MEMORANDUM
PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
TO: Victoria Chambers, Responsible Partner Howard Quinn, Billing Partner
FROM: Jasmine Thornton, Lead Associate Thomas Bradshaw, Senior Paralegal / e-discovery Lead Elena Vasquez, Paralegal Manager
DATE: April 28, 2022
RE: Data Map — Dunmore Energy Holdings Ltd. Global Data Sources & Custodian List
MATTER NO.: 1016-00009
CLIENT: Dunmore Energy Holdings Ltd.
Right-click to update Table of Contents
I. Purpose and Background
This memorandum maps all repositories of potentially responsive data across Dunmore Energy Holdings Ltd. ("DEH" or "Dunmore" or the "Company") and its subsidiaries worldwide, and identifies key custodians for document collection in connection with the grand jury subpoena issued on April 19, 2022, by the United States District Court for the District of Columbia, Grand Jury 22-2, bearing reference number GJ No. 22-418 (the "Subpoena"). The Subpoena was served on Dunmore's registered agent in Houston, Texas, and calls for the production of a broad range of documents and electronically stored information ("ESI").
The Subpoena seeks all documents from January 1, 2019 to the present related to the following subjects:
(a) Petronova Trading FZE, a free zone establishment registered in the UAE, and all transactions, communications, and business dealings with or concerning that entity;
(b) Volkhov Industrial Group JSC, a joint-stock company organized under the laws of the Russian Federation, and all transactions, communications, and business dealings with or concerning that entity;
(c) Zenith Petroleum DMCC, a Dubai Multi Commodities Centre company, and all transactions, communications, and business dealings with or concerning that entity;
(d) Caspian Logistik GmbH, a company organized under German law, and all transactions, communications, and business dealings with or concerning that entity;
(e) Any transaction involving Russian-origin crude oil or refined petroleum products, including but not limited to contracts, purchase orders, invoices, bills of lading, certificates of origin, price-cap attestations, and related shipping and logistics documentation; and
(f) Any export, re-export, or transfer of oilfield equipment, components, or related technology to Russia, Belarus, or to any individual or entity appearing on the U.S. Department of the Treasury, Office of Foreign Assets Control ("OFAC") Specially Designated Nationals and blocked Persons List ("SDN List"), the Bureau of Industry and Security Entity List, or the Denied Persons List.
This memorandum is prepared to support the e-discovery protocol currently being finalized with Nexagen Analytics Inc. ("Nexagen"), which has been retained as the e-discovery vendor and document review platform host for this engagement. The Nexagen project reference is Project No. NX-DEH-2204, and Brian Cavanaugh serves as the designated Nexagen Project Manager. The collection plan is targeted for execution beginning May 1, 2022, with phased collections occurring through mid-June 2022, as detailed in Section VIII below.
Litigation hold notices were issued to all Dunmore entities globally on April 20, 2022 — one day after receipt of the Subpoena — directing all employees, officers, and directors of Dunmore and its subsidiaries to preserve all potentially relevant documents and ESI. The hold notices were distributed in English, Arabic, and German, as appropriate, and covered all data sources and formats, including email, electronic documents, physical records, mobile device communications, and instant messaging platforms. The distribution log and acknowledgment tracking for the litigation hold notices are set forth in Appendix E to this memorandum.
Dunmore has approximately 3,200 employees globally across operations in six jurisdictions: the Cayman Islands, the United Arab Emirates, the United States, Germany, Nigeria, and the United Kingdom (the latter through Calderwood & Harkness LLP's London office involvement and interactions with Thornbury Infrastructure Fund II's general partner). The scope of the data mapping exercise has been tailored to address the multinational footprint of Dunmore's operations and the cross-border data transfer considerations that arise in each jurisdiction.
II. Dunmore Corporate Structure Overview
Dunmore Energy Holdings Ltd. is a global energy company with operations spanning upstream exploration, commodity trading, renewables, and logistics. The Company's corporate structure consists of a Cayman Islands parent entity and four principal operating subsidiaries. The following is a summary of each entity relevant to this investigation:
Dunmore Energy Holdings Ltd. ("DEH") — The parent entity and ultimate holding company. DEH is an exempted company with limited liability organized under the laws of the Cayman Islands, with Cayman Company Registration No. MC-334821. Its registered office is located at Harbour Place, 4th Floor, 103 South Church Street, George Town, Grand Cayman KY1-1002. However, the Company's operational headquarters — where senior management and corporate functions including Legal, Compliance, Finance, and Executive leadership are located — is situated at 1200 McKinney Street, Suite 3400, Houston, Texas 77010. For all practical purposes, DEH's day-to-day operations are directed from Houston.
Dunmore Trading International Ltd. ("DTI") — A limited company registered in Dubai, United Arab Emirates, within the Dubai International Financial Centre ("DIFC"). DTI holds DIFC License No. CL-4827 and maintains its principal office at Level 14, Gate Building 3, Dubai International Financial Centre, P.O. Box 506774, Dubai, UAE. DTI is the primary focus of the DOJ investigation. DTI operates Dunmore's commodity trading desk and is responsible for the execution of crude oil and refined product trades, as well as oilfield equipment logistics and procurement activities. The 14 flagged crude oil swap transactions, the 127 structured payment transactions, and the oilfield equipment shipments via Caspian Logistik GmbH all originated from or were facilitated through DTI.
Dunmore upstream Americas LLC ("DUA") — A limited liability company organized under the laws of Delaware, with EIN 84-2937561. DUA's registered agent is located at 1209 Orange Street, Wilmington, Delaware 19801, and its principal office is co-located with DEH at 1200 McKinney Street, Suite 3400, Houston, Texas 77010. DUA manages Dunmore's upstream exploration and production operations in the Americas. While DUA is not a primary focus of the investigation, its Houston-based personnel share IT systems and office space with DEH, and certain financial oversight functions for DTI's trading activities are performed by DUA personnel.
Dunmore Renewables GmbH — A Gesellschaft mit beschränkter Haftung organized under German law, with its registered office at Überseeallee 12, 20457 Hamburg, Germany. Dunmore Renewables GmbH is tangentially involved in the investigation based on its participation in one suspect transaction with Caspian Logistik GmbH. The nature and scope of the Hamburg entity's involvement remains under assessment but is believed to be limited to a single logistics arrangement that may have been used to facilitate an oilfield equipment shipment.
Dunmore Exploration West Africa Ltd. ("DEWA") — A limited company registered in Lagos, Nigeria, with its principal office at 14B Kofo Abayomi Street, Victoria Island, Lagos, Nigeria. DEWA manages Dunmore's upstream exploration operations in West Africa. DEWA's relevance to the investigation is peripheral and is expected to be limited to any communications between DEWA personnel and DTI Dubai regarding crude oil sourcing and supply chain matters.
Ownership Structure. The equity of Dunmore Energy Holdings Ltd. is held as follows:
• Greystone Capital Partners Fund IV, L.P. — 62.5%
• Dunmore management — 22.5%
• Thornbury Infrastructure Fund II, L.P. — 15%
Thornbury Infrastructure Fund II, L.P. is managed by Thornbury Asset Management Ltd., a London-based investment management firm. Common interest agreement considerations are discussed in Section III.F below.
Dunmore reported consolidated revenue of $4.87 billion for the fiscal year ended December 31, 2021, per audited financial statements issued by Ashford & Whitmore LLP, the Company's independent external auditor.
A diagram illustrating the parent-subsidiary relationships and the principal data flows between Dunmore entities is set forth in Appendix A.
III. Jurisdictional Considerations
The multinational nature of Dunmore's operations requires careful attention to the data protection, privacy, and blocking statute regimes in each jurisdiction where relevant data resides. The following is a summary of the key jurisdictional considerations for each location where data collection will be required.
A. United States (Houston, TX / Wilmington, DE)
The United States is the primary jurisdiction for collection. DEH's operational headquarters and DUA's principal office are co-located at 1200 McKinney Street, Suite 3400, Houston, Texas 77010. The Subpoena was issued by a federal grand jury sitting in the District of Columbia and was served on Dunmore's registered agent in Houston. There are no cross-border data transfer obstacles for data originating within the United States.
All data stored on U.S.-based servers, including data hosted in Ashgrove Software environments with U.S.-based data residency, is subject to U.S. federal discovery and subpoena requirements without significant legal impediment. The primary considerations for U.S.-based collection are standard forensic collection protocols, chain-of-custody documentation, and privilege review procedures.
DUA's Delaware registered agent at 1209 Orange Street, Wilmington, Delaware 19801 is not expected to maintain any substantive business records. DUA's operational records are maintained at the Houston office.
B. United Arab Emirates (Dubai — DIFC)
DTI operates within the Dubai International Financial Centre, which has its own regulatory framework distinct from the broader UAE federal legal system. The DIFC has its own courts, its own data protection regime, and its own commercial laws. DTI's operations are thus subject to both the DIFC-specific regulatory framework and, in certain respects, UAE federal law.
A separate memorandum prepared by Amara Osei of Calderwood & Harkness LLP's London office, dated April 25, 2022, analyzes the UAE federal and DIFC-specific document preservation obligations in detail. That memorandum should be read in conjunction with the present data map. Key conclusions from Ms. Osei's analysis include that Dunmore has an affirmative obligation under DIFC law to preserve documents subject to reasonably anticipated litigation and regulatory proceedings, and that the litigation hold issued on April 20, 2022, is consistent with DIFC Data Protection Law requirements.
Data privacy considerations arise under two principal regimes:
• UAE Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law): This law, which came into effect on January 2, 2022, with a grace period for compliance, establishes requirements for the processing and transfer of personal data, including restrictions on cross-border data transfers to jurisdictions that do not provide an adequate level of protection. The United States is not currently recognized by UAE authorities as providing an adequate level of protection, and accordingly, cross-border transfer mechanisms — such as standard contractual clauses, binding corporate rules, or the data subject's explicit consent — may need to be addressed before personal data leaves UAE jurisdiction.
• DIFC Data Protection Law No. 5 of 2020: The DIFC's data protection regime is modeled on the EU's GDPR and imposes its own requirements for data processing, including restrictions on cross-border transfers of personal data. The DIFC Commissioner of Data Protection may issue guidance or approvals regarding transfer mechanisms.
Coordination with local IT support at the DTI Dubai office will be required for on-site collections, forensic imaging of devices, and access to locally hosted systems. The DTI IT Manager (contact to be confirmed) will serve as the primary IT point of contact in Dubai.
C. Cayman Islands
DEH's registered office is located at Harbour Place, 4th Floor, 103 South Church Street, George Town, Grand Cayman KY1-1002. Limited operational data is stored locally at the Cayman Islands registered office. The data expected to be held in the Cayman Islands consists primarily of corporate governance records, including board minutes, shareholder resolutions, articles of association, and corporate secretary files.
The Cayman Islands Confidential Relationships (Preservation) Law (Revised) imposes restrictions on the disclosure of confidential information received by persons in a professional capacity. This law may raise considerations with respect to the cross-border disclosure of certain corporate records held by the registered agent and corporate secretary. However, the Law provides exceptions for disclosure made with the consent of the person to whom the duty of confidentiality is owed, and Dunmore, as the principal, may authorize such disclosure. The team should confirm with Cayman Islands counsel that no additional steps are required before corporate records are transmitted to U.S. counsel.
D. Germany (Hamburg)
Dunmore Renewables GmbH is registered at Überseeallee 12, 20457 Hamburg, Germany. As a German entity with employees and operations in Germany, Dunmore Renewables GmbH is subject to the following data protection and privacy regimes:
• EU General Data Protection Regulation ("GDPR"): The GDPR applies to the processing of personal data of EU data subjects. Collection of employee communications and personnel data from Dunmore Renewables GmbH constitutes processing of personal data subject to GDPR requirements, including lawful basis for processing, data minimization, purpose limitation, and restrictions on cross-border transfers to countries outside the European Economic Area that do not provide an adequate level of data protection. The United States does not currently benefit from an adequacy decision (noting the Schrems II decision invalidating the Privacy Shield), and accordingly, Standard Contractual Clauses ("SCCs") adopted by the European Commission, together with a Transfer Impact Assessment, will be required to effectuate transfers of personal data from Germany to the United States.
• German Federal Data Protection Act (Bundesdatenschutzgesetz, "BDSG"): The BDSG supplements the GDPR with German-specific provisions. Of particular relevance are provisions relating to employee data protection (§ 26 BDSG) and the potential application of German blocking statute considerations under §§ 7 and 40 BDSG, which may restrict the transfer of certain categories of employee communications and personal data to foreign jurisdictions in connection with judicial or regulatory proceedings.
• German Works Council (Betriebsrat) Involvement: Under the German Works Constitution Act (Betriebsverfassungsgesetz), if Dunmore Renewables GmbH has an established works council, the collection and transfer of employee data may require prior consultation with or approval by the works council. The team must assess whether a works council is in place at the Hamburg office and, if so, the scope of any required works council involvement. This assessment should be completed before any collection activity commences at the Hamburg facility.
Coordination with Liam Donahue of Calderwood & Harkness's team regarding the German collection protocols is essential. Engagement of German employment counsel or data protection counsel may be necessary to ensure full compliance with applicable requirements.
E. Nigeria (Lagos)
DEWA's principal office is located at 14B Kofo Abayomi Street, Victoria Island, Lagos, Nigeria. The Nigeria Data Protection Regulation ("NDPR") of 2019, issued by the National Information Technology Development Agency ("NITDA"), imposes requirements on the collection, processing, and cross-border transfer of personal data. Under the NDPR, cross-border transfer of personal data is permitted only where the destination country provides an adequate level of data protection, or where appropriate safeguards are in place.
Nigeria is a lower-priority jurisdiction for collection given DEWA's peripheral involvement in the matters under investigation. The focus of any DEWA collection will be on communications between DEWA personnel and DTI Dubai concerning crude oil sourcing, supply chain logistics, and any references to the counterparties identified in the Subpoena. Provided that the collection scope remains limited to business communications (rather than bulk employee personal data), the NDPR compliance burden should be manageable, but the team should confirm requirements before data leaves Nigerian jurisdiction.
F. United Kingdom (London)
Dunmore does not maintain a UK subsidiary. However, the United Kingdom is relevant to the investigation in several respects:
• Calderwood & Harkness LLP London Office: Our firm's London office at 30 St Mary Axe, 12th Floor, London EC3A 8BF is involved in the investigation, with Amara Osei leading the UAE/DIFC jurisdictional analysis from London. Attorney work product generated at the London office is subject to Calderwood & Harkness's internal data security protocols.
• Thornbury Asset Management Ltd.: Thornbury Infrastructure Fund II, L.P.'s general partner, Thornbury Asset Management Ltd., is a London-based entity. Common interest agreement considerations should be addressed with respect to any sharing of investigation-related materials with Thornbury and its counsel. A common interest agreement may be appropriate given the alignment of interests between Dunmore management and the Thornbury fund as equity holders, but the terms of such an agreement should be negotiated and documented before any substantive information sharing occurs.
• UK GDPR and Data Protection Act 2018: These regimes may apply if Dunmore personnel based in or transiting through the United Kingdom generate data relevant to the investigation, or if UK-based systems are used to route or store communications. Some DTI personnel may have communicated via London-routed systems, particularly in connection with meetings at or near the Calderwood & Harkness London office or with Thornbury Asset Management.
IV. Data Sources by Entity
The following sections identify and describe the data sources maintained by each Dunmore entity that are potentially responsive to the Subpoena. The data sources are organized by entity and location, and within each entity, by type of data source.
A. Dunmore Energy Holdings Ltd. / Dunmore upstream Americas LLC (Houston, TX)
DEH and DUA share IT infrastructure and office space at 1200 McKinney Street, Suite 3400, Houston, Texas 77010. For purposes of data collection, these two entities are treated together.
1. Email Systems. Dunmore's Houston-based operations utilize a Ashgrove Software / Drayton Solutions environment. Email is centrally hosted in the cloud for all Houston-based personnel, with data residency in U.S.-based Ashbury Holdings data centers. Two principal email domains are in use:
• @dunmoreenergy.com — The primary corporate email domain used by DEH personnel, including senior management, Legal, Compliance, Finance, and executive staff.
• @dunmore-upstream.com — A subsidiary-specific domain used by DUA personnel, primarily those involved in upstream exploration and production operations.
Email archiving and journaling are enabled through the Sterling Reach Systems. Dunmore has a corporate email retention policy providing for seven-year retention of all business communications. This policy has been in effect since at least 2018, meaning that email data from the beginning of the Subpoena's date range (January 1, 2019) should be available within the archive.
The estimated mailbox count for key custodians based in Houston is approximately 15 to 20 mailboxes, encompassing Tier 1 and Tier 2 custodians as well as certain anticipated Tier 3 additions. Some personnel — particularly those in senior leadership and compliance roles — may use both the @dunmoreenergy.com and @dunmore-upstream.com email domains, and both domains should be collected for such individuals to ensure completeness.
2. Shared Network Drives / File Servers. Dunmore maintains an on-premises file server at the Houston office at 1200 McKinney Street. The shared drive environment is organized by department, with the following directories identified as potentially containing responsive material:
• Legal Department Shared Drive — Contains legal memoranda, contracts, regulatory correspondence, board materials, and litigation files.
• Compliance Department Drive — Contains OFAC screening records, sanctions compliance program documentation, trade compliance policies and procedures, compliance training materials, investigation files, and whistleblower hotline records.
• CFO / Finance Shared Drive — Contains financial reports, treasury management files, bank account documentation, wire transfer records, budgets, and audit-related materials.
• CEO Office Shared Drive — Contains executive correspondence, strategic planning documents, board presentations, and investor relations materials.
• Trading Operations Oversight — Contains oversight and reporting files related to DTI's commodity trading activities, including periodic trading desk reports submitted to Houston management.
In addition to on-premises file servers, Dunmore utilizes cloud-based document storage through Hollowell Technologies and Larkspur Health IT. These platforms are part of the Ashgrove Software environment and are used for collaborative document creation, storage, and sharing. Both Aldermere Systems sites and individual Cobalt Ridge Systems accounts for identified custodians should be included in the collection scope.
3. Enterprise Systems. The following enterprise systems are in use at the Houston office and may contain responsive data:
• Harborline Software: Dunmore's enterprise resource planning ("ERP") system. The SAP platform is used across all Dunmore entities (with entity-specific instances and local charts of accounts) for financial accounting, procurement, logistics, and supply chain management. The Houston installation serves as the central hub for consolidated financial reporting and includes modules for general ledger accounting, accounts payable and receivable, procurement, and treasury management.
• Vireo Software: Vireo Software are deployed on the Houston trading oversight desk. Vireo Software generate and store trading communications through the Westmark Services Inc. Instant Westmark Services Inc. ("IB") chat function, which is a critical data source for real-time communications between traders and counterparties. Westmark Services Inc. IB chat logs for Houston-based personnel should be collected for all custodians with active Vireo Software access.
• Larkspur Data Systems: The Eikon platform is used for market data, pricing intelligence, and communications. Eikon messaging and any deal-related communications generated through the platform should be reviewed for responsive content.
• Ashford Systems (Human Capital Management): Ashford Systems is the Company's human resources information system, containing employee records, organizational charts, reporting structures, compensation information, and personnel files. Ashford Systems data may be relevant to identifying additional custodians, confirming reporting relationships, and establishing the organizational context for the individuals involved in the conduct at issue.
• DocuSign: Dunmore uses the contract execution platform for the electronic execution of agreements with counterparties. DocuSign records should be reviewed for any agreements, amendments, or other contractual documents executed with Petronova Trading FZE, Zenith Petroleum DMCC, Caspian Logistik GmbH, Volkhov Industrial Group JSC, or other entities identified in the Subpoena.
4. Financial / Accounting Systems. In addition to the SAP financial modules described above, the following financial data sources are potentially responsive:
• SAP Financial Modules (Houston Instance): General ledger entries, accounts payable and receivable records, treasury management records, intercompany transaction records, and consolidated financial statements.
• Meridian National Bank, N.A. Records: Dunmore maintains a $750 million revolving credit facility with Meridian National Bank, N.A., located at 277 Park Avenue, New York, New York 10172. The lead banker is Gregory Stanhope, Managing Director. Bank records including account statements, wire transfer records, loan draw-down and repayment records, and related correspondence should be obtained from Meridian National Bank. These records may be obtained through Dunmore's authorization or, if necessary, through bank subpoena.
• Ashford & Whitmore LLP Audit Work Papers: Ashford & Whitmore LLP, Dunmore's independent external auditor, maintains audit work papers, internal controls assessments, and trade finance transaction testing documentation from the annual audit engagements for fiscal years 2019, 2020, and 2021. The Engagement Partner is Kenneth Ashford. Access to audit work papers is subject to auditor cooperation and requires careful consideration of any applicable privilege or work product protections. The team should coordinate with Ashford & Whitmore regarding access protocols.
5. Compliance Systems. Dunmore's compliance function, historically led by former Chief Compliance Officer Gerald Fisk, maintains the following systems and records:
• OFAC Screening Tool: Dunmore utilizes a third-party vendor-provided OFAC screening tool for sanctions compliance. This tool is used to screen counterparties, transactions, and other parties against the OFAC SDN List, the Entity List, and other restricted party lists. The screening tool generates logs of all screening inquiries, results, and disposition determinations. These logs are a critical data source for the investigation, as they will show whether and when the entities named in the Subpoena were screened, what results were returned, and what actions were taken in response.
• Trade Compliance Database / Restricted Party Screening Logs: In addition to the automated OFAC screening tool, the Compliance Department maintains a database of restricted party screening results, including manual reviews, escalations, and approvals. This database contains records of compliance reviews performed on counterparty transactions, including any waivers, exceptions, or override determinations.
• Compliance Training Records: Records of compliance training sessions conducted for Dunmore personnel, including attendance records, training materials, and certifications. These records may be relevant to establishing the adequacy of Dunmore's compliance program and the knowledge of individuals regarding sanctions and export control requirements.
• Whistleblower Hotline Records: Dunmore maintains a confidential whistleblower hotline. Records of any reports, complaints, or tips received through the hotline should be reviewed for any reports related to the subject matter of the Subpoena.
6. Physical Records. The Houston office maintains hard-copy records in several departments:
• Legal Department: Contracts (including original counterparty agreements), board materials, corporate governance records, and regulatory correspondence.
• Compliance Department: Screening records, compliance training logs, hard-copy investigation files, and policy and procedure manuals.
• Finance Department: Certain trade finance documents, including letters of credit, bank guarantee instruments, and wire transfer authorizations that may exist only in hard-copy form or in hard-copy original form.
Additionally, original board minute books and certain corporate governance records are maintained in part at the Cayman Islands registered office and in part at the Houston operational headquarters. The team should confirm where originals reside for each category of corporate governance records.
B. Dunmore Trading International Ltd. (Dubai, UAE — DIFC)
DTI is the highest-priority collection target in this investigation. DTI is the center of the conduct at issue, including the crude oil swap transactions with Petronova Trading FZE and Zenith Petroleum DMCC, the oilfield equipment shipments facilitated through Caspian Logistik GmbH, and the structured payment flows through Crescent Commercial Bank PJSC. The following data sources have been identified at DTI.
1. Email Systems. DTI utilizes the same Ashgrove Software / Drayton Solutions environment as the broader Dunmore organization. DTI operates on a shared tenant with the Houston office but has a separate regional configuration to accommodate DIFC regulatory requirements and local operational needs.
Two email domains are in use at DTI:
• @dunmore-trading.ae — The primary domain used by DTI personnel for business communications.
• @dunmoreenergy.com — Senior DTI personnel, including Derek Hargrave and Rajesh Malhotra, also maintain email aliases on the corporate @dunmoreenergy.com domain for communications with Houston-based management and external stakeholders.
The estimated mailbox count for key custodians at DTI is approximately 10 to 15 mailboxes, spanning Tier 1 custodians and anticipated Tier 2 and Tier 3 additions from the DTI trading desk and support staff.
Important Note: There are indications that some DTI personnel may have used personal email accounts (e.g., Northgate Software, Cascade Health IT, or other web-based email providers) for business-related communications. This practice has been flagged for investigation, and custodian interviews should specifically probe the use of personal email accounts for business purposes. If confirmed, collection of personal email accounts may be required, subject to custodian cooperation and applicable privacy laws.
2. Instant Messaging / Chat Platforms. The DTI trading desk and operations personnel utilize multiple instant messaging and chat platforms, several of which are critical data sources for this investigation:
• Westmark Services Inc. IB Chat: Westmark Services Inc. Instant Westmark Services Inc. chat is heavily used by the DTI trading desk for real-time communications with counterparties, brokers, and other market participants. The Westmark Services Inc. IB chat histories for Natasha Sorokin and other traders are among the most critical data sources in this investigation, as they may contain contemporaneous communications regarding the suspect crude oil swap transactions. Westmark Services Inc. chat data can be collected through Westmark Services Inc. Vault, Westmark Services Inc.'s enterprise archiving solution, or through equivalent archiving tools if Westmark Services Inc. Vault is deployed. The team must confirm whether Westmark Services Inc. Vault or an equivalent archiving solution is active for DTI's trading desk and determine the applicable retention period.
• Meridian Services Inc.: Meridian Services Inc. is widely used in the Dubai business environment and is known to be a routine communication channel for DTI personnel. Meridian Services Inc. messages may contain business-relevant communications between DTI personnel and counterparty contacts, including at Petronova Trading FZE and Zenith Petroleum DMCC. Meridian Services Inc. data resides on individual users' personal mobile devices and (if enabled) in cloud backups associated with each user's Tidewater Industries Meridian Systems or Severin Industries account. Collection of Meridian Services Inc. data presents significant preservation challenges, as messages may be subject to auto-deletion settings, and collection typically requires access to the user's personal device.
• Northgate Data Systems: Northgate Data Systems is used for internal communications within the Dunmore organization, including chat messages, video conferencing, and file sharing. Teams chat data is stored within the Ashgrove Software environment and can be collected through the Sterling Reach Systems eDiscovery tools.
• Encrypted Messaging Applications (Signal, Kestrel Data Systems): There are grounds to suspect that certain communications between Natasha Sorokin and Sergei Volkov of Petronova Trading FZE may have been conducted through encrypted messaging applications such as Signal or Kestrel Data Systems. The use of such platforms for business communications raises serious concerns, as these applications are designed to provide end-to-end encryption and, in some cases, auto-deleting message functionality. Personal device collection may be required to preserve and collect data from these platforms. The legal authority for and feasibility of such collection must be assessed with Victoria Chambers, taking into account UAE privacy law, custodian cooperation, and the Company's BYOD (Bring Your Own Device) policies, if any.
3. Trading Systems. DTI's trading operations are supported by the following systems, which contain structured data records of all commodity trading activity:
• Allegro Horizon (Commodity Trading and Risk Management System, "CTRM"): Allegro Horizon is DTI's primary CTRM platform and records all crude oil and refined petroleum product trades executed by the DTI trading desk. This system contains the records of the 14 flagged crude oil swap transactions executed between June 2020 and February 2022, with an aggregate notional value of approximately $218.7 million, involving Petronova Trading FZE and Zenith Petroleum DMCC as counterparties. The Allegro system captures trade details including counterparty identification, trade date, settlement date, commodity type, volume, pricing terms, and deal approval workflow. Data extraction from Allegro Horizon will require structured data export in a format suitable for review and analysis, and will necessitate coordination with DTI IT and potentially with the Allegro software vendor.
• Vireo Software: In addition to chat data (discussed above), Vireo Software at the DTI trading desk generate trade execution records, pricing data, market data feeds, and broker communications. Vireo Software data should be collected for all DTI custodians with active Westmark Services Inc. access.
• Internal Trade Blotter / Deal Ticket System: DTI maintains an internal trade blotter and deal ticket system that records individual trade approvals, counterparty information, pricing terms, deal structure, and trader identification for each trade. This system may be a standalone application or an internal module integrated with the Northpoint Software platform. The team should confirm the architecture and collection methodology with DTI IT.
4. Financial / Accounting Systems.
• SAP Financial Modules (DTI Instance): DTI maintains its own SAP instance with a local chart of accounts tailored to the entity's trading operations. The SAP financial data for DTI includes general ledger entries, accounts payable and receivable records, intercompany transactions with DEH and other Dunmore entities, and financial reporting data.
• Crescent Commercial Bank PJSC Records: DTI maintains banking relationships with Crescent Commercial Bank PJSC, located at Al Maktoum Tower, DIFC, Dubai. The Relationship Manager is Khalid Mansour. Crescent Commercial Bank records are a critical data source for the investigation, as they contain records of approximately $34.2 million in payments across 127 transactions during the period from March 2020 through March 2022. These payments were routed through intermediary accounts in a manner that suggests potential structuring to evade sanctions compliance screening or reporting thresholds. Bank records to be obtained include account statements, wire transfer records and confirmations, beneficiary information, intermediary bank routing information, and any know-your-customer ("KYC") or enhanced due diligence files maintained by the bank in connection with DTI's account.
• Trade Finance Documentation: DTI generates and receives substantial trade finance documentation in connection with its commodity trading operations, including letters of credit, bills of lading, commercial invoices, certificates of origin, inspection certificates, and insurance documents. These records are critical to establishing the provenance, origin, and routing of crude oil shipments and oilfield equipment transactions.
• Accounts Payable / Receivable Records: Detailed records of payments to and receipts from Petronova Trading FZE, Zenith Petroleum DMCC, and Caspian Logistik GmbH, including invoice matching, payment authorization records, and remittance advice.
5. Logistics / Shipping Systems.
• Pinnacle Software: DTI uses the Pinnacle Software logistics and freight management system, operated by the team led by Yves Leclerc, Director of Logistics & Shipping. Drayton Solutions records of all logistics and freight activities managed by DTI, including the oilfield equipment shipments totaling approximately $12.4 million that were facilitated through Caspian Logistik GmbH. The system records shipment details, routing information, carrier selection, customs declarations, and freight costs.
• End-User Certificates ("EUCs"): Filed copies of end-user certificates submitted in connection with oilfield equipment shipments are maintained by DTI. The investigation has identified concerns regarding potentially false end-user certifications — i.e., certifications that may have misrepresented the ultimate end-user or destination of oilfield equipment to circumvent export control restrictions. All EUCs for shipments involving Caspian Logistik GmbH and any shipments destined for or transiting through Russia or Belarus should be collected and reviewed.
• Bills of Lading, Shipping Manifests, and Customs Declarations: These documents are generated and received in connection with physical commodity and equipment shipments through Dubai and Hamburg ports. They are maintained in both electronic and hard-copy form and should be collected from both DTI's electronic systems and physical files.
• Export License Applications and Records: Any applications for export licenses or export control classifications submitted by DTI to UAE, U.S., or other government authorities, together with any approvals, denials, or correspondence related thereto. The existence and content of such records should be confirmed with DTI's compliance and logistics personnel.
6. Physical Records. The DTI Dubai office at Level 14, Gate Building 3, DIFC maintains hard-copy records in the following categories:
• Trade files organized by counterparty and transaction
• Counterparty due diligence folders, including KYC documentation, beneficial ownership information, and sanctions screening printouts
• Compliance screening printouts and manual compliance review files
• Original contract files for agreements with counterparties
The personal offices of Derek Hargrave and Natasha Sorokin have been physically secured pursuant to the litigation hold notice issued on April 20, 2022. The contents of these offices, including any documents, notebooks, external storage devices, and other materials, should be inventoried and collected during Phase 1.
7. Personal Devices. Company-issued mobile phones have been identified for the following DTI personnel:
• Derek Hargrave — President, DTI
• Natasha Sorokin — Senior Trader
• Omar Al-Rashidi — Head of Middle East Operations
• Yves Leclerc — Director of Logistics & Shipping
• Rajesh Malhotra — Controller, DTI
In addition to company-issued devices, personal mobile devices may have been used for business communications by some or all of the above individuals. Collection of personal devices is dependent on custodian cooperation and is subject to jurisdictional considerations under UAE privacy law. The scope of the Company's authority over personal devices used for business purposes, and the terms of any BYOD policy, must be assessed before personal device collection is attempted.
Laptop computers issued to DTI personnel should be forensically imaged as part of the Phase 1 collection effort.
C. Dunmore Renewables GmbH (Hamburg, Germany)
1. Email Systems. Dunmore Renewables GmbH operates on the shared Ashgrove Software / Drayton Solutions tenant used by the broader Dunmore organization. The Hamburg entity uses the email domain @dunmore-renewables.de. The estimated mailbox count for relevant custodians is 2 to 3, with the primary custodian being Tobias Engel, Managing Director.
2. Enterprise / Financial Systems.
• SAP Financial Modules (Renewables Instance): Dunmore Renewables GmbH maintains its own SAP instance with a local chart of accounts. The SAP data should be reviewed for any records of the suspect transaction involving Caspian Logistik GmbH, including purchase orders, invoices, payment records, and general ledger entries.
• Records of Caspian Logistik GmbH Transaction: The investigation has identified one suspect transaction between Dunmore Renewables GmbH and Caspian Logistik GmbH (Mönckebergstraße 22, 20095 Hamburg). The nature and details of this transaction are under review, and all related records — including contracts, purchase orders, invoices, payment records, correspondence, and logistics documentation — should be collected from the Hamburg office.
3. Physical Records. The Hamburg office at Überseeallee 12 maintains limited hard-copy files related to the Caspian Logistik transaction, including contracts, correspondence, and logistics documentation. Physical records collection at the Hamburg office must be conducted in compliance with GDPR requirements, and potential works council consultation should be completed before collection activities commence.
D. Dunmore Exploration West Africa Ltd. (Lagos, Nigeria)
1. Email Systems. DEWA operates on the shared Ashgrove Software / Drayton Solutions tenant. The Lagos entity uses the email domain @dunmore-westafrica.com. The estimated mailbox count for relevant custodians is 1 to 2, with the focus on any DEWA personnel who communicated with DTI Dubai regarding crude oil sourcing or supply chain matters.
2. Enterprise Systems.
• SAP Financial Modules (DEWA Instance): DEWA maintains its own SAP instance. The relevance of DEWA's SAP data is expected to be limited, and collection should focus on any records of transactions, communications, or financial flows connected to DTI's trading activities or to any of the counterparties identified in the Subpoena.
3. Physical Records. The Lagos office at 14B Kofo Abayomi Street maintains hard-copy files related to crude oil sourcing and logistics. These records are a lower priority for initial collection but may be escalated if the investigation identifies Nigeria-connected transactions that are relevant to the Subpoena.
E. Cayman Islands (Registered Office — Harbour Place)
1. Corporate Records. The Cayman Islands registered office at Harbour Place, 4th Floor, 103 South Church Street, George Town, Grand Cayman maintains corporate governance records for DEH, including:
• Board minutes and resolutions
• Shareholder agreements and resolutions
• Articles of association (memorandum and articles of association)
• Corporate governance documents relevant to compliance program oversight, including any board-level committee charters (e.g., Audit Committee, Compliance Committee)
These records are maintained by the registered agent and corporate secretary. The volume of Cayman-based records is expected to be limited, as the substantive business operations are conducted from Houston and Dubai. However, board-level governance documents may be relevant to establishing what the Board knew about compliance program adequacy, counterparty risk, and the specific transactions under investigation.
V. Third-Party Data Sources
In addition to the data sources maintained within the Dunmore corporate family, several categories of third-party data sources have been identified as potentially responsive to the Subpoena or otherwise relevant to the investigation.
A. Banking Records
The following banking institutions maintain records relevant to the investigation:
Meridian National Bank, N.A. — 277 Park Avenue, New York, New York 10172. Meridian National Bank is the lead lender on Dunmore's $750 million revolving credit facility. The primary contact is Gregory Stanhope, Managing Director. Records to be obtained include credit facility documentation, account statements, wire transfer records and confirmations, loan draw-down and repayment records, and any correspondence related to compliance representations or certifications made by Dunmore in connection with the credit facility. Meridian's records may also reflect any internal compliance screening or suspicious activity reports triggered by Dunmore-related transactions.
Crescent Commercial Bank PJSC — Al Maktoum Tower, DIFC, Dubai, UAE. Crescent Commercial Bank is DTI's primary banking partner in Dubai. The primary contact is Khalid Mansour, Relationship Manager. This is a critical data source for the investigation, as Crescent Commercial Bank's records are expected to contain detailed information regarding the 127 structured payment transactions totaling approximately $34.2 million that were routed through intermediary accounts during the period from March 2020 through March 2022. Records to be obtained include account statements, wire transfer records (including originator, beneficiary, and intermediary bank information), trade finance documentation (letters of credit, bank guarantees), KYC and enhanced due diligence files for DTI and any associated intermediary accounts, and any internal compliance alerts or suspicious activity reports. The process for obtaining these records directly from Crescent Commercial Bank must be determined — options include Dunmore authorization letter, direct request to the bank, or UAE/DIFC court process. See Section XII, Item 4 below.
Commonwealth Trust Company — 1000 West Street, Suite 1500, Wilmington, Delaware 19801. Commonwealth Trust Company maintains escrow account records related to employee separation payments. These records may be relevant to the terms and conditions of departures by individuals connected to the investigation, including Gerald Fisk.
B. Outside Auditors
Ashford & Whitmore LLP — 1 Finsbury Square, London EC2A 1AE. Ashford & Whitmore LLP is Dunmore's independent external auditor and has conducted annual audits of Dunmore's consolidated financial statements for fiscal years 2019, 2020, and 2021. The Engagement Partner is Kenneth Ashford. Records potentially relevant to the investigation include audit work papers, internal controls assessments (particularly those related to the sanctions compliance and trade compliance programs), trade finance transaction testing, management representation letters, and any communications between the auditors and Dunmore management or the Audit Committee regarding identified deficiencies, material weaknesses, or areas of concern.
Access to audit work papers is subject to auditor cooperation and requires careful consideration of applicable professional standards and any privilege or work product protections. The team should assess whether a formal request, an auditor consent letter, or other access protocol is required, and should coordinate with Ashford & Whitmore at the engagement partner level.
C. Counterparty Records (if obtainable)
Documents held by Petronova Trading FZE, Zenith Petroleum DMCC, and Caspian Logistik GmbH are not within Dunmore's possession, custody, or control, and the Company has no legal basis to compel production of documents from these third-party counterparties. However, copies of contracts, correspondence, invoices, purchase orders, shipping documents, and other materials exchanged between Dunmore entities and these counterparties should exist within Dunmore's own systems and are fully subject to collection. The team should ensure that collection from Dunmore's systems captures both sent and received communications with these counterparties across all communication channels, including email, Westmark Services Inc. chat, Meridian Services Inc., and any other identified platforms.
To the extent the DOJ elects to issue separate subpoenas or requests to Petronova, Zenith Petroleum, or Caspian Logistik, any documents obtained from those sources may be made available to Dunmore's counsel through the government's discovery obligations in any subsequent proceeding.
D. D&O Insurance Carrier
Garrison Mutual Insurance Co. — Cedar House, 41 Cedar Avenue, Hamilton HM 12, Bermuda. Dunmore maintains directors' and officers' liability insurance under Policy No. GM-DO-2021-08734 issued by Garrison Mutual Insurance Co. The claims adjuster assigned to this matter is Patricia Holbrook. Claim correspondence, coverage determination letters, reservation of rights letters, and any related communications should be obtained and reviewed. The team should ensure that communications with the D&O carrier are conducted in a manner that preserves applicable privileges.
VI. Key Custodian List
The following individuals have been identified as key custodians whose data should be collected, preserved, and reviewed in connection with the Subpoena. Custodians are organized into three tiers based on their proximity to the conduct at issue, the priority of their data for the investigation, and the anticipated timing of collection.
Tier 1 — Priority Custodians (Immediate Collection)
Tier 1 custodians are individuals with direct involvement in the transactions and conduct under investigation. Collection of their data should commence immediately upon execution of the collection plan (Phase 1, beginning May 1, 2022).
Tier 2 — Secondary Custodians (Collection Within 2 Weeks of Kickoff)
Tier 2 custodians are individuals in senior management or oversight roles who may have had knowledge of or involvement in the transactions under investigation. Collection of their data should be completed within two weeks of the collection plan kickoff (Phase 2, beginning May 8, 2022).
Tier 3 — Additional Custodians (Collection as Investigation Develops)
Tier 3 custodians include individuals whose relevance to the investigation may become apparent as document review and witness interviews progress. Initial identification is set forth below, with specific custodian names and data source assignments to be finalized as the investigation develops.
Custodian Volume Summary. The total estimated number of custodians for initial collection is approximately 20 to 25 individuals. This number may expand to 40 or more as the investigation progresses and additional relevant personnel are identified through document review, custodian interviews, and forensic accounting analysis. Ultimately, 47 witnesses were identified for interview across three planned rounds (22 in the first round, 15 in the second round, and 10 in the third round), and the custodian list should be revisited and updated as each interview round concludes to ensure that newly identified data sources and custodians are promptly added to the collection scope.
A detailed custodian matrix, including full contact information, device inventories, and data source assignments for each identified custodian, is set forth in Appendix B.
VII. Data Volume Estimates
Based on preliminary assessments conducted with Dunmore's IT department and Nexagen Analytics, the following data volume estimates have been developed for the collection universe. These estimates are expressed in approximate document counts and are subject to refinement as collection activities proceed.
Following processing, de-duplication, and technology-assisted review ("TAR") by Nexagen Analytics using the Relativity platform, the following estimates have been developed for the responsive and privileged document populations:
• Responsive documents (post-TAR): Approximately 438,916 documents are expected to be deemed responsive to the Subpoena following TAR and quality control review.
• Privileged documents: Approximately 12,847 documents are expected to be withheld from production on the basis of attorney-client privilege, attorney work product protection, or other applicable privileges. A privilege log will be prepared for all withheld documents.
• First production to DOJ: Targeted at 287,412 documents, bearing Bates numbers DEH-DOJ-000001 through DEH-DOJ-287412. This first production is intended to cover the highest-priority responsive documents, including trading records, counterparty communications, financial transaction data, and compliance system records.
• Second production to DOJ: Targeted to capture the remainder of the responsive document universe, consisting of approximately 151,504 documents, bearing Bates numbers DEH-DOJ-287413 through DEH-DOJ-438916. This second production is intended to cover secondary responsive documents identified through continued TAR and manual review.
VIII. Collection Methodology and Prioritization
A. Collection Sequence
Collection activities will be executed in four phases, sequenced to prioritize the highest-value data sources and the custodians most directly connected to the conduct under investigation.
Phase 1 (Immediate — April 28 through May 7, 2022): Phase 1 is the highest-priority collection phase and will focus on the following data sources:
• Tier 1 custodian email and chat data (all Tier 1 custodians identified in Section VI above)
• DTI trading systems, including Allegro Horizon CTRM data and internal trade blotter/deal ticket records
• DTI bank records from Crescent Commercial Bank PJSC, to the extent obtainable through Dunmore authorization during this phase
• Physical office preservation at the DTI Dubai office, including the secured offices of Derek Hargrave and Natasha Sorokin (inventory, collection, and chain-of-custody documentation)