparties; integration with OFAC's Sectoral Sanctions Identification ("SSI") List; integration with non-U.S. sanctions lists (EU, UK, UAE); and configurable alert management and audit trail functionality.
The screening process suffered from a fundamental limitation: screening was conducted only at the time of onboarding new counterparties. Once a counterparty passed the initial onboarding screen, no periodic or event-driven rescreening was performed. There was no automated or scheduled process for rescreening existing counterparties against updated sanctions lists, and no protocol for triggering rescreening in response to regulatory developments (e.g., new executive orders, list updates, or designation changes).
Additionally, the screening platform was not integrated with any of Dunmore's operational systems. There was no connection between the screening tool and the company's trading system, its enterprise resource planning ("ERP") software, or its accounts payable and accounts receivable systems. This lack of integration meant that transactions could be — and were — executed, invoiced, and settled without any automated sanctions check at the transaction level. Wire transfer instructions and payment beneficiaries were not screened against sanctions lists before payments were processed, a deficiency that is directly relevant to the $34.2 million in structured payments routed through Crescent Commercial Bank PJSC.
B. Rescreening Deficiencies
The absence of a rescreening protocol was perhaps the single most consequential deficiency in Dunmore's screening program. Sanctions lists are dynamic; OFAC updates the SDN List, the SSI List, and other restricted party lists on a frequent and sometimes unpredictable basis. A compliance program that screens counterparties only at onboarding and fails to rescreen when lists are updated is inherently incapable of detecting sanctions exposure that arises after the initial onboarding screen.
Dunmore's compliance team performed an annual OFAC list update refresh, but our review established that this process was manual and ad hoc. The annual refresh consisted of Fisk or one of the junior analysts downloading the most recent version of the OFAC SDN List, comparing it to the version loaded in the screening platform, and updating the platform accordingly. There was no documented procedure for this process, no quality assurance or verification step, and no record of whether the annual refresh was completed each year.
The consequences of this deficiency are starkly illustrated by the facts of this case. When Volkhov Industrial Group JSC was designated under OFAC Directive 2 on November 15, 2019, no rescreening of Dunmore's existing counterparty database was triggered. As a result, no systematic review was conducted to determine whether any of Dunmore's existing counterparties — including Petronova Trading FZE, which was onboarded in approximately early 2020 — had connections to Volkhov.
Gerald Fisk addressed this issue directly in his June 8, 2022 interview, conducted by Victoria Chambers with Catherine Blackthorn present as Fisk's personal counsel. Fisk acknowledged that the November 2019 Directive 2 designation of Volkhov "did not result in a systematic review of Dunmore's counterparty database." Fisk stated that he was generally aware of the Volkhov designation at the time it occurred but did not take specific steps to identify Dunmore counterparties with potential connections to Volkhov because the screening tool did not support SSI List screening and because he did not consider the Directive 2 designation to be directly relevant to DTI's trading operations. This assessment — which reflected a misunderstanding of the scope and application of Directive 2 — contributed to the failure to identify Petronova's Volkhov connections.
It was not until April 11, 2022 — five days after the full SDN blocking of Volkhov on April 6, 2022 — that Fisk conducted a rescreening refresh. Upon running the updated SDN List through the screening platform, Fisk identified a potential match for Volkhov and, through further manual research, identified potential historical exposure through Petronova Trading FZE. Fisk notified General Counsel Marcus Wellbourne on the same date. The grand jury subpoena was issued eight days later, on April 19, 2022.
The approximately two-and-a-half-year gap between Volkhov's initial Directive 2 designation (November 15, 2019) and Dunmore's identification of its exposure (April 11, 2022) represents a critical and fundamental failure of the rescreening process. During this period, nine of the fourteen crude oil swap transactions at issue were executed without any sanctions screening having identified the Volkhov connection.
C. SDN List, Sectoral Sanctions Identification (SSI) List, and Consolidated Screening
Our review established that Dunmore's screening program was limited to the OFAC SDN List. The OFAC Sectoral Sanctions Identification ("SSI") List — which identifies entities subject to sectoral sanctions under Directives 1 through 4 of Executive Order 13662 — was not integrated into the screening platform as a separate screening criterion and was not applied as part of the screening process.
This omission is particularly significant because Volkhov Industrial Group was listed on the SSI List (Directive 2) from November 15, 2019 through its addition to the SDN List on April 6, 2022. Had Dunmore screened its counterparties against the SSI List, the screening process could have identified Volkhov-connected entities at the onboarding stage or during a rescreening cycle, potentially preventing or detecting the transactions at issue.
Beyond the SSI List, Dunmore's screening did not incorporate any of the following restricted party lists, each of which is relevant to a company with Dunmore's global footprint and the nature of its operations:
• BIS Entity List (15 C.F.R. Part 744, Supplement No. 4) — a list of entities subject to specific license requirements under the EAR, which is directly relevant to Dunmore's export of controlled oilfield equipment.
• BIS Denied Persons List — a list of individuals and entities denied export privileges.
• BIS Unverified List (15 C.F.R. Part 744, Supplement No. 6) — a list of entities for which BIS has been unable to verify the bona fides (legitimacy and reliability) of parties to export transactions.
• EU Consolidated Financial Sanctions List — relevant to Dunmore Renewables GmbH's operations in Germany and DTI's potential EU nexus through Caspian Logistik GmbH (Hamburg).
• UK Office of Financial Sanctions Implementation ("OFSI") Consolidated List — relevant to transactions with UK-nexus counterparties and financial institutions.
• UAE sanctions lists — relevant to DTI's operations in Dubai.
The failure to screen against these additional lists exposed Dunmore to the risk of transacting with restricted parties across multiple jurisdictional regimes and further compounded the deficiencies in the company's screening program.
D. 50% Rule Analysis Failures
OFAC's 50% Rule provides that the property and interests in property of entities owned, directly or indirectly, fifty percent (50%) or more, individually or in the aggregate, by one or more blocked persons are also considered blocked, regardless of whether the entity itself appears on the SDN List. The 50% Rule is a critical component of OFAC compliance because it extends the reach of blocking sanctions beyond the specifically named SDN to encompass entities within the SDN's ownership and control structure.
Dunmore did not incorporate the 50% Rule into its counterparty screening or due diligence procedures in any form. There was no process for determining or verifying the beneficial ownership of counterparties and comparing the results against SDN-listed entities. There was no written policy, procedure, or guidance document addressing the 50% Rule. The screening platform did not have the capability to perform ownership chain analysis or cross-reference counterparty ownership structures against the SDN List.
This gap was a root cause of the failure to identify Petronova Trading FZE as a Volkhov-connected entity. As detailed in Liam Donahue's June 15, 2022 memorandum regarding Petronova's beneficial ownership and Conrad Reeves's June 20, 2022 memorandum regarding Volkhov's designation history and 50% Rule analysis, Petronova was managed by Sergei Volkov, who maintained beneficial ownership ties to Volkhov Industrial Group JSC sufficient to trigger the 50% Rule. Had Dunmore maintained a procedure for verifying the beneficial ownership of counterparties and analyzing that ownership against the SDN List under the 50% Rule, the Volkhov connection could have been identified at the time Petronova was onboarded or, at the latest, upon the Volkhov Directive 2 designation in November 2019.
The absence of any 50% Rule capability represents a fundamental gap in Dunmore's compliance program and one that is particularly egregious given the company's substantial exposure to Russian-connected counterparties through its Middle East trading operations.
V. Export Control Classification and Licensing
In addition to its sanctions compliance deficiencies, Dunmore lacked a meaningful export control compliance program. Export controls — administered primarily by BIS under the EAR — impose licensing requirements on the export, re-export, and in-country transfer of controlled items, including dual-use goods, technology, and software. For a company engaged in the global trade of oilfield equipment and technology, export control compliance is an essential element of the overall trade compliance framework. As set forth below, Dunmore had no formal export control classification program, no licensing procedures, and no personnel dedicated to EAR compliance.
A. Export Administration Regulations Compliance
Our review found no evidence that Dunmore maintained a formal export control classification program for the goods, technology, or software that it exported, re-exported, or transferred through its subsidiaries. No written procedure existed for classifying items against the Commerce Control List ("CCL") to determine whether they were subject to EAR jurisdiction, what their applicable ECCN was (if any), and whether a BIS export license was required for the intended destination, end user, and end use.
This deficiency had direct consequences. The oilfield drilling equipment and components shipped through Caspian Logistik GmbH between approximately August 2020 and January 2022 were classified under EAR ECCNs 2B350 and 2B999. These classifications — which correspond to chemical manufacturing equipment and specific processing equipment, respectively — triggered license requirements for Russia-destined exports under EAR §746.5. During the relevant period, the license review policy for items classified under these ECCNs destined for Russia was a policy of denial, meaning that BIS would presumptively deny any license application for the export of such items to Russia.
Despite the clear applicability of these license requirements, our review identified no evidence that any license applications were filed with BIS for the approximately $12.4 million in oilfield equipment exports during the relevant period. The goods were shipped without any export control review, license determination, or BIS authorization.
No export control compliance officer or designated responsible individual for EAR compliance was appointed at DTI, DUA, Dunmore Renewables GmbH, or any other subsidiary. Gerald Fisk, as CCO, handled export control matters on an informal, ad hoc basis, but Fisk had no formal training or certification in export control compliance and did not consider export controls to be a primary focus of his responsibilities. Fisk consulted from time to time with outside counsel on export control questions, but the outside counsel engaged by Dunmore for these purposes was not identified in the document review as possessing a recognized export control specialty.
B. End-User and End-Use Verification
The oilfield equipment shipments routed through Caspian Logistik GmbH were accompanied by end-user certifications provided by Caspian Logistik that identified non-Russian end users for the goods. These certifications were accepted at face value; no independent verification of their accuracy was performed by Dunmore or any of its subsidiaries.
Yves Leclerc, Director of Logistics & Shipping at DTI (based in Dubai), was responsible for handling shipping documentation for the oilfield equipment transactions. In his interview on June 22, 2022 (conducted by Amara Osei), Leclerc stated that he "relied entirely on Caspian Logistik's representations regarding end users" and that he had "no reason to question" the accuracy of the end-user certifications. Leclerc further stated that he had not received any training on export control requirements, red flags for diversion, or end-user verification procedures, and that he was not aware that the goods in question were subject to EAR licensing requirements.
No "know your customer" or enhanced due diligence process existed for logistics intermediaries handling controlled goods. The due diligence performed on Caspian Logistik GmbH — which, as discussed in Section VI.D below, was minimal — did not include any assessment of the intermediary's practices regarding end-user verification, its history of export control compliance, or the reliability of the end-user certifications it provided.
Liam Donahue's July 20, 2022 memorandum on Caspian Logistik GmbH documented evidence suggesting that the end-user certifications provided by Caspian Logistik were potentially false. Specifically, Donahue's analysis identified discrepancies between the stated end users and the actual shipping destinations, as well as evidence of transshipment patterns consistent with diversion of the goods to Russia. The full findings of that analysis are set forth in Donahue's memorandum and are incorporated here by reference.
C. Deemed Export Controls
The EAR's deemed export rules (15 C.F.R. § 734.13) provide that the release of controlled technology or source code to a foreign person in the United States (or, under the deemed re-export rule, in a third country) is "deemed" to be an export to the foreign person's country or countries of nationality. Compliance with deemed export rules requires organizations to assess the nationality of individuals who may have access to controlled technology and to obtain licenses where required.
No assessment of deemed export risks was performed for technology shared with foreign national employees at DTI or other non-U.S. subsidiaries. DTI employed a multinational workforce that included, among others, Natasha Sorokin (a Russian-American dual national), Yves Leclerc (a French national), and other non-U.S. persons who may have had access to controlled technology, technical data, or software in the course of their employment. No Technology Control Plan ("TCP") was in place at DTI or at any other Dunmore entity to govern access to controlled technology by foreign nationals.
The absence of a deemed export compliance framework is a significant gap, particularly given the nature of Dunmore's business (which involves technical aspects of oilfield equipment, drilling technology, and energy sector technology) and the composition of its workforce at non-U.S. locations.
VI. Third-Party and Counterparty Due Diligence
Effective third-party and counterparty due diligence is a critical safeguard against sanctions violations. The use of intermediaries, front companies, and opaque corporate structures to evade sanctions is a well-documented typology, and both OFAC and the DOJ have consistently emphasized the importance of robust due diligence as a means of detecting and preventing indirect sanctions violations. The OFAC Framework identifies "risk-based" due diligence as a core internal control, and the DOJ Evaluation examines the rigor and comprehensiveness of a company's third-party management processes. As set forth below, Dunmore's third-party and counterparty due diligence program was fundamentally inadequate.
A. Onboarding Procedures
Dunmore's counterparty onboarding procedure consisted of a basic "know your counterparty" ("KYC") form that required the following information: entity name, jurisdiction of registration, contact information, principal shareholders (self-reported by the counterparty), and a single-pass sanctions screening against the SDN List. The KYC form did not require, and the onboarding process did not involve, any of the following elements:
• Verified corporate registry documents (e.g., certificates of incorporation, commercial register extracts, or equivalent documents authenticated by an independent source);
• Audited financial statements or evidence of the counterparty's financial standing;
• Independent beneficial ownership verification (i.e., verification of beneficial ownership through sources independent of the counterparty's self-reporting);
• Risk-tiering of the counterparty based on geography, industry, sanctions exposure, or other relevant risk factors;
• Enhanced due diligence for higher-risk counterparties (e.g., entities domiciled in sanctioned or high-risk jurisdictions, newly incorporated entities, entities with Russian-national principals, or entities involved in commodity trading with Russian nexus);
• Adverse media screening or public-source intelligence review;
• Site visits, reference checks, or independent background investigations.
Dubai-based counterparties — including Petronova Trading FZE and Zenith Petroleum DMCC, the two principal counterparties at issue in this matter — were onboarded through DTI's local process. The DTI onboarding process was, if anything, even less rigorous than the Houston-based process. In the absence of any dedicated compliance personnel at DTI, the onboarding of new counterparties was performed by trading desk personnel or administrative staff, without compliance review or approval.
B. Petronova Trading FZE — Case Study in Due Diligence Failure
The onboarding of Petronova Trading FZE exemplifies the deficiencies in Dunmore's counterparty due diligence program. Petronova Trading FZE was registered in the Jebel Ali Free Zone Authority ("JAFZA"), UAE, with a registered address at Office 1407, Al Shafar Tower, Dubai Internet City. Petronova was onboarded as a counterparty to DTI in approximately early 2020, shortly before the first crude oil swap transaction was executed.
Our review of Petronova's KYC file — maintained as a paper file at DTI's Dubai office — revealed that the file contained only three documents: (1) a copy of Petronova's JAFZA trade license; (2) a self-reported shareholder declaration naming Sergei Volkov as the sole shareholder; and (3) basic sanctions screening results showing no hits against the SDN List. As noted in Section IV above, the SDN screening missed Volkov's connections to Volkhov Industrial Group because the screening did not incorporate the SSI List or the 50% Rule.
No independent verification of Sergei Volkov's identity, background, or associations was performed. No check was made of publicly available databases, corporate registries, adverse media sources, or open-source intelligence to determine whether Volkov had connections to sanctioned entities or individuals. No inquiry was made into the corporate structure of Petronova beyond the self-reported shareholder declaration. No assessment was made of the source of Petronova's crude oil supply or the ultimate origins of the commodities to be traded.
The onboarding of Petronova presented multiple red flags that, under industry best practices, should have triggered enhanced due diligence and, potentially, a decision not to proceed with the counterparty relationship:
(a) Newly incorporated entity. Petronova was incorporated shortly before the first transactions with DTI, a common indicator of a potential front company established for the purpose of evading sanctions.
(b) Russian-national managing director. Sergei Volkov, Petronova's sole shareholder and managing director, is a Russian national. In the post-2014 Crimea sanctions environment, a Russian-national principal of a commodity trading entity in the UAE is a well-recognized risk indicator.
(c) Commodity trading in Russian-origin crude oil. The transactions contemplated with Petronova involved crude oil with Russian-origin or Russian-destination characteristics, a further indicator of sanctions risk.
(d) Opaque corporate structure. Petronova's corporate structure was opaque, with limited publicly available information and a single-shareholder FZE structure that is commonly used in the UAE to shield beneficial ownership.
Industry best practices for Dubai-based commodity trading firms — as confirmed by Dr. Bremer's benchmarking analysis — require enhanced KYC for any counterparty with a Russian nexus, particularly in the post-2014 Crimea sanctions era. Enhanced KYC typically includes: independent verification of beneficial ownership through corporate registry searches and third-party databases; background checks on principals; adverse media screening; assessment of source of funds and source of commodities; and, where warranted, site visits or direct engagement with the counterparty to assess legitimacy. None of these measures were taken with respect to Petronova.
C. Zenith Petroleum DMCC — Similar Deficiencies
Zenith Petroleum DMCC (Unit 2201, Jumeirah Bay Tower X2, Cluster X, Jumeirah Lakes Towers, Dubai; Managing Director: Farhan Qureshi) was a counterparty to DTI in two of the fourteen flagged crude oil swap transactions. Zenith Petroleum's involvement in the transactions at issue raises similar concerns regarding the adequacy of Dunmore's counterparty due diligence.
Our review of Zenith Petroleum's KYC file revealed deficiencies substantially identical to those identified in the Petronova file. The KYC documentation was minimal, consisting of basic corporate formation documents and a self-reported ownership declaration. No red flag analysis was conducted, despite the entity's involvement in Russian-origin crude transactions. No enhanced due diligence was performed.
Amara Osei's July 5, 2022 memorandum detailed the counterparty due diligence failures with respect to Zenith Petroleum DMCC, including the absence of beneficial ownership verification, the failure to conduct adverse media screening, and the failure to assess the entity's role in the broader transaction structure involving Volkhov-connected parties. The findings of that memorandum are incorporated here by reference.
D. Caspian Logistik GmbH — Logistics Intermediary Due Diligence
Caspian Logistik GmbH (Mönckebergstraße 22, 20095 Hamburg, Germany; Managing Director: Klaus Weidemann) served as the logistics intermediary for the approximately $12.4 million in oilfield equipment exports at issue. Caspian Logistik handled the physical shipment of goods, arranged transportation, prepared shipping documentation, and provided end-user certifications.
Dunmore's due diligence process did not distinguish between direct trading counterparties and logistics or shipping intermediaries. No separate due diligence framework existed for intermediaries handling controlled goods — a significant gap, given that logistics intermediaries occupy a critical position in the supply chain and are frequently used as conduits for diversion and sanctions evasion.
The due diligence performed on Caspian Logistik was minimal. No verified corporate registry documents were obtained from German commercial registers. No assessment was made of Caspian Logistik's export control compliance history, its customer base, its geographic areas of operation, or its practices for verifying end users and end uses. No requirement was imposed on Caspian Logistik to provide independently verified end-user documentation — the company's self-generated end-user certifications were accepted without question.
Tobias Engel, Managing Director of Dunmore Renewables GmbH in Hamburg, confirmed in his interview that Caspian Logistik was "recommended by DTI's Dubai desk" and that the Hamburg operations performed "minimal vetting" before engaging the intermediary. Engel stated that he "assumed DTI had done its homework" on Caspian Logistik and that he had no reason to conduct independent due diligence on the intermediary.
E. Ongoing Monitoring
Dunmore maintained no program for the ongoing monitoring, periodic refresh, or event-triggered reassessment of existing counterparties. Once a counterparty was onboarded, no further due diligence was performed absent an ad hoc request — and no such requests were identified in the documentary record during the relevant period.
There was no adverse media screening or public-source intelligence monitoring for counterparties. No automated alerts were established to flag news reports, regulatory actions, or other developments that could indicate sanctions exposure or other compliance risks associated with existing counterparties.
There was no process for monitoring changes in sanctions designations that could affect existing business relationships. As discussed in Section IV.B above, the November 2019 Directive 2 designation of Volkhov — which directly implicated DTI's relationship with Petronova — did not trigger any review or reassessment of Dunmore's counterparty portfolio.
The absenc

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

MEMORANDUM

MATTER NO.: 1016-00009

Record

Parties

Dates

Amounts