1016-00009 · Dunmore Energy Holdings · Remediation & Compliance

memo-compliance-benchmarking-doj-guidance.docx DOCUMENT Litigation

61 / 88 ← → ✕

MEMORANDUM

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

TO: Victoria Chambers, Responsible Partner Conrad Reeves, Senior Counsel, Export Controls & Sanctions

FROM: Jasmine Thornton, Lead Associate, White Collar & Investigations

DATE: September 1, 2023

RE: Compliance Program Benchmarking — Dunmore Energy Holdings Ltd. Enhanced Sanctions & Export Controls Compliance Program vs. DOJ Evaluation of Corporate Compliance Programs (March 2023 Update)

MATTER NO.: 1016-00009

CLIENT: Dunmore Energy Holdings Ltd.

Right-click to update Table of Contents

I. Executive Summary

The purpose of this memorandum is to benchmark the Enhanced Sanctions & Export Controls Compliance Program (the "Enhanced Program") of Dunmore Energy Holdings Ltd. ("Dunmore" or "DEH") against the U.S. Department of Justice's Evaluation of Corporate Compliance Programs, as updated in March 2023 (the "DOJ Guidance"), in anticipation of submitting the supplemental remediation report to the DOJ's National Security Division. This benchmarking analysis is intended to identify areas of alignment between the Enhanced Program and the DOJ Guidance, as well as any remaining gaps requiring further remediation before Calderwood & Harkness LLP ("Calderwood & Harkness" or the "Firm") submits the supplemental remediation report, currently targeted for January 15, 2024.

The Enhanced Program was developed in coordination with Pemberton Investors Solutions LLC ("Marlowe Asset Management"), under the leadership of engagement partner Dr. Anton Bremer, following the DOJ National Security Division inquiry opened on April 19, 2022. That inquiry concerns potential violations of U.S. sanctions laws, including programs administered by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"), and U.S. export control regulations administered by the Bureau of Industry and Security ("BIS") under the Export Administration Regulations ("EAR"). A grand jury subpoena, GJ No. 22-418, was issued by the U.S. District Court for the District of Columbia (Grand Jury 22-2). The lead prosecutor is AUSA Meredith Calloway of the DOJ National Security Division, Counterintelligence and Export Control Section.

Pemberton Investors Solutions delivered its remediation report and the Enhanced Program framework on September 15, 2023. The Dunmore Board of Directors (the "Board") is expected to formally adopt the Enhanced Program by resolution at its regularly scheduled meeting on October 1, 2023. Prior to that adoption, Calderwood & Harkness submitted the Firm's comprehensive 176-page internal investigation report to DOJ on May 15, 2023. Additionally, Dunmore filed a voluntary self-disclosure with OFAC on June 1, 2023, covering the transactions at issue.

Overall Assessment. The Enhanced Program substantially aligns with the DOJ Guidance across all three fundamental questions that prosecutors are instructed to evaluate. However, this benchmarking analysis has identified gaps in five specific areas requiring further remediation before the supplemental remediation report is submitted. These gaps, detailed in Section VII below, are remediable within the Q4 2023 / Q1 2024 timeframe and, once addressed, will position Dunmore's compliance infrastructure as consistent with best-in-class programs that the DOJ has recognized as supporting declination decisions under the DOJ Corporate Enforcement Policy.

It should be noted that the voluntary disgorgement payment of $8.75 million to the U.S. Treasury — representing estimated net profits from the nine tainted crude oil swap transactions ($156.3 million notional value multiplied by 5.6% net margin, as calculated by Ridgeline Advisory Group LLC in its forensic accounting report) — is expected to be made by November 30, 2023. This payment will be referenced in the supplemental remediation report as tangible evidence of Dunmore's commitment to accountability and its good-faith cooperation with the government's investigation.

II. Background

A. The DOJ Inquiry and Conduct at Issue

Dunmore Energy Holdings Ltd. is a Cayman Islands–domiciled company (Registration No. MC-334821) with its operational headquarters located at 1200 McKinney Street, Suite 3400, Houston, Texas 77010. Dunmore employs approximately 3,200 personnel globally across its various subsidiaries and affiliates, and reported fiscal year 2021 revenue of approximately $4.87 billion. Dunmore operates principally in the upstream exploration and production, midstream logistics, commodity trading, and renewable energy sectors.

The conduct giving rise to the DOJ inquiry was centered at the Dubai-based trading desk of Dunmore Trading International Ltd. ("DTI"), a wholly owned subsidiary of DEH incorporated in the Dubai International Financial Centre (DIFC License No. CL-4827), with offices at Level 14, Gate Building 3, DIFC, Dubai, United Arab Emirates. Between approximately March 2020 and April 2022, DTI personnel engaged in the following categories of conduct now under investigation:

Crude Oil Swap Transactions. DTI executed fourteen crude oil swap transactions with an aggregate notional value of approximately $218.7 million with two counterparties: Petronova Trading FZE (a Jebel Ali Free Zone entity managed by Sergei Volkov) and Zenith Petroleum DMCC (a DMCC-registered entity managed by Farhan Qureshi). The internal investigation conducted by Calderwood & Harkness determined that nine of the fourteen transactions, representing approximately $156.3 million in notional value, involved Volkhov Industrial Group JSC–connected entities. These nine transactions potentially violated OFAC Directive 2, which imposed sectoral sanctions on certain entities in the Russian energy sector pursuant to Executive Order 13662 (as applied to Volkhov effective November 15, 2019), and subsequently full blocking sanctions imposed on Volkhov under Executive Order 14024 (with Volkhov's designation to the Specially Designated Nationals and blocked Persons List ("SDN List") effective April 6, 2022).

Oilfield Equipment Exports. DTI, acting through its logistics function, facilitated the export of oilfield equipment valued at approximately $12.4 million to end users in the Russian Federation via Caspian Logistik GmbH, a Hamburg-based freight forwarding and logistics firm managed by Klaus Weidemann. The equipment was classified under Export Administration Regulations ("EAR") Export Control Classification Numbers ("ECCNs") 2B350 and 2B999, and the shipments potentially violated EAR §746.5 (Russia/Belarus sanctions-related export controls). The internal investigation identified falsified end-user certificates submitted by Caspian Logistik for at least three of these shipments.

Structured Payments. DTI processed approximately $34.2 million in payments across 127 individual transactions through Crescent Commercial Bank PJSC ("Crescent"), a Dubai-based commercial bank, between March 2020 and March 2022. The forensic accounting analysis conducted by Ridgeline Advisory Group LLC identified patterns consistent with structuring designed to avoid enhanced due diligence thresholds and to obscure the ultimate beneficiaries of payment flows. Crescent's relationship manager for the DTI account was Khalid Mansour.

Key Individuals. The following individuals have been identified as directly involved in or responsible for the conduct at issue:

• Derek Hargrave, former President of DTI, who oversaw the Dubai-based trading desk and approved the counterparty relationships with Petronova Trading FZE and Zenith Petroleum DMCC. Hargrave was separated from the company effective October 1, 2022.

• Natasha Sorokin, former Senior Trader at DTI, who directly executed the crude oil swap transactions at issue and maintained communications with Sergei Volkov and Farhan Qureshi. Sorokin was separated from the company effective September 15, 2022. A review of Sorokin's personal communications devices (documented in the September 10, 2022 memorandum by working associate Liam Donahue) revealed that she had used encrypted messaging applications to communicate with counterparty representatives outside of DTI's monitored communications systems.

• Gerald Fisk, former Chief Compliance Officer of Dunmore, who was responsible for sanctions screening and compliance oversight during the period of the conduct at issue. Fisk departed the company on June 10, 2022. The internal investigation determined that Fisk had failed to maintain real-time OFAC screening protocols, had not implemented beneficial ownership verification procedures for DTI counterparties, and had not escalated red flags identified by junior compliance staff.

The investigation and remediation efforts are being conducted under the leadership of CEO Callum Renshaw and General Counsel Marcus Wellbourne. Priya Nayar was appointed as Chief Compliance Officer on August 1, 2022, replacing Gerald Fisk, and has been instrumental in driving the development and implementation of the Enhanced Program.

B. The Enhanced Program

The Enhanced Sanctions & Export Controls Compliance Program was designed by Pemberton Investors Solutions LLC, under the direction of Dr. Anton Bremer, in close coordination with Calderwood & Harkness, and specifically with Conrad Reeves (Senior Counsel, Export Controls & Sanctions), who provided subject-matter expertise on OFAC regulatory requirements, EAR classification and licensing obligations, and industry best practices for energy commodity trading compliance.

The draft Enhanced Sanctions & Export Controls Compliance Policy was circulated for internal review on August 1, 2023. The Enhanced Program covers the following core areas: (i) OFAC screening protocols, including real-time and batch screening against the SDN List, Sectoral Sanctions Identifications List ("SSI List"), and other OFAC-maintained lists; (ii) export control classification procedures under the EAR, including self-classification workflows and license determination protocols; (iii) counterparty and third-party due diligence, including beneficial ownership verification and risk-tiering methodologies; (iv) escalation mechanisms for flagged transactions, including defined escalation paths from trading desk personnel to the CCO and General Counsel; (v) employee training, including role-specific curricula and annual recertification requirements; and (vi) ongoing monitoring and testing protocols.

Board adoption of the Enhanced Program is anticipated for October 1, 2023. CCO Priya Nayar has been authorized as the implementing officer, with responsibility for overseeing the rollout, training, and operationalization of all Enhanced Program components across all Dunmore entities.

C. The DOJ Evaluation of Corporate Compliance Programs (March 2023 Update)

The DOJ Guidance, most recently updated in March 2023, is the primary framework used by DOJ prosecutors to evaluate the effectiveness of a company's compliance program in the context of charging decisions, plea negotiations, and sentencing recommendations. The DOJ Guidance is organized around three fundamental questions that prosecutors are instructed to assess:

1. Is the corporation's compliance program well designed? This inquiry examines whether the company has conducted a tailored risk assessment, implemented appropriate policies and procedures, provided adequate training, established confidential reporting mechanisms, and maintained robust third-party management and M&A due diligence processes.

2. Is the program being applied earnestly and in good faith — that is, is it adequately resourced and empowered? This inquiry focuses on whether senior and middle management have demonstrated genuine commitment to compliance, whether the compliance function has sufficient autonomy and resources (including access to data and analytics), and whether the company has implemented appropriate incentive structures and disciplinary measures.

3. Does the corporation's compliance program work in practice? This inquiry evaluates whether the company engages in continuous improvement through periodic testing and review, whether misconduct investigations are properly scoped and conducted, and whether the company has undertaken meaningful analysis and remediation of the root causes of any underlying misconduct.

The March 2023 update to the DOJ Guidance introduced several areas of heightened emphasis that are particularly relevant to Dunmore's circumstances. First, the update places increased importance on a company's use of data and analytics in its compliance function, including real-time transaction monitoring and data-driven risk identification. Second, the update specifically addresses compensation structures and clawback provisions, directing prosecutors to evaluate whether a company's compensation program incentivizes compliance and whether the company has mechanisms to recoup compensation from employees whose conduct results in compliance violations. Third, the update reinforces the importance of personal accountability for compliance failures. Fourth, the update places heightened emphasis on the evaluation of third-party management programs, including the rigor of due diligence at onboarding and on an ongoing basis.

This benchmarking analysis should also be read in conjunction with the DOJ Corporate Enforcement Policy, updated in September 2022, which governs the criteria under which the DOJ may offer a declination to a company that has voluntarily self-disclosed misconduct, cooperated fully with the government's investigation, and undertaken timely and appropriate remediation. Calderwood & Harkness addressed the application of the Corporate Enforcement Policy factors to Dunmore's cooperation and remediation efforts in the white paper submitted to DOJ on March 1, 2023.

III. Methodology

This benchmarking analysis was conducted by Jasmine Thornton (Lead Associate, White Collar & Investigations), with substantive input from Conrad Reeves (Senior Counsel, Export Controls & Sanctions), who provided expert guidance on OFAC regulatory requirements, EAR classification and licensing obligations, and sanctions compliance best practices for energy trading operations, and from Pemberton Investors Solutions LLC (Dr. Anton Bremer), which provided insight into the design rationale and implementation plan for the Enhanced Program.

The analysis proceeded through the following steps:

Step 1: Baseline Assessment Review. We reviewed the pre-existing compliance program assessment set forth in the memorandum dated November 15, 2022, jointly prepared by Conrad Reeves and Jasmine Thornton. That memorandum identified significant deficiencies in Dunmore's pre-investigation compliance infrastructure, including: (i) inadequate and intermittent OFAC screening protocols that relied on manual, batch-style screening refreshes rather than real-time, automated screening; (ii) insufficient and generic training programs that were not tailored to the specific sanctions and export risks faced by DTI trading desk personnel; (iii) absence of defined escalation protocols for flagged transactions; and (iv) lack of any formalized third-party due diligence process, including the complete absence of beneficial ownership verification procedures for trading counterparties.

Step 2: Enhanced Program Document Review. We conducted a comprehensive review of the Enhanced Program design documents, including the draft Enhanced Sanctions & Export Controls Compliance Policy (circulated August 1, 2023), and compared each element of the Enhanced Program against the corresponding provisions of the DOJ Guidance. This element-by-element comparison forms the basis of the benchmarking analysis set forth in Sections IV through VI below.

Step 3: Integration of Investigation Findings. We incorporated findings from the following workstreams conducted during the course of the internal investigation:

• Forensic Accounting. The forensic accounting report delivered by Ridgeline Advisory Group LLC (Engagement No. RAG-2022-0319; engagement lead Dr. Margaret Liu) on April 1, 2023. The Ridgeline report traced the $34.2 million in payments through Crescent Commercial Bank PJSC, identified the structured payment patterns, and calculated the $8.75 million estimated net profits from the nine tainted transactions that forms the basis for the voluntary disgorgement.

• Document Review. The document review findings generated by Nexagen Analytics Inc. (Project No. NX-DEH-2204; project manager Brian Cavanaugh). Nexagen collected 2,347,812 documents from custodians and non-custodial data sources across Dunmore's systems, of which 438,916 were identified as responsive through a technology-assisted review ("TAR") protocol. Key responsive documents included internal communications evidencing awareness of sanctions risks, counterparty onboarding files, export classification worksheets, and trading desk records.

• Witness Interviews. Forty-seven witness interviews were conducted across three rounds (22 interviews in the first round, 15 in the second, and 10 in the third), utilizing the Calderwood & Harkness witness interview protocol and Upjohn warning framework established on April 18, 2022. Witnesses included current and former DTI personnel, compliance staff, finance and controllers, logistics coordinators, senior management, and Board members.

Step 4: Gap Analysis and Recommendations. Based on the foregoing review, we identified areas of alignment between the Enhanced Program and the DOJ Guidance, as well as remaining gaps requiring further remediation. For each identified gap, we have developed specific recommendations, assigned responsible parties, and established target completion dates designed to ensure all gaps are remediated before the supplemental remediation report is submitted to DOJ on January 15, 2024.

IV. Benchmarking Analysis: Fundamental Question One — Is the Compliance Program Well Designed?

The DOJ Guidance's first fundamental question asks whether the corporation's compliance program is well designed. This inquiry encompasses several sub-elements, including risk assessment, policies and procedures, training and communications, confidential reporting structures and investigation processes, third-party management, and mergers and acquisitions due diligence. We address each sub-element below.

A. Risk Assessment

1. DOJ Guidance Requirements. The DOJ Guidance directs prosecutors to evaluate whether the company has engaged in a risk assessment process tailored to its specific business operations, industry, and geographic footprint. The risk assessment should identify, assess, and define the nature and extent of the risks associated with the company's particular industry, products and services, geographic areas of operation, and the types of transactions and counterparties involved. Critically, the DOJ Guidance requires that the risk assessment be periodically updated, particularly in light of lessons learned from prior compliance incidents, to ensure that the compliance program continues to address the company's evolving risk profile. A static or outdated risk assessment will weigh against a finding that the compliance program is well designed.

2. Enhanced Program Alignment. The Enhanced Program includes a comprehensive sanctions and export controls risk assessment covering all Dunmore subsidiaries and operating entities. The risk assessment encompasses the following entities:

• Dunmore Trading International Ltd. ("DTI") — Dubai, DIFC (the entity at the center of the conduct at issue);

• Dunmore upstream Americas LLC — Houston, Texas (EIN 84-2937561), the upstream exploration and production subsidiary;

• Dunmore Renewables GmbH — Hamburg, Germany, the renewable energy subsidiary; and

• Dunmore Exploration West Africa Ltd. ("DEWA") — Lagos, Nigeria, the West Africa exploration subsidiary.

The risk assessment identifies the highest-risk areas within Dunmore's global operations. Consistent with the findings of the internal investigation, the assessment correctly identifies DTI's trading desk operations in Dubai as the highest-risk area, given the desk's direct involvement in commodity trading with counterparties in jurisdictions presenting elevated sanctions risk, including the United Arab Emirates (particularly free zone entities in Jebel Ali and the DMCC), the Russian Federation, and the Commonwealth of Independent States. The assessment further identifies commodity flows involving Russian-origin products, oilfield equipment with dual-use potential classified under ECCNs 2B350 and 2B999, and counterparty networks in the UAE and Germany as presenting significant sanctions and export risks.

The risk assessment has been updated to reflect the April 6, 2022 designation of Volkhov Industrial Group JSC to the SDN List under Executive Order 14024, as well as the rapidly evolving Russia/Belarus sanctions landscape, including the expanded export controls under EAR §746.5. The assessment also incorporates lessons learned directly from the internal investigation, including the failure to identify Petronova Trading FZE's beneficial ownership ties to Volkhov Industrial Group (a failure that was a direct proximate cause of the sanctions violations at issue) and the inadequate end-user verification procedures that allowed Caspian Logistik GmbH to submit falsified end-user certificates for oilfield equipment shipments destined for Russian end users.

This approach to risk assessment represents a marked improvement over the pre-investigation compliance infrastructure, which lacked any formal, documented risk assessment process tailored to sanctions and export risks.

3. Remaining Gaps. Notwithstanding the substantial improvements described above, two gaps in the risk assessment methodology have been identified:

Gap 1: Quantitative Risk Scoring. The current risk assessment methodology relies on qualitative assessments of risk (e.g., "high," "medium," "low") without employing a quantitative risk-scoring model that would assign numerical scores to specific risk factors and aggregate those scores to produce an overall risk rating for each business unit, product line, geographic area, and counterparty. Pemberton Investors Solutions has recommended the implementation of a tiered, quantitative risk-scoring model that weights factors such as jurisdictional risk, counterparty opacity, transaction volume, product classification, and historical compliance incidents. A quantitative approach would provide greater consistency and transparency in risk assessments and would facilitate trend analysis over time, consistent with the DOJ Guidance's emphasis on data-driven compliance.

Gap 2: Formalized Assessment Cadence. The Enhanced Program does not yet establish a formalized cadence for risk assessment updates. We recommend that the Enhanced Program require (i) an annual comprehensive risk assessment, encompassing all business units, subsidiaries, and geographic areas of operation, and (ii) quarterly risk indicator reviews, which would involve a targeted review of key risk indicators — including new sanctions designations, changes to EAR restrictions, counterparty screening results, and transaction volume trends — to determine whether interim updates to the comprehensive risk assessment are warranted.

B. Policies and Procedures

1. DOJ Guidance Requirements. The DOJ Guidance instructs prosecutors to evaluate whether the company's policies and procedures are clearly articulated, accessible to all relevant employees, and effectively integrated into the company's day-to-day operations. Policies should be designed to address the specific risks identified through the risk assessment process and should be written in a manner that is comprehensible to the employees who are expected to follow them. Generic, off-the-shelf policies that are not tailored to the company's actual risk profile will not satisfy the DOJ Guidance's requirements.

2. Enhanced Program Alignment. The draft Enhanced Sanctions & Export Controls Compliance Policy (circulated August 1, 2023) comprehensively addresses the key areas of sanctions and export controls risk identified in the risk assessment. The policy includes the following substantive components:

• Prohibited Transactions. Clear identification of the categories of transactions that are prohibited under applicable U.S. sanctions programs, including transactions involving SDN-listed entities, entities subject to sectoral sanctions under OFAC Directives 1 through 4, and entities appearing on the BIS Entity List or Denied Persons List.

• OFAC Screening Requirements. Detailed procedures for screening all counterparties, beneficial owners, intermediaries, and transaction parties against OFAC-maintained lists, including the SDN List, the SSI List, the Non-SDN Menu-Based Sanctions List, and the Foreign Sanctions Evaders List, as well as consolidated screening against BIS restricted party lists.

• Export Classification Under the EAR. Procedures for self-classification of products and technology under the EAR, including determination of applicable ECCNs, assessment of EAR99 status, and license determination protocols for items subject to EAR §746.5 Russia/Belarus controls.

• Counterparty Due Diligence. Requirements for risk-based due diligence on all counterparties, including collection and verification of beneficial ownership information, assessment of counterparty jurisdictional risk, and evaluation of counterparty compliance programs.

• Escalation Protocols. Defined escalation paths for any transaction flagged by OFAC screening, export classification review, or counterparty due diligence, including mandatory escalation to CCO Priya Nayar and, for transactions involving potential SDN or sectoral sanctions issues, further escalation to General Counsel Marcus Wellbourne.

• Recordkeeping. Requirements for maintaining complete records of all screening results, due diligence files, escalation decisions, export classification determinations, and transaction documentation, consistent with OFAC and BIS recordkeeping requirements.

The policy has been written in English and Arabic to ensure accessibility for Dubai-based employees at DTI. A German translation is planned for Dunmore Renewables GmbH staff in Hamburg and is expected to be completed before the training rollout. All versions of the policy will be accessible via Dunmore's compliance intranet portal, which is available to all employees across all Dunmore entities.

3. Remaining Gaps. Two gaps have been identified in the policies and procedures component of the Enhanced Program:

Gap 3: Encrypted and Informal Communications Channels. The Enhanced Program's policies do not yet include specific protocols for the handling and monitoring of encrypted or informal communications channels, such as Meridian Services Inc., Signal, Kestrel Data Systems, or personal email accounts. This gap is particularly significant in light of the findings from the Natasha Sorokin personal communications review, documented in the September 10, 2022 memorandum by working associate Liam Donahue. That review revealed that Sorokin used encrypted messaging applications — specifically, Meridian Services Inc. and Kestrel Data Systems — to communicate with counterparty representatives Sergei Volkov and Farhan Qureshi outside of DTI's monitored corporate communications systems, effectively circumventing the company's ability to capture and review those communications for compliance purposes. The Enhanced Program should include explicit prohibitions on the use of unapproved communications channels for business purposes, requirements for the preservation of all business-related communications regardless of the platform used, and monitoring protocols designed to detect and deter the use of unauthorized channels.

Gap 4: Winddown Procedures. The policies do not yet include specific guidance on the procedures to be followed when a counterparty is newly designated to the SDN List or another restricted party list during the pendency of an existing transaction or contractual relationship. Given the speed at which new designations can be issued — as illustrated by the April 6, 2022 SDN designation of Volkhov Industrial Group, which took effect immediately and required DTI to cease all transactions involving Volkhov-connected entities — the Enhanced Program should include detailed winddown procedures that specify the immediate steps to be taken upon learning of a new designation, including transaction suspension protocols, notification requirements, OFAC licensing considerations (including the availability of general licenses authorizing winddown activities), and escalation procedures.

C. Training and Communications

1. DOJ Guidance Requirements. The DOJ Guidance requires that training be risk-based, tailored to the specific roles and responsibilities of the employees receiving the training, and periodically updated to reflect changes in applicable laws, regulations, and company policies. Generic, one-size-fits-all training programs are insufficient. The DOJ Guidance also emphasizes the importance of communications from senior leadership reinforcing the company's commitment to compliance — commonly referred to as "tone from the top" — as a critical element of a well-designed compliance program.

2. Enhanced Program Alignment. Pemberton Investors Solutions has developed a comprehensive training program (outline dated November 1, 2023, reviewed and approved by Conrad Reeves) covering the following core topics: OFAC compliance fundamentals and program-specific requirements; EAR classification, licensing, and export control requirements; recognition of red flags indicative of potential sanctions evasion or export control violations; and escalation procedures under the Enhanced Program.

The training program is designed with role-specific modules tailored to the following employee categories: (i) traders and trading desk personnel, who receive the most intensive and detailed training given their direct involvement in transaction execution; (ii) logistics personnel, who receive training focused on export classification, end-user verification, and shipping documentation requirements; (iii) finance and controllers personnel, who receive training focused on payment screening, transaction monitoring, and structuring detection; (iv) management, who receive training on supervisory responsibilities, escalation obligations, and compliance culture; and (v) Board members, who receive a governance-focused overview of sanctions and export control compliance obligations and the Board's oversight responsibilities.

Annual recertification is required for all employees, with more frequent refresher training for high-risk roles. The training program includes testing and certification components to verify comprehension and retention.

With respect to tone from the top, CEO Callum Renshaw and CCO Priya Nayar are expected to issue a joint communication to all Dunmore employees upon the Board's formal adoption of the Enhanced Program, emphasizing the company's commitment to sanctions and export controls compliance, the consequences of non-compliance, and the expectation that all employees will adhere to the Enhanced Program in both letter and spirit.

3. Remaining Gaps. Two gaps have been identified in the training and communications component:

Gap 5: Training for DEWA (Lagos) Staff. Training materials have not yet been finalized for employees of Dunmore Exploration West Africa Ltd. in Lagos, Nigeria. While DEWA's operations present a lower direct sanctions risk compared to DTI's trading desk, DEWA personnel may interact with counterparties or logistics providers that present sanctions exposure, particularly given the increasing complexity of global energy trade flows. The training materials for DEWA should be adapted to the local operational context, including the specific sanctions and export risks associated with West Africa energy operations, and should be delivered in a format accessible to DEWA's workforce.

Gap 6: Real-Time Compliance Alerts. No mechanism is currently in place for delivering real-time compliance alerts to frontline trading staff regarding new OFAC designations, amendments to existing sanctions programs, or changes to EAR rules and restrictions. Given the speed at which new designations can materially affect the permissibility of ongoing transactions — again, as demonstrated by the April 6, 2022 Volkhov designation — the Enhanced Program should include an automated alert system that pushes notifications to relevant personnel immediately upon the publication of new OFAC designations, Federal Register notices, BIS Entity List additions, and other relevant regulatory developments.

D. Confidential Reporting Structure and Investigation Process

1. DOJ Guidance Requirements. The DOJ Guidance requires that companies maintain an effective mechanism for employees to report compliance concerns confidentially and, where possible, anonymously, without fear of retaliation. The DOJ Guidance further requires that companies establish defined processes for conducting internal investigations of reported concerns, including appropriate scoping, staffing, and documentation of investigations.

2. Enhanced Program Alignment. The Enhanced Program establishes an anonymous compliance hotline to be administered by an independent third-party provider. The hotline is designed to allow employees at all Dunmore entities — regardless of geographic location — to report potential sanctions violations, export control concerns, and other compliance issues anonymously and in their preferred language.

Reports received through the hotline will be directed to CCO Priya Nayar, with a parallel reporting line to the Audit Committee of the Board of Directors. This dual-reporting structure is designed to ensure that compliance concerns are addressed at the operational level by the CCO while also providing the Board with direct visibility into the nature and volume of reported concerns.

The investigation protocols set forth in the Enhanced Program are modeled on the witness interview protocol and Upjohn warning framework that Calderwood & Harkness established on April 18, 2022, for use during the internal investigation. These protocols specify procedures for conducting witness interviews, including the delivery of Upjohn warnings, the preservation and collection of relevant documents and communications, the engagement of forensic specialists as warranted, and the documentation and reporting of investigation findings.

3. Remaining Gaps. Two gaps have been identified in the confidential reporting structure:

Gap 7: Hotline Vendor Selection. The independent third-party hotline vendor has not yet been selected or contracted. This is a threshold implementation requirement that should be completed before the Board's anticipated adoption of the Enhanced Program on October 1, 2023. CCO Priya Nayar should evaluate potential vendors, including their capability to provide multi-language support (at minimum, English, Arabic, and German), 24/7 availability, web-based and telephone reporting options, and secure case management functionality.

Gap 8: Anti-Retaliation Policy. The Enhanced Program does not yet include a formalized anti-retaliation policy with sufficient enforcement mechanisms. While the Enhanced Program references the importance of protecting reporters from retaliation, it does not include specific prohibitions on retaliatory conduct, definitions of what constitutes retaliation, mechanisms for investigating alleged retaliation, or disciplinary measures for employees found to have engaged in retaliation against a reporter. The DOJ Guidance places significant weight on the existence of robust anti-retaliation protections as an indicator that the compliance program is genuinely designed to encourage reporting. The anti-retaliation policy should be developed, approved, and distributed to all employees in conjunction with the Enhanced Program rollout.

E. Third-Party Management

1. DOJ Guidance Requirements. The March 2023 update to the DOJ Guidance places heightened emphasis on the risk-based due diligence that companies are expected to conduct with respect to third-party relationships, including intermediaries, agents, consultants, joint venture partners, and other business counterparties. Prosecutors are instructed to evaluate not only the rigor of due diligence at the onboarding stage but also whether the company engages in ongoing monitoring of third-party relationships throughout the duration of those relationships. This enhanced focus on third-party management is directly relevant to Dunmore's circumstances, given that the sanctions violations at issue were facilitated by DTI's failure to identify the beneficial ownership connections between its counterparties (Petronova Trading FZE and Zenith Petroleum DMCC) and the sanctioned Volkhov Industrial Group, and the export control violations were facilitated by the use of Caspian Logistik GmbH as an intermediary to obscure the ultimate Russian end users.

2. Enhanced Program Alignment. The Enhanced Program includes significantly strengthened due diligence protocols for all counterparties, intermediaries, and logistics providers. The enhanced protocols require the following:

• Mandatory Beneficial Ownership Verification. For all new counterparties, the Enhanced Program requires verification of beneficial ownership, incorporating OFAC's 50% Rule analysis, under which the property and interests in property of entities owned 50% or more (individually or in the aggregate) by one or more SDN-listed persons are themselves blocked, regardless of whether the entity itself appears on the SDN List. This requirement directly addresses the root cause of the Petronova Trading FZE failure: the beneficial ownership analysis documented in the June 15, 2022 memorandum by Liam Donahue and the Volkhov 50% Rule analysis set forth in the June 20, 2022 memorandum by Conrad Reeves established that Volkhov Industrial Group held a controlling interest in Petronova through a chain of intermediate entities, which would have triggered blocking obligations under OFAC's 50% Rule had the analysis been conducted at onboarding.

• Ongoing Re-Screening. All existing counterparties are subject to annual re-screening against the OFAC SDN List, SSI List, Entity List, and Denied Persons List. This ensures that counterparties that were permissible at onboarding but are subsequently designated are identified promptly.

• Risk-Tiering. Counterparties are classified as "high," "medium," or "low" risk based on a multi-factor assessment that considers jurisdiction of incorporation and operations, industry sector, ownership structure and opacity, transaction volume and frequency, and any prior compliance incidents or adverse media. High-risk counterparties are subject to enhanced due diligence, including more frequent re-screening and senior management approval requirements.

3. Remaining Gaps. Two gaps have been identified in the third-party management component:

Gap 9: Free Zone Entity Due Diligence. The Enhanced Program's due diligence protocols do not yet incorporate enhanced procedures specifically tailored to free zone entities ("FZEs") and DMCC-registered companies. Free zone entities in the UAE — including Jebel Ali Free Zone and the DMCC — present elevated due diligence challenges because of the relative ease of formation, limited public beneficial ownership disclosure requirements, and the prevalence of nominee and shelf-company structures. Both Petronova Trading FZE and Zenith Petroleum DMCC were free zone entities, and the opacity of their ownership structures was a material contributing factor in DTI's failure to identify their connections to Volkhov. The Enhanced Program should include specific due diligence procedures for FZE and DMCC counterparties, including requirements for obtaining and verifying original incorporation documents, nominee shareholder disclosures, and independent corporate registry searches.

Gap 10: Counterparty Sanctions Compliance Contractual Provisions. No existing contractual template requires counterparties to provide sanctions compliance representations and warranties. Standard trading agreements used by DTI do not include clauses requiring counterparties to represent that they are not owned or controlled by sanctioned persons, that they will comply with applicable sanctions and export control laws, and that they will notify DTI immediately upon any change in ownership or control that could affect sanctions compliance. Such contractual provisions serve both as a deterrent and as a basis for termination rights in the event of counterparty non-compliance. Marcus Wellbourne and Conrad Reeves should develop standard sanctions compliance clauses for inclusion in all new trading agreements and, to the extent commercially practicable, in renewals or amendments of existing agreements.

F. Mergers and Acquisitions (M&A) Diligence

1. DOJ Guidance Requirements. The DOJ Guidance directs prosecutors to evaluate whether the company conducts pre-acquisition due diligence to identify sanctions and compliance risks associated with potential acquisition targets, and whether the company has processes for integrating acquired entities into its compliance program post-acquisition. The DOJ has emphasized that compliance due diligence in the M&A context is an important indicator of a company's overall commitment to compliance.

2. Enhanced Program Alignment. The Enhanced Program includes a sanctions due diligence module applicable to any future merger, acquisition, joint venture, or similar strategic transaction undertaken by Dunmore or any of its subsidiaries. The module specifies the sanctions and export control due diligence procedures to be conducted during the pre-transaction phase, including counterparty and target screening, beneficial ownership analysis, review of the target's sanctions compliance program, and assessment of the target's transaction history for potential sanctions exposure. The module also includes post-closing integration procedures designed to ensure that acquired entities are promptly brought into compliance with the Enhanced Program.

While this module is of lower immediate priority given Dunmore's current focus on remediating the conduct at issue and implementing the Enhanced Program, the framework is in place and can be activated when needed.

3. Remaining Gaps. No material gaps have been identified in the M&A diligence component at this time. The framework is adequate for Dunmore's current operations and anticipated transaction activity.

V. Benchmarking Analysis: Fundamental Question Two — Is the Compliance Program Adequately Resourced and Empowered?

The DOJ Guidance's second fundamental question asks whether the compliance program is being applied earnestly and in good faith — that is, whether it is adequately resourced and empowered to function effectively. This inquiry encompasses the commitment of senior and middle management, the autonomy and resources of the compliance function, and the company's use of incentive structures and disciplinary measures to promote compliance.

A. Commitment by Senior and Middle Management

1. DOJ Guidance Requirements. The DOJ Guidance directs prosecutors to evaluate whether senior management has clearly articulated the company's ethical standards and compliance expectations, and whether the conduct of senior leadership — the "tone at the top" — reflects a genuine commitment to compliance. Equally important, prosecutors are instructed to assess the "tone at the middle" — that is, whether middle management reinforces and implements compliance expectations in day-to-day operations. A company that professes a commitment to compliance at the senior leadership level but fails to embed that commitment at the operational level will not satisfy the DOJ Guidance.

2. Enhanced Program Alignment. Several actions taken by Dunmore since the inception of the DOJ inquiry demonstrate a genuine commitment to compliance at the senior leadership level:

• Appointment of Priya Nayar as CCO. The appointment of Priya Nayar as Chief Compliance Officer on August 1, 2022 — less than four months after the DOJ inquiry was opened — demonstrates Dunmore's commitment to empowering the compliance function with qualified leadership. Nayar has a direct reporting line to both the Board of Directors and CEO Callum Renshaw, ensuring that the CCO has unimpeded access to the highest levels of corporate governance.

• Personnel Accountability. The departure of Gerald Fisk (June 10, 2022), the separation of Natasha Sorokin (September 15, 2022), and the separation of Derek Hargrave (October 1, 2022) demonstrate that Dunmore has held individuals accountable for their roles in the compliance failures that led to the conduct at issue. These personnel actions signal to the organization that compliance failures will result in meaningful consequences.

• Board-Level Oversight. The Board's Audit Committee has been actively engaged in overseeing the remediation efforts, and the Board is expected to adopt the Enhanced Program by formal resolution on October 1, 2023. This Board-level engagement demonstrates that compliance oversight is treated as a governance-level priority, not merely an operational function.

3. Remaining Gaps. One gap has been identified with respect to middle-management commitment:

Gap 11: Middle-Management Compliance KPIs. While the Enhanced Program establishes compliance responsibilities at the CCO and senior management levels, it does not yet formalize compliance responsibilities for middle-management positions with specific, measurable key performance indicators ("KPIs"). In particular, regional heads such as Omar Al-Rashidi (Head of Middle East Operations, who has been identified as a cooperating witness in the investigation) and Yves Leclerc (Director of Logistics) should have explicit compliance obligations — including responsibility for ensuring that their direct reports complete required training, adhere to screening and due diligence protocols, and escalate compliance concerns promptly — incorporated into their revised position descriptions. Compliance performance against these KPIs should be a factor in middle managers' annual performance evaluations and compensation decisions.

B. Autonomy and Resources

1. DOJ Guidance Requirements. The DOJ Guidance requires that the compliance function have adequate funding, staffing, and independence from the business units it oversees. The compliance function should not be subordinated to the business functions it is tasked with monitoring, and it should have sufficient resources — both human and technological — to carry out its mandate effectively. The March 2023 update places particular emphasis on the compliance function's access to relevant data, data sources, and analytics tools, reflecting the DOJ's recognition that modern compliance programs must leverage technology to be effective.

2. Enhanced Program Alignment. CCO Priya Nayar presides over a dedicated compliance team that has been meaningfully expanded since August 2022, with three additional compliance analysts hired to support the Enhanced Program's implementation and ongoing operations. The compliance function operates with independent budget authority, meaning that compliance expenditures are not subject to approval by business-unit leaders — a structural feature designed to prevent the business from exerting budgetary pressure that could undermine the compliance function's effectiveness. Additionally, the compliance team has been granted unrestricted access to all transaction data, trading systems, and communications platforms across all Dunmore entities, ensuring that the compliance function is not impeded in its ability to monitor and investigate potential violations.

3. Remaining Gaps. Two gaps have been identified with respect to autonomy and resources:

Gap 12: Automated OFAC Screening Integration. The Enhanced Program calls for automated, real-time OFAC screening integrated directly into DTI's trading platform, replacing the manual screening refresh protocol that was in place during the period of the conduct at issue. It was the inadequacy of the manual screening protocol that allowed Gerald Fisk discover the Volkhov exposure only on April 11, 2022 — five days after the SDN designation on April 6, 2022 — rather than immediately upon the designation becoming effective. The automated screening tool should be procured, tested, and integrated into the trading platform as a matter of the highest priority. Until automated screening is operational, the Enhanced Program will continue to rely on manual processes that are inherently slower and more error-prone, and that the DOJ would likely view as inconsistent with best practices.

Gap 13: Data Analytics for Transaction Monitoring. The Enhanced Program's data analytics capabilities for transaction monitoring remain underdeveloped. The forensic tracing methodology employed by Ridgeline Advisory Group LLC — which identified the $34.2 million in structured payments across 127 Crescent Commercial Bank PJSC transactions — was conducted as a post-hoc forensic exercise during the internal investigation, not as part of any real-time or near-real-time monitoring system. The Enhanced Program should incorporate data analytics capabilities modeled on Ridgeline's methodology, including algorithms designed to detect structuring patterns, unusual payment flows, transactions involving high-risk jurisdictions, and other indicators of potential sanctions evasion. The DOJ Guidance's March 2023 emphasis on data and analytics makes this a particularly important area for investment.

C. Incentives and Disciplinary Measures

1. DOJ Guidance Requirements. The March 2023 update to the DOJ Guidance places specific emphasis on compensation structures and the consequences imposed for compliance failures, including clawback provisions that allow the company to recoup compensation from employees whose misconduct results in compliance violations. Prosecutors are instructed to evaluate whether the company's compensation program incentivizes compliance and whether disciplinary measures for compliance violations are consistently and fairly applied across the organization, regardless of the seniority or revenue-generating capacity of the employee involved.

2. Enhanced Program Alignment. The Enhanced Program includes a requirement that compliance performance be a factor in annual performance reviews and compensation decisions for all DTI and management-level employees. This integration of compliance metrics into the compensation structure ensures that employees have a direct financial incentive to adhere to the Enhanced Program's requirements. The separations of Derek Hargrave and Natasha Sorokin, and the departure of Gerald Fisk, provide concrete precedent within the organization that compliance failures result in significant consequences, including termination of employment.

3. Remaining Gaps. Three gaps have been identified with respect to incentives and disciplinary measures:

Gap 14: Compensation Clawback Provisions. No formal clawback provisions are currently in place that would allow Dunmore to recoup compensation — including bonuses, commissions, and other incentive compensation — tied to transactions that are later found to involve sanctions violations or other compliance failures. This is a specific area that the March 2023 DOJ Guidance emphasizes, and the absence of clawback provisions represents a notable gap that prosecutors would likely scrutinize. Marcus Wellbourne and CCO Priya Nayar should work together to draft and implement a clawback policy that applies retroactively (to the extent permitted by applicable law and existing employment agreements) to compensation attributable to transactions subsequently determined to involve compliance violations.

Gap 15: Formal Disciplinary Matrix. The Enhanced Program does not yet include a formalized disciplinary matrix with escalating consequences for compliance violations. While the separations of Hargrave and Sorokin demonstrate that Dunmore is willing to impose severe consequences for serious violations, the absence of a structured, transparent disciplinary framework creates a risk that less severe violations may be addressed inconsistently. A formal disciplinary matrix — specifying the range of consequences for violations of varying severity, from counseling and written warnings for minor infractions to termination and referral for legal action for serious violations — should be developed and integrated into the Enhanced Program.

Gap 16: Indemnification and Advancement of Defense Costs. Dunmore has advanced approximately $3.4 million in individual counsel fees for Gerald Fisk, Natasha Sorokin, and Derek Hargrave under its existing indemnification obligations. While the advancement of defense costs is legally required under many corporate indemnification provisions and is generally consistent with corporate governance best practices, the DOJ may scrutinize whether Dunmore's indemnification agreements appropriately balance the company's obligations to its current and former employees against the need to hold individuals accountable for compliance failures. Future indemnification agreements should be reviewed to determine whether conduct-based forfeiture clauses — under which an employee's right to indemnification and advancement is forfeited if the employee is found to have engaged in willful or criminal conduct — should be incorporated.

VI. Benchmarking Analysis: Fundamental Question Three — Does the Compliance Program Work in Practice?

The DOJ Guidance's third fundamental question asks whether the corporation's compliance program works in practice. This is perhaps the most critical of the three fundamental questions, because it tests whether the compliance program, however well designed and resourced, actually operates effectively to detect, prevent, and remediate compliance violations. The inquiry encompasses continuous improvement through periodic testing and review, investigation of misconduct, and analysis and remediation of the root causes of any underlying misconduct.

A. Continuous Improvement, Periodic Testing, and Review

1. DOJ Guidance Requirements. The DOJ Guidance directs prosecutors to evaluate whether the company conducts internal audits and testing of its compliance controls, and whether the company engages in continuous improvement of its compliance program based on lessons learned from compliance incidents, regulatory developments, and evolving risks. A compliance program that is designed and implemented but never tested or updated will not satisfy the DOJ's expectations.

2. Enhanced Program Alignment. The Enhanced Program contemplates an ongoing monitoring and testing framework, the details of which are to be developed in a separate memorandum targeted for completion by December 15, 2023 (to be prepared by Jasmine Thornton). The framework will include the following components:

• Annual Independent Assessment. An annual independent assessment of the Enhanced Program's design and operational effectiveness, to be conducted by Pemberton Investors Solutions or a qualified successor firm. This assessment will evaluate whether the Enhanced Program continues to be appropriately tailored to Dunmore's evolving risk profile and whether its controls are functioning as intended.

• Quarterly Transaction Sampling and Screening Audits. Quarterly sampling of transactions across all Dunmore entities to verify that OFAC screening, export classification, counterparty due diligence, and escalation protocols are being followed consistently. Screening audits will test the accuracy and completeness of screening results and the timeliness of screening refreshes.

3. Remaining Gaps. Two gaps have been identified:

Gap 17: Testing Framework. The monitoring and testing framework has not yet been finalized. This is a key deliverable that must be completed before the supplemental remediation report is submitted to DOJ on January 15, 2024. The framework should specify testing methodologies, sampling parameters, reporting formats, and remediation tracking procedures, and should be designed to generate the type of documented evidence of program effectiveness that the DOJ Guidance contemplates.

Gap 18: Internal Audit Function for Compliance. Dunmore does not currently have an internal audit function with a compliance audit mandate. The external audit firm, Ashford & Whitmore LLP (engagement partner Kenneth Ashford), provides financial audit services but does not have a mandate to audit compliance controls. The Enhanced Program should establish either a dedicated internal compliance audit function or a supplemental engagement with an external firm specifically tasked with auditing the Enhanced Program's controls on a periodic basis, separate from the annual independent assessment described above.

B. Investigation of Misconduct

1. DOJ Guidance Requirements. The DOJ Guidance requires that companies conduct properly scoped internal investigations with qualified personnel when compliance issues are identified. Investigations should be thorough, timely, and independent, and should include root cause analysis of the underlying misconduct to ensure that remediation efforts address the systemic factors that enabled the misconduct, not just its symptoms.

2. Enhanced Program Alignment. The internal investigation conducted by Calderwood & Harkness provides a strong model for future investigations and demonstrates Dunmore's capacity to investigate misconduct thoroughly and effectively. The investigation encompassed 47 witness interviews conducted across three rounds, the collection and review of 2,347,812 documents through Nexagen Analytics' technology-assisted review protocol, forensic accounting by Ridgeline Advisory Group, and the preparation of a comprehensive 176-page report documenting the findings.

The root cause analysis conducted during the investigation identified the following primary root causes of the underlying misconduct:

• Gerald Fisk's failure to maintain real-time screening protocols, resulting in reliance on periodic manual screening refreshes that were insufficiently frequent and inadequately documented;

• The absence of beneficial ownership verification procedures for trading counterparties, which allowed DTI to onboard Petronova Trading FZE and Zenith Petroleum DMCC without identifying their ownership connections to Volkhov Industrial Group;

• Insufficient export classification review and end-user verification, which allowed Caspian Logistik GmbH to submit falsified end-user certificates without independent verification; and

• The absence of real-time transaction monitoring capabilities, which allowed $34.2 million in structured payments through Crescent Commercial Bank to go undetected until the post-hoc forensic analysis.

The Enhanced Program incorporates documented investigation procedures for future compliance incidents, based on the Calderwood & Harkness investigation protocol.

3. Remaining Gaps. One gap has been identified:

Gap 19: Standing Internal Investigations Protocol. The Enhanced Program should establish a standing internal investigations protocol that can be deployed for lower-severity matters without the need to retain external counsel. While external counsel will continue to be engaged for matters involving potential criminal liability, government inquiries, or other high-severity issues, the company should have the capacity to investigate lower-severity compliance concerns — such as isolated screening failures, training deficiencies, or procedural lapses — using internal resources. The protocol should specify investigation procedures, documentation require

MEMORANDUM
PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
TO: Victoria Chambers, Responsible Partner Conrad Reeves, Senior Counsel, Export Controls & Sanctions
FROM: Jasmine Thornton, Lead Associate, White Collar & Investigations
DATE: September 1, 2023
RE: Compliance Program Benchmarking — Dunmore Energy Holdings Ltd. Enhanced Sanctions & Export Controls Compliance Program vs. DOJ Evaluation of Corporate Compliance Programs (March 2023 Update)
MATTER NO.: 1016-00009
CLIENT: Dunmore Energy Holdings Ltd.
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to benchmark the Enhanced Sanctions & Export Controls Compliance Program (the "Enhanced Program") of Dunmore Energy Holdings Ltd. ("Dunmore" or "DEH") against the U.S. Department of Justice's Evaluation of Corporate Compliance Programs, as updated in March 2023 (the "DOJ Guidance"), in anticipation of submitting the supplemental remediation report to the DOJ's National Security Division. This benchmarking analysis is intended to identify areas of alignment between the Enhanced Program and the DOJ Guidance, as well as any remaining gaps requiring further remediation before Calderwood & Harkness LLP ("Calderwood & Harkness" or the "Firm") submits the supplemental remediation report, currently targeted for January 15, 2024.
The Enhanced Program was developed in coordination with Pemberton Investors Solutions LLC ("Marlowe Asset Management"), under the leadership of engagement partner Dr. Anton Bremer, following the DOJ National Security Division inquiry opened on April 19, 2022. That inquiry concerns potential violations of U.S. sanctions laws, including programs administered by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"), and U.S. export control regulations administered by the Bureau of Industry and Security ("BIS") under the Export Administration Regulations ("EAR"). A grand jury subpoena, GJ No. 22-418, was issued by the U.S. District Court for the District of Columbia (Grand Jury 22-2). The lead prosecutor is AUSA Meredith Calloway of the DOJ National Security Division, Counterintelligence and Export Control Section.
Pemberton Investors Solutions delivered its remediation report and the Enhanced Program framework on September 15, 2023. The Dunmore Board of Directors (the "Board") is expected to formally adopt the Enhanced Program by resolution at its regularly scheduled meeting on October 1, 2023. Prior to that adoption, Calderwood & Harkness submitted the Firm's comprehensive 176-page internal investigation report to DOJ on May 15, 2023. Additionally, Dunmore filed a voluntary self-disclosure with OFAC on June 1, 2023, covering the transactions at issue.
Overall Assessment. The Enhanced Program substantially aligns with the DOJ Guidance across all three fundamental questions that prosecutors are instructed to evaluate. However, this benchmarking analysis has identified gaps in five specific areas requiring further remediation before the supplemental remediation report is submitted. These gaps, detailed in Section VII below, are remediable within the Q4 2023 / Q1 2024 timeframe and, once addressed, will position Dunmore's compliance infrastructure as consistent with best-in-class programs that the DOJ has recognized as supporting declination decisions under the DOJ Corporate Enforcement Policy.
It should be noted that the voluntary disgorgement payment of $8.75 million to the U.S. Treasury — representing estimated net profits from the nine tainted crude oil swap transactions ($156.3 million notional value multiplied by 5.6% net margin, as calculated by Ridgeline Advisory Group LLC in its forensic accounting report) — is expected to be made by November 30, 2023. This payment will be referenced in the supplemental remediation report as tangible evidence of Dunmore's commitment to accountability and its good-faith cooperation with the government's investigation.
II. Background
A. The DOJ Inquiry and Conduct at Issue
Dunmore Energy Holdings Ltd. is a Cayman Islands–domiciled company (Registration No. MC-334821) with its operational headquarters located at 1200 McKinney Street, Suite 3400, Houston, Texas 77010. Dunmore employs approximately 3,200 personnel globally across its various subsidiaries and affiliates, and reported fiscal year 2021 revenue of approximately $4.87 billion. Dunmore operates principally in the upstream exploration and production, midstream logistics, commodity trading, and renewable energy sectors.
The conduct giving rise to the DOJ inquiry was centered at the Dubai-based trading desk of Dunmore Trading International Ltd. ("DTI"), a wholly owned subsidiary of DEH incorporated in the Dubai International Financial Centre (DIFC License No. CL-4827), with offices at Level 14, Gate Building 3, DIFC, Dubai, United Arab Emirates. Between approximately March 2020 and April 2022, DTI personnel engaged in the following categories of conduct now under investigation:
Crude Oil Swap Transactions. DTI executed fourteen crude oil swap transactions with an aggregate notional value of approximately $218.7 million with two counterparties: Petronova Trading FZE (a Jebel Ali Free Zone entity managed by Sergei Volkov) and Zenith Petroleum DMCC (a DMCC-registered entity managed by Farhan Qureshi). The internal investigation conducted by Calderwood & Harkness determined that nine of the fourteen transactions, representing approximately $156.3 million in notional value, involved Volkhov Industrial Group JSC–connected entities. These nine transactions potentially violated OFAC Directive 2, which imposed sectoral sanctions on certain entities in the Russian energy sector pursuant to Executive Order 13662 (as applied to Volkhov effective November 15, 2019), and subsequently full blocking sanctions imposed on Volkhov under Executive Order 14024 (with Volkhov's designation to the Specially Designated Nationals and blocked Persons List ("SDN List") effective April 6, 2022).
Oilfield Equipment Exports. DTI, acting through its logistics function, facilitated the export of oilfield equipment valued at approximately $12.4 million to end users in the Russian Federation via Caspian Logistik GmbH, a Hamburg-based freight forwarding and logistics firm managed by Klaus Weidemann. The equipment was classified under Export Administration Regulations ("EAR") Export Control Classification Numbers ("ECCNs") 2B350 and 2B999, and the shipments potentially violated EAR §746.5 (Russia/Belarus sanctions-related export controls). The internal investigation identified falsified end-user certificates submitted by Caspian Logistik for at least three of these shipments.
Structured Payments. DTI processed approximately $34.2 million in payments across 127 individual transactions through Crescent Commercial Bank PJSC ("Crescent"), a Dubai-based commercial bank, between March 2020 and March 2022. The forensic accounting analysis conducted by Ridgeline Advisory Group LLC identified patterns consistent with structuring designed to avoid enhanced due diligence thresholds and to obscure the ultimate beneficiaries of payment flows. Crescent's relationship manager for the DTI account was Khalid Mansour.
Key Individuals. The following individuals have been identified as directly involved in or responsible for the conduct at issue:
• Derek Hargrave, former President of DTI, who oversaw the Dubai-based trading desk and approved the counterparty relationships with Petronova Trading FZE and Zenith Petroleum DMCC. Hargrave was separated from the company effective October 1, 2022.
• Natasha Sorokin, former Senior Trader at DTI, who directly executed the crude oil swap transactions at issue and maintained communications with Sergei Volkov and Farhan Qureshi. Sorokin was separated from the company effective September 15, 2022. A review of Sorokin's personal communications devices (documented in the September 10, 2022 memorandum by working associate Liam Donahue) revealed that she had used encrypted messaging applications to communicate with counterparty representatives outside of DTI's monitored communications systems.
• Gerald Fisk, former Chief Compliance Officer of Dunmore, who was responsible for sanctions screening and compliance oversight during the period of the conduct at issue. Fisk departed the company on June 10, 2022. The internal investigation determined that Fisk had failed to maintain real-time OFAC screening protocols, had not implemented beneficial ownership verification procedures for DTI counterparties, and had not escalated red flags identified by junior compliance staff.
The investigation and remediation efforts are being conducted under the leadership of CEO Callum Renshaw and General Counsel Marcus Wellbourne. Priya Nayar was appointed as Chief Compliance Officer on August 1, 2022, replacing Gerald Fisk, and has been instrumental in driving the development and implementation of the Enhanced Program.
B. The Enhanced Program
The Enhanced Sanctions & Export Controls Compliance Program was designed by Pemberton Investors Solutions LLC, under the direction of Dr. Anton Bremer, in close coordination with Calderwood & Harkness, and specifically with Conrad Reeves (Senior Counsel, Export Controls & Sanctions), who provided subject-matter expertise on OFAC regulatory requirements, EAR classification and licensing obligations, and industry best practices for energy commodity trading compliance.
The draft Enhanced Sanctions & Export Controls Compliance Policy was circulated for internal review on August 1, 2023. The Enhanced Program covers the following core areas: (i) OFAC screening protocols, including real-time and batch screening against the SDN List, Sectoral Sanctions Identifications List ("SSI List"), and other OFAC-maintained lists; (ii) export control classification procedures under the EAR, including self-classification workflows and license determination protocols; (iii) counterparty and third-party due diligence, including beneficial ownership verification and risk-tiering methodologies; (iv) escalation mechanisms for flagged transactions, including defined escalation paths from trading desk personnel to the CCO and General Counsel; (v) employee training, including role-specific curricula and annual recertification requirements; and (vi) ongoing monitoring and testing protocols.
Board adoption of the Enhanced Program is anticipated for October 1, 2023. CCO Priya Nayar has been authorized as the implementing officer, with responsibility for overseeing the rollout, training, and operationalization of all Enhanced Program components across all Dunmore entities.
C. The DOJ Evaluation of Corporate Compliance Programs (March 2023 Update)
The DOJ Guidance, most recently updated in March 2023, is the primary framework used by DOJ prosecutors to evaluate the effectiveness of a company's compliance program in the context of charging decisions, plea negotiations, and sentencing recommendations. The DOJ Guidance is organized around three fundamental questions that prosecutors are instructed to assess:
1. Is the corporation's compliance program well designed? This inquiry examines whether the company has conducted a tailored risk assessment, implemented appropriate policies and procedures, provided adequate training, established confidential reporting mechanisms, and maintained robust third-party management and M&A due diligence processes.
2. Is the program being applied earnestly and in good faith — that is, is it adequately resourced and empowered? This inquiry focuses on whether senior and middle management have demonstrated genuine commitment to compliance, whether the compliance function has sufficient autonomy and resources (including access to data and analytics), and whether the company has implemented appropriate incentive structures and disciplinary measures.
3. Does the corporation's compliance program work in practice? This inquiry evaluates whether the company engages in continuous improvement through periodic testing and review, whether misconduct investigations are properly scoped and conducted, and whether the company has undertaken meaningful analysis and remediation of the root causes of any underlying misconduct.
The March 2023 update to the DOJ Guidance introduced several areas of heightened emphasis that are particularly relevant to Dunmore's circumstances. First, the update places increased importance on a company's use of data and analytics in its compliance function, including real-time transaction monitoring and data-driven risk identification. Second, the update specifically addresses compensation structures and clawback provisions, directing prosecutors to evaluate whether a company's compensation program incentivizes compliance and whether the company has mechanisms to recoup compensation from employees whose conduct results in compliance violations. Third, the update reinforces the importance of personal accountability for compliance failures. Fourth, the update places heightened emphasis on the evaluation of third-party management programs, including the rigor of due diligence at onboarding and on an ongoing basis.
This benchmarking analysis should also be read in conjunction with the DOJ Corporate Enforcement Policy, updated in September 2022, which governs the criteria under which the DOJ may offer a declination to a company that has voluntarily self-disclosed misconduct, cooperated fully with the government's investigation, and undertaken timely and appropriate remediation. Calderwood & Harkness addressed the application of the Corporate Enforcement Policy factors to Dunmore's cooperation and remediation efforts in the white paper submitted to DOJ on March 1, 2023.
III. Methodology
This benchmarking analysis was conducted by Jasmine Thornton (Lead Associate, White Collar & Investigations), with substantive input from Conrad Reeves (Senior Counsel, Export Controls & Sanctions), who provided expert guidance on OFAC regulatory requirements, EAR classification and licensing obligations, and sanctions compliance best practices for energy trading operations, and from Pemberton Investors Solutions LLC (Dr. Anton Bremer), which provided insight into the design rationale and implementation plan for the Enhanced Program.
The analysis proceeded through the following steps:
Step 1: Baseline Assessment Review. We reviewed the pre-existing compliance program assessment set forth in the memorandum dated November 15, 2022, jointly prepared by Conrad Reeves and Jasmine Thornton. That memorandum identified significant deficiencies in Dunmore's pre-investigation compliance infrastructure, including: (i) inadequate and intermittent OFAC screening protocols that relied on manual, batch-style screening refreshes rather than real-time, automated screening; (ii) insufficient and generic training programs that were not tailored to the specific sanctions and export risks faced by DTI trading desk personnel; (iii) absence of defined escalation protocols for flagged transactions; and (iv) lack of any formalized third-party due diligence process, including the complete absence of beneficial ownership verification procedures for trading counterparties.
Step 2: Enhanced Program Document Review. We conducted a comprehensive review of the Enhanced Program design documents, including the draft Enhanced Sanctions & Export Controls Compliance Policy (circulated August 1, 2023), and compared each element of the Enhanced Program against the corresponding provisions of the DOJ Guidance. This element-by-element comparison forms the basis of the benchmarking analysis set forth in Sections IV through VI below.
Step 3: Integration of Investigation Findings. We incorporated findings from the following workstreams conducted during the course of the internal investigation:
• Forensic Accounting. The forensic accounting report delivered by Ridgeline Advisory Group LLC (Engagement No. RAG-2022-0319; engagement lead Dr. Margaret Liu) on April 1, 2023. The Ridgeline report traced the $34.2 million in payments through Crescent Commercial Bank PJSC, identified the structured payment patterns, and calculated the $8.75 million estimated net profits from the nine tainted transactions that forms the basis for the voluntary disgorgement.
• Document Review. The document review findings generated by Nexagen Analytics Inc. (Project No. NX-DEH-2204; project manager Brian Cavanaugh). Nexagen collected 2,347,812 documents from custodians and non-custodial data sources across Dunmore's systems, of which 438,916 were identified as responsive through a technology-assisted review ("TAR") protocol. Key responsive documents included internal communications evidencing awareness of sanctions risks, counterparty onboarding files, export classification worksheets, and trading desk records.
• Witness Interviews. Forty-seven witness interviews were conducted across three rounds (22 interviews in the first round, 15 in the second, and 10 in the third), utilizing the Calderwood & Harkness witness interview protocol and Upjohn warning framework established on April 18, 2022. Witnesses included current and former DTI personnel, compliance staff, finance and controllers, logistics coordinators, senior management, and Board members.
Step 4: Gap Analysis and Recommendations. Based on the foregoing review, we identified areas of alignment between the Enhanced Program and the DOJ Guidance, as well as remaining gaps requiring further remediation. For each identified gap, we have developed specific recommendations, assigned responsible parties, and established target completion dates designed to ensure all gaps are remediated before the supplemental remediation report is submitted to DOJ on January 15, 2024.
IV. Benchmarking Analysis: Fundamental Question One — Is the Compliance Program Well Designed?
The DOJ Guidance's first fundamental question asks whether the corporation's compliance program is well designed. This inquiry encompasses several sub-elements, including risk assessment, policies and procedures, training and communications, confidential reporting structures and investigation processes, third-party management, and mergers and acquisitions due diligence. We address each sub-element below.
A. Risk Assessment
1. DOJ Guidance Requirements. The DOJ Guidance directs prosecutors to evaluate whether the company has engaged in a risk assessment process tailored to its specific business operations, industry, and geographic footprint. The risk assessment should identify, assess, and define the nature and extent of the risks associated with the company's particular industry, products and services, geographic areas of operation, and the types of transactions and counterparties involved. Critically, the DOJ Guidance requires that the risk assessment be periodically updated, particularly in light of lessons learned from prior compliance incidents, to ensure that the compliance program continues to address the company's evolving risk profile. A static or outdated risk assessment will weigh against a finding that the compliance program is well designed.
2. Enhanced Program Alignment. The Enhanced Program includes a comprehensive sanctions and export controls risk assessment covering all Dunmore subsidiaries and operating entities. The risk assessment encompasses the following entities:
• Dunmore Trading International Ltd. ("DTI") — Dubai, DIFC (the entity at the center of the conduct at issue);
• Dunmore upstream Americas LLC — Houston, Texas (EIN 84-2937561), the upstream exploration and production subsidiary;
• Dunmore Renewables GmbH — Hamburg, Germany, the renewable energy subsidiary; and
• Dunmore Exploration West Africa Ltd. ("DEWA") — Lagos, Nigeria, the West Africa exploration subsidiary.
The risk assessment identifies the highest-risk areas within Dunmore's global operations. Consistent with the findings of the internal investigation, the assessment correctly identifies DTI's trading desk operations in Dubai as the highest-risk area, given the desk's direct involvement in commodity trading with counterparties in jurisdictions presenting elevated sanctions risk, including the United Arab Emirates (particularly free zone entities in Jebel Ali and the DMCC), the Russian Federation, and the Commonwealth of Independent States. The assessment further identifies commodity flows involving Russian-origin products, oilfield equipment with dual-use potential classified under ECCNs 2B350 and 2B999, and counterparty networks in the UAE and Germany as presenting significant sanctions and export risks.
The risk assessment has been updated to reflect the April 6, 2022 designation of Volkhov Industrial Group JSC to the SDN List under Executive Order 14024, as well as the rapidly evolving Russia/Belarus sanctions landscape, including the expanded export controls under EAR §746.5. The assessment also incorporates lessons learned directly from the internal investigation, including the failure to identify Petronova Trading FZE's beneficial ownership ties to Volkhov Industrial Group (a failure that was a direct proximate cause of the sanctions violations at issue) and the inadequate end-user verification procedures that allowed Caspian Logistik GmbH to submit falsified end-user certificates for oilfield equipment shipments destined for Russian end users.
This approach to risk assessment represents a marked improvement over the pre-investigation compliance infrastructure, which lacked any formal, documented risk assessment process tailored to sanctions and export risks.
3. Remaining Gaps. Notwithstanding the substantial improvements described above, two gaps in the risk assessment methodology have been identified:
Gap 1: Quantitative Risk Scoring. The current risk assessment methodology relies on qualitative assessments of risk (e.g., "high," "medium," "low") without employing a quantitative risk-scoring model that would assign numerical scores to specific risk factors and aggregate those scores to produce an overall risk rating for each business unit, product line, geographic area, and counterparty. Pemberton Investors Solutions has recommended the implementation of a tiered, quantitative risk-scoring model that weights factors such as jurisdictional risk, counterparty opacity, transaction volume, product classification, and historical compliance incidents. A quantitative approach would provide greater consistency and transparency in risk assessments and would facilitate trend analysis over time, consistent with the DOJ Guidance's emphasis on data-driven compliance.
Gap 2: Formalized Assessment Cadence. The Enhanced Program does not yet establish a formalized cadence for risk assessment updates. We recommend that the Enhanced Program require (i) an annual comprehensive risk assessment, encompassing all business units, subsidiaries, and geographic areas of operation, and (ii) quarterly risk indicator reviews, which would involve a targeted review of key risk indicators — including new sanctions designations, changes to EAR restrictions, counterparty screening results, and transaction volume trends — to determine whether interim updates to the comprehensive risk assessment are warranted.
B. Policies and Procedures
1. DOJ Guidance Requirements. The DOJ Guidance instructs prosecutors to evaluate whether the company's policies and procedures are clearly articulated, accessible to all relevant employees, and effectively integrated into the company's day-to-day operations. Policies should be designed to address the specific risks identified through the risk assessment process and should be written in a manner that is comprehensible to the employees who are expected to follow them. Generic, off-the-shelf policies that are not tailored to the company's actual risk profile will not satisfy the DOJ Guidance's requirements.
2. Enhanced Program Alignment. The draft Enhanced Sanctions & Export Controls Compliance Policy (circulated August 1, 2023) comprehensively addresses the key areas of sanctions and export controls risk identified in the risk assessment. The policy includes the following substantive components:
• Prohibited Transactions. Clear identification of the categories of transactions that are prohibited under applicable U.S. sanctions programs, including transactions involving SDN-listed entities, entities subject to sectoral sanctions under OFAC Directives 1 through 4, and entities appearing on the BIS Entity List or Denied Persons List.
• OFAC Screening Requirements. Detailed procedures for screening all counterparties, beneficial owners, intermediaries, and transaction parties against OFAC-maintained lists, including the SDN List, the SSI List, the Non-SDN Menu-Based Sanctions List, and the Foreign Sanctions Evaders List, as well as consolidated screening against BIS restricted party lists.
• Export Classification Under the EAR. Procedures for self-classification of products and technology under the EAR, including determination of applicable ECCNs, assessment of EAR99 status, and license determination protocols for items subject to EAR §746.5 Russia/Belarus controls.
• Counterparty Due Diligence. Requirements for risk-based due diligence on all counterparties, including collection and verification of beneficial ownership information, assessment of counterparty jurisdictional risk, and evaluation of counterparty compliance programs.
• Escalation Protocols. Defined escalation paths for any transaction flagged by OFAC screening, export classification review, or counterparty due diligence, including mandatory escalation to CCO Priya Nayar and, for transactions involving potential SDN or sectoral sanctions issues, further escalation to General Counsel Marcus Wellbourne.
• Recordkeeping. Requirements for maintaining complete records of all screening results, due diligence files, escalation decisions, export classification determinations, and transaction documentation, consistent with OFAC and BIS recordkeeping requirements.
The policy has been written in English and Arabic to ensure accessibility for Dubai-based employees at DTI. A German translation is planned for Dunmore Renewables GmbH staff in Hamburg and is expected to be completed before the training rollout. All versions of the policy will be accessible via Dunmore's compliance intranet portal, which is available to all employees across all Dunmore entities.
3. Remaining Gaps. Two gaps have been identified in the policies and procedures component of the Enhanced Program:
Gap 3: Encrypted and Informal Communications Channels. The Enhanced Program's policies do not yet include specific protocols for the handling and monitoring of encrypted or informal communications channels, such as Meridian Services Inc., Signal, Kestrel Data Systems, or personal email accounts. This gap is particularly significant in light of the findings from the Natasha Sorokin personal communications review, documented in the September 10, 2022 memorandum by working associate Liam Donahue. That review revealed that Sorokin used encrypted messaging applications — specifically, Meridian Services Inc. and Kestrel Data Systems — to communicate with counterparty representatives Sergei Volkov and Farhan Qureshi outside of DTI's monitored corporate communications systems, effectively circumventing the company's ability to capture and review those communications for compliance purposes. The Enhanced Program should include explicit prohibitions on the use of unapproved communications channels for business purposes, requirements for the preservation of all business-related communications regardless of the platform used, and monitoring protocols designed to detect and deter the use of unauthorized channels.
Gap 4: Winddown Procedures. The policies do not yet include specific guidance on the procedures to be followed when a counterparty is newly designated to the SDN List or another restricted party list during the pendency of an existing transaction or contractual relationship. Given the speed at which new designations can be issued — as illustrated by the April 6, 2022 SDN designation of Volkhov Industrial Group, which took effect immediately and required DTI to cease all transactions involving Volkhov-connected entities — the Enhanced Program should include detailed winddown procedures that specify the immediate steps to be taken upon learning of a new designation, including transaction suspension protocols, notification requirements, OFAC licensing considerations (including the availability of general licenses authorizing winddown activities), and escalation procedures.
C. Training and Communications
1. DOJ Guidance Requirements. The DOJ Guidance requires that training be risk-based, tailored to the specific roles and responsibilities of the employees receiving the training, and periodically updated to reflect changes in applicable laws, regulations, and company policies. Generic, one-size-fits-all training programs are insufficient. The DOJ Guidance also emphasizes the importance of communications from senior leadership reinforcing the company's commitment to compliance — commonly referred to as "tone from the top" — as a critical element of a well-designed compliance program.
2. Enhanced Program Alignment. Pemberton Investors Solutions has developed a comprehensive training program (outline dated November 1, 2023, reviewed and approved by Conrad Reeves) covering the following core topics: OFAC compliance fundamentals and program-specific requirements; EAR classification, licensing, and export control requirements; recognition of red flags indicative of potential sanctions evasion or export control violations; and escalation procedures under the Enhanced Program.
The training program is designed with role-specific modules tailored to the following employee categories: (i) traders and trading desk personnel, who receive the most intensive and detailed training given their direct involvement in transaction execution; (ii) logistics personnel, who receive training focused on export classification, end-user verification, and shipping documentation requirements; (iii) finance and controllers personnel, who receive training focused on payment screening, transaction monitoring, and structuring detection; (iv) management, who receive training on supervisory responsibilities, escalation obligations, and compliance culture; and (v) Board members, who receive a governance-focused overview of sanctions and export control compliance obligations and the Board's oversight responsibilities.
Annual recertification is required for all employees, with more frequent refresher training for high-risk roles. The training program includes testing and certification components to verify comprehension and retention.
With respect to tone from the top, CEO Callum Renshaw and CCO Priya Nayar are expected to issue a joint communication to all Dunmore employees upon the Board's formal adoption of the Enhanced Program, emphasizing the company's commitment to sanctions and export controls compliance, the consequences of non-compliance, and the expectation that all employees will adhere to the Enhanced Program in both letter and spirit.
3. Remaining Gaps. Two gaps have been identified in the training and communications component:
Gap 5: Training for DEWA (Lagos) Staff. Training materials have not yet been finalized for employees of Dunmore Exploration West Africa Ltd. in Lagos, Nigeria. While DEWA's operations present a lower direct sanctions risk compared to DTI's trading desk, DEWA personnel may interact with counterparties or logistics providers that present sanctions exposure, particularly given the increasing complexity of global energy trade flows. The training materials for DEWA should be adapted to the local operational context, including the specific sanctions and export risks associated with West Africa energy operations, and should be delivered in a format accessible to DEWA's workforce.
Gap 6: Real-Time Compliance Alerts. No mechanism is currently in place for delivering real-time compliance alerts to frontline trading staff regarding new OFAC designations, amendments to existing sanctions programs, or changes to EAR rules and restrictions. Given the speed at which new designations can materially affect the permissibility of ongoing transactions — again, as demonstrated by the April 6, 2022 Volkhov designation — the Enhanced Program should include an automated alert system that pushes notifications to relevant personnel immediately upon the publication of new OFAC designations, Federal Register notices, BIS Entity List additions, and other relevant regulatory developments.
D. Confidential Reporting Structure and Investigation Process
1. DOJ Guidance Requirements. The DOJ Guidance requires that companies maintain an effective mechanism for employees to report compliance concerns confidentially and, where possible, anonymously, without fear of retaliation. The DOJ Guidance further requires that companies establish defined processes for conducting internal investigations of reported concerns, including appropriate scoping, staffing, and documentation of investigations.
2. Enhanced Program Alignment. The Enhanced Program establishes an anonymous compliance hotline to be administered by an independent third-party provider. The hotline is designed to allow employees at all Dunmore entities — regardless of geographic location — to report potential sanctions violations, export control concerns, and other compliance issues anonymously and in their preferred language.
Reports received through the hotline will be directed to CCO Priya Nayar, with a parallel reporting line to the Audit Committee of the Board of Directors. This dual-reporting structure is designed to ensure that compliance concerns are addressed at the operational level by the CCO while also providing the Board with direct visibility into the nature and volume of reported concerns.
The investigation protocols set forth in the Enhanced Program are modeled on the witness interview protocol and Upjohn warning framework that Calderwood & Harkness established on April 18, 2022, for use during the internal investigation. These protocols specify procedures for conducting witness interviews, including the delivery of Upjohn warnings, the preservation and collection of relevant documents and communications, the engagement of forensic specialists as warranted, and the documentation and reporting of investigation findings.
3. Remaining Gaps. Two gaps have been identified in the confidential reporting structure:
Gap 7: Hotline Vendor Selection. The independent third-party hotline vendor has not yet been selected or contracted. This is a threshold implementation requirement that should be completed before the Board's anticipated adoption of the Enhanced Program on October 1, 2023. CCO Priya Nayar should evaluate potential vendors, including their capability to provide multi-language support (at minimum, English, Arabic, and German), 24/7 availability, web-based and telephone reporting options, and secure case management functionality.
Gap 8: Anti-Retaliation Policy. The Enhanced Program does not yet include a formalized anti-retaliation policy with sufficient enforcement mechanisms. While the Enhanced Program references the importance of protecting reporters from retaliation, it does not include specific prohibitions on retaliatory conduct, definitions of what constitutes retaliation, mechanisms for investigating alleged retaliation, or disciplinary measures for employees found to have engaged in retaliation against a reporter. The DOJ Guidance places significant weight on the existence of robust anti-retaliation protections as an indicator that the compliance program is genuinely designed to encourage reporting. The anti-retaliation policy should be developed, approved, and distributed to all employees in conjunction with the Enhanced Program rollout.
E. Third-Party Management
1. DOJ Guidance Requirements. The March 2023 update to the DOJ Guidance places heightened emphasis on the risk-based due diligence that companies are expected to conduct with respect to third-party relationships, including intermediaries, agents, consultants, joint venture partners, and other business counterparties. Prosecutors are instructed to evaluate not only the rigor of due diligence at the onboarding stage but also whether the company engages in ongoing monitoring of third-party relationships throughout the duration of those relationships. This enhanced focus on third-party management is directly relevant to Dunmore's circumstances, given that the sanctions violations at issue were facilitated by DTI's failure to identify the beneficial ownership connections between its counterparties (Petronova Trading FZE and Zenith Petroleum DMCC) and the sanctioned Volkhov Industrial Group, and the export control violations were facilitated by the use of Caspian Logistik GmbH as an intermediary to obscure the ultimate Russian end users.
2. Enhanced Program Alignment. The Enhanced Program includes significantly strengthened due diligence protocols for all counterparties, intermediaries, and logistics providers. The enhanced protocols require the following:
• Mandatory Beneficial Ownership Verification. For all new counterparties, the Enhanced Program requires verification of beneficial ownership, incorporating OFAC's 50% Rule analysis, under which the property and interests in property of entities owned 50% or more (individually or in the aggregate) by one or more SDN-listed persons are themselves blocked, regardless of whether the entity itself appears on the SDN List. This requirement directly addresses the root cause of the Petronova Trading FZE failure: the beneficial ownership analysis documented in the June 15, 2022 memorandum by Liam Donahue and the Volkhov 50% Rule analysis set forth in the June 20, 2022 memorandum by Conrad Reeves established that Volkhov Industrial Group held a controlling interest in Petronova through a chain of intermediate entities, which would have triggered blocking obligations under OFAC's 50% Rule had the analysis been conducted at onboarding.
• Ongoing Re-Screening. All existing counterparties are subject to annual re-screening against the OFAC SDN List, SSI List, Entity List, and Denied Persons List. This ensures that counterparties that were permissible at onboarding but are subsequently designated are identified promptly.
• Risk-Tiering. Counterparties are classified as "high," "medium," or "low" risk based on a multi-factor assessment that considers jurisdiction of incorporation and operations, industry sector, ownership structure and opacity, transaction volume and frequency, and any prior compliance incidents or adverse media. High-risk counterparties are subject to enhanced due diligence, including more frequent re-screening and senior management approval requirements.
3. Remaining Gaps. Two gaps have been identified in the third-party management component:
Gap 9: Free Zone Entity Due Diligence. The Enhanced Program's due diligence protocols do not yet incorporate enhanced procedures specifically tailored to free zone entities ("FZEs") and DMCC-registered companies. Free zone entities in the UAE — including Jebel Ali Free Zone and the DMCC — present elevated due diligence challenges because of the relative ease of formation, limited public beneficial ownership disclosure requirements, and the prevalence of nominee and shelf-company structures. Both Petronova Trading FZE and Zenith Petroleum DMCC were free zone entities, and the opacity of their ownership structures was a material contributing factor in DTI's failure to identify their connections to Volkhov. The Enhanced Program should include specific due diligence procedures for FZE and DMCC counterparties, including requirements for obtaining and verifying original incorporation documents, nominee shareholder disclosures, and independent corporate registry searches.
Gap 10: Counterparty Sanctions Compliance Contractual Provisions. No existing contractual template requires counterparties to provide sanctions compliance representations and warranties. Standard trading agreements used by DTI do not include clauses requiring counterparties to represent that they are not owned or controlled by sanctioned persons, that they will comply with applicable sanctions and export control laws, and that they will notify DTI immediately upon any change in ownership or control that could affect sanctions compliance. Such contractual provisions serve both as a deterrent and as a basis for termination rights in the event of counterparty non-compliance. Marcus Wellbourne and Conrad Reeves should develop standard sanctions compliance clauses for inclusion in all new trading agreements and, to the extent commercially practicable, in renewals or amendments of existing agreements.
F. Mergers and Acquisitions (M&A) Diligence
1. DOJ Guidance Requirements. The DOJ Guidance directs prosecutors to evaluate whether the company conducts pre-acquisition due diligence to identify sanctions and compliance risks associated with potential acquisition targets, and whether the company has processes for integrating acquired entities into its compliance program post-acquisition. The DOJ has emphasized that compliance due diligence in the M&A context is an important indicator of a company's overall commitment to compliance.
2. Enhanced Program Alignment. The Enhanced Program includes a sanctions due diligence module applicable to any future merger, acquisition, joint venture, or similar strategic transaction undertaken by Dunmore or any of its subsidiaries. The module specifies the sanctions and export control due diligence procedures to be conducted during the pre-transaction phase, including counterparty and target screening, beneficial ownership analysis, review of the target's sanctions compliance program, and assessment of the target's transaction history for potential sanctions exposure. The module also includes post-closing integration procedures designed to ensure that acquired entities are promptly brought into compliance with the Enhanced Program.
While this module is of lower immediate priority given Dunmore's current focus on remediating the conduct at issue and implementing the Enhanced Program, the framework is in place and can be activated when needed.
3. Remaining Gaps. No material gaps have been identified in the M&A diligence component at this time. The framework is adequate for Dunmore's current operations and anticipated transaction activity.
V. Benchmarking Analysis: Fundamental Question Two — Is the Compliance Program Adequately Resourced and Empowered?
The DOJ Guidance's second fundamental question asks whether the compliance program is being applied earnestly and in good faith — that is, whether it is adequately resourced and empowered to function effectively. This inquiry encompasses the commitment of senior and middle management, the autonomy and resources of the compliance function, and the company's use of incentive structures and disciplinary measures to promote compliance.
A. Commitment by Senior and Middle Management
1. DOJ Guidance Requirements. The DOJ Guidance directs prosecutors to evaluate whether senior management has clearly articulated the company's ethical standards and compliance expectations, and whether the conduct of senior leadership — the "tone at the top" — reflects a genuine commitment to compliance. Equally important, prosecutors are instructed to assess the "tone at the middle" — that is, whether middle management reinforces and implements compliance expectations in day-to-day operations. A company that professes a commitment to compliance at the senior leadership level but fails to embed that commitment at the operational level will not satisfy the DOJ Guidance.
2. Enhanced Program Alignment. Several actions taken by Dunmore since the inception of the DOJ inquiry demonstrate a genuine commitment to compliance at the senior leadership level:
• Appointment of Priya Nayar as CCO. The appointment of Priya Nayar as Chief Compliance Officer on August 1, 2022 — less than four months after the DOJ inquiry was opened — demonstrates Dunmore's commitment to empowering the compliance function with qualified leadership. Nayar has a direct reporting line to both the Board of Directors and CEO Callum Renshaw, ensuring that the CCO has unimpeded access to the highest levels of corporate governance.
• Personnel Accountability. The departure of Gerald Fisk (June 10, 2022), the separation of Natasha Sorokin (September 15, 2022), and the separation of Derek Hargrave (October 1, 2022) demonstrate that Dunmore has held individuals accountable for their roles in the compliance failures that led to the conduct at issue. These personnel actions signal to the organization that compliance failures will result in meaningful consequences.
• Board-Level Oversight. The Board's Audit Committee has been actively engaged in overseeing the remediation efforts, and the Board is expected to adopt the Enhanced Program by formal resolution on October 1, 2023. This Board-level engagement demonstrates that compliance oversight is treated as a governance-level priority, not merely an operational function.
3. Remaining Gaps. One gap has been identified with respect to middle-management commitment:
Gap 11: Middle-Management Compliance KPIs. While the Enhanced Program establishes compliance responsibilities at the CCO and senior management levels, it does not yet formalize compliance responsibilities for middle-management positions with specific, measurable key performance indicators ("KPIs"). In particular, regional heads such as Omar Al-Rashidi (Head of Middle East Operations, who has been identified as a cooperating witness in the investigation) and Yves Leclerc (Director of Logistics) should have explicit compliance obligations — including responsibility for ensuring that their direct reports complete required training, adhere to screening and due diligence protocols, and escalate compliance concerns promptly — incorporated into their revised position descriptions. Compliance performance against these KPIs should be a factor in middle managers' annual performance evaluations and compensation decisions.
B. Autonomy and Resources
1. DOJ Guidance Requirements. The DOJ Guidance requires that the compliance function have adequate funding, staffing, and independence from the business units it oversees. The compliance function should not be subordinated to the business functions it is tasked with monitoring, and it should have sufficient resources — both human and technological — to carry out its mandate effectively. The March 2023 update places particular emphasis on the compliance function's access to relevant data, data sources, and analytics tools, reflecting the DOJ's recognition that modern compliance programs must leverage technology to be effective.
2. Enhanced Program Alignment. CCO Priya Nayar presides over a dedicated compliance team that has been meaningfully expanded since August 2022, with three additional compliance analysts hired to support the Enhanced Program's implementation and ongoing operations. The compliance function operates with independent budget authority, meaning that compliance expenditures are not subject to approval by business-unit leaders — a structural feature designed to prevent the business from exerting budgetary pressure that could undermine the compliance function's effectiveness. Additionally, the compliance team has been granted unrestricted access to all transaction data, trading systems, and communications platforms across all Dunmore entities, ensuring that the compliance function is not impeded in its ability to monitor and investigate potential violations.
3. Remaining Gaps. Two gaps have been identified with respect to autonomy and resources:
Gap 12: Automated OFAC Screening Integration. The Enhanced Program calls for automated, real-time OFAC screening integrated directly into DTI's trading platform, replacing the manual screening refresh protocol that was in place during the period of the conduct at issue. It was the inadequacy of the manual screening protocol that allowed Gerald Fisk discover the Volkhov exposure only on April 11, 2022 — five days after the SDN designation on April 6, 2022 — rather than immediately upon the designation becoming effective. The automated screening tool should be procured, tested, and integrated into the trading platform as a matter of the highest priority. Until automated screening is operational, the Enhanced Program will continue to rely on manual processes that are inherently slower and more error-prone, and that the DOJ would likely view as inconsistent with best practices.
Gap 13: Data Analytics for Transaction Monitoring. The Enhanced Program's data analytics capabilities for transaction monitoring remain underdeveloped. The forensic tracing methodology employed by Ridgeline Advisory Group LLC — which identified the $34.2 million in structured payments across 127 Crescent Commercial Bank PJSC transactions — was conducted as a post-hoc forensic exercise during the internal investigation, not as part of any real-time or near-real-time monitoring system. The Enhanced Program should incorporate data analytics capabilities modeled on Ridgeline's methodology, including algorithms designed to detect structuring patterns, unusual payment flows, transactions involving high-risk jurisdictions, and other indicators of potential sanctions evasion. The DOJ Guidance's March 2023 emphasis on data and analytics makes this a particularly important area for investment.
C. Incentives and Disciplinary Measures
1. DOJ Guidance Requirements. The March 2023 update to the DOJ Guidance places specific emphasis on compensation structures and the consequences imposed for compliance failures, including clawback provisions that allow the company to recoup compensation from employees whose misconduct results in compliance violations. Prosecutors are instructed to evaluate whether the company's compensation program incentivizes compliance and whether disciplinary measures for compliance violations are consistently and fairly applied across the organization, regardless of the seniority or revenue-generating capacity of the employee involved.
2. Enhanced Program Alignment. The Enhanced Program includes a requirement that compliance performance be a factor in annual performance reviews and compensation decisions for all DTI and management-level employees. This integration of compliance metrics into the compensation structure ensures that employees have a direct financial incentive to adhere to the Enhanced Program's requirements. The separations of Derek Hargrave and Natasha Sorokin, and the departure of Gerald Fisk, provide concrete precedent within the organization that compliance failures result in significant consequences, including termination of employment.
3. Remaining Gaps. Three gaps have been identified with respect to incentives and disciplinary measures:
Gap 14: Compensation Clawback Provisions. No formal clawback provisions are currently in place that would allow Dunmore to recoup compensation — including bonuses, commissions, and other incentive compensation — tied to transactions that are later found to involve sanctions violations or other compliance failures. This is a specific area that the March 2023 DOJ Guidance emphasizes, and the absence of clawback provisions represents a notable gap that prosecutors would likely scrutinize. Marcus Wellbourne and CCO Priya Nayar should work together to draft and implement a clawback policy that applies retroactively (to the extent permitted by applicable law and existing employment agreements) to compensation attributable to transactions subsequently determined to involve compliance violations.
Gap 15: Formal Disciplinary Matrix. The Enhanced Program does not yet include a formalized disciplinary matrix with escalating consequences for compliance violations. While the separations of Hargrave and Sorokin demonstrate that Dunmore is willing to impose severe consequences for serious violations, the absence of a structured, transparent disciplinary framework creates a risk that less severe violations may be addressed inconsistently. A formal disciplinary matrix — specifying the range of consequences for violations of varying severity, from counseling and written warnings for minor infractions to termination and referral for legal action for serious violations — should be developed and integrated into the Enhanced Program.
Gap 16: Indemnification and Advancement of Defense Costs. Dunmore has advanced approximately $3.4 million in individual counsel fees for Gerald Fisk, Natasha Sorokin, and Derek Hargrave under its existing indemnification obligations. While the advancement of defense costs is legally required under many corporate indemnification provisions and is generally consistent with corporate governance best practices, the DOJ may scrutinize whether Dunmore's indemnification agreements appropriately balance the company's obligations to its current and former employees against the need to hold individuals accountable for compliance failures. Future indemnification agreements should be reviewed to determine whether conduct-based forfeiture clauses — under which an employee's right to indemnification and advancement is forfeited if the employee is found to have engaged in willful or criminal conduct — should be incorporated.
VI. Benchmarking Analysis: Fundamental Question Three — Does the Compliance Program Work in Practice?
The DOJ Guidance's third fundamental question asks whether the corporation's compliance program works in practice. This is perhaps the most critical of the three fundamental questions, because it tests whether the compliance program, however well designed and resourced, actually operates effectively to detect, prevent, and remediate compliance violations. The inquiry encompasses continuous improvement through periodic testing and review, investigation of misconduct, and analysis and remediation of the root causes of any underlying misconduct.
A. Continuous Improvement, Periodic Testing, and Review
1. DOJ Guidance Requirements. The DOJ Guidance directs prosecutors to evaluate whether the company conducts internal audits and testing of its compliance controls, and whether the company engages in continuous improvement of its compliance program based on lessons learned from compliance incidents, regulatory developments, and evolving risks. A compliance program that is designed and implemented but never tested or updated will not satisfy the DOJ's expectations.
2. Enhanced Program Alignment. The Enhanced Program contemplates an ongoing monitoring and testing framework, the details of which are to be developed in a separate memorandum targeted for completion by December 15, 2023 (to be prepared by Jasmine Thornton). The framework will include the following components:
• Annual Independent Assessment. An annual independent assessment of the Enhanced Program's design and operational effectiveness, to be conducted by Pemberton Investors Solutions or a qualified successor firm. This assessment will evaluate whether the Enhanced Program continues to be appropriately tailored to Dunmore's evolving risk profile and whether its controls are functioning as intended.
• Quarterly Transaction Sampling and Screening Audits. Quarterly sampling of transactions across all Dunmore entities to verify that OFAC screening, export classification, counterparty due diligence, and escalation protocols are being followed consistently. Screening audits will test the accuracy and completeness of screening results and the timeliness of screening refreshes.
3. Remaining Gaps. Two gaps have been identified:
Gap 17: Testing Framework. The monitoring and testing framework has not yet been finalized. This is a key deliverable that must be completed before the supplemental remediation report is submitted to DOJ on January 15, 2024. The framework should specify testing methodologies, sampling parameters, reporting formats, and remediation tracking procedures, and should be designed to generate the type of documented evidence of program effectiveness that the DOJ Guidance contemplates.
Gap 18: Internal Audit Function for Compliance. Dunmore does not currently have an internal audit function with a compliance audit mandate. The external audit firm, Ashford & Whitmore LLP (engagement partner Kenneth Ashford), provides financial audit services but does not have a mandate to audit compliance controls. The Enhanced Program should establish either a dedicated internal compliance audit function or a supplemental engagement with an external firm specifically tasked with auditing the Enhanced Program's controls on a periodic basis, separate from the annual independent assessment described above.
B. Investigation of Misconduct
1. DOJ Guidance Requirements. The DOJ Guidance requires that companies conduct properly scoped internal investigations with qualified personnel when compliance issues are identified. Investigations should be thorough, timely, and independent, and should include root cause analysis of the underlying misconduct to ensure that remediation efforts address the systemic factors that enabled the misconduct, not just its symptoms.
2. Enhanced Program Alignment. The internal investigation conducted by Calderwood & Harkness provides a strong model for future investigations and demonstrates Dunmore's capacity to investigate misconduct thoroughly and effectively. The investigation encompassed 47 witness interviews conducted across three rounds, the collection and review of 2,347,812 documents through Nexagen Analytics' technology-assisted review protocol, forensic accounting by Ridgeline Advisory Group, and the preparation of a comprehensive 176-page report documenting the findings.
The root cause analysis conducted during the investigation identified the following primary root causes of the underlying misconduct:
• Gerald Fisk's failure to maintain real-time screening protocols, resulting in reliance on periodic manual screening refreshes that were insufficiently frequent and inadequately documented;
• The absence of beneficial ownership verification procedures for trading counterparties, which allowed DTI to onboard Petronova Trading FZE and Zenith Petroleum DMCC without identifying their ownership connections to Volkhov Industrial Group;
• Insufficient export classification review and end-user verification, which allowed Caspian Logistik GmbH to submit falsified end-user certificates without independent verification; and
• The absence of real-time transaction monitoring capabilities, which allowed $34.2 million in structured payments through Crescent Commercial Bank to go undetected until the post-hoc forensic analysis.
The Enhanced Program incorporates documented investigation procedures for future compliance incidents, based on the Calderwood & Harkness investigation protocol.
3. Remaining Gaps. One gap has been identified:
Gap 19: Standing Internal Investigations Protocol. The Enhanced Program should establish a standing internal investigations protocol that can be deployed for lower-severity matters without the need to retain external counsel. While external counsel will continue to be engaged for matters involving potential criminal liability, government inquiries, or other high-severity issues, the company should have the capacity to investigate lower-severity compliance concerns — such as isolated screening failures, training deficiencies, or procedural lapses — using internal resources. The protocol should specify investigation procedures, documentation require

MEMORANDUM

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

MATTER NO.: 1016-00009

Record

Parties

Dates

Amounts