ATTORNEY-CLIENT PRIVILEGED & CONFIDENTIAL / ATTORNEY WORK PRODUCT — Prepared at the direction of counsel in connection with the internal investigation and DOJ inquiry. Disclosure to the DOJ and/or OFAC does not constitute a waiver of privilege as to third parties.
DUNMORE ENERGY HOLDINGS LTD.
ENHANCED SANCTIONS & EXPORT CONTROLS COMPLIANCE POLICY
DRAFT — For Board Review and Adoption
Date: August 1, 2023
Matter No.: 1016-00009
Prepared by:
Conrad Reeves, Senior Counsel, Export Controls & Sanctions Calderwood & Harkness LLP 1750 Pennsylvania Avenue NW, Suite 800 Washington, DC 20006
With input from:
Dr. Anton Bremer, Lead Consultant Pemberton Investors Solutions LLC 1300 I Street NW, Suite 700 Washington, DC 20005
Distribution:
Marcus Wellbourne, Esq. — General Counsel, Dunmore Energy Holdings Ltd. Priya Nayar — Chief Compliance Officer, Dunmore Energy Holdings Ltd. Callum Renshaw — Chief Executive Officer, Dunmore Energy Holdings Ltd. Sandra Whitfield — Chief Financial Officer, Dunmore Energy Holdings Ltd. Board of Directors, Dunmore Energy Holdings Ltd.
Right-click to update Table of Contents
I. Executive Summary
This policy establishes the Enhanced Sanctions & Export Controls Compliance Program (the "Enhanced Program" or the "Program") for Dunmore Energy Holdings Ltd. ("Dunmore" or "DEH"), a Cayman Islands–domiciled exempted company with limited liability (Company Registration No. MC-334821), and all of its global subsidiaries, affiliates, joint ventures, and controlled entities (collectively, the "Dunmore Group").
The Enhanced Program is developed in direct response to a U.S. Department of Justice ("DOJ") National Security Division inquiry opened on April 19, 2022, concerning potential violations of U.S. sanctions laws — including programs administered by the Office of Foreign Assets Control ("OFAC") of the U.S. Department of the Treasury — and U.S. export control regulations. The inquiry centered on the activities of Dunmore Trading International Ltd. ("DTI"), the company's Dubai-based commodities trading subsidiary (DIFC License No. CL-4827), and specifically the conduct of certain DTI personnel in connection with transactions involving counterparties with ties to sanctioned Russian entities.
Upon becoming effective, the Enhanced Program shall supersede and replace all prior sanctions and export controls compliance policies, procedures, and guidance documents across all Dunmore Group entities. All prior policies, including the Dunmore Group Trade Compliance Manual (Version 3.2, dated January 15, 2020) and the DTI Sanctions Screening Procedures (Version 1.0, undated), are hereby withdrawn and replaced in their entirety.
The Enhanced Program is designed to meet or exceed the compliance standards set forth in the following U.S. government guidance documents and enforcement frameworks:
• The DOJ Evaluation of Corporate Compliance Programs (updated March 2023);
• The DOJ Corporate Enforcement Policy (updated September 2022);
• OFAC's Framework for Compliance Commitments (May 2019); and
• OFAC's Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, Appendix A).
The Enhanced Program addresses specific and systemic deficiencies identified during the internal investigation conducted by Calderwood & Harkness LLP (retained as outside counsel on April 14, 2022), with the support of Pemberton Investors Solutions LLC (retained as compliance advisory consultant on December 15, 2022) and Ridgeline Advisory Group LLC (retained as forensic accountants on May 2, 2022). Those deficiencies are summarized in Section II of this policy and are described in greater detail in the privileged assessment memorandum dated November 15, 2022, prepared by Conrad Reeves and Jasmine Thornton of Calderwood & Harkness LLP, and in the remediation report delivered by Pemberton Investors Solutions LLC on September 15, 2023.
This draft is submitted for review by the Board of Directors of Dunmore Energy Holdings Ltd. in advance of formal adoption. Formal adoption is anticipated on or about October 1, 2023, at which time the Enhanced Program shall become binding on all Covered Entities and Covered Persons as defined herein.
II. Background: The Internal Investigation and Identified Deficiencies
This Section provides a summary of the factual background and compliance deficiencies that gave rise to the development of this Enhanced Program. This summary is included to provide the Board of Directors with the necessary context for understanding the scope and requirements of the Enhanced Program and the rationale for each of its components. All information set forth in this Section is derived from the internal investigation and is subject to the attorney-client privilege and work product protections described in the Confidentiality Legend on the cover page of this policy.
II.A. Summary of Conduct at Issue
Between approximately March 2020 and April 2022, DTI's Dubai-based trading desk engaged in a series of transactions that are the subject of the DOJ and OFAC inquiries. The relevant transactions were conducted under the supervision of Derek Hargrave, then serving as President of DTI, and with the direct involvement of Natasha Sorokin, who served as a Senior Trader at DTI during the relevant period.
The internal investigation determined that certain transactions conducted by the DTI trading desk involved counterparties with undisclosed ties to Volkhov Industrial Group JSC ("Volkhov" or "VIG"), a Russian industrial conglomerate with operations in the energy, metals, and logistics sectors. Volkhov was initially made subject to OFAC Directive 2 sectoral sanctions on November 15, 2019, pursuant to Executive Order 13662 (relating to the Russian financial services, energy, and defense sectors). Volkhov was subsequently designated as a Specially Designated National ("SDN") and placed on the OFAC SDN List on April 6, 2022, pursuant to Executive Order 14024, resulting in full blocking sanctions.
The internal investigation, including the forensic accounting analysis conducted by Ridgeline Advisory Group LLC (Engagement No. RAG-2022-0319; lead investigator: Dr. Margaret Liu, CPA, CFE), identified three categories of problematic conduct:
1. Crude Oil Swap Transactions
The DTI trading desk executed fourteen (14) crude oil swap transactions totaling approximately $218.7 million in notional value with two counterparties: Petronova Trading FZE (managed by Sergei Volkov; registered in the Jebel Ali Free Zone, United Arab Emirates) and Zenith Petroleum DMCC (managed by Farhan Qureshi; registered in Dubai, United Arab Emirates). Forensic analysis by Ridgeline Advisory Group determined that nine (9) of the fourteen (14) transactions, representing approximately $156.3 million in notional value, involved crude oil that was sourced from or destined for entities controlled, directly or indirectly, by Volkhov Industrial Group JSC or its affiliates. The remaining five (5) transactions, representing approximately $62.4 million in notional value, involved counterparties whose connection to Volkhov was not definitively established but whose beneficial ownership structures remain opaque.
The investigation further determined that Petronova Trading FZE was incorporated in the Jebel Ali Free Zone on February 12, 2020, approximately one month before the first crude oil swap transaction at issue, and that Sergei Volkov, the managing director of Petronova, had previously served as a logistics coordinator for Volkhov's subsidiary, Volkhov Petroleum LLC, from 2015 to 2019. This connection was not identified during DTI's initial counterparty onboarding process.
2. Oilfield Equipment Exports
DTI, in coordination with Dunmore upstream Americas LLC, arranged for the export of oilfield drilling equipment and components with an aggregate value of approximately $12.4 million. The equipment and components were classified under Export Control Classification Numbers ("ECCNs") 2B350 (chemical/biological equipment with potential dual-use applications) and 2B999 (items controlled for anti-terrorism and Russia/Belarus-related reasons) under the U.S. Export Administration Regulations ("EAR"). These items were shipped to end users in the Russian Federation via Caspian Logistik GmbH, a freight forwarding and logistics company managed by Klaus Weidemann and registered in Hamburg, Germany.
The investigation determined that the end-user certifications obtained in connection with these shipments contained false statements regarding the ultimate end users of the equipment. Specifically, the end-user certifications identified the end users as entities located in Turkey and Kazakhstan, whereas the equipment was ultimately delivered to oilfield operations in the Russian Federation controlled by or affiliated with Volkhov Industrial Group JSC. The investigation was unable to determine conclusively whether DTI personnel knew or should have known that the end-user certifications were false, although the investigation identified multiple red flags that, had proper procedures been in place, should have prompted further inquiry.
3. Payment Structuring
Ridgeline Advisory Group's forensic accounting analysis identified a total of $34.2 million in payments across 127 individual transactions that were routed through intermediary accounts maintained at Crescent Commercial Bank PJSC in Dubai, United Arab Emirates. The payment patterns identified during the investigation were consistent with deliberate structuring designed to obscure the beneficial ownership of the ultimate recipients and to evade transaction-level sanctions screening. In particular, payments were split across multiple accounts, denominated in multiple currencies, and routed through several intermediary entities — none of which had a clear independent business purpose — before ultimately reaching accounts associated with Volkhov-connected entities.
II.B. Deficiencies in Pre-Existing Compliance Program
In connection with the internal investigation, Calderwood & Harkness LLP conducted a comprehensive assessment of Dunmore's pre-existing sanctions and export controls compliance program. The findings of that assessment are set forth in detail in the privileged memorandum dated November 15, 2022, prepared by Conrad Reeves and Jasmine Thornton of Calderwood & Harkness LLP. The remediation report delivered by Pemberton Investors Solutions LLC on September 15, 2023, further elaborated on these findings and provided specific recommendations for the Enhanced Program. The key deficiencies identified are summarized below:
Inadequate OFAC Screening Protocols. Under the pre-existing compliance program, sanctions screening of counterparties was conducted only at the time of initial counterparty onboarding and was not performed on a recurring or transaction-level basis. The screening system was not configured to perform automated re-screening upon updates to the OFAC SDN List, Sectoral Sanctions Identifications ("SSI") List, or any other restricted party list. As a result, Volkhov's April 2022 SDN designation did not trigger re-screening of existing counterparties, and the connections between DTI's counterparties and Volkhov were not identified through the screening process.
No Systematic Export Control Classification Procedure. The pre-existing program did not include a systematic procedure for classifying goods and technology under the EAR or other applicable export control regimes prior to export. Classification decisions, to the extent they were made, were performed on an ad hoc basis by operations personnel without compliance oversight or formal documentation.
Insufficient Counterparty and Third-Party Due Diligence. The pre-existing KYC procedures did not require verification of the beneficial ownership of counterparties, intermediaries, or end users. There was no assessment of the sanctions risk associated with intermediary relationships, and no procedures for evaluating whether counterparties were acting as fronts or conduits for sanctioned persons or entities.
Lack of Escalation Mechanisms. Red flags identified by trading desk personnel were not required to be escalated to the compliance or legal functions. The pre-existing program did not include a formal escalation protocol, and there was no mechanism for suspending or blocking transactions pending compliance review.
Inadequate Training. No sanctions- or export-controls-specific training was provided to DTI trading desk or logistics personnel. General compliance training provided to DTI employees did not address OFAC sanctions programs, EAR requirements, or red flag identification.
Insufficient CCO Authority and Resources. The former Chief Compliance Officer, Gerald Fisk, lacked the authority and resources necessary to implement and enforce an effective compliance program. Mr. Fisk did not have independent authority to block or escalate transactions, did not have a direct reporting line to the Board of Directors, and operated with a compliance budget that was subject to business unit approval and constraints.
No Transaction Monitoring or Post-Trade Surveillance. The pre-existing program did not include any automated or manual transaction monitoring or post-trade surveillance capability for sanctions compliance purposes. There was no systematic review of completed transactions to identify sanctions compliance risk indicators.
II.C. Personnel Actions
In response to the findings of the internal investigation, Dunmore took the following personnel actions with respect to the individuals most directly involved in the conduct at issue:
Derek Hargrave (then-President, DTI): Placed on administrative leave effective July 1, 2022. Separated from the company effective October 1, 2022. Mr. Hargrave retained personal legal counsel, James Overstreet of Overstreet & McClain PLLC, Dallas, Texas.
Natasha Sorokin (then-Senior Trader, DTI): Placed on administrative leave effective May 16, 2022. Separated from the company effective September 15, 2022. Ms. Sorokin retained personal legal counsel, Philip Keane of Wexford Keane LLP, Washington, D.C.
Gerald Fisk (then-Chief Compliance Officer, DEH): Departed the company effective June 10, 2022. Mr. Fisk retained personal legal counsel, Catherine Blackthorn of Blackthorn & Associates LLP, Houston, Texas. The circumstances of Mr. Fisk's departure were documented in the internal investigation file.
Priya Nayar was appointed as the new Chief Compliance Officer of Dunmore Energy Holdings Ltd. effective August 1, 2022, following a comprehensive search process. Ms. Nayar's qualifications and the circumstances of her appointment are described further in Section IV.B below.
III. Scope and Applicability
III.A. Covered Entities
This Policy applies to Dunmore Energy Holdings Ltd. and all of its global subsidiaries, affiliates, joint ventures, partnerships, and any other entity in which Dunmore holds a fifty percent (50%) or greater direct or indirect equity interest (each, a "Covered Entity" and collectively, the "Covered Entities"). The registered office of Dunmore Energy Holdings Ltd. is located at Harbour Place, 4th Floor, 103 South Church Street, George Town, Grand Cayman KY1-1002, Cayman Islands. The company's principal operational headquarters are located at 1200 McKinney Street, Suite 3400, Houston, Texas 77010.
The Covered Entities include, without limitation, the following wholly-owned and majority-owned subsidiaries:
1. Dunmore Trading International Ltd. — The company's Dubai-based commodities trading subsidiary, registered in the Dubai International Financial Centre. Principal office: Level 14, Gate Building 3, DIFC, P.O. Box 506774, Dubai, United Arab Emirates. DIFC License No. CL-4827.
2. Dunmore upstream Americas LLC — The company's U.S.-based upstream oil and gas operating subsidiary. Principal office: 1200 McKinney Street, Suite 3400, Houston, Texas 77010. Registered agent for service of process: 1209 Orange Street, Wilmington, Delaware 19801. Employer Identification Number (EIN): 84-2937561.
3. Dunmore Renewables GmbH — The company's German-based renewables and energy transition subsidiary. Principal office: Überseeallee 12, 20457 Hamburg, Germany. Registered in the Hamburg Commercial Register.
4. Dunmore Exploration West Africa Ltd. — The company's Nigerian-based exploration and production subsidiary. Principal office: 14B Kofo Abayomi Street, Victoria Island, Lagos, Nigeria.
In addition, this Policy applies to all joint ventures, partnerships, and any other entity in which Dunmore holds a fifty percent (50%) or greater equity interest, whether directly or indirectly, regardless of whether such entity is listed above. For entities in which Dunmore holds less than a fifty percent (50%) equity interest, Dunmore shall use commercially reasonable efforts to cause such entities to adopt sanctions and export controls compliance programs materially consistent with this Policy.
III.B. Covered Persons
This Policy applies to all directors, officers, and employees of each Covered Entity, regardless of nationality, citizenship, or geographic location (each, a "Covered Person" and collectively, "Covered Persons"). The obligations set forth in this Policy apply with equal force to personnel based in the United States, the United Arab Emirates, Germany, Nigeria, the Cayman Islands, and any other jurisdiction in which a Covered Entity operates or conducts business.
In addition, this Policy applies to all contractors, consultants, agents, representatives, and other third parties acting on behalf of, or for the benefit of, any Covered Entity. All such third parties must be informed of, and must agree in writing to comply with, the sanctions and export controls compliance requirements set forth in this Policy as a condition of their engagement.
Particular emphasis is placed on ensuring full compliance by personnel in the following functions at DTI (Dubai), which were identified during the internal investigation as areas of heightened risk: (a) commodity trading, including all trading desk personnel; (b) logistics and shipping; (c) finance and treasury; and (d) compliance and legal.
III.C. Covered Activities
This Policy applies to all business activities conducted by or on behalf of any Covered Entity, including without limitation:
• All transactions involving the purchase, sale, swap, exchange, brokering, or other dealing in commodities, including crude oil, refined petroleum products, natural gas, liquefied natural gas, oilfield equipment, drilling components, and all related goods and services;
• All exports, re-exports, and in-country transfers of goods, technology, technical data, and software, whether tangible or intangible;
• All financial transactions, including wire transfers, electronic funds transfers, payments, receipts, letters of credit, documentary collections, trade finance instruments, guarantees, and any other form of monetary transfer or credit arrangement;
• All counterparty and intermediary relationships, including relationships with trading counterparties, brokers, agents, freight forwarders, shipping companies, insurance providers, financial institutions, and any other third party involved in or facilitating the activities described above; and
• All due diligence, screening, classification, and recordkeeping activities related to the foregoing.
No Covered Entity or Covered Person may engage in any Covered Activity in a manner that violates applicable sanctions laws or export control regulations, regardless of whether such activity is conducted directly or through intermediaries, agents, or other third parties.
IV. Governance and Organizational Structure
IV.A. Board of Directors Oversight
The Board of Directors of Dunmore Energy Holdings Ltd. bears the ultimate oversight responsibility for the Enhanced Sanctions & Export Controls Compliance Program. The Board recognizes that an effective compliance program requires sustained commitment and active engagement at the highest levels of corporate governance, and the Board is committed to providing the resources, authority, and support necessary for the Program to achieve its objectives.
The Board shall receive quarterly written reports from the Chief Compliance Officer on the status, effectiveness, and material developments of the compliance program. These reports shall include, at a minimum: (a) a summary of all sanctions screening alerts, escalations, and dispositions during the reporting period; (b) a summary of any potential or confirmed violations of this Policy; (c) the status of any ongoing regulatory inquiries or enforcement actions; (d) training completion rates across all Covered Entities; (e) a summary of any changes to applicable sanctions or export control regulations that affect Dunmore's operations; and (f) any recommendations for amendments or enhancements to this Policy.
Board approval shall be required for any material exception to, or waiver of, any provision of this Policy. For purposes of this Section, a "material exception" includes, but is not limited to, any decision to proceed with a transaction that has been flagged by the compliance function as presenting a significant sanctions or export controls risk and that cannot be resolved through the standard escalation procedures set forth in Section IX.
The Board shall conduct an annual comprehensive review of the compliance program's design, implementation, and effectiveness. The first such annual review shall be completed by October 1, 2024, on the first anniversary of the Policy's anticipated adoption. Subsequent annual reviews shall be completed no later than the anniversary of the prior year's review. The annual review shall be informed by the results of the independent compliance program assessment described in Section XII.B.
IV.B. Chief Compliance Officer
Priya Nayar serves as the Chief Compliance Officer ("CCO") of Dunmore Energy Holdings Ltd., having been appointed to that position effective August 1, 2022. Ms. Nayar was appointed following a comprehensive search process conducted with the assistance of an executive search firm and the input of outside counsel.
The CCO reports directly to the Chief Executive Officer, Callum Renshaw, for day-to-day operational matters and has a direct and independent reporting line to the Board of Directors for all matters relating to the compliance program (dual reporting). This dual reporting structure is designed to ensure that the CCO has unimpeded access to the Board and that compliance matters are not filtered or constrained by operational management.
The CCO has independent authority to block, suspend, or escalate any transaction that is suspected of violating this Policy or any applicable sanctions or export control law or regulation. This authority may be exercised at any stage of a transaction, including after a transaction has been initiated but before it has been completed or settled. No Covered Person may override the CCO's decision to block or suspend a transaction without the express approval of the Board of Directors.
The CCO has unrestricted access to all books, records, personnel, data, systems, and facilities of all Covered Entities. No Covered Person may deny or impede the CCO's access to any information or resource that the CCO deems necessary for the performance of her duties under this Policy.
The CCO is responsible for the following functions, which may be delegated in part to compliance personnel under the CCO's supervision, but for which the CCO retains ultimate accountability:
(a) Implementation and administration of all elements of the Enhanced Program;
(b) Development, delivery, and oversight of the mandatory training program described in Section XI;
(c) Oversight of all sanctions screening, counterparty due diligence, export classification, and transaction review and approval processes;
(d) Oversight of the transaction monitoring and post-trade surveillance program described in Section XII;
(e) Investigation of all potential violations of this Policy, in coordination with the General Counsel and outside counsel as appropriate;
(f) Determination, in consultation with the General Counsel and outside counsel, of whether voluntary self-disclosure to OFAC, BIS, or other regulatory authorities is warranted;
(g) Preparation and submission of all regulatory reports and filings required by this Policy or applicable law;
(h) Maintenance of all compliance records in accordance with Section X; and
(i) Quarterly and ad hoc reporting to the Board of Directors as described in Section IV.A.
The CCO shall have a dedicated annual compliance budget, the amount of which shall be set and approved by the Board of Directors. The compliance budget shall be independent of, and not subject to the control or approval of, any business unit or operational manager. The compliance budget shall be sufficient to fund all personnel, technology, training, advisory, and other resources necessary for the effective implementation and operation of the Enhanced Program.
The CCO may not be removed, terminated, or have her compensation reduced without the prior approval of the Board of Directors. This provision is intended to ensure the independence and integrity of the compliance function and to protect the CCO from retaliation or undue influence from business unit personnel.
IV.C. General Counsel
Marcus Wellbourne, General Counsel of Dunmore Energy Holdings Ltd., provides legal advice and support to the CCO and the compliance function on all matters relating to the Enhanced Program. The General Counsel's role includes, but is not limited to: (a) providing legal interpretation of applicable sanctions and export control laws and regulations; (b) advising the CCO on the legal implications of compliance decisions and escalations; (c) coordinating with outside counsel, specifically Calderwood & Harkness LLP, on all regulatory matters, government inquiries, and enforcement actions; and (d) overseeing the legal aspects of voluntary self-disclosures to OFAC, BIS, the DOJ, and other regulatory authorities.
The General Counsel and the CCO jointly oversee all voluntary self-disclosure processes. Decisions regarding whether and when to submit a voluntary self-disclosure to any regulatory authority shall be made jointly by the CCO and the General Counsel, in consultation with outside counsel, and shall be reported to the Board of Directors promptly.
IV.D. Compliance Function Staffing
The Enhanced Program requires dedicated compliance personnel at each of Dunmore's major operating locations. The compliance function shall be staffed as follows:
Houston, Texas (Operational Headquarters). The CCO and a dedicated compliance team shall be based at Dunmore's Houston headquarters. The Houston compliance team shall include, at a minimum, one sanctions compliance analyst and one export controls compliance specialist, in addition to the CCO.
Dubai, United Arab Emirates (DTI). Given the heightened risk profile associated with DTI's trading operations and the deficiencies identified during the internal investigation, a minimum of two (2) full-time sanctions compliance officers shall be permanently stationed at DTI's Dubai office. These compliance officers must possess demonstrated expertise in OFAC sanctions programs, EU sanctions and restrictive measures, and UAE sanctions and anti-money laundering regulations. At least one of the two Dubai-based compliance officers must have prior experience with commodity trading compliance.
Hamburg, Germany (Dunmore Renewables GmbH). At least one compliance officer or compliance-designated employee shall be assigned responsibility for sanctions and export controls compliance at the Hamburg office, with specific expertise in EU sanctions, the EU Dual-Use Regulation, and the German Foreign Trade and Payments Act (AWG) and Foreign Trade and Payments Ordinance (AWV).
Lagos, Nigeria (Dunmore Exploration West Africa Ltd.). At least one compliance officer or compliance-designated employee shall be assigned responsibility for sanctions compliance at the Lagos office, with appropriate training in OFAC and UN sanctions programs.
All compliance personnel shall report to the CCO, either directly or through a designated regional compliance lead, and shall have no conflicting business unit reporting obligations that could compromise their independence.
IV.E. Outside Advisors
Pemberton Investors Solutions LLC (Dr. Anton Bremer, Lead Consultant) has been engaged to provide ongoing advisory support to Dunmore during the implementation period for the Enhanced Program. The engagement shall continue through at least December 31, 2024, and may be extended upon mutual agreement and with Board approval as appropriate. Marlowe Asset Management's advisory responsibilities include assisting with the design and implementation of the Enhanced Program's key components, including screening protocols, due diligence procedures, training programs, and transaction monitoring systems.
In addition, Dunmore shall engage a qualified outside firm to conduct an annual independent assessment of the compliance program's design, implementation, and effectiveness, as described further in Section XII.B. The firm engaged to conduct the annual independent assessment shall be independent of the firm providing ongoing advisory support, unless the Board determines that a single firm may perform both functions without compromising the independence or integrity of the assessment.
Calderwood & Harkness LLP shall continue to serve as Dunmore's outside legal counsel for all matters relating to sanctions and export controls compliance, regulatory inquiries, and enforcement actions, under the direction of the General Counsel.
V. Sanctions Compliance Program
V.A. Applicable Sanctions Regimes
The Enhanced Program requires compliance with all applicable sanctions laws and regulations, regardless of the jurisdiction in which a particular Covered Entity is incorporated or operates. The principal sanctions regimes applicable to Dunmore's operations include, but are not limited to, the following:
United States Sanctions. All sanctions programs administered by OFAC, U.S. Department of the Treasury, including:
(a) Executive Order 14024 (April 15, 2021, as amended), which authorizes the imposition of blocking sanctions on persons determined to operate or have operated in specified sectors of the Russian Federation economy, and persons determined to be responsible for or complicit in actions that undermine the peace, security, stability, sovereignty, or territorial integrity of Ukraine;
(b) Executive Order 13662 and Directive 2 thereunder, which impose sectoral sanctions on entities operating in the Russian energy sector, including prohibitions on certain transactions involving new debt of longer than 90 days maturity or new equity of persons identified on the SSI List;
(c) The Russian Harmful Foreign Activities Sanctions Regulations, 31 C.F.R. Part 589, which implement Executive Order 14024 and related authorities;
(d) All other OFAC-administered sanctions programs, whether country-based (including programs relating to Iran, Syria, North Korea, Cuba, the Crimea region of Ukraine, and the so-called Donetsk People's Republic and Luhansk People's Republic regions of Ukraine) or list-based (including the SDN List, the SSI List, the Foreign Sanctions Evaders List, the Non-SDN Menu-Based Sanctions List, and other OFAC-maintained lists).
European Union Sanctions. All EU sanctions and restrictive measures, including those adopted by Council Regulation in response to the situation in Ukraine and Russia's actions destabilizing the situation in Ukraine.
United Kingdom Sanctions. All UK sanctions administered by the Office of Financial Sanctions Implementation ("OFSI") of HM Treasury, including the Russia (Sanctions) (EU Exit) Regulations 2019 (as amended).
United Arab Emirates Sanctions. All sanctions regulations issued by the UAE Central Bank, the Executive Office of the Committee for Goods and Materials Subject to Import and Export Control, and any other UAE governmental authority with sanctions enforcement authority.
United Nations Sanctions. All sanctions imposed by the United Nations Security Council and implemented through relevant national legislation in each jurisdiction where Dunmore operates.
Where multiple sanctions regimes apply to a particular transaction, counterparty, or activity, the most restrictive standard shall govern. In the event of any conflict or ambiguity between applicable sanctions regimes, the CCO shall consult with the General Counsel and outside counsel to determine the appropriate course of action.
V.B. OFAC Screening Protocols
Screening Tool. All sanctions screening shall be performed using automated, commercially licensed sanctions screening software that is integrated into the company's transaction management systems, counterparty onboarding systems, and payment processing systems. The screening software shall be capable of screening against all applicable restricted party lists identified in Appendix B to this Policy and shall employ fuzzy matching logic to identify potential matches notwithstanding variations in spelling, transliteration, or naming conventions. The CCO is responsible for selecting, implementing, and maintaining the screening software, and for ensuring that the software is updated to reflect changes in applicable restricted party lists on a timely basis.
Screening Points. Sanctions screening shall be conducted at the following points:
(a) At Counterparty Onboarding. All new counterparties, intermediaries, brokers, agents, freight forwarders, vessel owners, and other third parties shall be screened against all applicable restricted party lists as part of the Know-Your-Counterparty (KYC) onboarding process described in Section VII, before any transaction is initiated.
(b) At Transaction Initiation (Pre-Trade Screening). All parties to every commodity trade, equipment sale, financial transaction, and other Covered Activity shall be screened against all applicable restricted party lists before the transaction is executed, confirmed, or processed. Pre-trade screening applies to all counterparties, intermediaries, end users, consignees, vessels, and any other parties or assets involved in the transaction.
(c) Upon Restricted Party List Updates. The screening system shall be configured to perform automated re-screening of all active counterparties, intermediaries, vessels, and end users immediately upon any update to OFAC's SDN List, SSI List, the BIS Entity List, or any other applicable restricted party list. The CCO shall ensure that the screening system is configured to receive and process list updates within twenty-four (24) hours of publication by the relevant regulatory authority.
(d) Daily Automated Re-Screening. In addition to event-driven re-screening triggered by list updates, the screening system shall perform automated daily re-screening of all active counterparties, intermediaries, vessels, and end users against all applicable restricted party lists.
(e) Annual Comprehensive Re-Screening. The compliance function shall conduct an annual comprehensive re-screening of all counterparty databases, including dormant and inactive counterparties, to ensure the integrity and completeness of the screening process.
Screening Scope. Each screening event must cover, at a minimum, the following data points for each screened party:
(a) Entity legal name and all known aliases, trade names, and former names;
(b) Names of all directors, officers, senior managers, and authorized signatories;
(c) Names and identifying information of all beneficial owners, applying the OFAC 50% Rule (as defined in Section XVIII);
(d) Registered address, principal place of business, and all other known addresses;
(e) Vessel names, International Maritime Organization ("IMO") numbers, and flag state (for all transactions involving maritime shipping); and
(f) Any other identifiers reasonably available to the compliance function, including tax identification numbers, registration numbers, and government-issued identification numbers.
OFAC 50% Rule Application
Consistent with OFAC guidance, any entity that is owned fifty percent (50%) or more, directly or indirectly, by one or more persons identified on the SDN List shall be treated as a blocked person, regardless of whether such entity is itself separately listed on the SDN List. The screening process must trace ultimate beneficial ownership to the level of natural persons in order to identify entities that are blocked by operation of the 50% Rule. Where beneficial ownership information is unavailable or incomplete, the transaction shall be treated as presenting elevated risk and shall be subject to the Enhanced Due Diligence procedures described in Section VII.B.
Alert Management. All screening alerts generated by the screening system shall be reviewed by a qualified compliance officer within twenty-four (24) hours of generation. The reviewing compliance officer shall document the results of the review, including the basis for any determination that an alert is a false positive.
Any alert that cannot be resolved as a false positive within twenty-four (24) hours shall be escalated to the CCO within forty-eight (48) hours of the initial alert. No transaction may proceed while a potential match is under review or pending escalation. The CCO shall have sole authority to clear a potential match and authorize the transaction to proceed, or to block the transaction and initiate further investigation.
All alert management decisions shall be documented in the compliance records, including the identity of the reviewing compliance officer, the date and time of review, the disposition of the alert, and the rationale for the disposition.
V.C. Transaction Review and Approval
Pre-Approval Requirement. All commodity trading transactions, equipment sales, and other commercial transactions with counterparties that are domiciled in, or that have significant operations in, jurisdictions subject to comprehensive or sectoral sanctions — including, but not limited to, the Russian Federation, the Republic of Belarus, the Islamic Republic of Iran, the Syrian Arab Republic, the Democratic People's Republic of Korea (North Korea), the Republic of Cuba, and the Crimea, Donetsk, and Luhansk regions of Ukraine — shall require prior written approval from the CCO before the transaction may be executed.
This pre-approval requirement applies regardless of the nature or size of the transaction and regardless of whether the counterparty has previously been approved under the KYC onboarding process. The purpose of the pre-approval requirement is to ensure that the CCO has the opportunity to conduct a contemporaneous assessment of the sanctions risk associated with each such transaction, taking into account the most current information available.
Enhanced Due Diligence Triggers
In addition to the pre-approval requirement described above, transactions presenting any of the following characteristics shall be subject to Enhanced Due Diligence ("EDD") by the compliance function before the transaction may proceed:
(a) Transactions involving counterparties organized or domiciled in free trade zones or free zones, including but not limited to the Jebel Ali Free Zone, the Dubai Multi Commodities Centre (DMCC), and similar free zone jurisdictions in the UAE and elsewhere;
(b) Transactions involving intermediaries, brokers, or agents, including transactions in which the ultimate buyer or seller is not a direct counterparty to Dunmore;
(c) Transactions involving counterparties with less than two (2) years of operating history from the date of incorporation or registration;
(d) Transactions involving crude oil or refined petroleum products of Russian origin or that are sourced from or destined for the Russian Federation, Belarus, or any other comprehensively sanctioned jurisdiction;
(e) Transactions involving oilfield equipment, drilling components, or other items that are potentially classified under controlled ECCNs under the EAR or controlled under any other applicable export control regime; and
(f) Any other transaction that the CCO, in her sole discretion, determines presents an elevated sanctions or export controls risk.
Approval Documentation. All transaction review and approval decisions shall be fully documented. The documentation shall include, at a minimum: (a) a description of the transaction, including all parties, the type and value of goods or services, and the relevant jurisdictions; (b) the results of all sanctions screening and due diligence conducted in connection with the transaction; (c) the CCO's written approval or denial, including the date of the decision and the rationale; and (d) any conditions attached to the approval. All approval documentation shall be retained for a minimum of seven (7) years from the date of the transaction.
V.D. Blocked and Rejected Transactions
Blocking Procedures. In the event that any Covered Entity identifies a transaction that involves an SDN-listed person or a person otherwise subject to full blocking sanctions, the transaction shall be immediately blocked in accordance with OFAC's requirements under 31 C.F.R. § 501.603. Property that is blocked shall be segregated and held in a blocked account, and no further action shall be taken with respect to the property without authorization from OFAC. Blocked property must be reported to OFAC within ten (10) business days of the date of blocking, using OFAC's prescribed reporting form.
Rejected Transactions. Transactions that are prohibited but do not involve blocked property — such as transactions involving persons subject to sectoral sanctions under Directive 2 of Executive Order 13662, where the transaction falls within the scope of the applicable prohibitions — shall be rejected. Rejected transactions shall be documented and reported internally to the CCO within twenty-four (24) hours of rejection. The CCO shall determine, in consultation with the General Counsel, whether the rejected transaction requires reporting to OFAC or any other regulatory authority.
V.E. OFAC Voluntary Self-Disclosure Procedures
On June 1, 2023, Dunmore submitted a voluntary self-disclosure to OFAC in connection with the potential sanctions violations identified during the internal investigation. The voluntary self-disclosure was prepared by Calderwood & Harkness LLP and filed with OFAC's Enforcement Division.
As a matter of policy, any potential sanctions violation discovered by any employee, contractor, or member of the compliance function of any Covered Entity shall be escalated to the CCO and the General Counsel within twenty-four (24) hours of discovery. Upon receipt of such a report, the CCO and the General Counsel shall promptly evaluate whether the potential violation constitutes an apparent violation of OFAC-administered sanctions and whether a voluntary self-disclosure to OFAC is warranted, in consultation with outside counsel (Calderwood & Harkness LLP).
It is the policy of Dunmore Energy Holdings Ltd. that timely voluntary self-disclosure of apparent violations to OFAC is strongly favored. OFAC's Economic Sanctions Enforcement Guidelines treat voluntary self-disclosure as a significant mitigating factor in the determination of enforcement outcomes, and the DOJ Corporate Enforcement Policy similarly provides substantial benefits for companies that voluntarily self-disclose misconduct. Absent extraordinary circumstances, the CCO and General Counsel shall recommend voluntary self-disclosure to OFAC for any apparent violation that is not clearly de minimis.
VI. Export Controls Compliance Program
VI.A. Applicable Export Control Regimes
The Enhanced Program requires compliance with all applicable export control laws and regulations in each jurisdiction where Dunmore operates or conducts business. The principal export control regimes applicable to Dunmore's operations include the following:
U.S. Export Administration Regulations (EAR). The EAR, codified at 15 C.F.R. Parts 730–774, administered by the Bureau of Industry and Security ("BIS") of the U.S. Department of Commerce. The EAR regulate the export, re-export, and transfer (in-country) of items that are subject to U.S. export jurisdiction. Items of particular relevance to Dunmore's operations include those classified under the following ECCNs:
(a) ECCN 2B350 — Equipment that may be used in the production of chemical weapons precursors and certain biological agents, and related equipment, including certain chemical processing equipment that has dual-use applications in the oilfield services sector;
(b) ECCN 2B999 — Specific processing equipment and components controlled for anti-terrorism reasons and, since February 2022, for Russia/Belarus-related foreign policy reasons;
(c) EAR §746.5 — Russia/Belarus sanctions provisions, which impose enhanced license requirements and restrictions on exports, re-exports, and transfers to Russia and Belarus of a wide range of items subject to the EAR.
International Traffic in Arms Regulations (ITAR). The ITAR, codified at 22 C.F.R. Parts 120–130, administered by the Directorate of Defense Trade Controls ("DDTC") of the U.S. Department of State. While the majority of Dunmore's operations do not involve ITAR-controlled defense articles or defense services, the Enhanced Program includes procedures to identify any items or activities that may be subject to ITAR jurisdiction and to ensure compliance with ITAR requirements in such cases.
EU Dual-Use Regulation. Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 (as amended), which establishes an EU regime for the control of exports, brokering, technical assistance, transit, and transfer of dual-use items. This regulation is applicable to the operations of Dunmore Renewables GmbH in Hamburg, Germany.
German Foreign Trade and Payments Act (AWG) and Foreign Trade and Payments Ordinance (AWV). German national export control legislation, which supplements and implements EU export control regulations and imposes additional German-specific restrictions. These requirements are directly applicable to Dunmore Renewables GmbH.
UAE Export Control Regulations. Regulations issued by the UAE Federal Authority for Nuclear Regulation and other relevant UAE governmental authorities governing the export of controlled goods and technology from the UAE. These requirements are applicable to DTI's operations in Dubai.
VI.B. Export Classification Procedures
All goods, technology, technical data, and software exported, re-exported, or transferred by any Dunmore entity must be classified under all applicable export control regimes before any export, re-export, or transfer takes place. The failure to properly classify items prior to export was identified during the internal investigation as a significant compliance deficiency, and the Enhanced Program implements the following procedures to address this deficiency:
Classification Requirement. For each item to be exported, re-exported, or transferred, the compliance function shall determine: (a) the applicable Export Control Classification Number (ECCN) under the EAR Commerce Control List (Supplement No. 1 to Part 774); (b) whether the item is controlled under the EU dual-use list or any other applicable export control list; and (c) whether any license, license exception, or other authorization is required for the proposed export, re-export, or transfer, taking into account the destination country, the end user, and the end use.
Classification Methodology. Classification shall be performed by trained compliance personnel with appropriate technical knowledge of the items being classified. Where the compliance personnel lack the technical expertise necessary to make a classification determination, they shall obtain technical input from the engineering, operations, or product management functions of the relevant Covered Entity. In cases of doubt or ambiguity, the compliance function shall seek a formal commodity classification from BIS or the relevant regulatory authority, or shall consult with outside counsel.
Classification Records. A written classification determination shall be prepared for each item or category of items, documenting the ECCN assigned (or, where the item is designated as EAR99, the basis for that determination), the applicable export control regime(s), any license or license exception relied upon, and the identity of the compliance officer and any technical personnel who contributed to the determination. Classification records shall be retained for a minimum of seven (7) years from the date of the most recent export, re-export, or transfer of the classified item, or longer if required by applicable law.
Annual Classification Audit. The CCO, or an outside compliance advisor designated by the CCO, shall conduct an annual audit of classification accuracy. The audit shall include a representative sample of classification determinations made during the prior year and shall assess whether the classifications were accurate, complete, and properly documented. The results of the annual classification audit shall be reported to the CCO and included in the CCO's quarterly report to the Board.
VI.C. End-User and End-Use Screening
Screening Requirements. All exports, re-exports, and transfers of controlled items shall require verification of the identity of the end user and the intended end use of the item. The following screening and verification procedures shall apply:
Restricted Party Screening. All proposed end users, consignees, and other parties to the transaction shall be screened against the BIS Entity List, the Denied Persons List, the Unverified List, the OFAC SDN List, and all other applicable restricted party lists identified in Appendix B to this Policy. No export, re-export, or transfer shall proceed if any party to the transaction appears on a restricted party list, unless a specific license or authorization has been obtained from the relevant regulatory authority.
End-Use Certification. Written end-user certificates shall be obtained from the buyer, consignee, or end user for all exports, re-exports, and transfers of controlled items. End-user certificates shall include, at a minimum: (a) the identity and address of the end user; (b) a description of the items to be received; (c) a statement of the intended end use; (d) a representation that the items will not be re-exported, diverted, or transferred to any unauthorized party, destination, or end use; and (e) the signature of an authorized representative of the end user.
Red Flag Review of End-Use Certifications. All end-use certificates shall be reviewed by compliance personnel for red flags, including but not limited to: (a) a stated end use that is inconsistent with the nature of the items or the end user's known business activities; (b) a proposed transshipment route through high-risk or sanctioned jurisdictions; (c) the involvement of intermediaries, freight forwarders, or logistics companies domiciled in sanctioned jurisdictions or with ties to sanctioned persons; and (d) the refusal of the end user to provide a signed end-use certificate or to include anti-diversion representations.
Independent Verification of End-Use Certifications
The internal investigation identified a critical deficiency in the handling of end-user certifications in connection with the Caspian Logistik GmbH shipments: the end-user certifications provided by Caspian Logistik were not independently verified, and false end-user statements were not detected prior to shipment. To address this deficiency, the Enhanced Program requires independent verification of end-user certifications for all shipments meeting either of the following criteria:
(a) Shipments with a value exceeding $100,000; or
(b) Shipments involving items classified under controlled ECCNs under the EAR or controlled under any other applicable export control regime.
Independent verification may include, but is not limited to: (a) direct communication with the stated end user to confirm the order, the end use, and the delivery address; (b) review of publicly available information regarding the end user's business activities and physical facilities; (c) engagement of an external due diligence provider to conduct an independent background investigation of the end user; or (d) coordination with the relevant regulatory authority to confirm the bona fides of the end user, where appropriate.
VI.D. Deemed Exports and Technology Transfers
The Enhanced Program includes procedures for controlling deemed exports — that is, the release of controlled technology, technical data, or source code to foreign nationals within the United States or at any Dunmore facility worldwide, which is treated as an export to the foreign national's most recent country of citizenship or permanent residency under the EAR (15 C.F.R. §734.13) and the ITAR (22 C.F.R. §120.54).
Each Covered Entity with operations involving controlled technology shall develop and maintain a Technology Control Plan ("TCP") for its operating location(s). The TCP shall identify: (a) all controlled technology present at the facility; (b) all foreign national employees, contractors, and visitors who may have access to controlled technology; (c) the countries of citizenship and permanent residency of all such foreign nationals; (d) the applicable export control restrictions for each combination of controlled technology and foreign national; and (e) the access controls, physical security measures, and information security measures in place to prevent unauthorized release of controlled technology.
TCPs shall be reviewed and updated by the compliance function at least annually, and whenever there is a material change in the controlled technology present at a facility or in the foreign national personnel with access to such technology.
VI.E. Recordkeeping
All export-related documents shall be retained for a minimum of seven (7) years from the date of export, re-export, or transfer, or longer if required by applicable law or regulation. Documents subject to this retention requirement include, without limitation: classification determinations, license applications, granted licenses and license exceptions, end-user certificates, shipping documents (including bills of lading, airway bills, and commercial invoices), compliance approvals, export control screening results, and Technology Control Plans.
All export-related records shall be maintained in the centralized digital repository described in Section X, and shall be accessible to the CCO, the General Counsel, and designated compliance personnel at all times.
VII. Counterparty and Third-Party Due Diligence
VII.A. Know-Your-Counterparty (KYC) Program
All new counterparties, intermediaries, brokers, agents, freight forwarders, and other third parties with whom any Covered Entity proposes to transact must undergo Know-Your-Counterparty ("KYC") due diligence before any transaction is initiated. No Covered Entity may enter into any commercial relationship or execute any transaction with a third party that has not been approved through the KYC process.