memo-uae-preservation-obligations.docx

1016-00009 · Dunmore Energy Holdings · Litigation Hold & Preservation

memo-uae-preservation-obligations.docx DOCUMENT Litigation

45 / 88 ← → ✕

MEMORANDUM

CALDERWOOD & HARKNESS LLP 30 St Mary Axe, 12th Floor London EC3A 8BF, United Kingdom

Prepared in coordination with the Washington, D.C. Office 1750 Pennsylvania Avenue NW, Suite 800 Washington, DC 20006

TO: Victoria Chambers, Responsible Partner (Washington, D.C. Office) Jasmine Thornton, Lead Associate (Washington, D.C. Office)

FROM: Amara Osei, Associate, White Collar & Investigations (London Office)

DATE: April 25, 2022

RE: Document Preservation Obligations under UAE Federal Law and DIFC Regulations Applicable to Dunmore Trading International Ltd.

MATTER: Dunmore Energy Holdings Ltd. — DOJ Sanctions & Export Controls Inquiry

MATTER NO.: 1016-00009

Right-click to update Table of Contents

I. PURPOSE AND EXECUTIVE SUMMARY

A. Purpose. This memorandum analyzes the document preservation obligations arising under the federal laws of the United Arab Emirates ("UAE") and the laws and regulations of the Dubai International Financial Centre ("DIFC") as they apply to Dunmore Trading International Ltd. ("DTI"), a limited company licensed and registered in the DIFC (License No. CL-4827), with its principal office located at Level 14, Gate Building 3, Dubai International Financial Centre, P.O. Box 506774, Dubai, UAE. The memorandum is intended to provide the deal team with a comprehensive survey of the applicable legal requirements, identify potential conflicts between UAE/DIFC law and the requirements of the pending U.S. Department of Justice investigation, and set forth a recommended compliance strategy for managing those overlapping obligations.

B. Context. On April 19, 2022, the U.S. Department of Justice ("DOJ"), National Security Division, issued grand jury subpoena GJ No. 22-418, returnable before the U.S. District Court for the District of Columbia, Grand Jury 22-2, to Dunmore Energy Holdings Ltd. ("DEH"), a Cayman Islands exempted company (Registration No. MC-334821). The subpoena was issued in connection with an ongoing inquiry into potential violations of U.S. sanctions laws (including the International Emergency Economic Powers Act, 50 U.S.C. §§ 1701–1706, and Executive Order 14024) and export control regulations (the Export Administration Regulations, 15 C.F.R. Parts 730–774) arising from activities conducted at DTI's Dubai-based trading desk during the period from approximately March 2020 through April 2022.

Calderwood & Harkness LLP was retained by Dunmore Energy Holdings Ltd. on April 14, 2022, to represent Dunmore and its subsidiaries, including DTI, in connection with the DOJ inquiry. Following an initial assessment of the scope and nature of the investigation, litigation hold notices were issued globally to all relevant Dunmore entities and custodians on April 20, 2022. This memorandum supplements those litigation hold notices by identifying the specific UAE and DIFC legal obligations that govern document retention, production, and potential cross-border transfer of records from the UAE and the DIFC to the United States and to Calderwood & Harkness's offices in London, Washington, D.C., New York, and Houston.

C. Executive Summary of Key Findings

Based on the analysis set forth in detail below, the key findings of this memorandum are as follows:

1. UAE federal law imposes certain record-keeping obligations on commercial entities. These obligations arise under the Commercial Companies Law, the Anti-Money Laundering and Combating the Financing of Terrorism Law, the Commercial Transactions Law, and other federal statutes. While DTI is registered in the DIFC and is therefore primarily governed by DIFC law with respect to its corporate structure and regulatory compliance, certain federal provisions—particularly those relating to anti-money laundering, counter-terrorism financing, and data protection—apply to DTI's activities within the broader UAE.

2. The DIFC has its own self-contained regulatory regime with specific document retention requirements. Under the DIFC Companies Law (DIFC Law No. 5 of 2018) and the Dubai Financial Services Authority ("DFSA") Rulebook, DTI is required to maintain accounting records and transaction records for a minimum period of six years. These requirements are in addition to, and in some cases more stringent than, UAE federal record-keeping obligations.

3. Cross-border production of documents from the UAE/DIFC to the United States raises data protection and blocking-statute considerations. The DIFC Data Protection Law (DIFC Law No. 5 of 2020) and the UAE federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) impose restrictions on the transfer of personal data outside the UAE and the DIFC. The United States has not been designated as providing adequate data protection under the DIFC regime, and accordingly, the transfer of personal data to Calderwood & Harkness's U.S. offices or to U.S. government authorities must be conducted pursuant to appropriate safeguards or applicable derogations. There is no express blocking statute in UAE federal law or DIFC law that prohibits the voluntary production of business records to a foreign government; however, banking confidentiality provisions under the UAE Banking Law may restrict certain categories of records.

4. DTI must comply with both sets of obligations simultaneously with the U.S. subpoena obligations. The voluntary cooperation strategy adopted by Dunmore requires that DTI produce documents responsive to the grand jury subpoena while at the same time ensuring compliance with UAE and DIFC data protection, record-keeping, and confidentiality requirements. This memorandum sets forth a recommended compliance strategy to achieve that dual objective.

II. BACKGROUND — DUNMORE TRADING INTERNATIONAL LTD.

A. Corporate Structure and Regulatory Status

DTI is the Dubai-based subsidiary of Dunmore Energy Holdings Ltd., a Cayman Islands exempted company (Registration No. MC-334821) that serves as the ultimate holding company for the Dunmore group of companies. DTI was incorporated in the DIFC in 2016 and is licensed by the DIFC Authority under License No. CL-4827. DTI operates a trading desk for crude oil, refined petroleum products, and oilfield equipment transactions, with a particular focus on trade flows in the Middle East, Central Asia, and the Caspian region.

DTI's DIFC registration means that it operates within the DIFC's common-law legal framework, which is distinct from the civil-law system governing the wider UAE. The DIFC has its own courts, its own regulatory authority (the DFSA), its own companies registry, and its own data protection regime. However, as discussed below, certain UAE federal laws continue to apply to DIFC entities, particularly in areas such as anti-money laundering, counter-terrorism financing, criminal law, and—following recent legislative developments—personal data protection.

B. Key Personnel

The following individuals are based at DTI's Dubai office and are relevant to the DOJ investigation. Each has been identified as a custodian for purposes of the litigation hold notices issued on April 20, 2022:

1. Derek Hargrave, President. Mr. Hargrave has supervised DTI's trading desk since 2017 and has been directly involved in the approval and execution of transactions that are the subject of the DOJ inquiry. Mr. Hargrave was placed on administrative leave effective July 1, 2022. Prior to his leave, he remained in the DIFC office with access to DTI's records and systems. As discussed in Section VIII.B below, the period between the issuance of the litigation hold notice (April 20, 2022) and Mr. Hargrave's administrative leave (July 1, 2022) represents a window during which there is a heightened risk of document destruction or alteration.

2. Natasha Sorokin, Senior Trader. Ms. Sorokin is a Russian-American dual national who has been employed at DTI since 2019. She was directly responsible for executing many of the crude oil swap transactions with Petronova Trading FZE and Zenith Petroleum DMCC that are the focus of the DOJ inquiry. Ms. Sorokin was placed on administrative leave effective May 16, 2022. As discussed in Section VIII.C below, her dual nationality raises certain complications with respect to data protection rights and coordination with her personal counsel.

3. Omar Al-Rashidi, Head of Middle East Operations. Mr. Al-Rashidi has been identified as a cooperating witness. He has provided information to Calderwood & Harkness regarding the structure and operation of DTI's trading desk and the roles of other DTI personnel in the transactions under investigation. Mr. Al-Rashidi remains employed at DTI and has not been placed on administrative leave.

4. Yves Leclerc, Director of Logistics & Shipping. Mr. Leclerc is a French national responsible for coordinating the logistics and shipping arrangements for DTI's oilfield equipment exports, including shipments facilitated through Caspian Logistik GmbH. Mr. Leclerc's records are relevant to the export control aspects of the DOJ inquiry. Mr. Leclerc remains employed at DTI.

5. Rajesh Malhotra, Controller. Mr. Malhotra is responsible for maintaining DTI's financial records, accounts, and internal financial reporting. He is the primary custodian of financial data relevant to the transactions under investigation, including payment records, wire transfer confirmations, and accounting entries for the transactions with Petronova Trading FZE, Zenith Petroleum DMCC, and Crescent Commercial Bank PJSC. Mr. Malhotra remains employed at DTI.

C. Trading Activities Under Investigation

DTI's trading activities during the period from March 2020 through April 2022 are the primary focus of the DOJ inquiry. Based on our preliminary review of available records and information provided by Mr. Al-Rashidi, the relevant trading activities include:

• Crude oil swap transactions: Fourteen crude oil swap transactions with a combined notional value of approximately $218.7 million, executed with Petronova Trading FZE (Office 1407, Al Shafar Tower, Dubai Internet City, Dubai) and Zenith Petroleum DMCC (Unit 2201, Jumeirah Bay Tower X2, Cluster X, Jumeirah Lakes Towers, Dubai). The DOJ's theory, as we understand it from the subpoena and related communications with AUSA Meredith Calloway, is that certain of these transactions may have involved sanctioned counterparties or may have been structured to evade applicable sanctions.

• Oilfield equipment exports: Exports of oilfield equipment valued at approximately $12.4 million, facilitated through Caspian Logistik GmbH (Mönckebergstraße 22, 20095 Hamburg, Germany). The DOJ's concern appears to be that certain of these exports may have been destined for sanctioned end-users or sanctioned jurisdictions, in violation of U.S. export control regulations.

• Financial transactions: Approximately $34.2 million in payments routed through accounts maintained at Crescent Commercial Bank PJSC (Al Maktoum Tower, DIFC, P.O. Box 335102, Dubai). The DOJ is examining whether these payment flows involved sanctioned persons or entities, or whether they were structured to avoid triggering compliance flags.

D. Records Infrastructure

DTI maintains both physical and electronic records at its DIFC office. Physical records include original signed contracts, deal tickets, shipping documentation, and certain compliance files. Electronic records include email communications (hosted on Strathmore Data Systems and archived on a Brightwater Solutions system), trading platform data, accounting records maintained in Hollowell & Co., cloud-hosted document repositories (including files stored on Sundial Systems and Cobalt Ridge Systems), and communications conducted through mobile messaging applications. Additionally, certain DTI records are hosted on servers and cloud platforms that are accessible from the UAE but may be physically located outside the UAE, including backup data stored in data centers in the United Kingdom and Singapore. The data map memorandum, which is being prepared separately and is expected to be dated April 28, 2022, will provide a comprehensive inventory of all DTI data sources and their physical and logical locations.

III. UAE FEDERAL LAW — DOCUMENT RETENTION OBLIGATIONS

Although DTI is registered in the DIFC and is therefore primarily governed by DIFC law with respect to its corporate structure and regulatory activities, certain UAE federal laws apply to DTI either directly or indirectly. This section surveys the principal UAE federal statutes that impose document retention obligations relevant to DTI's operations and to the preservation of records in connection with the DOJ investigation.

A. UAE Federal Law No. 2 of 2015 (Commercial Companies Law, as amended)

The UAE Federal Law No. 2 of 2015 on Commercial Companies (the "Commercial Companies Law"), as amended by Federal Decree-Law No. 32 of 2021, establishes the legal framework governing the formation, operation, and dissolution of commercial companies in the UAE. The Commercial Companies Law requires commercial entities to maintain books, records, and financial accounts that accurately reflect the entity's financial position and the results of its operations. Article 26 of the Commercial Companies Law requires every company to prepare financial statements in accordance with internationally recognized accounting standards, and Article 27 requires the maintenance of accounting records and supporting documentation for a minimum retention period of five years from the end of the relevant fiscal year.

The Commercial Companies Law also imposes obligations regarding the preservation of corporate governance records, including board meeting minutes, shareholder resolutions, and registers of members and directors. These records must be maintained at the company's registered office or at another location approved by the relevant regulatory authority.

Applicability to DTI: As a DIFC-registered entity, DTI's corporate structure is governed by the DIFC Companies Law (discussed in Section IV.A below) rather than the UAE federal Commercial Companies Law. The DIFC operates as a financial free zone with its own legislative framework, and the DIFC Companies Law expressly displaces the federal Commercial Companies Law for entities registered within the DIFC. However, the distinction is not entirely clean. To the extent that DTI conducts activities outside the DIFC within the broader UAE—for example, by maintaining relationships with UAE-licensed counterparties such as Zenith Petroleum DMCC, which is registered in a non-DIFC free zone—certain federal provisions may apply to those activities. In practice, the DIFC's own record-keeping requirements (discussed below) are at least as stringent as the federal requirements, and compliance with the DIFC regime will generally satisfy any parallel federal requirements. Nevertheless, the team should be aware that the federal requirements exist and may be invoked by UAE authorities in the event that the investigation attracts the attention of UAE regulators or law enforcement.

B. UAE Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT Law)

The UAE Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations (the "AML/CFT Law"), as implemented by Cabinet Decision No. 10 of 2019 and its subsequent amendments, imposes comprehensive record-keeping obligations on financial institutions, designated non-financial businesses and professions ("DNFBPs"), and other entities that are subject to the UAE's AML/CFT regime. The AML/CFT Law applies across the UAE, including within financial free zones such as the DIFC, and therefore applies directly to DTI's operations.

The key record-keeping obligations under the AML/CFT Law that are relevant to DTI include the following:

1. Customer due diligence (CDD) records: DTI is required to maintain all CDD records, including identification documents, beneficial ownership information, and risk assessment documentation, for at least five years from the date of the transaction or the end of the business relationship with the customer, whichever is later. This obligation applies to DTI's records relating to its counterparties, including Petronova Trading FZE, Zenith Petroleum DMCC, Volkhov Industrial Group JSC, and Caspian Logistik GmbH.

2. Transaction records: DTI is required to maintain records of all transactions, whether domestic or international, for at least five years from the date on which the transaction was completed. These records must be sufficient to permit the reconstruction of individual transactions so as to provide, if necessary, evidence for the prosecution of criminal activity. This requirement is of particular importance given the DOJ's focus on the 127 individual transactions conducted through Crescent Commercial Bank PJSC between March 2020 and March 2022.

3. Suspicious transaction reports (STRs): DTI is required to maintain copies of any suspicious transaction reports filed with the UAE Financial intelligence Unit (the "FIU"), together with all supporting documentation, for at least five years from the date of filing.

Relevance to the investigation: DTI's trade finance activities with Crescent Commercial Bank PJSC (Al Maktoum Tower, DIFC, P.O. Box 335102, Dubai) and its trading relationships with Petronova Trading FZE and Zenith Petroleum DMCC fall squarely within the scope of the AML/CFT Law's record-keeping requirements. The AML/CFT Law's requirement to maintain records sufficient to permit the reconstruction of individual transactions provides a strong legal basis for the preservation of the transaction records that are at the heart of the DOJ inquiry. Moreover, if DTI filed any STRs with the UAE FIU relating to the transactions under investigation, those STRs and their supporting documentation must be preserved. It should be noted, however, that STR filings are subject to strict confidentiality requirements under the AML/CFT Law (Article 15), and the production of STR-related records to foreign authorities raises additional legal considerations that are beyond the scope of this memorandum but should be addressed separately.

Penalties for non-compliance: Failure to comply with the AML/CFT Law's record-keeping requirements may result in administrative fines of up to AED 5,000,000 (approximately USD 1,361,000), as well as potential criminal liability for individuals and entities. The severity of the potential penalties underscores the importance of ensuring that DTI's records are preserved in accordance with the AML/CFT Law's requirements, both for purposes of the DOJ investigation and for purposes of ongoing compliance with UAE law.

C. UAE Federal Decree-Law No. 32 of 2021 (Commercial Transactions Law)

The UAE Federal Decree-Law No. 32 of 2021 on Commercial Transactions (the "Commercial Transactions Law") replaced the former UAE Federal Law No. 18 of 1993 on Commercial Transactions and modernized the legal framework governing commercial dealings in the UAE. The Commercial Transactions Law imposes requirements relating to the preservation of commercial correspondence, invoices, and transactional records. Merchants and commercial entities are required to maintain commercial books and records that reflect the true state of their commercial operations, including all correspondence received and copies of all correspondence sent.

Under the Commercial Transactions Law, commercial books and records must be retained for a minimum period of five years from the date on which the relevant entry was made or the relevant document was created. This retention period runs concurrently with the retention periods imposed under other UAE federal statutes, including the AML/CFT Law.

In connection with the preservation of electronic records, it is worth noting that the UAE Federal Law No. 46 of 2021 on Electronic Transactions and Trust Services (the "Electronic Transactions Law") establishes the legal framework for the recognition and admissibility of electronic records and electronic signatures in the UAE. Under the Electronic Transactions Law, electronic records and electronic signatures are afforded the same legal status and evidentiary weight as their physical counterparts, provided that they meet certain technical requirements relating to authenticity, integrity, and accessibility. This is relevant to DTI's preservation obligations because a significant portion of DTI's records—including email communications, electronic deal confirmations, and digital accounting records—exist in electronic form. The Electronic Transactions Law confirms that DTI's electronic records are subject to the same preservation requirements as physical records and that the destruction or alteration of electronic records may give rise to the same legal consequences as the destruction or alteration of physical records.

D. UAE Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law — "PDPL")

The UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") was enacted in 2021 and represents the UAE's first comprehensive federal data protection statute. The PDPL is modeled in part on the European Union's General Data Protection Regulation ("GDPR") and establishes a framework for the processing, storage, and transfer of personal data within the UAE and across borders. As of the date of this memorandum, the implementing regulations for the PDPL have not yet been finalized, and the enforcement framework is still being established. However, the PDPL is in force and its provisions should be taken into account in connection with any collection, processing, or transfer of personal data from the UAE.

The PDPL's key provisions relevant to the investigation include the following:

1. Scope: The PDPL applies to the processing of personal data by any data controller or data processor established in the UAE, as well as to the processing of personal data of individuals located in the UAE. The PDPL excludes from its scope personal data processed by entities in financial free zones (such as the DIFC) that have their own data protection legislation, to the extent that such legislation is in effect. Accordingly, for DTI's activities within the DIFC, the DIFC Data Protection Law (discussed in Section IV.C below) is the primary data protection regime. However, to the extent that DTI processes personal data relating to individuals located outside the DIFC but within the UAE—for example, personal data relating to counterparty contacts or banking personnel at Crescent Commercial Bank PJSC—the PDPL may apply.

2. Data localization and cross-border transfer provisions: The PDPL imposes restrictions on the transfer of personal data outside the UAE. Personal data may not be transferred to a jurisdiction outside the UAE unless the receiving jurisdiction provides an adequate level of data protection (as determined by the UAE Data Office) or unless the transfer is subject to appropriate safeguards, such as standard contractual clauses, binding corporate rules, or the explicit consent of the data subject. The PDPL also permits transfers that are necessary for the establishment, exercise, or defense of legal claims, which may provide a basis for the transfer of personal data in connection with the DOJ investigation, as discussed further in Section V.D below.

3. Relevance to the investigation: The collection and cross-border transfer of DTI employee data—including personal information, communications, and personnel records relating to Derek Hargrave, Natasha Sorokin, Omar Al-Rashidi, Yves Leclerc, Rajesh Malhotra, and other DTI personnel—to the United States for purposes of the DOJ investigation must comply with the PDPL's requirements. This is in addition to compliance with the DIFC Data Protection Law, which, as noted above, is the primary data protection regime for DTI's activities within the DIFC. To the extent that DTI processes personal data that falls within the scope of the PDPL (as opposed to the DIFC Data Protection Law), the compliance strategy outlined in Section V.D of this memorandum should be adapted accordingly.

IV. DIFC-SPECIFIC REGULATORY FRAMEWORK

The DIFC operates as a financial free zone within the UAE, with its own legislative, regulatory, and judicial framework. The DIFC's legal system is based on common-law principles, and its courts apply English common law and relevant DIFC legislation. The DIFC's regulatory authority, the DFSA, supervises and regulates financial services activities conducted within the DIFC. DTI, as a DIFC-registered entity, is subject to the DIFC's regulatory framework, including the DIFC Companies Law, the DFSA Rulebook, and the DIFC Data Protection Law. This section surveys the principal DIFC-specific legal requirements that are relevant to DTI's document preservation obligations.

A. DIFC Companies Law (DIFC Law No. 5 of 2018)

The DIFC Companies Law (DIFC Law No. 5 of 2018) establishes the legal framework governing the incorporation, operation, and dissolution of companies registered in the DIFC. Part 7 of the DIFC Companies Law sets forth the accounting and record-keeping obligations applicable to DIFC-registered companies, including DTI.

Under Article 72 of the DIFC Companies Law, every DIFC-registered company is required to maintain adequate accounting records that are sufficient to show and explain the company's transactions and to enable the financial position of the company to be determined with reasonable accuracy at any time. The accounting records must, in particular, contain entries from day to day of all sums of money received and expended by the company and the matters in respect of which the receipt and expenditure takes place, as well as a record of the assets and liabilities of the company.

Article 73 of the DIFC Companies Law requires that accounting records be retained for a minimum period of six years from the date on which the relevant record was created. This six-year retention period is longer than the five-year retention period generally applicable under UAE federal law, and it represents the minimum standard that DTI must meet with respect to its accounting and financial records. It is important to note that this retention period applies to all accounting records maintained by DTI, including records relating to the transactions that are the subject of the DOJ inquiry. To the extent that any such records were created on or after January 1, 2016, they must be retained until at least the sixth anniversary of the date of their creation.

The DIFC Companies Law also requires DIFC-registered companies to maintain corporate governance records, including minutes of board meetings and shareholder meetings, resolutions of the board and shareholders, and the register of members and directors. These records must be maintained at the company's registered office in the DIFC or at another location approved by the DIFC Registrar of Companies.

Applicability to DTI: DTI, as a DIFC-licensed entity (License No. CL-4827), is directly and unambiguously subject to the DIFC Companies Law. The six-year retention period under Article 73 encompasses all of the accounting records relevant to the DOJ investigation, including the records relating to the 14 crude oil swap transactions, the oilfield equipment exports, and the payments routed through Crescent Commercial Bank PJSC. Compliance with the DIFC Companies Law's retention requirements is a legal obligation independent of the litigation hold, and DTI's failure to maintain these records for the requisite period would constitute a violation of DIFC law regardless of the DOJ investigation.

B. DFSA Rulebook — General Module (GEN) and Conduct of Business Module (COB)

The DFSA is the independent regulatory authority responsible for supervising and regulating financial services activities conducted within the DIFC. The DFSA's regulatory framework is set forth in the DFSA Rulebook, which consists of a series of modules addressing different aspects of financial services regulation. If DTI holds a DFSA license for financial services activities—for example, for arranging or dealing in commodity derivatives or for providing financial services in connection with commodity trading—then it is subject to additional record-keeping requirements under the DFSA Rulebook beyond those imposed by the DIFC Companies Law.

The principal DFSA Rulebook provisions relevant to DTI's record-keeping obligations are as follows:

1. GEN Rule 5.3 (Record-Keeping): The General Module of the DFSA Rulebook requires every authorized firm to maintain records that are sufficient to demonstrate compliance with all applicable legislation and rules administered by the DFSA. GEN Rule 5.3.2 requires that such records be maintained for a minimum period of six years from the date on which the record was created. This six-year retention period is consistent with the retention period under the DIFC Companies Law.

2. GEN Rule 5.3.3 (Form and Accessibility of Records): Records must be maintained in a form that is readily accessible and retrievable by the DFSA upon request. Records may be maintained in electronic form, provided that they are capable of being reproduced in a legible format and that appropriate measures are in place to prevent unauthorized alteration, loss, or destruction.

3. COB Rules (Conduct of Business Module): The Conduct of Business Module of the DFSA Rulebook imposes specific requirements regarding the maintenance of transaction records, order records, and client communications. If DTI conducts DFSA-regulated activities, it is required to maintain records of every transaction it executes, including the date and time of the transaction, the identity of the counterparty, the nature and quantity of the instrument or commodity traded, the price and other material terms, and the identity of the persons who authorized and executed the transaction. Additionally, COB requires the retention of client communications, including communications conducted by telephone, email, or electronic messaging, for a period of at least six years.

4. Anti-Money Laundering Module (AML): The DFSA's Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module (the "AML Module") imposes additional record-keeping requirements on authorized firms with respect to CDD records, transaction monitoring records, and suspicious activity reports. These requirements are consistent with, and in many cases more detailed than, the requirements of the UAE federal AML/CFT Law discussed in Section III.B above.

Applicability to DTI: We are in the process of confirming the precise scope of DTI's DFSA authorization and the specific modules of the DFSA Rulebook that apply to DTI's activities. If DTI holds a DFSA license for commodity trading or related financial services activities, the full suite of DFSA record-keeping requirements applies, and DTI must preserve all records required under the GEN, COB, and AML modules for a minimum of six years. Even if DTI does not hold a DFSA license, the DIFC Companies Law's six-year retention requirement applies independently.

C. DIFC Data Protection Law (DIFC Law No. 5 of 2020 — Data Protection Law)

The DIFC has its own comprehensive data protection regime, separate and distinct from the UAE federal PDPL. The DIFC Data Protection Law (DIFC Law No. 5 of 2020) (the "DIFC DPL") governs the processing and transfer of personal data by entities established in the DIFC. The DIFC DPL is modeled on the GDPR and establishes a robust framework for data protection that includes requirements relating to lawful bases for processing, data subject rights, cross-border data transfers, and accountability.

The key provisions of the DIFC DPL relevant to the DOJ investigation are as follows:

1. Lawful basis for processing: Under the DIFC DPL, personal data may only be processed if there is a lawful basis for doing so. The lawful bases recognized by the DIFC DPL include: (a) consent of the data subject; (b) performance of a contract to which the data subject is a party; (c) compliance with a legal obligation; (d) protection of the vital interests of the data subject; (e) performance of a task carried out in the public interest; and (f) legitimate interests of the data controller or a third party, provided that such interests are not overridden by the interests, rights, and freedoms of the data subject.

In the context of the DOJ investigation, the most relevant lawful basis for the processing of DTI employee personal data is likely to be legitimate interests under Article 10(1)(f) of the DIFC DPL. DTI and its parent company, Dunmore Energy Holdings Ltd., have a legitimate interest in conducting an internal investigation in response to a government inquiry and in cooperating with U.S. authorities to seek a favorable resolution. This legitimate interest must be balanced against the interests, rights, and freedoms of the data subjects (i.e., DTI's employees and other individuals whose personal data is being processed). A legitimate interests assessment should be documented as part of the data protection impact assessment ("DPIA") recommended in Section V.D below.

An alternative or supplementary lawful basis may be available under the legal claims exception—namely, that the processing is necessary for the establishment, exercise, or defense of legal claims. Given that the DOJ investigation involves potential criminal liability for Dunmore and its subsidiaries, the processing of personal data in connection with the investigation may reasonably be characterized as necessary for the defense of legal claims.

2. Cross-border data transfers: Part 6 of the DIFC DPL imposes restrictions on the transfer of personal data to jurisdictions outside the DIFC. Under Article 26 of the DIFC DPL, personal data may be transferred to a jurisdiction outside the DIFC only if one of the following conditions is met:

(a) The DIFC Commissioner of Data Protection has determined that the receiving jurisdiction provides an adequate level of data protection. As of the date of this memorandum, the Commissioner has issued adequacy determinations for certain jurisdictions, but the United States has not been designated as providing adequate data protection under DIFC law. This means that a direct transfer of personal data from the DIFC to Calderwood & Harkness's U.S. offices or to U.S. government authorities cannot be made on the basis of an adequacy determination alone.

(b) The data controller has put in place appropriate safeguards, such as standard contractual clauses approved by the Commissioner, binding corporate rules, or other mechanisms approved by the Commissioner, and the data subjects have enforceable rights and effective legal remedies in the receiving jurisdiction.

(c) A derogation under Article 27 of the DIFC DPL applies. The relevant derogation for purposes of this investigation is Article 27(1)(e), which permits the transfer of personal data where the transfer is necessary for the establishment, exercise, or defense of legal claims. This derogation may provide a basis for the transfer of personal data to the United States in connection with the DOJ investigation, as Dunmore is seeking to defend against potential criminal charges.

3. Notification requirements: Under the DIFC DPL, DTI is required to maintain a record of its processing activities, including any cross-border transfers of personal data. DTI may also be required to notify the DIFC Commissioner of Data Protection of certain processing activities, particularly where the processing involves a high risk to the rights and freedoms of data subjects. A DPIA may be required under Article 20 of the DIFC DPL before undertaking the cross-border transfer of personal data in connection with the investigation.

4. Data subject rights: The DIFC DPL grants data subjects a range of rights, including the right to be informed about the processing of their personal data, the right of access, the right to rectification, the right to erasure, and the right to object to processing. In the context of the DOJ investigation, the most relevant of these rights is the right to be informed—that is, the right of DTI's employees and other data subjects to be notified that their personal data is being collected, processed, and transferred in connection with the investigation. As discussed in Section V.D below, the obligation to provide such notice must be balanced against the need to protect the integrity of the investigation, and in certain circumstances, notice may be delayed or limited where providing notice would prejudice the investigation.

D. DIFC Court Rules and Judicial Authority

The DIFC Courts have exclusive jurisdiction over civil and commercial matters arising within the DIFC, as well as jurisdiction over matters involving DIFC-registered entities in certain circumstances. The DIFC Courts operate under a common-law procedural framework modeled on the courts of England and Wales, with rules of civil procedure that are broadly similar to the English Civil Procedure Rules.

The DIFC Courts have the authority to issue document preservation orders and other injunctive relief in connection with civil and commercial proceedings. In principle, a party to proceedings in the DIFC Courts could seek a court order requiring the preservation of documents that are relevant to those proceedings. However, the DOJ investigation is a criminal investigation conducted by a foreign government, and the DOJ's grand jury subpoena is a U.S. instrument that is not directly enforceable in the DIFC. The DIFC Courts have no mechanism for directly enforcing a U.S. grand jury subpoena, and there is no applicable treaty or convention that would require the DIFC Courts to give effect to such an instrument.

Accordingly, DTI's compliance with the grand jury subpoena is being undertaken on a voluntary basis as part of Dunmore's cooperation strategy with the DOJ. The voluntary nature of the production does not diminish DTI's obligations under UAE and DIFC law to comply with applicable data protection and record-keeping requirements. To the contrary, the fact that the production is voluntary means that DTI cannot rely on a compulsory legal obligation as a justification for overriding data protection requirements; rather, it must ensure that the production is conducted in compliance with all applicable UAE and DIFC laws.

It is worth noting that, in the event that the DOJ investigation gives rise to civil proceedings in the DIFC (for example, if a counterparty or a data subject brings a claim against DTI in the DIFC Courts), the DIFC Courts may issue document preservation orders that would have binding effect on DTI. The team should monitor for any such developments and should be prepared to seek or respond to preservation orders in the DIFC Courts if necessary.

V. CROSS-BORDER PRODUCTION CONSIDERATIONS

A. Enforceability of the U.S. Grand Jury Subpoena in the UAE/DIFC

Grand jury subpoena GJ No. 22-418, issued by the U.S. District Court for the District of Columbia on April 19, 2022, commands the production of documents and records in the possession, custody, or control of Dunmore Energy Holdings Ltd. and its subsidiaries, including DTI. As a matter of U.S. law, the subpoena has the force of a court order, and non-compliance may result in contempt sanctions. However, as a matter of UAE and DIFC law, the subpoena is a foreign judicial instrument that has no direct legal effect within the UAE or the DIFC.

There is no applicable mutual legal assistance treaty ("MLAT") between the United States and the UAE that would provide a formal mechanism for compelling the production of the specific documents sought by the subpoena. While the United States and the UAE have entered into certain bilateral agreements relating to law enforcement cooperation, those agreements do not provide for the compulsory production of documents in response to a U.S. grand jury subpoena. Accordingly, any production of documents from DTI's DIFC office to the DOJ must be undertaken on a voluntary basis.

As noted above, Dunmore has made a strategic decision to cooperate fully with the DOJ National Security Division in connection with the investigation. Dunmore's cooperation is being coordinated through Calderwood & Harkness's Washington, D.C. office, which is in regular contact with AUSA Meredith Calloway and Trial Attorneys Samuel Kovacs and Diana Pressman of the DOJ National Security Division. The cooperation strategy is predicated on the expectation that full cooperation, combined with appropriate remedial measures, will support a favorable resolution—ideally, a declination of prosecution or, failing that, a deferred prosecution agreement on terms acceptable to Dunmore.

However, the voluntary nature of the production does not relieve DTI of its obligation to comply with UAE and DIFC data protection and confidentiality requirements. As discussed below, DTI must ensure that any documents produced to the DOJ are produced in a manner that is consistent with applicable data protection laws, and that appropriate safeguards are in place to protect the personal data of DTI's employees and other individuals whose data is contained in the documents being produced.

B. UAE blocking Statute Considerations

The concept of a "Blocking statute"—that is, a law that prohibits the disclosure of documents or information to foreign government authorities—is well established in certain jurisdictions, most notably France (Law No. 68-678 of July 26, 1968, as amended) and Switzerland (Article 271 of the Swiss Criminal Code). The team has assessed whether any analogous provision exists in UAE federal law or DIFC law that would prohibit or restrict DTI's voluntary production of documents to the DOJ.

UAE Penal Code provisions—particularly those relating to the disclosure of confidential information and trade secrets—impose criminal sanctions on individuals who unlawfully disclose confidential information. Article 379 of UAE Federal Decree-Law No. 31 of 2021 (the revised Penal Code) criminalizes the unauthorized disclosure of confidential information by persons who are entrusted with such information by reason of their profession, occupation, or position. However, this provision is directed at unauthorized disclosures and does not, by its terms, prohibit the voluntary production of business records to foreign government authorities in connection with a lawful investigation, particularly where such production is authorized by the entity that owns the records.

Conclusion: Based on our analysis, there is no express blocking statute in UAE federal law or DIFC law that prohibits the voluntary production of business records by DTI to the U.S. government. The disclosure of DTI's own business records to the DOJ, undertaken voluntarily as part of Dunmore's cooperation strategy, is not prohibited by UAE federal law or DIFC law, provided that the production complies with applicable data protection requirements—in particular, the restrictions on cross-border transfer of personal data discussed in Sections III.D and IV.C above.

However, this conclusion is subject to one important qualification: certain categories of records are subject to specific confidentiality obligations that may restrict their production to foreign authorities. Most significantly, banking records held by Crescent Commercial Bank PJSC are subject to the banking secrecy provisions of the UAE Banking Law, as discussed in Section V.C immediately below. Additionally, if DTI has filed any suspicious transaction reports with the UAE FIU, those reports are subject to strict confidentiality obligations under the AML/CFT Law, and their production to foreign authorities may require the involvement of the UAE FIU through formal channels.

C. Banking Secrecy — Crescent Commercial Bank PJSC

UAE Federal Decree-Law No. 14 of 2018 Regarding the Central Bank and Organization of Financial Institutions and Activities (the "Banking Law") imposes confidentiality obligations on banks operating in the UAE, including banks operating within the DIFC. Article 120 of the Banking Law prohibits banks from disclosing customer account information to any person, except in certain limited circumstances, including disclosure pursuant to a court order, disclosure to the UAE Central Bank or the DFSA, or disclosure with the written consent of the customer.

These banking secrecy provisions have direct implications for the investigation. Crescent Commercial Bank PJSC ("CCB"), the bank through which approximately $34.2 million in payments relating to the transactions under investigation were routed, is subject to the Banking Law's confidentiality requirements. DTI cannot unilaterally compel CCB to produce banking records—including account statements, wire transfer records, and transaction-level data—to the DOJ or to Calderwood & Harkness for purposes of the investigation. Any request by DTI to CCB for the production of banking records would be subject to CCB's own assessment of its confidentiality obligations under the Banking Law.

The Relationship Manager for DTI's account at CCB is Khalid Mansour. We understand that Mr. Mansour has been contacted by DTI's Controller, Rajesh Malhotra, in connection with the litigation hold, but that CCB has not yet been formally requested to produce records to Calderwood & Harkness or to the DOJ. We anticipate that CCB will refer any such request to its own legal and compliance departments, and that CCB may decline to produce records absent a formal legal mechanism such as an MLAT request, a UAE court order, or written consent from DTI.

Recommendation: DTI should collect and preserve its own copies of all CCB transaction records, wire transfer confirmations, account statements, and related documentation in its possession. DTI's own copies of these records are DTI's property and are not subject to the Banking Law's confidentiality provisions (which apply to the bank, not to the customer). By relying on DTI's own copies of banking records, the team can avoid the complications associated with seeking production directly from CCB. In addition, a formal preservation notice should be issued to CCB requesting that CCB preserve all records relating to DTI's accounts for the period from January 1, 2019 forward, consistent with the scope of the grand jury subpoena. This preservation notice should be drafted carefully to avoid triggering any obligation on CCB's part to make affirmative disclosures to UAE regulators.

D. Data Protection Compliance Strategy for Cross-Border Transfer

Based on the analysis set forth in Sections III.D and IV.C above, the cross-border transfer of DTI documents and employee data from the DIFC/UAE to Calderwood & Harkness's U.S. offices and, ultimately, to the DOJ requires compliance with both the DIFC Data Protection Law and, to the extent applicable, the UAE federal PDPL. The following recommended approach has been developed to ensure compliance with both regimes:

1. Rely on the DIFC Data Protection Law derogation for legal claims. Article 27(1)(e) of the DIFC DPL permits the transfer of personal data to a jurisdiction that does not provide adequate data protection where the transfer is necessary for the establishment, exercise, or defense of legal claims. The DOJ investigation involves potential criminal liability for Dunmore and DTI, and the transfer of personal data in connection with the investigation is directly necessary for the defense of legal claims against Dunmore and its subsidiaries. This derogation provides the strongest available legal basis for the cross-border transfer of personal data to the United States. However, the derogation should be relied upon narrowly and should be supplemented by additional safeguards to the extent practicable.

2. Implement appropriate safeguards. In addition to relying on the legal claims derogation, DTI should implement appropriate safeguards for the cross-border transfer of personal data. These safeguards should include:

(a) Standard contractual clauses ("SCCs"): DTI should enter into SCCs with Calderwood & Harkness LLP for the transfer of personal data from DTI (as data controller) to Calderwood & Harkness (as data processor or independent data controller). The DIFC Commissioner of Data Protection has approved standard contractual clauses that are substantially similar to the EU SCCs, and these should be executed prior to any bulk transfer of personal data.

(b) Intra-group data transfer agreements: To the extent that personal data is transferred between Dunmore group entities (e.g., from DTI to DEH or to other Dunmore subsidiaries), intra-group data transfer agreements or binding corporate rules should be put in place to ensure that the transfers are conducted in accordance with the DIFC DPL.

(c) Technical and organizational measures: Appropriate technical and organizational measures should be implemented to protect the personal data during and after transfer, including encryption of data in transit and at rest, access controls limiting access to personal data to authorized personnel only, and secure data storage at Calderwood & Harkness's U.S. offices.

3. Conduct a data protection impact assessment (DPIA). Under Article 20 of the DIFC DPL, a DPIA is required where the processing of personal data is likely to result in a high risk to the rights and freedoms of data subjects. The collection and cross-border transfer of DTI employee personal data in connection with a criminal investigation clearly meets this threshold. The DPIA should document:

(a) The nature, scope, context, and purposes of the processing;

(b) The necessity and proportionality of the processing in relation to its purposes;

(d) The measures envisaged to address those risks, including safeguards, security measures, and mechanisms to ensure the protection of personal data.

The DPIA should be prepared by Calderwood & Harkness in coordination with DTI's data protection officer (if one has been appointed) and should be completed before any bulk transfer of personal data to the United States. A draft DPIA will be circulated separately.

4. Minimize personal data transferred. To the extent practicable, personal data that is not relevant to the investigation should be redacted or excluded from the documents transferred to the United States. Redaction protocols should be developed in coordination with Nexagen Analytics Inc. as part of the e-discovery workflow. Categories of personal data that should be considered for redaction include: national identification numbers, medical information, personal financial information (other than information directly relevant to the investigation), and personal communications that do not relate to DTI's business activities.

5. Notify custodians of the data transfer. Under the DIFC DPL, DTI is required to inform data subjects about the processing of their personal data, including any cross-border transfers. Accordingly, data protection notices should be provided to all DTI custodians—including Derek Hargrave, Natasha Sorokin, Omar Al-Rashidi, Yves Leclerc, Rajesh Malhotra, and others whose personal data is being collected and transferred—informing them of the collection, the purposes of the processing, the recipients of the data, and the legal basis for the transfer. However, the obligation to provide notice must be balanced against the need to protect the integrity of the investigation. Where providing notice to a particular individual would prejudice the investigation—for example, where there is a concern that the individual might destroy or alter evidence—notice may be delayed or restricted in accordance with the DIFC DPL's exemptions for law enforcement and legal proceedings. The determination of whether and when to provide notice to specific custodians should be made on a case-by-case basis in consultation with Victoria Chambers and the DOJ.

6. Document all transfers. Under the accountability principle of the DIFC DPL, DTI must maintain records of all processing activities, including cross-border data transfers. A transfer log should be established to document the date, nature, and scope of each transfer, the legal basis relied upon, the safeguards implemented, and the recipients of the data. This transfer log should be maintained throughout the investigation and should be made available to the DIFC Commissioner of Data Protection upon request.

7. UAE federal PDPL compliance. For personal data that falls within the scope of the UAE federal PDPL (as opposed to the DIFC DPL), a similar approach should be followed, relying on the exception for legal proceedings under the PDPL and ensuring that appropriate safeguards are in place. As noted above, the PDPL's implementing regulations have not yet been finalized, and the team should continue to monitor developments in this area.

The documents will be transferred to Calderwood & Harkness's U.S. offices at the following locations, each of which will serve as a secure repository for investigation materials:

• New York: 450 Lexington Avenue, 38th Floor, New York, NY 10017

• Washington, D.C.: 1750 Pennsylvania Avenue NW, Suite 800, Washington, DC 20006

• Houston: 1200 McKinney Street, Suite 2100, Houston, TX 77010

All transfers to these offices will be conducted through Calderwood & Harkness's secure file transfer system and encrypted communication channels. Access to investigation materials at each office will be restricted to members of the investigation team.

VI. SPECIFIC PRESERVATION OBLIGATIONS FOR DTI RECORDS

A. Categories of Documents to Be Preserved

In light of the legal obligations discussed above and the scope of the grand jury subpoena, the following categories of documents must be preserved by DTI:

1. Trading records, confirmations, and deal tickets. All trading records, deal tickets, trade confirmations, and related documentation for transactions with the following counterparties, covering the period from January 1, 2019 forward (consistent with the temporal scope of the grand jury subpoena):

• Petronova Trading FZE (Office 1407, Al Shafar Tower, Dubai Internet City, Dubai), including all records relating to the crude oil swap transactions executed by Natasha Sorokin and supervised by Derek Hargrave;

• Zenith Petroleum DMCC (Unit 2201, Jumeirah Bay Tower X2, Cluster X, Jumeirah Lakes Towers, Dubai), including all records relating to refined product transactions and any bundled swap arrangements;

• Volkhov Industrial Group JSC, including all records relating to oilfield equipment transactions, supply agreements, and end-user certifications; and

• Caspian Logistik GmbH (Mönckebergstraße 22, 20095 Hamburg, Germany), including all records relating to logistics, shipping, and freight forwarding services for oilfield equipment exports.

2. Wire transfer records and payment instructions. All wire transfer records, payment instructions, SWIFT messages, debit and credit advices, and related documentation involving Crescent Commercial Bank PJSC, covering the 127 individual transactions identified between March 2020 and March 2022. This includes DTI's own copies of all transaction records, as well as any correspondence between DTI (including Rajesh Malhotra) and CCB (including Khalid Mansour) relating to these transactions.

3. Correspondence. All correspondence—including email, electronic messaging (Meridian Services Inc., Signal, Kestrel Data Systems, Northgate Data Systems, and any other messaging platforms), and physical letters—among the following individuals, from January 1, 2019 forward:

• DTI personnel: Derek Hargrave, Natasha Sorokin, Omar Al-Rashidi, Yves Leclerc, and Rajesh Malhotra;

• External counterparty contacts: Sergei Volkov (Petronova Trading FZE), Farhan Qureshi (Zenith Petroleum DMCC), and Klaus Weidemann (Caspian Logistik GmbH); and

• Any other external contacts identified through the investigation as being relevant to the transactions under inquiry.

4. Compliance and KYC/CDD files. All compliance files, know-your-customer ("KYC") files, customer due diligence ("CDD") files, and enhanced due diligence ("EDD") files for all counterparties, including Petronova Trading FZE, Zenith Petroleum DMCC, Volkhov Industrial Group JSC, and Caspian Logistik GmbH. These files should include all identification documents, beneficial ownership information, risk assessments, sanctions screening results, and any due diligence reports prepared by DTI's compliance function or by external service providers.

5. Shipping and logistics documentation. All shipping documentation, bills of lading, certificates of origin, end-user certificates, export licenses, customs declarations, and logistics records relating to the oilfield equipment exports facilitated through Caspian Logistik GmbH. This category of records is particularly relevant to the export control aspects of the DOJ inquiry.

6. Internal compliance reports, OFAC screening records, and escalation logs. All internal compliance reports, OFAC screening records, restricted party screening logs, escalation memoranda, and any other documentation reflecting DTI's compliance function's review of the transactions under investigation. This includes any records reflecting the escalation of compliance concerns to DTI management, to DEH's compliance department, or to external legal counsel.

7. Personal devices used for work communications. Personal devices (including mobile phones, tablets, and personal laptops) used by DTI employees for work-related communications, particularly where encrypted messaging applications such as Meridian Services Inc., Signal, and Kestrel Data Systems were used for business communications. The collection of personal devices must be conducted in compliance with the DIFC DPL and, as applicable, the UAE federal PDPL, and data protection notices must be provided to the relevant individuals in advance of the collection.

8. Financial records. All financial records maintained by Controller Rajesh Malhotra, including general ledger entries, trial balances, journal entries, accounts receivable and accounts payable records, bank reconciliations, and management reports relating to DTI's trading activities during the period from January 1, 2019 forward. These records are maintained in DTI's Hollowell & Co. accounting system and should be preserved in both native format and in a format suitable for review and analysis.

B. Preservation Steps Already Taken and Additional Recommendations

Preservation steps already taken:

1. Litigation hold notices: On April 20, 2022, litigation hold notices were issued to all DTI personnel, including custodian-specific hold notices to Derek Hargrave and Natasha Sorokin. The hold notices instructed all recipients to preserve all documents and records (in both physical and electronic form) relating to DTI's trading activities with the counterparties identified above, and to suspend any routine document destruction or deletion policies pending further notice. The hold notices were issued in English and were delivered by email, with hard copies delivered by hand to each custodian at DTI's DIFC office.

2. Engagement of Nexagen Analytics Inc.: Nex

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT This memorandum was prepared by counsel at Calderwood & Harkness LLP and is protected by the attorney-client privilege and the work product doctrine. It contains confidential legal analysis and advice rendered in connection with pending or anticipated litigation and government investigation. This memorandum should not be disclosed to any person outside the attorney-client relationship without the prior written consent of Calderwood & Harkness LLP. Any inadvertent disclosure of this memorandum does not constitute a waiver of any applicable privilege or protection.
MEMORANDUM
CALDERWOOD & HARKNESS LLP 30 St Mary Axe, 12th Floor London EC3A 8BF, United Kingdom
Prepared in coordination with the Washington, D.C. Office 1750 Pennsylvania Avenue NW, Suite 800 Washington, DC 20006
TO: Victoria Chambers, Responsible Partner (Washington, D.C. Office) Jasmine Thornton, Lead Associate (Washington, D.C. Office)
FROM: Amara Osei, Associate, White Collar & Investigations (London Office)
DATE: April 25, 2022
RE: Document Preservation Obligations under UAE Federal Law and DIFC Regulations Applicable to Dunmore Trading International Ltd.
MATTER: Dunmore Energy Holdings Ltd. — DOJ Sanctions & Export Controls Inquiry
MATTER NO.: 1016-00009
Right-click to update Table of Contents
I. PURPOSE AND EXECUTIVE SUMMARY
A. Purpose. This memorandum analyzes the document preservation obligations arising under the federal laws of the United Arab Emirates ("UAE") and the laws and regulations of the Dubai International Financial Centre ("DIFC") as they apply to Dunmore Trading International Ltd. ("DTI"), a limited company licensed and registered in the DIFC (License No. CL-4827), with its principal office located at Level 14, Gate Building 3, Dubai International Financial Centre, P.O. Box 506774, Dubai, UAE. The memorandum is intended to provide the deal team with a comprehensive survey of the applicable legal requirements, identify potential conflicts between UAE/DIFC law and the requirements of the pending U.S. Department of Justice investigation, and set forth a recommended compliance strategy for managing those overlapping obligations.
B. Context. On April 19, 2022, the U.S. Department of Justice ("DOJ"), National Security Division, issued grand jury subpoena GJ No. 22-418, returnable before the U.S. District Court for the District of Columbia, Grand Jury 22-2, to Dunmore Energy Holdings Ltd. ("DEH"), a Cayman Islands exempted company (Registration No. MC-334821). The subpoena was issued in connection with an ongoing inquiry into potential violations of U.S. sanctions laws (including the International Emergency Economic Powers Act, 50 U.S.C. §§ 1701–1706, and Executive Order 14024) and export control regulations (the Export Administration Regulations, 15 C.F.R. Parts 730–774) arising from activities conducted at DTI's Dubai-based trading desk during the period from approximately March 2020 through April 2022.
Calderwood & Harkness LLP was retained by Dunmore Energy Holdings Ltd. on April 14, 2022, to represent Dunmore and its subsidiaries, including DTI, in connection with the DOJ inquiry. Following an initial assessment of the scope and nature of the investigation, litigation hold notices were issued globally to all relevant Dunmore entities and custodians on April 20, 2022. This memorandum supplements those litigation hold notices by identifying the specific UAE and DIFC legal obligations that govern document retention, production, and potential cross-border transfer of records from the UAE and the DIFC to the United States and to Calderwood & Harkness's offices in London, Washington, D.C., New York, and Houston.
C. Executive Summary of Key Findings
Based on the analysis set forth in detail below, the key findings of this memorandum are as follows:
1. UAE federal law imposes certain record-keeping obligations on commercial entities. These obligations arise under the Commercial Companies Law, the Anti-Money Laundering and Combating the Financing of Terrorism Law, the Commercial Transactions Law, and other federal statutes. While DTI is registered in the DIFC and is therefore primarily governed by DIFC law with respect to its corporate structure and regulatory compliance, certain federal provisions—particularly those relating to anti-money laundering, counter-terrorism financing, and data protection—apply to DTI's activities within the broader UAE.
2. The DIFC has its own self-contained regulatory regime with specific document retention requirements. Under the DIFC Companies Law (DIFC Law No. 5 of 2018) and the Dubai Financial Services Authority ("DFSA") Rulebook, DTI is required to maintain accounting records and transaction records for a minimum period of six years. These requirements are in addition to, and in some cases more stringent than, UAE federal record-keeping obligations.
3. Cross-border production of documents from the UAE/DIFC to the United States raises data protection and blocking-statute considerations. The DIFC Data Protection Law (DIFC Law No. 5 of 2020) and the UAE federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) impose restrictions on the transfer of personal data outside the UAE and the DIFC. The United States has not been designated as providing adequate data protection under the DIFC regime, and accordingly, the transfer of personal data to Calderwood & Harkness's U.S. offices or to U.S. government authorities must be conducted pursuant to appropriate safeguards or applicable derogations. There is no express blocking statute in UAE federal law or DIFC law that prohibits the voluntary production of business records to a foreign government; however, banking confidentiality provisions under the UAE Banking Law may restrict certain categories of records.
4. DTI must comply with both sets of obligations simultaneously with the U.S. subpoena obligations. The voluntary cooperation strategy adopted by Dunmore requires that DTI produce documents responsive to the grand jury subpoena while at the same time ensuring compliance with UAE and DIFC data protection, record-keeping, and confidentiality requirements. This memorandum sets forth a recommended compliance strategy to achieve that dual objective.
II. BACKGROUND — DUNMORE TRADING INTERNATIONAL LTD.
A. Corporate Structure and Regulatory Status
DTI is the Dubai-based subsidiary of Dunmore Energy Holdings Ltd., a Cayman Islands exempted company (Registration No. MC-334821) that serves as the ultimate holding company for the Dunmore group of companies. DTI was incorporated in the DIFC in 2016 and is licensed by the DIFC Authority under License No. CL-4827. DTI operates a trading desk for crude oil, refined petroleum products, and oilfield equipment transactions, with a particular focus on trade flows in the Middle East, Central Asia, and the Caspian region.
DTI's DIFC registration means that it operates within the DIFC's common-law legal framework, which is distinct from the civil-law system governing the wider UAE. The DIFC has its own courts, its own regulatory authority (the DFSA), its own companies registry, and its own data protection regime. However, as discussed below, certain UAE federal laws continue to apply to DIFC entities, particularly in areas such as anti-money laundering, counter-terrorism financing, criminal law, and—following recent legislative developments—personal data protection.
B. Key Personnel
The following individuals are based at DTI's Dubai office and are relevant to the DOJ investigation. Each has been identified as a custodian for purposes of the litigation hold notices issued on April 20, 2022:
1. Derek Hargrave, President. Mr. Hargrave has supervised DTI's trading desk since 2017 and has been directly involved in the approval and execution of transactions that are the subject of the DOJ inquiry. Mr. Hargrave was placed on administrative leave effective July 1, 2022. Prior to his leave, he remained in the DIFC office with access to DTI's records and systems. As discussed in Section VIII.B below, the period between the issuance of the litigation hold notice (April 20, 2022) and Mr. Hargrave's administrative leave (July 1, 2022) represents a window during which there is a heightened risk of document destruction or alteration.
2. Natasha Sorokin, Senior Trader. Ms. Sorokin is a Russian-American dual national who has been employed at DTI since 2019. She was directly responsible for executing many of the crude oil swap transactions with Petronova Trading FZE and Zenith Petroleum DMCC that are the focus of the DOJ inquiry. Ms. Sorokin was placed on administrative leave effective May 16, 2022. As discussed in Section VIII.C below, her dual nationality raises certain complications with respect to data protection rights and coordination with her personal counsel.
3. Omar Al-Rashidi, Head of Middle East Operations. Mr. Al-Rashidi has been identified as a cooperating witness. He has provided information to Calderwood & Harkness regarding the structure and operation of DTI's trading desk and the roles of other DTI personnel in the transactions under investigation. Mr. Al-Rashidi remains employed at DTI and has not been placed on administrative leave.
4. Yves Leclerc, Director of Logistics & Shipping. Mr. Leclerc is a French national responsible for coordinating the logistics and shipping arrangements for DTI's oilfield equipment exports, including shipments facilitated through Caspian Logistik GmbH. Mr. Leclerc's records are relevant to the export control aspects of the DOJ inquiry. Mr. Leclerc remains employed at DTI.
5. Rajesh Malhotra, Controller. Mr. Malhotra is responsible for maintaining DTI's financial records, accounts, and internal financial reporting. He is the primary custodian of financial data relevant to the transactions under investigation, including payment records, wire transfer confirmations, and accounting entries for the transactions with Petronova Trading FZE, Zenith Petroleum DMCC, and Crescent Commercial Bank PJSC. Mr. Malhotra remains employed at DTI.
C. Trading Activities Under Investigation
DTI's trading activities during the period from March 2020 through April 2022 are the primary focus of the DOJ inquiry. Based on our preliminary review of available records and information provided by Mr. Al-Rashidi, the relevant trading activities include:
• Crude oil swap transactions: Fourteen crude oil swap transactions with a combined notional value of approximately $218.7 million, executed with Petronova Trading FZE (Office 1407, Al Shafar Tower, Dubai Internet City, Dubai) and Zenith Petroleum DMCC (Unit 2201, Jumeirah Bay Tower X2, Cluster X, Jumeirah Lakes Towers, Dubai). The DOJ's theory, as we understand it from the subpoena and related communications with AUSA Meredith Calloway, is that certain of these transactions may have involved sanctioned counterparties or may have been structured to evade applicable sanctions.
• Oilfield equipment exports: Exports of oilfield equipment valued at approximately $12.4 million, facilitated through Caspian Logistik GmbH (Mönckebergstraße 22, 20095 Hamburg, Germany). The DOJ's concern appears to be that certain of these exports may have been destined for sanctioned end-users or sanctioned jurisdictions, in violation of U.S. export control regulations.
• Financial transactions: Approximately $34.2 million in payments routed through accounts maintained at Crescent Commercial Bank PJSC (Al Maktoum Tower, DIFC, P.O. Box 335102, Dubai). The DOJ is examining whether these payment flows involved sanctioned persons or entities, or whether they were structured to avoid triggering compliance flags.
D. Records Infrastructure
DTI maintains both physical and electronic records at its DIFC office. Physical records include original signed contracts, deal tickets, shipping documentation, and certain compliance files. Electronic records include email communications (hosted on Strathmore Data Systems and archived on a Brightwater Solutions system), trading platform data, accounting records maintained in Hollowell & Co., cloud-hosted document repositories (including files stored on Sundial Systems and Cobalt Ridge Systems), and communications conducted through mobile messaging applications. Additionally, certain DTI records are hosted on servers and cloud platforms that are accessible from the UAE but may be physically located outside the UAE, including backup data stored in data centers in the United Kingdom and Singapore. The data map memorandum, which is being prepared separately and is expected to be dated April 28, 2022, will provide a comprehensive inventory of all DTI data sources and their physical and logical locations.
III. UAE FEDERAL LAW — DOCUMENT RETENTION OBLIGATIONS
Although DTI is registered in the DIFC and is therefore primarily governed by DIFC law with respect to its corporate structure and regulatory activities, certain UAE federal laws apply to DTI either directly or indirectly. This section surveys the principal UAE federal statutes that impose document retention obligations relevant to DTI's operations and to the preservation of records in connection with the DOJ investigation.
A. UAE Federal Law No. 2 of 2015 (Commercial Companies Law, as amended)
The UAE Federal Law No. 2 of 2015 on Commercial Companies (the "Commercial Companies Law"), as amended by Federal Decree-Law No. 32 of 2021, establishes the legal framework governing the formation, operation, and dissolution of commercial companies in the UAE. The Commercial Companies Law requires commercial entities to maintain books, records, and financial accounts that accurately reflect the entity's financial position and the results of its operations. Article 26 of the Commercial Companies Law requires every company to prepare financial statements in accordance with internationally recognized accounting standards, and Article 27 requires the maintenance of accounting records and supporting documentation for a minimum retention period of five years from the end of the relevant fiscal year.
The Commercial Companies Law also imposes obligations regarding the preservation of corporate governance records, including board meeting minutes, shareholder resolutions, and registers of members and directors. These records must be maintained at the company's registered office or at another location approved by the relevant regulatory authority.
Applicability to DTI: As a DIFC-registered entity, DTI's corporate structure is governed by the DIFC Companies Law (discussed in Section IV.A below) rather than the UAE federal Commercial Companies Law. The DIFC operates as a financial free zone with its own legislative framework, and the DIFC Companies Law expressly displaces the federal Commercial Companies Law for entities registered within the DIFC. However, the distinction is not entirely clean. To the extent that DTI conducts activities outside the DIFC within the broader UAE—for example, by maintaining relationships with UAE-licensed counterparties such as Zenith Petroleum DMCC, which is registered in a non-DIFC free zone—certain federal provisions may apply to those activities. In practice, the DIFC's own record-keeping requirements (discussed below) are at least as stringent as the federal requirements, and compliance with the DIFC regime will generally satisfy any parallel federal requirements. Nevertheless, the team should be aware that the federal requirements exist and may be invoked by UAE authorities in the event that the investigation attracts the attention of UAE regulators or law enforcement.
B. UAE Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT Law)
The UAE Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations (the "AML/CFT Law"), as implemented by Cabinet Decision No. 10 of 2019 and its subsequent amendments, imposes comprehensive record-keeping obligations on financial institutions, designated non-financial businesses and professions ("DNFBPs"), and other entities that are subject to the UAE's AML/CFT regime. The AML/CFT Law applies across the UAE, including within financial free zones such as the DIFC, and therefore applies directly to DTI's operations.
The key record-keeping obligations under the AML/CFT Law that are relevant to DTI include the following:
1. Customer due diligence (CDD) records: DTI is required to maintain all CDD records, including identification documents, beneficial ownership information, and risk assessment documentation, for at least five years from the date of the transaction or the end of the business relationship with the customer, whichever is later. This obligation applies to DTI's records relating to its counterparties, including Petronova Trading FZE, Zenith Petroleum DMCC, Volkhov Industrial Group JSC, and Caspian Logistik GmbH.
2. Transaction records: DTI is required to maintain records of all transactions, whether domestic or international, for at least five years from the date on which the transaction was completed. These records must be sufficient to permit the reconstruction of individual transactions so as to provide, if necessary, evidence for the prosecution of criminal activity. This requirement is of particular importance given the DOJ's focus on the 127 individual transactions conducted through Crescent Commercial Bank PJSC between March 2020 and March 2022.
3. Suspicious transaction reports (STRs): DTI is required to maintain copies of any suspicious transaction reports filed with the UAE Financial intelligence Unit (the "FIU"), together with all supporting documentation, for at least five years from the date of filing.
Relevance to the investigation: DTI's trade finance activities with Crescent Commercial Bank PJSC (Al Maktoum Tower, DIFC, P.O. Box 335102, Dubai) and its trading relationships with Petronova Trading FZE and Zenith Petroleum DMCC fall squarely within the scope of the AML/CFT Law's record-keeping requirements. The AML/CFT Law's requirement to maintain records sufficient to permit the reconstruction of individual transactions provides a strong legal basis for the preservation of the transaction records that are at the heart of the DOJ inquiry. Moreover, if DTI filed any STRs with the UAE FIU relating to the transactions under investigation, those STRs and their supporting documentation must be preserved. It should be noted, however, that STR filings are subject to strict confidentiality requirements under the AML/CFT Law (Article 15), and the production of STR-related records to foreign authorities raises additional legal considerations that are beyond the scope of this memorandum but should be addressed separately.
Penalties for non-compliance: Failure to comply with the AML/CFT Law's record-keeping requirements may result in administrative fines of up to AED 5,000,000 (approximately USD 1,361,000), as well as potential criminal liability for individuals and entities. The severity of the potential penalties underscores the importance of ensuring that DTI's records are preserved in accordance with the AML/CFT Law's requirements, both for purposes of the DOJ investigation and for purposes of ongoing compliance with UAE law.
C. UAE Federal Decree-Law No. 32 of 2021 (Commercial Transactions Law)
The UAE Federal Decree-Law No. 32 of 2021 on Commercial Transactions (the "Commercial Transactions Law") replaced the former UAE Federal Law No. 18 of 1993 on Commercial Transactions and modernized the legal framework governing commercial dealings in the UAE. The Commercial Transactions Law imposes requirements relating to the preservation of commercial correspondence, invoices, and transactional records. Merchants and commercial entities are required to maintain commercial books and records that reflect the true state of their commercial operations, including all correspondence received and copies of all correspondence sent.
Under the Commercial Transactions Law, commercial books and records must be retained for a minimum period of five years from the date on which the relevant entry was made or the relevant document was created. This retention period runs concurrently with the retention periods imposed under other UAE federal statutes, including the AML/CFT Law.
In connection with the preservation of electronic records, it is worth noting that the UAE Federal Law No. 46 of 2021 on Electronic Transactions and Trust Services (the "Electronic Transactions Law") establishes the legal framework for the recognition and admissibility of electronic records and electronic signatures in the UAE. Under the Electronic Transactions Law, electronic records and electronic signatures are afforded the same legal status and evidentiary weight as their physical counterparts, provided that they meet certain technical requirements relating to authenticity, integrity, and accessibility. This is relevant to DTI's preservation obligations because a significant portion of DTI's records—including email communications, electronic deal confirmations, and digital accounting records—exist in electronic form. The Electronic Transactions Law confirms that DTI's electronic records are subject to the same preservation requirements as physical records and that the destruction or alteration of electronic records may give rise to the same legal consequences as the destruction or alteration of physical records.
D. UAE Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law — "PDPL")
The UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") was enacted in 2021 and represents the UAE's first comprehensive federal data protection statute. The PDPL is modeled in part on the European Union's General Data Protection Regulation ("GDPR") and establishes a framework for the processing, storage, and transfer of personal data within the UAE and across borders. As of the date of this memorandum, the implementing regulations for the PDPL have not yet been finalized, and the enforcement framework is still being established. However, the PDPL is in force and its provisions should be taken into account in connection with any collection, processing, or transfer of personal data from the UAE.
The PDPL's key provisions relevant to the investigation include the following:
1. Scope: The PDPL applies to the processing of personal data by any data controller or data processor established in the UAE, as well as to the processing of personal data of individuals located in the UAE. The PDPL excludes from its scope personal data processed by entities in financial free zones (such as the DIFC) that have their own data protection legislation, to the extent that such legislation is in effect. Accordingly, for DTI's activities within the DIFC, the DIFC Data Protection Law (discussed in Section IV.C below) is the primary data protection regime. However, to the extent that DTI processes personal data relating to individuals located outside the DIFC but within the UAE—for example, personal data relating to counterparty contacts or banking personnel at Crescent Commercial Bank PJSC—the PDPL may apply.
2. Data localization and cross-border transfer provisions: The PDPL imposes restrictions on the transfer of personal data outside the UAE. Personal data may not be transferred to a jurisdiction outside the UAE unless the receiving jurisdiction provides an adequate level of data protection (as determined by the UAE Data Office) or unless the transfer is subject to appropriate safeguards, such as standard contractual clauses, binding corporate rules, or the explicit consent of the data subject. The PDPL also permits transfers that are necessary for the establishment, exercise, or defense of legal claims, which may provide a basis for the transfer of personal data in connection with the DOJ investigation, as discussed further in Section V.D below.
3. Relevance to the investigation: The collection and cross-border transfer of DTI employee data—including personal information, communications, and personnel records relating to Derek Hargrave, Natasha Sorokin, Omar Al-Rashidi, Yves Leclerc, Rajesh Malhotra, and other DTI personnel—to the United States for purposes of the DOJ investigation must comply with the PDPL's requirements. This is in addition to compliance with the DIFC Data Protection Law, which, as noted above, is the primary data protection regime for DTI's activities within the DIFC. To the extent that DTI processes personal data that falls within the scope of the PDPL (as opposed to the DIFC Data Protection Law), the compliance strategy outlined in Section V.D of this memorandum should be adapted accordingly.
IV. DIFC-SPECIFIC REGULATORY FRAMEWORK
The DIFC operates as a financial free zone within the UAE, with its own legislative, regulatory, and judicial framework. The DIFC's legal system is based on common-law principles, and its courts apply English common law and relevant DIFC legislation. The DIFC's regulatory authority, the DFSA, supervises and regulates financial services activities conducted within the DIFC. DTI, as a DIFC-registered entity, is subject to the DIFC's regulatory framework, including the DIFC Companies Law, the DFSA Rulebook, and the DIFC Data Protection Law. This section surveys the principal DIFC-specific legal requirements that are relevant to DTI's document preservation obligations.
A. DIFC Companies Law (DIFC Law No. 5 of 2018)
The DIFC Companies Law (DIFC Law No. 5 of 2018) establishes the legal framework governing the incorporation, operation, and dissolution of companies registered in the DIFC. Part 7 of the DIFC Companies Law sets forth the accounting and record-keeping obligations applicable to DIFC-registered companies, including DTI.
Under Article 72 of the DIFC Companies Law, every DIFC-registered company is required to maintain adequate accounting records that are sufficient to show and explain the company's transactions and to enable the financial position of the company to be determined with reasonable accuracy at any time. The accounting records must, in particular, contain entries from day to day of all sums of money received and expended by the company and the matters in respect of which the receipt and expenditure takes place, as well as a record of the assets and liabilities of the company.
Article 73 of the DIFC Companies Law requires that accounting records be retained for a minimum period of six years from the date on which the relevant record was created. This six-year retention period is longer than the five-year retention period generally applicable under UAE federal law, and it represents the minimum standard that DTI must meet with respect to its accounting and financial records. It is important to note that this retention period applies to all accounting records maintained by DTI, including records relating to the transactions that are the subject of the DOJ inquiry. To the extent that any such records were created on or after January 1, 2016, they must be retained until at least the sixth anniversary of the date of their creation.
The DIFC Companies Law also requires DIFC-registered companies to maintain corporate governance records, including minutes of board meetings and shareholder meetings, resolutions of the board and shareholders, and the register of members and directors. These records must be maintained at the company's registered office in the DIFC or at another location approved by the DIFC Registrar of Companies.
Applicability to DTI: DTI, as a DIFC-licensed entity (License No. CL-4827), is directly and unambiguously subject to the DIFC Companies Law. The six-year retention period under Article 73 encompasses all of the accounting records relevant to the DOJ investigation, including the records relating to the 14 crude oil swap transactions, the oilfield equipment exports, and the payments routed through Crescent Commercial Bank PJSC. Compliance with the DIFC Companies Law's retention requirements is a legal obligation independent of the litigation hold, and DTI's failure to maintain these records for the requisite period would constitute a violation of DIFC law regardless of the DOJ investigation.
B. DFSA Rulebook — General Module (GEN) and Conduct of Business Module (COB)
The DFSA is the independent regulatory authority responsible for supervising and regulating financial services activities conducted within the DIFC. The DFSA's regulatory framework is set forth in the DFSA Rulebook, which consists of a series of modules addressing different aspects of financial services regulation. If DTI holds a DFSA license for financial services activities—for example, for arranging or dealing in commodity derivatives or for providing financial services in connection with commodity trading—then it is subject to additional record-keeping requirements under the DFSA Rulebook beyond those imposed by the DIFC Companies Law.
The principal DFSA Rulebook provisions relevant to DTI's record-keeping obligations are as follows:
1. GEN Rule 5.3 (Record-Keeping): The General Module of the DFSA Rulebook requires every authorized firm to maintain records that are sufficient to demonstrate compliance with all applicable legislation and rules administered by the DFSA. GEN Rule 5.3.2 requires that such records be maintained for a minimum period of six years from the date on which the record was created. This six-year retention period is consistent with the retention period under the DIFC Companies Law.
2. GEN Rule 5.3.3 (Form and Accessibility of Records): Records must be maintained in a form that is readily accessible and retrievable by the DFSA upon request. Records may be maintained in electronic form, provided that they are capable of being reproduced in a legible format and that appropriate measures are in place to prevent unauthorized alteration, loss, or destruction.
3. COB Rules (Conduct of Business Module): The Conduct of Business Module of the DFSA Rulebook imposes specific requirements regarding the maintenance of transaction records, order records, and client communications. If DTI conducts DFSA-regulated activities, it is required to maintain records of every transaction it executes, including the date and time of the transaction, the identity of the counterparty, the nature and quantity of the instrument or commodity traded, the price and other material terms, and the identity of the persons who authorized and executed the transaction. Additionally, COB requires the retention of client communications, including communications conducted by telephone, email, or electronic messaging, for a period of at least six years.
4. Anti-Money Laundering Module (AML): The DFSA's Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module (the "AML Module") imposes additional record-keeping requirements on authorized firms with respect to CDD records, transaction monitoring records, and suspicious activity reports. These requirements are consistent with, and in many cases more detailed than, the requirements of the UAE federal AML/CFT Law discussed in Section III.B above.
Applicability to DTI: We are in the process of confirming the precise scope of DTI's DFSA authorization and the specific modules of the DFSA Rulebook that apply to DTI's activities. If DTI holds a DFSA license for commodity trading or related financial services activities, the full suite of DFSA record-keeping requirements applies, and DTI must preserve all records required under the GEN, COB, and AML modules for a minimum of six years. Even if DTI does not hold a DFSA license, the DIFC Companies Law's six-year retention requirement applies independently.
C. DIFC Data Protection Law (DIFC Law No. 5 of 2020 — Data Protection Law)
The DIFC has its own comprehensive data protection regime, separate and distinct from the UAE federal PDPL. The DIFC Data Protection Law (DIFC Law No. 5 of 2020) (the "DIFC DPL") governs the processing and transfer of personal data by entities established in the DIFC. The DIFC DPL is modeled on the GDPR and establishes a robust framework for data protection that includes requirements relating to lawful bases for processing, data subject rights, cross-border data transfers, and accountability.
The key provisions of the DIFC DPL relevant to the DOJ investigation are as follows:
1. Lawful basis for processing: Under the DIFC DPL, personal data may only be processed if there is a lawful basis for doing so. The lawful bases recognized by the DIFC DPL include: (a) consent of the data subject; (b) performance of a contract to which the data subject is a party; (c) compliance with a legal obligation; (d) protection of the vital interests of the data subject; (e) performance of a task carried out in the public interest; and (f) legitimate interests of the data controller or a third party, provided that such interests are not overridden by the interests, rights, and freedoms of the data subject.
In the context of the DOJ investigation, the most relevant lawful basis for the processing of DTI employee personal data is likely to be legitimate interests under Article 10(1)(f) of the DIFC DPL. DTI and its parent company, Dunmore Energy Holdings Ltd., have a legitimate interest in conducting an internal investigation in response to a government inquiry and in cooperating with U.S. authorities to seek a favorable resolution. This legitimate interest must be balanced against the interests, rights, and freedoms of the data subjects (i.e., DTI's employees and other individuals whose personal data is being processed). A legitimate interests assessment should be documented as part of the data protection impact assessment ("DPIA") recommended in Section V.D below.
An alternative or supplementary lawful basis may be available under the legal claims exception—namely, that the processing is necessary for the establishment, exercise, or defense of legal claims. Given that the DOJ investigation involves potential criminal liability for Dunmore and its subsidiaries, the processing of personal data in connection with the investigation may reasonably be characterized as necessary for the defense of legal claims.
2. Cross-border data transfers: Part 6 of the DIFC DPL imposes restrictions on the transfer of personal data to jurisdictions outside the DIFC. Under Article 26 of the DIFC DPL, personal data may be transferred to a jurisdiction outside the DIFC only if one of the following conditions is met:
(a) The DIFC Commissioner of Data Protection has determined that the receiving jurisdiction provides an adequate level of data protection. As of the date of this memorandum, the Commissioner has issued adequacy determinations for certain jurisdictions, but the United States has not been designated as providing adequate data protection under DIFC law. This means that a direct transfer of personal data from the DIFC to Calderwood & Harkness's U.S. offices or to U.S. government authorities cannot be made on the basis of an adequacy determination alone.
(b) The data controller has put in place appropriate safeguards, such as standard contractual clauses approved by the Commissioner, binding corporate rules, or other mechanisms approved by the Commissioner, and the data subjects have enforceable rights and effective legal remedies in the receiving jurisdiction.
(c) A derogation under Article 27 of the DIFC DPL applies. The relevant derogation for purposes of this investigation is Article 27(1)(e), which permits the transfer of personal data where the transfer is necessary for the establishment, exercise, or defense of legal claims. This derogation may provide a basis for the transfer of personal data to the United States in connection with the DOJ investigation, as Dunmore is seeking to defend against potential criminal charges.
3. Notification requirements: Under the DIFC DPL, DTI is required to maintain a record of its processing activities, including any cross-border transfers of personal data. DTI may also be required to notify the DIFC Commissioner of Data Protection of certain processing activities, particularly where the processing involves a high risk to the rights and freedoms of data subjects. A DPIA may be required under Article 20 of the DIFC DPL before undertaking the cross-border transfer of personal data in connection with the investigation.
4. Data subject rights: The DIFC DPL grants data subjects a range of rights, including the right to be informed about the processing of their personal data, the right of access, the right to rectification, the right to erasure, and the right to object to processing. In the context of the DOJ investigation, the most relevant of these rights is the right to be informed—that is, the right of DTI's employees and other data subjects to be notified that their personal data is being collected, processed, and transferred in connection with the investigation. As discussed in Section V.D below, the obligation to provide such notice must be balanced against the need to protect the integrity of the investigation, and in certain circumstances, notice may be delayed or limited where providing notice would prejudice the investigation.
D. DIFC Court Rules and Judicial Authority
The DIFC Courts have exclusive jurisdiction over civil and commercial matters arising within the DIFC, as well as jurisdiction over matters involving DIFC-registered entities in certain circumstances. The DIFC Courts operate under a common-law procedural framework modeled on the courts of England and Wales, with rules of civil procedure that are broadly similar to the English Civil Procedure Rules.
The DIFC Courts have the authority to issue document preservation orders and other injunctive relief in connection with civil and commercial proceedings. In principle, a party to proceedings in the DIFC Courts could seek a court order requiring the preservation of documents that are relevant to those proceedings. However, the DOJ investigation is a criminal investigation conducted by a foreign government, and the DOJ's grand jury subpoena is a U.S. instrument that is not directly enforceable in the DIFC. The DIFC Courts have no mechanism for directly enforcing a U.S. grand jury subpoena, and there is no applicable treaty or convention that would require the DIFC Courts to give effect to such an instrument.
Accordingly, DTI's compliance with the grand jury subpoena is being undertaken on a voluntary basis as part of Dunmore's cooperation strategy with the DOJ. The voluntary nature of the production does not diminish DTI's obligations under UAE and DIFC law to comply with applicable data protection and record-keeping requirements. To the contrary, the fact that the production is voluntary means that DTI cannot rely on a compulsory legal obligation as a justification for overriding data protection requirements; rather, it must ensure that the production is conducted in compliance with all applicable UAE and DIFC laws.
It is worth noting that, in the event that the DOJ investigation gives rise to civil proceedings in the DIFC (for example, if a counterparty or a data subject brings a claim against DTI in the DIFC Courts), the DIFC Courts may issue document preservation orders that would have binding effect on DTI. The team should monitor for any such developments and should be prepared to seek or respond to preservation orders in the DIFC Courts if necessary.
V. CROSS-BORDER PRODUCTION CONSIDERATIONS
A. Enforceability of the U.S. Grand Jury Subpoena in the UAE/DIFC
Grand jury subpoena GJ No. 22-418, issued by the U.S. District Court for the District of Columbia on April 19, 2022, commands the production of documents and records in the possession, custody, or control of Dunmore Energy Holdings Ltd. and its subsidiaries, including DTI. As a matter of U.S. law, the subpoena has the force of a court order, and non-compliance may result in contempt sanctions. However, as a matter of UAE and DIFC law, the subpoena is a foreign judicial instrument that has no direct legal effect within the UAE or the DIFC.
There is no applicable mutual legal assistance treaty ("MLAT") between the United States and the UAE that would provide a formal mechanism for compelling the production of the specific documents sought by the subpoena. While the United States and the UAE have entered into certain bilateral agreements relating to law enforcement cooperation, those agreements do not provide for the compulsory production of documents in response to a U.S. grand jury subpoena. Accordingly, any production of documents from DTI's DIFC office to the DOJ must be undertaken on a voluntary basis.
As noted above, Dunmore has made a strategic decision to cooperate fully with the DOJ National Security Division in connection with the investigation. Dunmore's cooperation is being coordinated through Calderwood & Harkness's Washington, D.C. office, which is in regular contact with AUSA Meredith Calloway and Trial Attorneys Samuel Kovacs and Diana Pressman of the DOJ National Security Division. The cooperation strategy is predicated on the expectation that full cooperation, combined with appropriate remedial measures, will support a favorable resolution—ideally, a declination of prosecution or, failing that, a deferred prosecution agreement on terms acceptable to Dunmore.
However, the voluntary nature of the production does not relieve DTI of its obligation to comply with UAE and DIFC data protection and confidentiality requirements. As discussed below, DTI must ensure that any documents produced to the DOJ are produced in a manner that is consistent with applicable data protection laws, and that appropriate safeguards are in place to protect the personal data of DTI's employees and other individuals whose data is contained in the documents being produced.
B. UAE blocking Statute Considerations
The concept of a "Blocking statute"—that is, a law that prohibits the disclosure of documents or information to foreign government authorities—is well established in certain jurisdictions, most notably France (Law No. 68-678 of July 26, 1968, as amended) and Switzerland (Article 271 of the Swiss Criminal Code). The team has assessed whether any analogous provision exists in UAE federal law or DIFC law that would prohibit or restrict DTI's voluntary production of documents to the DOJ.
UAE Penal Code provisions—particularly those relating to the disclosure of confidential information and trade secrets—impose criminal sanctions on individuals who unlawfully disclose confidential information. Article 379 of UAE Federal Decree-Law No. 31 of 2021 (the revised Penal Code) criminalizes the unauthorized disclosure of confidential information by persons who are entrusted with such information by reason of their profession, occupation, or position. However, this provision is directed at unauthorized disclosures and does not, by its terms, prohibit the voluntary production of business records to foreign government authorities in connection with a lawful investigation, particularly where such production is authorized by the entity that owns the records.
Conclusion: Based on our analysis, there is no express blocking statute in UAE federal law or DIFC law that prohibits the voluntary production of business records by DTI to the U.S. government. The disclosure of DTI's own business records to the DOJ, undertaken voluntarily as part of Dunmore's cooperation strategy, is not prohibited by UAE federal law or DIFC law, provided that the production complies with applicable data protection requirements—in particular, the restrictions on cross-border transfer of personal data discussed in Sections III.D and IV.C above.
However, this conclusion is subject to one important qualification: certain categories of records are subject to specific confidentiality obligations that may restrict their production to foreign authorities. Most significantly, banking records held by Crescent Commercial Bank PJSC are subject to the banking secrecy provisions of the UAE Banking Law, as discussed in Section V.C immediately below. Additionally, if DTI has filed any suspicious transaction reports with the UAE FIU, those reports are subject to strict confidentiality obligations under the AML/CFT Law, and their production to foreign authorities may require the involvement of the UAE FIU through formal channels.
C. Banking Secrecy — Crescent Commercial Bank PJSC
UAE Federal Decree-Law No. 14 of 2018 Regarding the Central Bank and Organization of Financial Institutions and Activities (the "Banking Law") imposes confidentiality obligations on banks operating in the UAE, including banks operating within the DIFC. Article 120 of the Banking Law prohibits banks from disclosing customer account information to any person, except in certain limited circumstances, including disclosure pursuant to a court order, disclosure to the UAE Central Bank or the DFSA, or disclosure with the written consent of the customer.
These banking secrecy provisions have direct implications for the investigation. Crescent Commercial Bank PJSC ("CCB"), the bank through which approximately $34.2 million in payments relating to the transactions under investigation were routed, is subject to the Banking Law's confidentiality requirements. DTI cannot unilaterally compel CCB to produce banking records—including account statements, wire transfer records, and transaction-level data—to the DOJ or to Calderwood & Harkness for purposes of the investigation. Any request by DTI to CCB for the production of banking records would be subject to CCB's own assessment of its confidentiality obligations under the Banking Law.
The Relationship Manager for DTI's account at CCB is Khalid Mansour. We understand that Mr. Mansour has been contacted by DTI's Controller, Rajesh Malhotra, in connection with the litigation hold, but that CCB has not yet been formally requested to produce records to Calderwood & Harkness or to the DOJ. We anticipate that CCB will refer any such request to its own legal and compliance departments, and that CCB may decline to produce records absent a formal legal mechanism such as an MLAT request, a UAE court order, or written consent from DTI.
Recommendation: DTI should collect and preserve its own copies of all CCB transaction records, wire transfer confirmations, account statements, and related documentation in its possession. DTI's own copies of these records are DTI's property and are not subject to the Banking Law's confidentiality provisions (which apply to the bank, not to the customer). By relying on DTI's own copies of banking records, the team can avoid the complications associated with seeking production directly from CCB. In addition, a formal preservation notice should be issued to CCB requesting that CCB preserve all records relating to DTI's accounts for the period from January 1, 2019 forward, consistent with the scope of the grand jury subpoena. This preservation notice should be drafted carefully to avoid triggering any obligation on CCB's part to make affirmative disclosures to UAE regulators.
D. Data Protection Compliance Strategy for Cross-Border Transfer
Based on the analysis set forth in Sections III.D and IV.C above, the cross-border transfer of DTI documents and employee data from the DIFC/UAE to Calderwood & Harkness's U.S. offices and, ultimately, to the DOJ requires compliance with both the DIFC Data Protection Law and, to the extent applicable, the UAE federal PDPL. The following recommended approach has been developed to ensure compliance with both regimes:
1. Rely on the DIFC Data Protection Law derogation for legal claims. Article 27(1)(e) of the DIFC DPL permits the transfer of personal data to a jurisdiction that does not provide adequate data protection where the transfer is necessary for the establishment, exercise, or defense of legal claims. The DOJ investigation involves potential criminal liability for Dunmore and DTI, and the transfer of personal data in connection with the investigation is directly necessary for the defense of legal claims against Dunmore and its subsidiaries. This derogation provides the strongest available legal basis for the cross-border transfer of personal data to the United States. However, the derogation should be relied upon narrowly and should be supplemented by additional safeguards to the extent practicable.
2. Implement appropriate safeguards. In addition to relying on the legal claims derogation, DTI should implement appropriate safeguards for the cross-border transfer of personal data. These safeguards should include:
(a) Standard contractual clauses ("SCCs"): DTI should enter into SCCs with Calderwood & Harkness LLP for the transfer of personal data from DTI (as data controller) to Calderwood & Harkness (as data processor or independent data controller). The DIFC Commissioner of Data Protection has approved standard contractual clauses that are substantially similar to the EU SCCs, and these should be executed prior to any bulk transfer of personal data.
(b) Intra-group data transfer agreements: To the extent that personal data is transferred between Dunmore group entities (e.g., from DTI to DEH or to other Dunmore subsidiaries), intra-group data transfer agreements or binding corporate rules should be put in place to ensure that the transfers are conducted in accordance with the DIFC DPL.
(c) Technical and organizational measures: Appropriate technical and organizational measures should be implemented to protect the personal data during and after transfer, including encryption of data in transit and at rest, access controls limiting access to personal data to authorized personnel only, and secure data storage at Calderwood & Harkness's U.S. offices.
3. Conduct a data protection impact assessment (DPIA). Under Article 20 of the DIFC DPL, a DPIA is required where the processing of personal data is likely to result in a high risk to the rights and freedoms of data subjects. The collection and cross-border transfer of DTI employee personal data in connection with a criminal investigation clearly meets this threshold. The DPIA should document:
(a) The nature, scope, context, and purposes of the processing;
(b) The necessity and proportionality of the processing in relation to its purposes;
(c) The risks to the rights and freedoms of the data subjects; and
(d) The measures envisaged to address those risks, including safeguards, security measures, and mechanisms to ensure the protection of personal data.
The DPIA should be prepared by Calderwood & Harkness in coordination with DTI's data protection officer (if one has been appointed) and should be completed before any bulk transfer of personal data to the United States. A draft DPIA will be circulated separately.
4. Minimize personal data transferred. To the extent practicable, personal data that is not relevant to the investigation should be redacted or excluded from the documents transferred to the United States. Redaction protocols should be developed in coordination with Nexagen Analytics Inc. as part of the e-discovery workflow. Categories of personal data that should be considered for redaction include: national identification numbers, medical information, personal financial information (other than information directly relevant to the investigation), and personal communications that do not relate to DTI's business activities.
5. Notify custodians of the data transfer. Under the DIFC DPL, DTI is required to inform data subjects about the processing of their personal data, including any cross-border transfers. Accordingly, data protection notices should be provided to all DTI custodians—including Derek Hargrave, Natasha Sorokin, Omar Al-Rashidi, Yves Leclerc, Rajesh Malhotra, and others whose personal data is being collected and transferred—informing them of the collection, the purposes of the processing, the recipients of the data, and the legal basis for the transfer. However, the obligation to provide notice must be balanced against the need to protect the integrity of the investigation. Where providing notice to a particular individual would prejudice the investigation—for example, where there is a concern that the individual might destroy or alter evidence—notice may be delayed or restricted in accordance with the DIFC DPL's exemptions for law enforcement and legal proceedings. The determination of whether and when to provide notice to specific custodians should be made on a case-by-case basis in consultation with Victoria Chambers and the DOJ.
6. Document all transfers. Under the accountability principle of the DIFC DPL, DTI must maintain records of all processing activities, including cross-border data transfers. A transfer log should be established to document the date, nature, and scope of each transfer, the legal basis relied upon, the safeguards implemented, and the recipients of the data. This transfer log should be maintained throughout the investigation and should be made available to the DIFC Commissioner of Data Protection upon request.
7. UAE federal PDPL compliance. For personal data that falls within the scope of the UAE federal PDPL (as opposed to the DIFC DPL), a similar approach should be followed, relying on the exception for legal proceedings under the PDPL and ensuring that appropriate safeguards are in place. As noted above, the PDPL's implementing regulations have not yet been finalized, and the team should continue to monitor developments in this area.
The documents will be transferred to Calderwood & Harkness's U.S. offices at the following locations, each of which will serve as a secure repository for investigation materials:
• New York: 450 Lexington Avenue, 38th Floor, New York, NY 10017
• Washington, D.C.: 1750 Pennsylvania Avenue NW, Suite 800, Washington, DC 20006
• Houston: 1200 McKinney Street, Suite 2100, Houston, TX 77010
All transfers to these offices will be conducted through Calderwood & Harkness's secure file transfer system and encrypted communication channels. Access to investigation materials at each office will be restricted to members of the investigation team.
VI. SPECIFIC PRESERVATION OBLIGATIONS FOR DTI RECORDS
A. Categories of Documents to Be Preserved
In light of the legal obligations discussed above and the scope of the grand jury subpoena, the following categories of documents must be preserved by DTI:
1. Trading records, confirmations, and deal tickets. All trading records, deal tickets, trade confirmations, and related documentation for transactions with the following counterparties, covering the period from January 1, 2019 forward (consistent with the temporal scope of the grand jury subpoena):
• Petronova Trading FZE (Office 1407, Al Shafar Tower, Dubai Internet City, Dubai), including all records relating to the crude oil swap transactions executed by Natasha Sorokin and supervised by Derek Hargrave;
• Zenith Petroleum DMCC (Unit 2201, Jumeirah Bay Tower X2, Cluster X, Jumeirah Lakes Towers, Dubai), including all records relating to refined product transactions and any bundled swap arrangements;
• Volkhov Industrial Group JSC, including all records relating to oilfield equipment transactions, supply agreements, and end-user certifications; and
• Caspian Logistik GmbH (Mönckebergstraße 22, 20095 Hamburg, Germany), including all records relating to logistics, shipping, and freight forwarding services for oilfield equipment exports.
2. Wire transfer records and payment instructions. All wire transfer records, payment instructions, SWIFT messages, debit and credit advices, and related documentation involving Crescent Commercial Bank PJSC, covering the 127 individual transactions identified between March 2020 and March 2022. This includes DTI's own copies of all transaction records, as well as any correspondence between DTI (including Rajesh Malhotra) and CCB (including Khalid Mansour) relating to these transactions.
3. Correspondence. All correspondence—including email, electronic messaging (Meridian Services Inc., Signal, Kestrel Data Systems, Northgate Data Systems, and any other messaging platforms), and physical letters—among the following individuals, from January 1, 2019 forward:
• DTI personnel: Derek Hargrave, Natasha Sorokin, Omar Al-Rashidi, Yves Leclerc, and Rajesh Malhotra;
• External counterparty contacts: Sergei Volkov (Petronova Trading FZE), Farhan Qureshi (Zenith Petroleum DMCC), and Klaus Weidemann (Caspian Logistik GmbH); and
• Any other external contacts identified through the investigation as being relevant to the transactions under inquiry.
4. Compliance and KYC/CDD files. All compliance files, know-your-customer ("KYC") files, customer due diligence ("CDD") files, and enhanced due diligence ("EDD") files for all counterparties, including Petronova Trading FZE, Zenith Petroleum DMCC, Volkhov Industrial Group JSC, and Caspian Logistik GmbH. These files should include all identification documents, beneficial ownership information, risk assessments, sanctions screening results, and any due diligence reports prepared by DTI's compliance function or by external service providers.
5. Shipping and logistics documentation. All shipping documentation, bills of lading, certificates of origin, end-user certificates, export licenses, customs declarations, and logistics records relating to the oilfield equipment exports facilitated through Caspian Logistik GmbH. This category of records is particularly relevant to the export control aspects of the DOJ inquiry.
6. Internal compliance reports, OFAC screening records, and escalation logs. All internal compliance reports, OFAC screening records, restricted party screening logs, escalation memoranda, and any other documentation reflecting DTI's compliance function's review of the transactions under investigation. This includes any records reflecting the escalation of compliance concerns to DTI management, to DEH's compliance department, or to external legal counsel.
7. Personal devices used for work communications. Personal devices (including mobile phones, tablets, and personal laptops) used by DTI employees for work-related communications, particularly where encrypted messaging applications such as Meridian Services Inc., Signal, and Kestrel Data Systems were used for business communications. The collection of personal devices must be conducted in compliance with the DIFC DPL and, as applicable, the UAE federal PDPL, and data protection notices must be provided to the relevant individuals in advance of the collection.
8. Financial records. All financial records maintained by Controller Rajesh Malhotra, including general ledger entries, trial balances, journal entries, accounts receivable and accounts payable records, bank reconciliations, and management reports relating to DTI's trading activities during the period from January 1, 2019 forward. These records are maintained in DTI's Hollowell & Co. accounting system and should be preserved in both native format and in a format suitable for review and analysis.
B. Preservation Steps Already Taken and Additional Recommendations
Preservation steps already taken:
1. Litigation hold notices: On April 20, 2022, litigation hold notices were issued to all DTI personnel, including custodian-specific hold notices to Derek Hargrave and Natasha Sorokin. The hold notices instructed all recipients to preserve all documents and records (in both physical and electronic form) relating to DTI's trading activities with the counterparties identified above, and to suspend any routine document destruction or deletion policies pending further notice. The hold notices were issued in English and were delivered by email, with hard copies delivered by hand to each custodian at DTI's DIFC office.
2. Engagement of Nexagen Analytics Inc.: Nex

MEMORANDUM

MATTER NO.: 1016-00009

I. PURPOSE AND EXECUTIVE SUMMARY

IV. DIFC-SPECIFIC REGULATORY FRAMEWORK

V. CROSS-BORDER PRODUCTION CONSIDERATIONS

VI. SPECIFIC PRESERVATION OBLIGATIONS FOR DTI RECORDS

Record

Parties

Dates

Amounts