CALDERWOOD & HARKNESS LLP 1750 Pennsylvania Avenue NW, Suite 800 Washington, DC 20006
MEMORANDUM
PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT This memorandum constitutes attorney-client privileged communication and attorney work product prepared in anticipation of litigation and in connection with the provision of legal advice. This document should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP.
TO: Victoria Chambers, Responsible Partner Conrad Reeves, Senior Counsel, Export Controls & Sanctions
FROM: Jasmine Thornton, Lead Associate, White Collar & Investigations
DATE: December 15, 2023
RE: Ongoing Monitoring & Testing Framework for Enhanced Sanctions & Export Controls Compliance Program — Dunmore Energy Holdings Ltd.
Matter No.: 1016-00009
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to set forth the comprehensive ongoing monitoring, testing, and audit framework designed to ensure the sustained effectiveness of Dunmore Energy Holdings Ltd.'s ("Dunmore" or "DEH") Enhanced Sanctions & Export Controls Compliance Program (the "Enhanced Program"), which was formally adopted by the Board of Directors of Dunmore Energy Holdings Ltd. on October 1, 2023. This memorandum provides a detailed roadmap for the ongoing implementation, verification, and continuous improvement of the Enhanced Program's controls and procedures, and is intended to serve as a foundational document for both internal governance and external engagement with the U.S. Department of Justice ("DOJ").
The Enhanced Program was developed in direct response to the DOJ National Security Division inquiry opened on April 19, 2022, concerning potential violations of U.S. sanctions laws — including programs administered by the Office of Foreign Assets Control ("OFAC") of the U.S. Department of the Treasury — and export control regulations administered by the Bureau of Industry and Security ("BIS") of the U.S. Department of Commerce. The inquiry arose from activities conducted at the Dubai-based trading desk of Dunmore Trading International Ltd. ("DTI"), a wholly owned subsidiary of Dunmore Energy Holdings Ltd. As described in greater detail in Section II below, the underlying conduct at issue involved crude oil swap transactions, oilfield equipment exports, and structured payments involving counterparties with undisclosed ties to sanctioned Russian entities.
This monitoring and testing framework has been designed to align with the DOJ Evaluation of Corporate Compliance Programs, as updated in March 2023 (the "DOJ Evaluation Guidance"), which sets forth the criteria the DOJ uses to assess the effectiveness of corporate compliance programs in the context of enforcement decisions. The framework has been benchmarked against the DOJ Evaluation Guidance as detailed in the Compliance Program Benchmarking Memorandum prepared by the undersigned and dated September 1, 2023 (the "Benchmarking Memorandum"). In particular, the framework addresses each of the three fundamental questions posed by the DOJ Evaluation Guidance: (1) whether the compliance program is well-designed; (2) whether the program is being applied earnestly and in good faith — in other words, whether it is adequately resourced and empowered to function effectively; and (3) whether the compliance program works in practice, which is the central focus of this monitoring and testing framework.
The framework further reflects the remediation recommendations contained in the comprehensive remediation report delivered on September 15, 2023, by Pemberton Investors Solutions LLC ("Marlowe Asset Management"), an independent compliance consulting firm retained by Dunmore at Calderwood & Harkness's recommendation. The Marlowe Asset Management remediation report was prepared under the direction of Dr. Anton Bremer, a recognized expert in sanctions compliance program design and a former senior advisor to OFAC. Calderwood & Harkness's own remediation workstream, conducted in parallel with and complementary to Marlowe Asset Management's engagement, has likewise informed the design of the monitoring and testing protocols described herein.
The monitoring and testing framework described in this memorandum is intended to be presented to the DOJ as part of the Supplemental Remediation Report to DOJ, which is scheduled for submission on January 15, 2024. The Supplemental Remediation Report will serve as the primary vehicle for demonstrating Dunmore's ongoing compliance commitment and the robustness of the Enhanced Program's monitoring and testing infrastructure. It is anticipated that the framework described herein, together with the broader remediation narrative, will materially support Dunmore's request for a declination of prosecution under the DOJ Corporate Enforcement Policy, as updated in September 2022.
The framework is built upon the following key design principles, each of which reflects best practices identified in the DOJ Evaluation Guidance and OFAC's Economic Sanctions Enforcement Guidelines:
• Risk-Based Approach: Monitoring and testing activities are calibrated to the specific risk profile of Dunmore's business operations, with enhanced scrutiny applied to higher-risk counterparties, jurisdictions, products, and transaction types. Resources are allocated proportionally to the areas of greatest sanctions and export control risk.
• Independence of Testing Function: The framework establishes a clear separation between day-to-day compliance activities performed by business units (the first line of defense) and the monitoring, testing, and audit functions performed by the Compliance Department (second line) and internal audit (third line). This independence is essential to ensuring the objectivity and credibility of testing results.
• Integration of Technology: The framework leverages automated screening systems, data analytics platforms, and transaction monitoring tools to enhance the efficiency and coverage of monitoring activities. Technology is used both for real-time interdiction and for retrospective anomaly detection.
• Regular Reporting to Board and Senior Leadership: The framework establishes a structured reporting cadence, including quarterly compliance reports to the Board of Directors and an annual comprehensive compliance assessment, ensuring that senior leadership remains informed of the program's effectiveness and any areas requiring remediation.
• Documentation and Audit Trail: All monitoring, testing, and audit activities are documented in a centralized compliance management system, creating a comprehensive and accessible audit trail. This documentation serves both internal governance objectives and the need to demonstrate compliance commitment to regulators.
II. Background and Procedural Context
A. The DOJ Inquiry and Internal Investigation
On April 19, 2022, the DOJ National Security Division opened a formal inquiry into Dunmore Energy Holdings Ltd. and its subsidiary, Dunmore Trading International Ltd., concerning potential violations of U.S. sanctions laws and export control regulations. The inquiry was initiated following intelligence received by the DOJ from multiple sources, including referrals from the Financial Crimes Enforcement Network ("FinCEN") and information developed through interagency coordination with OFAC and BIS. On the same date, grand jury subpoena GJ No. 22-418 was issued by the U.S. District Court for the District of Columbia (Grand Jury 22-2), commanding the production of extensive categories of documents relating to DTI's trading activities, counterparty relationships, and compliance functions.
The lead prosecutor assigned to the matter is Assistant United States Attorney Meredith Calloway of the DOJ National Security Division, Counterintelligence and Export Control Section ("CES"). AUSA Calloway is assisted by Trial Attorneys Samuel Kovacs and Diana Pressman, also of CES. The prosecution team has been actively engaged with Calderwood & Harkness throughout the investigation and remediation process, and counsel have maintained a constructive and cooperative dialogue regarding the scope and progress of Dunmore's remediation efforts.
Upon receipt of the grand jury subpoena, Dunmore retained Calderwood & Harkness LLP to conduct a comprehensive internal investigation. The investigation was conducted under the direction of Victoria Chambers, Responsible Partner, and Conrad Reeves, Senior Counsel, with the undersigned serving as Lead Associate. The investigation involved the collection and review of over 2.3 million documents — specifically, 2,347,812 documents collected across six jurisdictions: the Cayman Islands, the United Arab Emirates, the United States, Germany, Nigeria, and the United Kingdom. Document collection was performed by Nexagen Analytics Inc. (Project No. NX-DEH-2204), a leading e-discovery and data analytics firm, and included email communications, instant messages, trading records, compliance files, financial records, shipping documentation, corporate formation documents, and bank records.
The investigation further included three rounds of witness interviews, encompassing a total of 47 individuals across the Dunmore organization and certain third parties. The first round consisted of 22 interviews conducted between June and August 2022, focusing on individuals with direct involvement in DTI's Dubai trading operations and compliance functions. The second round consisted of 15 interviews conducted between October and December 2022, focusing on senior management, finance personnel, and logistics staff. The third round consisted of 10 follow-up interviews conducted between February and April 2023, addressing specific factual questions that arose from the document review and forensic accounting analysis.
Forensic accounting services were provided by Ridgeline Advisory Group LLC ("Ridgeline"), under Engagement No. RAG-2022-0319. The engagement was led by Dr. Margaret Liu, CPA, CFE, a former forensic accountant with the Federal Bureau of Investigation's Financial Crimes Unit. Ridgeline's forensic analysis focused on tracing fund flows associated with the suspect transactions, reconstructing the economics of the crude oil swap transactions, identifying structured payment patterns, and quantifying the financial benefit derived by Dunmore from the tainted transactions.
The internal investigation culminated in a 176-page internal investigation report, which was submitted to the DOJ on May 15, 2023. The report set forth the factual findings of the investigation, including a detailed chronology of the conduct at issue, an analysis of the individuals involved and their respective roles, and an assessment of the compliance and control failures that enabled the conduct to occur and persist undetected for approximately two years.
B. The Conduct at Issue
The internal investigation established that between approximately March 2020 and April 2022, DTI's Dubai-based trading desk engaged in a series of crude oil swap transactions, oilfield equipment exports, and structured payments involving counterparties with undisclosed ties to Volkhov Industrial Group JSC ("Volkhov"), a Russian industrial conglomerate with significant interests in the energy, petrochemical, and defense sectors. Volkhov was designated by OFAC under Directive 2 of Executive Order 13662 on November 15, 2019, which prohibited U.S. persons from engaging in certain debt and equity transactions with designated entities. Volkhov was subsequently designated as a Specially Designated National ("SDN") under Executive Order 14024 on April 6, 2022, resulting in full blocking of Volkhov's assets within U.S. jurisdiction and a comprehensive prohibition on transactions involving Volkhov.
The conduct at issue involved three principal categories of activity:
Crude Oil Swap Transactions. DTI's Dubai trading desk executed 14 crude oil swap transactions with a combined notional value of approximately $218.7 million through two Dubai-based counterparties: Petronova Trading FZE ("Petronova") and Zenith Petroleum DMCC ("Zenith"). The internal investigation determined that 9 of these 14 transactions, representing approximately $156.3 million in notional value, involved entities with direct or indirect ties to Volkhov. Specifically, Petronova was controlled by Sergei Volkov, a close associate and business partner of Arkady Volkhov, the founder and controlling shareholder of Volkhov Industrial Group JSC. Zenith Petroleum DMCC was ultimately owned through a chain of nominee entities by Arkady Volkhov himself, though this ownership was concealed through a multi-layered corporate structure involving entities registered in the Cayman Islands and the British Virgin Islands.
Oilfield Equipment Exports. DTI facilitated the export of oilfield equipment valued at approximately $12.4 million through Caspian Logistik GmbH ("Caspian Logistik"), a Germany-based logistics and shipping company managed by Klaus Weidemann. The equipment included items classified under Export Control Classification Numbers ("ECCN") 2B350 and 2B999, which are subject to export licensing requirements under the Export Administration Regulations ("EAR"). The investigation determined that certain of these exports were potentially in violation of EAR §746.5, which imposes comprehensive restrictions on exports, reexports, and transfers (in-country) to Russia and Belarus. The end-user certificates associated with several of these shipments were determined to be falsified, listing end-users in Turkey and the UAE when the actual end-users were located in Russia.
Structured Payments. DTI processed approximately $34.2 million in structured payments across 127 individual wire transfer transactions through Crescent Commercial Bank PJSC ("Crescent"), a Dubai-based financial institution. These payments were processed between March 2020 and March 2022 and were associated with the crude oil swap transactions and equipment exports described above. The forensic analysis conducted by Ridgeline Advisory Group identified patterns consistent with deliberate structuring designed to obscure the ultimate beneficiaries of the payments and to avoid triggering enhanced due diligence thresholds at correspondent banking institutions.
C. Remediation Steps Taken
Following the commencement of the DOJ inquiry and the internal investigation, Dunmore undertook a series of significant remediation measures, which are summarized below and described in greater detail in prior memoranda and the Marlowe Asset Management remediation report.
Personnel Actions. Priya Nayar was appointed Chief Compliance Officer of Dunmore Energy Holdings Ltd. on August 1, 2022, replacing Gerald Fisk, who departed the company on June 10, 2022. Ms. Nayar was recruited from a senior compliance leadership role at a major international energy company and brings extensive experience in sanctions compliance program design and implementation. Derek Hargrave, President of DTI, was placed on administrative leave effective July 1, 2022, and was formally separated from the company on October 1, 2022. Natasha Sorokin, the Senior Trader on DTI's Dubai trading desk who was directly responsible for the execution of the suspect transactions, was placed on administrative leave effective May 16, 2022, and was separated from the company on September 15, 2022.
External Compliance Consultant. Pemberton Investors Solutions LLC was retained on December 15, 2022, to conduct an independent assessment of Dunmore's existing compliance program and to develop comprehensive remediation recommendations. Marlowe Asset Management's engagement was led by Dr. Anton Bremer, who conducted a thorough review of Dunmore's compliance policies, procedures, systems, and organizational structure. Marlowe Asset Management delivered its remediation report on September 15, 2023, which contained detailed recommendations for the design and implementation of the Enhanced Program.
Board Adoption of Enhanced Program. The Board of Directors of Dunmore Energy Holdings Ltd. formally adopted the Enhanced Sanctions & Export Controls Compliance Program on October 1, 2023, following extensive review and discussion with senior management, the CCO, and outside counsel.
Voluntary Self-Disclosure. Dunmore filed a voluntary self-disclosure ("VSD") with OFAC on June 1, 2023, disclosing the conduct identified through the internal investigation. The VSD was filed in accordance with OFAC's Enforcement Guidelines, which provide that voluntary self-disclosure is a significant mitigating factor in OFAC's determination of the appropriate enforcement response.
Voluntary Disgorgement. On November 30, 2023, Dunmore made a voluntary disgorgement payment of $8.75 million to the U.S. Treasury. This amount was derived from the estimated net profit attributable to the 9 tainted crude oil swap transactions involving Volkhov-connected entities, calculated as $156.3 million in notional value multiplied by an estimated net margin of 5.6%, as determined through the forensic analysis conducted by Ridgeline Advisory Group.
Compliance Program Benchmarking. The Benchmarking Memorandum prepared by the undersigned on September 1, 2023, conducted a detailed benchmarking of the Enhanced Program against the criteria set forth in the DOJ Evaluation of Corporate Compliance Programs (March 2023 update). The Benchmarking Memorandum identified the Enhanced Program as substantially addressing each of the DOJ's enumerated evaluation criteria, while also identifying areas for continued development — including the monitoring and testing framework that is the subject of this memorandum.
III. Monitoring and Testing Framework — Structural Overview
A. Three Lines of Defense Model
The monitoring and testing framework is structured in accordance with the "Three Lines of Defense" model, which is widely recognized as a best practice in compliance program design and is consistent with the expectations reflected in the DOJ Evaluation Guidance. Under this model, responsibility for compliance is distributed across three distinct organizational layers, each with clearly defined roles and responsibilities:
First Line of Defense: Business Unit Compliance. The first line of defense consists of the personnel within Dunmore's operating business units — specifically, the trading desks (including DTI's Dubai trading desk, which has been reconstituted under new leadership), logistics and shipping functions, and finance and treasury operations. First-line personnel are responsible for day-to-day adherence to the Enhanced Program's policies and procedures, including real-time OFAC screening of counterparties and transactions, proper export classification of goods and technology, and compliance with payment processing procedures. First-line personnel are the initial point of contact for compliance obligations in the ordinary course of business and are expected to identify and escalate potential compliance issues in accordance with the escalation procedures established under the Enhanced Program.
Second Line of Defense: Compliance Department. The second line of defense is the Compliance Department, which operates under the direction of CCO Priya Nayar. The Compliance Department is responsible for policy interpretation and guidance, ongoing monitoring of compliance activities across all business units, review and adjudication of escalated compliance issues, and periodic testing of the effectiveness of first-line compliance controls. The Compliance Department also maintains the compliance management system, manages the training program, oversees the counterparty due diligence process, and prepares the quarterly and annual compliance reports described in this framework. As the second line, the Compliance Department serves as an independent check on the first line's compliance activities and provides the primary monitoring and testing function on an ongoing basis.
Third Line of Defense: Internal Audit. The third line of defense is the independent internal audit function, which provides periodic audits of the Enhanced Program's design and operating effectiveness. The internal audit function operates independently of both the business units and the Compliance Department, reporting directly to the Audit Committee of the Board of Directors. Internal audit's role in the monitoring and testing framework is to provide independent assurance that the first and second lines of defense are operating as designed and to identify any systemic deficiencies in the Enhanced Program's controls. Internal audit conducts its testing on an annual basis, as described in Section VII below, and its findings are reported directly to the Board through the Audit Committee.
Role of External Advisors. During the initial 12- to 18-month implementation period following the Board's adoption of the Enhanced Program on October 1, 2023, Calderwood & Harkness LLP and Pemberton Investors Solutions LLC will serve in an advisory capacity to support the deployment and operationalization of the monitoring and testing framework. Calderwood & Harkness will provide ongoing legal guidance on regulatory developments, assist with the preparation of regulatory submissions, and advise on the interpretation and application of sanctions and export control requirements. Marlowe Asset Management, under the direction of Dr. Anton Bremer, will provide hands-on compliance consulting support, assist with the design and calibration of monitoring protocols, and participate in the first two annual comprehensive compliance assessments (2024 and 2025) to ensure continuity from the remediation phase. The goal is for Dunmore's internal compliance infrastructure to be fully self-sustaining by mid-2025, with external advisors transitioning to an as-needed support role.
B. Reporting Structure
The reporting structure for the Enhanced Program's monitoring and testing framework is designed to ensure that compliance information flows efficiently and transparently to the appropriate levels of the organization, and that the Board of Directors and senior leadership have direct and timely visibility into the program's effectiveness.
CCO Priya Nayar reports directly to CEO Callum Renshaw on operational compliance matters and has an independent reporting line to the Board of Directors of Dunmore Energy Holdings Ltd. This dual reporting structure ensures that the CCO has direct access to the Board without the need for intermediation by operational management, which is consistent with the DOJ Evaluation Guidance's emphasis on the empowerment and independence of the compliance function. The CCO also has a dotted-line reporting relationship to General Counsel Marcus Wellbourne for purposes of legal coordination on matters involving potential regulatory exposure or enforcement risk.
The CCO prepares and presents quarterly compliance reports to the Board of Directors, as described in detail in Section XIII.A below. These reports summarize the results of monitoring and testing activities, training completion rates, whistleblower and escalation metrics, third-party due diligence status, and any material compliance incidents or near-misses that occurred during the reporting period.
An annual comprehensive compliance assessment is prepared and presented to the Board and shared with outside counsel, as described in Section VII below. This assessment provides a holistic evaluation of the Enhanced Program's design and operating effectiveness and serves as the primary vehicle for identifying areas requiring remediation or enhancement.
Information sharing with Dunmore's principal equity holders is governed by a Common Interest Agreement that has been executed among the relevant parties. Specifically, summary compliance updates are shared with Greystone Capital Partners Fund IV, L.P. ("Greystone"), which holds a 62.5% equity interest in Dunmore Energy Holdings Ltd. Greystone's outside counsel is Harwood & Pennington LLP, with lead partner Arthur Pennington III. Compliance updates are also shared with Thornbury Infrastructure Fund II, L.P. ("Thornbury"), which holds a 15% equity interest in Dunmore. The scope and format of the information shared with these equity holders is governed by the Common Interest Agreement and applicable information-sharing protocols, which have been designed to preserve privilege while ensuring that the equity holders have adequate visibility into the compliance program's effectiveness and any material risk developments.
IV. OFAC Sanctions Screening — Ongoing Monitoring Protocols
A. Automated Screening System
The cornerstone of the Enhanced Program's ongoing sanctions monitoring capability is a robust automated screening system that provides real-time interdiction screening of all relevant parties against applicable OFAC sanctions lists and programs. The automated screening system is designed to screen all counterparties, beneficial owners, intermediaries, brokers, agents, freight forwarders, and end-users prior to the initiation of any transaction or business relationship, and on an ongoing basis throughout the duration of any such relationship.
The screening system checks all relevant parties against the following OFAC-administered lists and programs, at a minimum:
• OFAC Specially Designated Nationals and blocked Persons List (the "SDN List");
• Sectoral Sanctions Identifications List (the "SSI List");
• OFAC Consolidated Sanctions List (which includes the SDN List, the SSI List, the Foreign Sanctions Evaders List, the Non-SDN Palestinian Legislative Council List, the Non-SDN Menu-Based Sanctions List, and other OFAC-administered lists);
• Country-specific sanctions programs, including those administered under Executive Order 14024 (pertaining to Russia), Executive Order 13662 and associated Directives (including Directive 2, under which Volkhov Industrial Group JSC was initially designated), and the regulations codified at 31 C.F.R. Part 589 (Ukraine/Russia-Related Sanctions Regulations); and
• Any other OFAC-administered sanctions lists or programs that are applicable to Dunmore's business operations.
In addition to real-time screening at the point of transaction initiation, the automated screening system is configured to perform weekly batch rescreening of all active counterparties, vendors, and business relationships across all Dunmore entities globally. This includes DEH (the parent holding company), DTI (the trading subsidiary), Dunmore upstream Assets LLC ("DUA"), Dunmore Renewables GmbH, and Dunmore East & West Africa Ltd. ("DEWA"). The weekly batch rescreening process ensures that any changes to OFAC sanctions lists — including new designations, modifications to existing designations, or removals — are promptly reflected in Dunmore's screening results.
In addition to the scheduled weekly batch rescreening, the system is configured to perform immediate rescreening upon any OFAC list update. OFAC periodically publishes updates to its sanctions lists, including SDN additions, modifications, and removals, and these updates can occur at any time without advance notice. The screening system is integrated with OFAC's RSS data feed to ensure that list updates are ingested promptly and that rescreening is triggered automatically upon each update.
The screening system is further integrated with the trade finance systems maintained by Dunmore's principal banking partners: Crescent Commercial Bank PJSC in Dubai and Meridian National Bank, N.A. in New York. This integration enables payment-level screening, ensuring that all wire transfers, letters of credit, and other payment instruments are screened against applicable OFAC lists prior to execution. The integration with Crescent Commercial Bank PJSC is of particular importance given the role that Crescent played in processing the structured payments at issue in the DOJ inquiry.
B. Beneficial Ownership and 50% Rule Monitoring
A critical deficiency identified in the internal investigation was DTI's failure to adequately identify and monitor the beneficial ownership of its counterparties — specifically, the failure to detect the ownership connections between Petronova Trading FZE, Zenith Petroleum DMCC, and Volkhov Industrial Group JSC (through the Sergei Volkov and Arkady Volkhov connections). Accordingly, the Enhanced Program places particular emphasis on ongoing monitoring of beneficial ownership, with protocols designed to address the specific vulnerabilities that enabled the underlying conduct to occur.
Beneficial ownership information for all active counterparties is subject to a minimum annual refresh, ensuring that ownership data remains current and accurate. In addition to the scheduled annual refresh, the Enhanced Program mandates an immediate refresh of beneficial ownership information upon the occurrence of any of the following triggering events:
• An adverse media alert or negative news report involving the counterparty, any of its principals, or any entity in its ownership chain;
• An OFAC designation or amendment involving any entity or individual associated with the counterparty;
• A transaction anomaly or compliance alert generated by the automated screening or monitoring systems; or
• A request from the Compliance Department or any first-line compliance personnel based on information received through any channel.
The Enhanced Program requires rigorous application of OFAC's "50% Rule," which provides that any entity that is owned, directly or indirectly, 50% or more (individually or in the aggregate) by one or more persons whose property and interests in property are blocked pursuant to an OFAC sanctions program is itself a blocked entity, regardless of whether it appears on the SDN List. The Compliance Department has implemented procedures to trace and aggregate direct and indirect ownership interests across complex corporate structures, including the use of corporate registry searches, beneficial ownership databases, and, where appropriate, third-party investigative due diligence providers.
Special monitoring protocols have been established for entities domiciled in or operating from jurisdictions of elevated sanctions risk, with particular focus on the jurisdictions implicated in the underlying conduct: the United Arab Emirates (as the domicile of Petronova Trading FZE, Zenith Petroleum DMCC, and Crescent Commercial Bank PJSC), Russia (as the domicile of Volkhov Industrial Group JSC), and Germany (as the domicile of Caspian Logistik GmbH). Counterparties in these jurisdictions are subject to more frequent beneficial ownership refreshes, enhanced due diligence at onboarding, and elevated scrutiny during ongoing monitoring.
The Enhanced Program incorporates detailed procedures for tracing indirect ownership chains, drawing directly on the lessons learned from the Petronova/Volkhov beneficial ownership structure. The investigation revealed that Volkhov's interest in Petronova was held through a series of nominee arrangements and intermediate holding entities, making direct ownership links difficult to identify through standard screening alone. The procedures now require compliance personnel to trace ownership chains to their ultimate beneficial owners, with a presumption of elevated risk for any counterparty where complete ownership transparency cannot be achieved.
C. Payment Monitoring
The payment monitoring protocols within the Enhanced Program are designed to detect and prevent the types of structured payment activity that characterized the underlying conduct. The investigation identified approximately $34.2 million in payments processed across 127 individual wire transfer transactions through Crescent Commercial Bank PJSC between March 2020 and March 2022, and the forensic analysis by Ridgeline Advisory Group identified patterns consistent with deliberate structuring.
Enhanced transaction monitoring has been implemented for all wire transfers processed through intermediary accounts, with specific focus on Dubai-based banking relationships. The monitoring protocols include automated alerts for patterns of payments that may be designed to obscure the ultimate beneficial ownership of the recipient or to structure transactions to avoid triggering enhanced due diligence or reporting thresholds at intermediary or correspondent financial institutions. The structuring detection algorithms have been calibrated using the patterns identified in the forensic analysis of the 127 transactions processed through Crescent, which included characteristics such as: payments broken into multiple smaller transfers within short time periods; payments routed through multiple intermediary accounts in different jurisdictions; payments to entities with opaque ownership structures; and payments with vague or inconsistent reference information.
The Crescent Commercial Bank PJSC relationship, managed by relationship manager Khalid Mansour, is subject to heightened oversight. All wire transfers processed through Crescent are subject to enhanced screening and monitoring, and the Compliance Department conducts periodic reviews of the banking relationship to ensure that adequate controls are in place at the correspondent banking level.
In addition to automated monitoring, the Compliance Department conducts a monthly review of all payments exceeding $500,000 in value that are directed to or received from counterparties in elevated-risk jurisdictions, as defined in the Enhanced Program's jurisdictional risk assessment. This manual review supplements the automated monitoring system and provides an additional layer of assurance that high-value transactions in elevated-risk corridors are receiving appropriate compliance scrutiny.
V. Export Controls — Ongoing Monitoring Protocols
A. Export Classification and License Determination
The export control monitoring protocols within the Enhanced Program address the specific vulnerabilities identified in connection with the oilfield equipment exports facilitated through Caspian Logistik GmbH. The investigation determined that DTI facilitated exports of items classified under ECCN 2B350 (chemical manufacturing equipment and components) and ECCN 2B999 (items controlled for anti-terrorism reasons), with certain of these exports potentially violating EAR §746.5, which imposes comprehensive restrictions on exports, reexports, and transfers (in-country) to Russia and Belarus.
The Enhanced Program mandates ongoing classification review of all oilfield equipment and components exported by DTI or any Dunmore subsidiary. Classification reviews are performed by trained compliance personnel with expertise in the Commerce Control List ("CCL") and the EAR's classification framework, and are subject to quality assurance review by the Compliance Department. Particular attention is directed to items classified under ECCN 2B350 and ECCN 2B999, which are the classifications most relevant to Dunmore's product portfolio and which were implicated in the underlying conduct.
A mandatory pre-shipment compliance review by the Compliance Department is required for any export to Russia, Belarus, or any other destination subject to restrictions under EAR §746.5 or other applicable EAR provisions. This pre-shipment review must be completed and documented prior to the release of any goods for shipment, and no goods may be exported to a restricted destination without affirmative written clearance from the Compliance Department. The pre-shipment review includes verification of the applicable ECCN classification, determination of whether an export license is required, confirmation that no prohibited end-use or end-user restrictions apply, and verification of the identity and bona fides of the consignee and end-user.
End-user certificate verification procedures have been significantly strengthened under the Enhanced Program, addressing the false end-user certification risk identified in connection with the Caspian Logistik GmbH shipments. The investigation revealed that Klaus Weidemann, the managing director of Caspian Logistik, facilitated the preparation of falsified end-user certificates that listed end-users in Turkey and the UAE when the actual end-users were located in Russia. Under the Enhanced Program, the Compliance Department is required to independently verify the identity and stated use of all end-users listed on end-user certificates through means that do not rely solely on information provided by the freight forwarder or logistics provider. Verification methods include direct communication with the purported end-user, independent corporate registry and business database searches, site visit or verification by a third-party due diligence provider (for high-value or elevated-risk shipments), and cross-referencing with commercial intelligence databases.
B. Denied Party and Entity List Screening
The Enhanced Program requires real-time screening of all parties to any export transaction against the full suite of BIS-administered restricted party lists, including:
• The BIS Entity List (15 C.F.R. Part 744, Supplement No. 4);
• The Denied Persons List;
• The Unverified List; and
• The Military End-User List (15 C.F.R. Part 744, Supplement No. 7).
This screening is performed in addition to, and in conjunction with, the OFAC sanctions screening described in Section IV above. The screening system is configured to check all parties to the transaction, including the buyer, consignee, intermediate consignee, end-user, and any other parties named in the transaction documentation.
Critically, the screening protocols extend to freight forwarders, logistics providers, and shipping agents involved in the export transaction. This enhancement directly reflects the role of Yves Leclerc, Director of Logistics & Shipping at DTI, in facilitating equipment exports via Caspian Logistik GmbH. The investigation revealed that Mr. Leclerc maintained the relationship with Caspian Logistik and coordinated the shipment of oilfield equipment through that entity without adequate due diligence on the freight forwarder or its principals. Under the Enhanced Program, all freight forwarders, logistics providers, and shipping agents must be screened against all applicable restricted party lists prior to engagement, and must be subject to ongoing monitoring throughout the duration of the engagement.
C. Red Flag Monitoring
The Enhanced Program incorporates a codified set of red flag indicators for export control evasion, drawn from BIS guidance, industry best practices, and the specific fact patterns identified in the internal investigation. First-line personnel, compliance staff, and internal auditors are trained to identify and escalate the following red flag indicators:
• Unusual or illogical shipping routes, including routing through third countries that are not consistent with the stated destination or end-use;
• Transshipment through jurisdictions known as diversion points for controlled items;
• Refusal or reluctance by the buyer, consignee, or end-user to provide end-user information, including end-user certificates or statements of intended use;
• Last-minute changes to the consignee, shipping destination, or end-user, particularly changes that redirect goods to restricted destinations or parties;
• Use of intermediary logistics companies without transparent beneficial ownership or with inadequate corporate presence in their stated jurisdiction of registration;
• Payment arrangements that are inconsistent with the transaction (e.g., payment from a third-party entity or a jurisdiction unrelated to the transaction);
• Orders for items that are inconsistent with the customer's known business or technical capabilities;
• Requests for abnormal packaging or labeling, or requests to avoid standard export documentation; and
• Customers with no verifiable business presence or with newly formed entities in elevated-risk jurisdictions.
Any identified red flag requires mandatory escalation to CCO Priya Nayar and, where appropriate, to General Counsel Marcus Wellbourne for further assessment and determination of appropriate action. Escalated red flags are documented in the compliance exceptions tracker, and the outcome of each escalation is recorded and retained in accordance with the record-keeping requirements described in Section XII below.
VI. Transaction Sampling and Testing Methodology
A. Sampling Protocol — Crude Oil and Commodity Trades
The Compliance Department will conduct quarterly sampling and testing of crude oil, refined product, and commodity swap transactions executed by DTI. The sampling protocol is designed to provide statistically meaningful coverage of DTI's trading activity while allocating enhanced scrutiny to transactions presenting elevated compliance risk.
The minimum sampling rate is 10% of all crude oil, refined product, and commodity swap transactions executed by DTI during each calendar quarter. Transactions are selected for testing through a combination of random sampling and risk-based targeted selection. Random sampling ensures broad coverage of the transaction population, while risk-based selection ensures that transactions involving elevated-risk counterparties, jurisdictions, or transaction structures receive proportionally greater scrutiny.
For each sampled transaction, the testing protocol includes verification of the following criteria:
• Counterparty Screening Documentation: Confirmation that the counterparty, its beneficial owners, and any intermediaries were screened against all applicable OFAC and BIS lists prior to the execution of the transaction, and that screening results were reviewed and documented.
• Beneficial Ownership Verification: Confirmation that beneficial ownership information for the counterparty was current at the time of the transaction, that the OFAC 50% Rule was applied, and that ownership data was sourced from reliable and independent sources.
• Sanctions Clearance Records: Confirmation that the transaction was cleared by the sanctions screening system and that any alerts or potential hits were properly adjudicated and documented.
• Trade Finance Documentation: Review of trade finance instruments associated with the transaction, including letters of credit, payment instructions, and bank confirmations, for compliance with applicable sanctions requirements.
• Compliance Sign-Off: Confirmation that the transaction received the required compliance sign-off prior to execution, in accordance with the Enhanced Program's transaction approval procedures.
An enhanced sampling rate of 25% is applied to any transactions involving counterparties domiciled in OFAC-designated countries or elevated-risk jurisdictions, as defined in the Enhanced Program's jurisdictional risk assessment. This enhanced rate reflects the heightened compliance risk associated with transactions in these corridors and is intended to provide a substantially higher level of assurance for the highest-risk portion of DTI's transaction portfolio.
All 14 types of transactions flagged in the internal investigation — specifically, the crude oil swap transactions with Petronova Trading FZE and Zenith Petroleum DMCC — serve as the baseline typology for testing scenarios. The testing protocols are specifically designed to detect the types of compliance failures that characterized these transactions, including inadequate counterparty due diligence, failure to identify beneficial ownership connections to sanctioned parties, and reliance on insufficient or outdated screening results.
B. Sampling Protocol — Equipment Exports
The Compliance Department will conduct quarterly sampling and testing of equipment export transactions executed by DTI or any other Dunmore subsidiary. The minimum sampling rate is 15% of all equipment export transactions by value during each calendar quarter. As with the commodity transaction sampling protocol, transactions are selected through a combination of random and risk-based sampling methods.
For each sampled export transaction, the testing protocol includes verification of the following criteria:
• ECCN Classification Accuracy: Confirmation that the exported item was correctly classified under the Commerce Control List, and that the classification was performed by a qualified individual and documented in the transaction file.
• License Determination: Verification that the correct license determination was made, including whether the transaction was eligible for a license exception or required a specific export license from BIS.
• End-User Certificate Integrity: Review of the end-user certificate associated with the transaction, including independent verification of the end-user's identity and stated use, as described in Section V.A above.
• Denied-Party Screening Documentation: Confirmation that all parties to the transaction were screened against applicable BIS and OFAC restricted party lists prior to shipment.
• Shipping Route Verification: Review of shipping documentation to confirm that the actual shipping route was consistent with the stated destination and did not involve transshipment through restricted or elevated-risk jurisdictions.
A 100% review rate applies to any export valued above $1 million or involving oilfield equipment classified under ECCN 2B350 or ECCN 2B999. This comprehensive review reflects the heightened sensitivity of these export classifications in light of the underlying conduct and the specific enforcement focus of BIS on controlled items destined for Russia and Belarus.
C. Sampling Protocol — Payments and Wire Transfers
The Compliance Department will conduct monthly sampling and testing of outgoing wire transfers processed through Dunmore's trade finance accounts. The minimum sampling rate is 5% of all outgoing wire transfers during each calendar month. The monthly testing cadence reflects the higher transaction volume and the critical importance of payment-level screening as a compliance control.
Enhanced sampling rates apply to payments routed through multiple intermediary accounts or to or from UAE-based financial institutions, reflecting the specific risk factors identified in the investigation's analysis of the structured payment activity through Crescent Commercial Bank PJSC.
For each sampled payment, the testing protocol includes verification of the following criteria:
• OFAC Screening Records: Confirmation that the payment beneficiary and any intermediary banks were screened against applicable OFAC lists prior to the execution of the payment.
• Payment Routing Logic: Review of the payment routing to confirm that the routing is consistent with the stated commercial purpose of the transaction and does not involve unnecessary or unexplained intermediary accounts.
• Beneficiary Verification: Confirmation that the identity of the payment beneficiary was verified and is consistent with the underlying trade documentation.
• Correspondence with Underlying Trade Documentation: Reconciliation of the payment amount, timing, and reference information with the underlying trade contract, invoice, or other commercial documentation to confirm that the payment is consistent with a bona fide commercial transaction.
D. Testing Execution
Testing is performed by the Compliance Department (second line of defense), which maintains a dedicated testing team with responsibility for executing the sampling and testing protocols described above. The testing team operates under the supervision of the CCO and is staffed with personnel who have appropriate training and expertise in sanctions compliance, export controls, and financial transaction analysis.
Annual independent verification of the Compliance Department's testing methodology and results is performed by the internal audit function (third line of defense). Internal audit's annual review includes an assessment of the adequacy of the sampling methodology, the accuracy and completeness of the testing procedures, and the appropriateness of the conclusions drawn from the testing results. Internal audit's findings are reported to the Audit Committee of the Board and are incorporated into the annual comprehensive compliance assessment described in Section VII below.
All testing results are documented in standardized testing worksheets, the template for which is attached as Appendix B. Exceptions identified during testing — including instances of non-compliance, documentation gaps, screening failures, or process deviations — are logged in the compliance exceptions tracker, the template for which is attached as Appendix C. The compliance exceptions tracker records the nature of the exception, the date of identification, the responsible business unit, the remediation actions taken, and the date of remediation completion.
Quarterly summaries of testing results are reported to CCO Priya Nayar and are incorporated into the quarterly compliance reports presented to the Board of Directors. Material findings — including any instance of a potential sanctions violation, export control violation, or systemic control failure — are escalated immediately to the CCO, General Counsel Marcus Wellbourne, and, where appropriate, to Calderwood & Harkness.
VII. Annual Comprehensive Compliance Assessment
A. Scope and Objectives
The Enhanced Program provides for an annual comprehensive compliance assessment designed to evaluate both the design and operating effectiveness of the sanctions and export controls compliance program as a whole. The annual assessment serves as the most rigorous and holistic evaluation mechanism within the monitoring and testing framework, supplementing the ongoing monitoring and quarterly testing activities described in Sections IV through VI above.
The scope of the annual assessment encompasses the following evaluation areas:
• (i) Policy Adequacy: Assessment of whether the Enhanced Program's policies and procedures remain current, comprehensive, and aligned with applicable legal requirements, regulatory guidance, and industry best practices. This includes review of the Enhanced Sanctions & Export Controls Compliance Policy (adopted October 1, 2023, attached as Appendix A) and all subsidiary procedures and guidance documents.
• (ii) Screening System Effectiveness: Evaluation of the performance of the automated OFAC and BIS screening systems, including accuracy of matching algorithms, timeliness of list updates, adequacy of fuzzy-matching capabilities, and appropriateness of alert thresholds and false-positive management.
• (iii) Training Completion and Quality: Assessment of training completion rates across all relevant business functions, evaluation of training content for accuracy and relevance, and review of post-training knowledge assessment results and scenario-based exercise outcomes.
• (iv) Third-Party Due Diligence Procedures: Evaluation of the counterparty risk rating methodology, the adequacy and timeliness of due diligence refreshes, and the effectiveness of ongoing monitoring of intermediaries, agents, and logistics providers.
• (v) Escalation and Reporting Mechanisms: Assessment of the functioning of the escalation workflow, including response times, documentation quality, and the effectiveness of reporting to the CCO, General Counsel, and the Board.
• (vi) Disciplinary Measures: Review of the company's application of disciplinary measures for compliance violations, including assessment of whether sanctions and export control violations are treated with appropriate seriousness and whether disciplinary outcomes are consistent and proportionate.
• (vii) Organizational Culture and Tone from the Top: Evaluation of the compliance culture across the organization, including assessment of senior leadership's visible commitment to compliance, the adequacy of resources allocated to the compliance function, and the extent to which compliance considerations are integrated into business decision-making.
The annual assessment is explicitly benchmarked against the DOJ Evaluation of Corporate Compliance Programs (March 2023 update), ensuring that the assessment criteria and methodology are aligned with the standards the DOJ applies in evaluating corporate compliance programs in the enforcement context. The assessment is also benchmarked against OFAC's Economic Sanctions Enforcement Guidelines, which enumerate the factors OFAC considers in determining the appropriate enforcement response to apparent violations.
B. Assessment Methodology
The annual comprehensive compliance assessment employs a multi-faceted methodology, combining several complementary evaluation techniques to provide a thorough and reliable assessment of the Enhanced Program's effectiveness:
Control Testing. The assessment includes substantive testing of key compliance controls, including the sanctions screening system, export classification procedures, beneficial ownership verification processes, and payment monitoring protocols. Control testing is designed to verify that controls are operating as designed and producing reliable results.
Document Review. The assessment team reviews a sample of compliance documentation, including screening records, testing worksheets, escalation logs, training records, due diligence files, and Board reports, to assess the quality and completeness of compliance documentation and to identify any gaps or inconsistencies.
Interviews. The assessment team conducts interviews with business unit personnel and compliance staff across all relevant functions and jurisdictions. Interviews are designed to assess the level of compliance awareness and understanding among first-line personnel, the effectiveness of communication between the first and second lines of defense, and the organizational culture with respect to compliance.
Technology System Validation. The assessment includes validation testing of the automated screening and monitoring systems, as described in greater detail in Section XI below. System validation is designed to confirm that technology controls are functioning correctly and that system configurations are appropriate for Dunmore's risk profile.
To provide independent perspective and continuity from the remediation phase, Pemberton Investors Solutions LLC, under the direction of Dr. Anton Bremer, will participate in the first two annual assessments (covering the 2024 and 2025 assessment periods). Dr. Bremer's involvement will ensure that the assessment methodology reflects the remediation recommendations contained in the Marlowe Asset Management remediation report and that the assessment team has the benefit of Dr. Bremer's specialized expertise in sanctions compliance program design.
The assessment report is presented to the Board of Directors and General Counsel Marcus Wellbourne, and is shared with Calderwood & Harkness under the protection of the attorney-client privilege and attorney work product doctrine. The assessment report includes a summary of findings, a detailed discussion of any identified deficiencies, and specific remediation recommendations with assigned responsibilities and target completion dates.
C. Timing. The first annual comprehensive compliance assessment is to commence no later than October 1, 2024, which is one year after the Board's adoption of the Enhanced Program on October 1, 2023. This timing ensures that the Enhanced Program will have been operational for a full year before the first assessment is conducted, providing a sufficient period for controls to be tested and for monitoring data to accumulate.
The assessment report is to be completed within 60 days of the commencement of the assessment — that is, no later than December 1, 2024, for the first assessment. This timeline allows adequate time for thorough evaluation while ensuring that the results are available for timely review by the Board and for incorporation into any required regulatory submissions.
Remediation of any deficiencies identified in the assessment report is to be completed within 90 days of the issuance of the assessment report. Remediation activities are tracked through the compliance exceptions tracker, and the CCO is responsible for monitoring and verifying the completion of all remediation items. The status of remediation activities is reported to the Board in the next quarterly compliance report following the issuance of the assessment report.
VIII. Third-Party Due Diligence — Ongoing Monitoring
A. Counterparty Risk Rating and Refreshment
The Enhanced Program establishes a tiered counterparty risk rating system that categorizes all counterparties on a three-level scale — High, Medium, and Low — based on a multi-factor risk assessment. The risk rating determines the frequency and depth of ongoing due diligence activities for each counterparty. The risk factors considered in the rating assessment include:
• Jurisdiction: Counterparties domiciled in or operating from OFAC-designated countries, countries subject to comprehensive or sectoral sanctions programs, or jurisdictions identified as elevated-risk in the Enhanced Program's jurisdictional risk assessment receive a higher risk rating.
• Industry: Counterparties operating in industries associated with elevated sanctions or export control risk — including energy trading, oilfield equipment and services, defense, and petrochemicals — receive a higher risk rating.
• Ownership Structure: Counterparties with complex, opaque, or multi-layered ownership structures, or with beneficial owners who are politically exposed persons or nationals of sanctioned or elevated-risk jurisdictions, receive a higher risk rating.
• Transaction History: Counterparties with a history of compliance alerts, adverse media, or previous involvement in sanctions-related issues receive a higher risk rating.
The due diligence refreshment schedule is tied to the counterparty's risk rating as follows:
• High-Risk Counterparties: Annual re-diligence, including a comprehensive refresh of beneficial ownership information, corporate registry searches, adverse media screening, and review of transaction history. High-risk counterparties are also subject to enhanced ongoing monitoring, including more frequent adverse media screening (quarterly, at minimum) and immediate alerts for any OFAC or BIS list updates affecting the counterparty or its beneficial owners.
• Medium-Risk Counterparties: Biennial re-diligence, including an update of beneficial ownership information, adverse media screening, and review of any changes in the counterparty's corporate structure or business activities.
• Low-Risk Counterparties: Triennial re-diligence, including a basic refresh of corporate information and adverse media screening.
Regardless of the scheduled re-diligence frequency, any counterparty involved in an OFAC designation event, an adverse media hit relating to sanctions or export control issues, or any other material risk indicator is subject to immediate re-diligence. The immediate re-diligence process includes a comprehensive review of the counterparty's risk profile, beneficial ownership, and transaction history, and may result in a reassignment of the counterparty's risk rating and, in appropriate cases, the suspension or termination (off-boarding) of the business relationship.
B. Intermediary and Agent Monitoring
The Enhanced Program establishes enhanced monitoring protocols for all intermediaries, agents, freight forwarders, and logistics providers engaged by Dunmore or any of its subsidiaries. These enhanced protocols directly reflect the role that intermediary entities — specifically, Petronova Trading FZE (which served as an intermediary in the crude oil swap transactions), Caspian Logistik GmbH (which served as the logistics and freight forwarding provider for equipment exports), and Zenith Petroleum DMCC (which served as a counterparty with conce