|W kroll. i 2 Ap 2018 Project Tenor — Scoping Phase Final Report Propared for The National Bank of Moldova Neus Place, 25 Faringdon Stet London E64 448 i 4 (0}20 7028-000 beolLcom Pete ond Consents (Copy 39 of 39 rH Cana, the Speaker of he Periament oft Ropu of WoléoveB Kroll. Private & Confidential Restricted Use Warning “Thi rapt was prepared by Kol at ha aque of the int fo wham ie fariahes. The Sant grees th repos and information received fom Kel ining thie reper, sre ealy condentil, may only ledored oregustery Bosas and agen wth pr appioal am Krol an ar tended aay fe the ‘vate and exclave use ofthe cent nl in conection with «busines, invesiment or ther commercial Durpoce. ny ster ure nclung for enloyment purpose, ced evluton of insurance uncerwiing Dpurpoes) i sic probed and cnt has apfead hal sich use wil zzut Any communication, ubtcaon, dacosu, dlsaminatan 2 fapteducton of his tape any gttan fs content oth ‘coreaquatal bly tony ths pate any ota parson wno othe intended saeressae of hs fpr {or te infomation consines nore, i nerpetatin a eplatens, of fr omiasos, oo etane by any such hed party oer prec thareon. To he eaten fmt prouded ots reper is based on@ reviw of publcavaabe records, such infmation, at presente, relss upon the acousey snd ‘complelness of hoe racads, which have ot Been cereboraed by Kol, Satan erin cencring ‘ancl ropatry 0: legal matters should be undertoed to be gneral observations based soley on ‘ros experiance as risk constants ané may not be relied upen as fnanci,ropulatory or logs ace, whlch Kr isnot authorized te prove. A such matrs shouldbe rvawed with apreraalyqualied Jadveor In heee arise. THIS REPORT DOES NOT CONSTITUTE A RECOMMENDATION, ENDORSEMENT, OPINION OR APPROVAL OF ANY KIND WWITH RESPECT TO ANY TRANSACTION, DECISION OR EVALUATION, AND SHOULD NOT BE RELED UPON AS SUCH UNDER ANY ‘RCUMSTANCES, Private ans Canfentia: Copy 33 of 33— Andi Cand, the Speskerof ha Partament of he Repubie ornecons 2BB) Kroll. Contents Irtoduten.nonn ene od fa Sepvatwat 6 2. Bxecute summary : oe 6 22 miantna scaler UB | w TOTAL: oom [oom — Pros 6.41 Sharoholders BS has only dlsclosed to NBM vo groups of related parties amongst its shareholders. The firsts 8 group of shareholders beneicaly owned by VlasimirJardan, as well as Jardan himslf, a Moldovan entepreneut. The olher group includes members of the Cell family. Igor Cael isthe ‘owner of @ Moldovan company named Teluri Mobialre SRL, his father Gheorghe Cale! is eran st any Company Pate and Confident: Copy 39 af 33~ Mr Anan Cand, tho Speeker of he Partaman’ of he Republe of ocove 28BB) Kroll. Project Tenor Phase | Report reported to have previously worked at the Modloven financial markets regulator, CNPF. Both r0ups appear to have held stakes in BS since atleast 2010, when come of them wore fst replstred as shareholders according to deta proved by NBM. Attough Koll has not conducted in depth research Info esch cof the shareholders and beneficiaries, information provided by NBM, supplemented by investigative research, indicates that a number of them were likely to have been acting In concert and holding shares os nominees, to mask sue benefice! Intorost. Certain have links fo lan Shor, whit there 6o not have profes which are not reflective oftheir aquisition of realy significant stakes inthe bank. Examples of information which lead to tis conclusion are highighted below: 4. Maria Gutuleae - Gutuleae acquired a 4.98% stake In BS on 15 May 2013, She has bean reporied In Moldovan media sources 95 the "head of administration’ for tlan ‘Shor. and as « ‘ropresenatve ofthe Miron Shor" foundation. * Miron Shor i¢ in ‘Sho's father. Further information hes been gained from the NBM, showing that Gutuleac is actually lan Shor's cousin, and is marred to Serglu Albet, who was appointed vice-president of UB in December 2012, and subsequently became president (ofS In December 2013, 2. Moldovan Corporate Enles - The five Moldovan companies which obiaind stakes in BS on 30 May 2013 (Olafan SRL, Tonimar SRL, Tivetpro SRL, Rominserv SRL, Veer Plus SRL) were all ncoporated tee weoks before the purchsse on 8 May 2013, Inia research of the beneficial owners of these companies found them to have low public profies. 3. Smit Pls SRL ~ this company oblainad @ stake in BS on 1 November 2019. The discloses beneficial owner, Nalala Gojira, Is Isted in official Moldovan databases 3s being the head of the operational ivsion at Chisinau alot from Novernber 2007 Natala. Gojna's positon at Chisinau airport is notable duo to lan Shor's commercial links to the aiport Chisinau airports curenty managed by Avia Invest SRL folowing the signing of # concessionary agreement with the Moldovan State Asset Agency on 30 ‘August 2013. On 11 September 2014 lan Shor was elected tothe board of Avia Invest 'SRL, at whieh point Durem! reportely aressyrentes 60% ofthe commercial space at the apt." Shor was subsequently elected chairman of Avia Invests board on 1 2 tpsennodaestcangcreunbeez8 5 arsaar/anrenar alone andre adel partcpar¢ conten rernaosla_penranrenat! ‘rive and Contdentat: Copy 3 f 38 = Mr, Arian Candy, the Speaker he Parsment of he Repub oftotiors 2AD) Kroll. Project Tenor Phase | Report November 2014, The current CEO of Ava Invest is Pets Jarcan, tis unclear fam ina researc f this individual ie related to Viadint Jordan ee Voscesay Jada, 4, Uteainian and Russian individuals - A number of Ukrainian and Russian individuals soquied stakes in BS In May 2013 each of which have extremely low puble profes thel espectvejurscetions. According to disclosure documentation provided to NBM, the fe Utcainan indviduals are registered in Nova Kakhovka, Kherson Oblast, Uraine. Nova Kakhovka is @emall ety in couthorn Ukraine with population of loss than 100.000. Two of the sharcholiers, Teena Boke and Sergi Andrictuk, are registered at cferent fats win the same building inthe cy. These profles are not relleetive of a ypea Investor, acqung eelatvely significant stakes ina Moldovan bank, al financed trough loans trom offshore entities and appearing to have opened accounts ‘at Latvjas Pasta Banka atthe sare tne 6.4.2. Funding of share acquisition in BS [As outined above, withthe exception of those shareholders dleclosed by BS as related partes, the melorty appear on ina! examination to be unrelated, However, analysis ofthe source of ‘unding used by the individuals and entiies to acquire the shares in BS provides futher indeation ‘hat a number wore in fact elated and potantally acting In concert. By way of example: ‘+The fve Moldovan companies which acquired stakes in 8S on 30 May 2013 appear to have each financed their share purchase with loans ffom offshore entities between 17 May 2013 and 22 May 2013, Al fe loans carried a 3.5% Interest rate and the fe ‘chore companies each held accounts at ABLY Bank AS in Lab. ‘+ Ancor Lux SRL and Sami Plus SRL, which acquied stakes in BS on 1 November 2018, simlaty financed their share purchases wih leans fram offshore entiosrepstred atthe sama address in Balize, each with Latvian bank accounts. ‘+The Uksainian and Russian individuals, which acquired stakes on 8 Way 2013, were Tkewiae financed by offshore companies, Both he indvduals end the offshore companies held eccounts at Latvjas Pasta Banka, Latvia. Futhermere, the loan agreements disclose to NBM show thatthe iivals have slmoet dentiel account numbers a the Latvian bank, which indcates tat they most probably opened ther accounts st the same tine ‘Pile and Condon Copy 39 58 ltr. aon Can, ho Specter ote Parlement of th Ropubic fate 2BB) Kroll. Project Tenor Phase | Report the remaining shareholders were tuy independent, tis righ unlikely that they would have al receiving funding in sucha similar manner, via what appecr tobe ofehore shell companies, each ‘wih Latvian bank accounts, Instead, this appears a deliberate attempt to conceal the ‘of funding ofthe share acqustions. An overview ofthe shareholder inviduals and ents that acquired shares in BS, showing the source of funds, i stout at Appendhc I 6.2 Financial overview Por othe shareholder restructure in May and June 2013, the asset pote at 3S was dominated by customer loans, which were balanced by deposits placed atthe bank.* OF the MDL2.0 billon In customer ans at the end of 2012, MDL238 millon comprise loans to Shor Group companies, representing a smal proportion ofthe total” By the ond of 2013, customer loans had increased by MDLOS bien, and deposits at other barks had increased by MOLO.5bition.* The inrease in deposits at other banks can be aecounted fr bya ise in Nostro accounts and short term deposts, wth these tems making up MDL‘. bilion ‘ofthe total deposte of MDLI.2 biion atthe end of 2012 (note that MDLASO milion of he teal deposits were placed by BS at UB) . The MLO bilion increase In customer loans duting 2013 ‘canbe accounted or by an Increase in loans to Shor Group companies.” During 2012, depose placed at BS increased by MDL1.0 bition, wick In deposts placed at BS by other banks. * “oto 7:85 balac hel ee foto shri atte ng 2013" In part, can be accounted for by MDLSTE miion 35, ‘sinanowa| 90am aT MDL 06, ‘MOL 00 ‘MOL 800. Demand Gepost and ash eau 624.54 781067 1.308076 Loon and Reoehabes 2.025.402 2is2.213 2.731.786 ‘thar Aste 501,708 srizte 408 800 Total ares 3216.36 354400 43.732 ‘Devons zara asa Saoeee ‘ther ties 43.599 2.188 14730 Tota abies 805,328 Brriaa Srzasar Eauity wis.07 was es manny tine chet Jue 2012.Cesenber 2014 ol anys of her penance 55 Prandal Samet Deer 203 ‘Tale Shot Grup ns eure 31 ecee 2012 34 Decor 289 ‘ivate and Consent Copy 33 of 33 =r. Andre Candy, the Speaker te Poament of he Repub 2°BD) Kroll. Project Tenor Phase | Report 6.3Control of BS Following the acquisition of BS in May 2013, lan Crivoeanschi took the role of president of BEM and eubeequenty resigned a6 a vice-president of BS. Crvceanschi had been 2 long-standing ‘member ofthe BS board since 2007, and the bank was arty owned by his family I is possible thal he aoquisiton of 8S and movement o Crvceanschi to SEM was par of a coorsinted plan 1o take control ofboth banks. This is supported by Investigations conducted by NBM which found ‘email ovionce of Ivan Crvceanschi belng consulted on management decisions at BS ia November 2014, overa year after he let the bank and whe he was president of BEM, Further, Sergiy Albot, fomery © vice-president of UB, was appointed president of BS on 24 December 2013, Albot is maried to Maria Gutuloac, a cousin of lian Shor and a minority _sharoholder of BS Private ond Canfidrta: Copy 30 of 33~ I Ania Cand he Speake of Be Paramont oe Ropubo hoor 0BB) Kroll. Project Tenor Phase | Report 7. 2013: The Acquisition of BEM Subsequent othe chango in share ownership structure at UB and BS, BEM, at ho time majority ‘state owned, was also subject toa share restuctre. Shorty prio to the share restructure, the former BS board member Ivan Crvceanschi, was sppoinied president of BEM on 8 May 2013. By ‘his point in ime BEM already hac @ numberof naw shareholders which aoquled stakes earler that year. This was preceded by a signifeant vansacton entered into In ary 2013, the origin of ‘which ls uncles, which resuted in over MDL. bitin in non-performing leans being removed {tom BEN's balance shoo, in oxchango fr cash, and therefore significantly increasing iui. 7.4 February 2013 — Roseau transaction (On 18 March 2013, BEM signed a cession agreement, which resulted inthe transfer of aime relating to a series of non-performing lane to © UK based entiy, Roseau Aliance LLP ‘PRoseou", Rosesu acquired the leans at nominal value, aounting to lmost MOL ‘bn “The origi ofthe transaction is unclear fom information avaiable a present, 95s the reason why Roseau would be wiling to acquire a series of non-performing assets, with no discount applied, eflectvely enabling BEM to exchange a series of distressed assets, for cash. The loans had ‘boon on BEWM's books for 8 number af years, and according to information provided by NBM, erves from a series of historical commercial lending act: “Ta & Leas sl ue nga Rosen cason apueent oan Customer oan Anauat HOC ae Taratored AVG Satan SAL ‘Saar TS ‘BSE pa TTT 23SROTS ‘Daler SRL BBE TORE BOTS Foes Bas Oe 2arsaRoTS ‘Waropa 2000 SAL 553,508.05 ETS Valxshing SRL Bas TTS 280ROS aso SAL BETES TTS TOS AAA SRL 5230 TEATS ‘Rar Com SRL STEERS aS Natrona BBTO TEED FEDSAOT Tweriians SAL TarsT000 SOS TES. BPS SRL Be UTOVOIT TOTS TGS Uidans tax SRL ‘a0, 00000 “sas oe siemens sg by Cov Brith aetna rosin ef BEM Pinta nats ations suman ‘rate ard Confdondat Copy 38 of 3 Mr. Arian Cand, the Speaker othe Parton fhe Repubic ofMsisore eSPB) Kroll. Project Tenor Phase | Report BT ES TES Bape aaa TOTAL: 350 905,927 57 RRoseau was incorporated only @ year prior tothe transaction, and appears no more than @ shell company, with goneral parners based in the Marshall Isands. Resesu is registered In Birmingtam, UK, st the same adsress asa fiduciary compary, B2B Company Secretary Limited, hich s also a director of UB shareholder Reyrose Managoment Lid. lla Grbkov, who signed the agreement as a represeniatve of Reseav, has a relatively common Russian nama, However, he Je potentially related to Elena Griova, who has been reported in Moldovan press as 9 spokesperson for lan Sher 7.2 August 2013 Change in shareholding of BEM following share issue ‘8y mid2019, SEM was focing financial dfcuty due to 8 growing non-pertoming loan portfol, [NB staff informs Kroll that BET's expeeure atthe ie was primarily to Moldovan companies, Which were unaicted wth the Shor Group, Tiss evidenced by the relatively lw proportion of ‘Shor Group loans at BEN, winch stood at MOLOT millon atthe end of June 2013, jst over five percent of the total loans outstanding at BEM atthe time ‘The situation at BEM, which was atthe tine majory owned by the state of Moldove with a 56% stake, was the subject of poltieal debate and parliamentary enqules. A olution was proposed whereby BEM raised capa trough an addtional share issue. However, du to @ lack of funds the sate of Moldova a not acquire any adétonal shares and tnereby reduced its sharehoding inthe bank" ‘session on the BEM issue was held by the Commission for the Development of Commercial CCompettion and invtment inthe Privatization of ube Property en ‘1 July 2012, Subsequent, the Moldovan Agency fo Public Property informed the Ministry of Finance and NBM that it agreed wih 2 proposal to forego is pre-emptive rights o new shares issued by BEM, and thereby reduce its sta in tho bank fom 56.19% toa blocking stake of 33.2(8)% + 1 share Following this decison, on 1 August 2013 the government of Moldova, represented by the Ministy of Finance ané the Agency for Pub Propet, igned an agreement on the development of BEM withthe bank's minorty sheranolders (SRL Slstme Informationale Integrate; Cermodean “nepunaday uzataasaneaane re issn lace econo donee __ SissSieianainessaeecsat ivate and Condon! Copy 39 0f 39 Mc Arion Cand the Speaker of fe Partamont of te RepubseBD) Kroll, Project Tenor Phase | Report Development Lt Tine! Peoeet Lis; O09 Garan-Grupp; Wall Trend Limited: SRL Caiteco Prin: SRL Vladox Grup; CA Klaseka Asigura ‘According tothe agreement, shareholder's mecing was organised for 2 August 2013, where {government representatives would fecitate a closed supplementary issue of 16,049,940 shares In BEM, with @ nominal price of DLE and a total value of MOL8O,249,700. The contract stipulated that he Moldovan government would net acquire the additonal shares, which would be oblained bythe minority shareholder, In tum, Before the Moldovan government ragisered the ownership of the new shares, the ‘2greement stipulated thatthe minofty shareholders would themselves, or through a third party, ‘organise subordinated loan to BEM worth MDLE0O millon, within 2 days ofthe now shares being repstred. In ation, the minority shareholders were required to purchase non-performing loans at BEM totaling ne les tran MOL300 milion, ‘The shares which were not taken up by the Moldovan state folowing the share utimately whoty acquire by an existing shareholder, ICS “Sisteme Informationale Integrate” ‘SRL, ralsing its stake fom 10%, to 34%. Asa result at 30 Soptomber 2019, BEM's shareholding structure was 9 flows: ‘Sarehotaar | Jura ‘Bonelaal —| Bale HR | Saks Waa | Swe Waisat or ‘owner? | Registered | stoenets | somor0%s (x) Nationa Sharsnotaer | (8) Tae Fab Fepaieo 7 wren wD Fea Toonazo | seis 3333 16S "Sime Tana Inforatonale | 0 Gaydactur |oer22010 | 070 a7 Ingrate SRL @u) "CRRUONGERT Evan ST peve.oruner | uk wu soso | a7 aa ‘wtedox Gus" sRL | uD are ay) | 3er018 | are 47 Kurioea @U) “ay SGARANT-OROUP | yy ucnererco |oanaaoe [ase 492 us eu TCALTECO PRI WO ‘rary [Faaaos [eer +e on BM cosa tom nono ‘vate and Condon Copy 3 of 38M. Anen Cana, ie Speaker oth Paramon ofhe Repub orMoiioe 8BB) Kroll. Project Tenor Phase | Report ‘Sharahalder | Javeaeion | Senahiial [Date First] Sake Wold | Sa Foldat os ‘Owner® | Reaistered ac | srosvant3 | sorsn43.4) Nationality Shareholder | (6) SRC Teast eu — UK verre uy |o90ezo1a [eat aa ran “nel Project 10 | UK ovexdeve | tamsrzors | s72 am eu. ae | S zansaora [270 278 Initial rasearch indicates thatthe Russian beneficial owners of the bank have fay common ares. and do not appear to be high profile individuals, with the exception of Aleksey Kucherenko, whe has the same name as ¢ Ukrainian pollen, GrvandIndkov has been reported by Moldovan press as Russian make-up artist and most likely a front for the bank's real shareholders 7.24 Shareholders ‘Win the exception of the state-otned stake, the remaining minonty shareholders dlciose ‘themselves to be beneficially owned by vaious Russian individuals via offshore entities. Wh the ‘exception of SSI, each of these shareholders fst acquire stakes only months prior tothe share Disclosures mage to BEM and NBM by the shareholders inscate that they benelcaty owned by separate Individuals. However, intl analysis of the company's sources of funding and losn ‘operations suggests thst they ae related and have been warking in concert. Further, two ofthe sharenolder, wh @ combined staka of over 36% are related olan Shor. 41. CA"Klasska Asigurar S.A reports Ise to be Beneflaly owned by tlona Shor, who Is ‘widely reperod as business partner of lan Shor. Shor himeelf has disclosed to NAM that Nona family relavon, and has been eontimned by NEM that she ie the stepmother of lan Sher. 2, 16S Sisteme Informstonale Integrate" SRL, which became the single largest shareholder in BEM folowing the share issue, ceciosas taf tobe benafcaly owned by a Ru ——Dimauinerscstpeatiewssess ‘Pivate and Condon Copy 39 of 38 lc Aaen Can, to Spoter ote Perieman of th Repubic2B) Kroll, Project Tenor Phase | Report lize, lana Gayéachuk (Gaydechuk), via the Russian registered O00 Konstanta, CGaydachuk was the former general director of Moscow-ogistored OOO Vitor Trey, company assoclated with lan Shor'sdutysfee bushess through its majrty shareholder by Motakiasska international Despite he shareholders giving the appearence of being largely unrelated, analysis conducted by NBM and reviewed by Koll shows a numberof sknfarites betweon these shareholders and SSI In particular, specially In relation tothe manser in which ther sharcholdngs were financed and the fact that they subsequently used their shares in BEM to guarantoo loans issued by BS to ‘various Moldovan companies 7.22 Funding of Share Acquisitions. ‘As with 8S and UB, 2 numberof BEM's new minotiy shareholders received loans trom ofshore 0urc0 inorder to inane ther soquicion, wih funds being wired from Latvia's ABLV bank. AL this pont In tine Krol has not conducted a detale review ofthe source of funds used to acquire shares in BEM. [Analysis of the funding of the subordinate loan requirement of the share transacton does however provide furter nication ofthe fact thatthe minty sharaholders may be related. With the exception of C00 Garant Grup, they al received financing on 4 September 2048 fem one of two Russian companies, O00 SKIF or O00 Transtur. According to data provided by NAM, both Russian companies have the same shareholder, Rusisegistered EltStroylnves, which wired the funds from Gazprombenk, Soon after the transaction, on 10 September 2018, each ofthese shareholders issued subordinated loan totaling USDSO milion to BEN, Russian corporate records confim that 000 Eltstroynves'*Is the 100% shareholdar of 000 SKIF, 000 Transtur, as weil at COO Germes, However, corporale databases indicate cular ‘ownership structure, wih Elstroyinvest in turn being 99%-owned by OOO Transtr, with the remaining 1% owned by O00 SKIF. By way of example, on 10 September 2015, BEM signed a subordinated loan contact with iis rinorty shareholder, Tintl Project Lt, according to which tho latter was due to fond the bank {USD 11,869,900 within 10 days, The G:ear loan carried a 3% interest rate, paid in monty instalments, and was due to be setied on 10 September 2018. The Tintel Project Lid contract “vty Goyétenss ter, is Peachey, Seed at 47% sari US “Wet Repataon Nance 72251252 ‘Pate ond Conde Copy 33 of 5 ~ Mr Artian Cand, the Speake othe Parament fe Repub ofMoisve 38DD) Kroll. Project Tenor Phase | Report ls the only such subordinated loan contrct reviewed by Kral, However, data provided by NOM states thet other BEM sharcholders also signed simlar contracts with BEM on the same day, leading to total USOSO milion oaned to BEM. Be “mount Fare | Subordinated | Dale SaboraTTeaLSan Sharaholder | Recoived on | Recoied | Loan Agreement| signed | Counterparty owoa7013 | From | with sem uso) so) oe ‘eson00 | SKF La |e oceso0 | TaeaOTS | 00 Kanata (uni (shetehlde of 58) ‘Gaiace Piss 9205000 SKF Ls 6,706,500] TbaRUTS | Aye Manaparen Lid ORT sa (ui = (Bharholder of Catace) ‘VadorGap | 7EGISO | SKF Ls | T7SSS00 | BGGOTS | Gen Teasing = sat (iy (Sharada f Vado ‘Camnaraaan | BOTROT | Transtr —| TOO ROT | TORTS Canondean Devaaprant Development ua ua ua (Pus ‘Wal Tiend | 70900 | Tenstr [7.056500 ——|TasaarS | Wa Treat (ues TRI PRRE | TH TOTDOT Taner | TRS SOT | TOOTS TT PTT ua us (Bue ‘Torat: [60,600,000 xy 7.3 September 2013 — 2" Roseau Cession Agreement [As perth terms of he terms ofthe agreement with the Moléovan government, the shareokiers wore requied to purchase non-performing leans at BEM totaling no less than MDL200 milion, This took the form ofa second cession agreement, wich was again facilitated trough Roseau, ‘The agreement was signed on 10 September 2073, by lan Krwchansky 25 president of BEM and ya Grbkov as the representative of Roseau ‘The agreement was similar to the first cession agreement. The agreement had a minimum value ‘of MDLSO0 milion which could be inereased according to the lit of claims transfored. Rosoau rs Sa StareteofSS) ato agra sea nearer wan Dail net (UH) ct ‘Pate and Condon Copy 29 of 22~ he Anion Cand he Speaker fhe Pariamant fe Repube oftotva 38BB) Kroll, Project Tenor Phase | Report was due to vanster 10% of the value by 30 September 2013, wih the remaining 80% due fo be paid by 81 December 2013, ‘Acsotdng to Information provided by NBM, the second cession sgreement Included fersign ‘currency loans, wit total equivalent value of MDL304, 80,800.48, and comprised the following Joan customers: “Talo Lons ss sesso Rota arn arene Toan Customer ‘Original Loan Value | Loan Value NOL Dato Tansfarod Fata RL BIASES HOD) | TAT Baars TaVersoWondat SX | 6Giazna0 EUR) [8706.05 Aas Ti Varde onda SR | Ta Sa5 26.50 WOT] | RHE RDB Baw PPS Weise SRL——| azase WON) | aazaee 0a Tae RL BOT SURAT MOL) | 707 300aT BaDaT SC Alen-Pias SRE | LOW@ SBI EUR) | TazrE ToL 0 Teaco SRL BE BOSBRETE MOL) | 8,05 503.15 Bare Tinea SRC ‘aoraae.7i Uso) [821457 OT Ves SRC TETR DA BONO —_| ETRE TEST ars Ves RL 568437847 (USO) | 73.40038887 ATT Wear zoqacoo0 EUR) [6.100208 2ana78 Gee Smion Mina rrr 2aeae WON) | rrr ates airs TOTAL: 09a, 0a ‘The agreement with Roseau was amended on § December 2013, to Include @ further MOL116,017,083.88 of claims rlating to two BEM loan customers: IM Sarin Plus SRL and IM Sani SRL. Roseau was due to pay 10% ofthe vale of these claims by 31 December 2013, with the remining 90% due by 31 March 2014 ‘Loan Customer ‘riginal Loan Value | Loan Value im NOL [Date Transtored ThiSanin Pus 6RL_—_|25.025.468.60 oy) | 25.25.488.60 “rar013 iMGanin Pus RL |257s47.15 @UR) [425100032 “rar0%9 IM Sanin SRL 7203.00.16 Cun) | 3.60,05035 sarz0%s ia Sanin SRL 24286.00(S0) | 1.667,796.9¢ Sr Ia Senin SRL 721,906.00 USD) | 987.0809 “ar2r01s in Sanin SAL 2.189,78629 (USO) | 27,71085886 Taran in Sanin SAL 42.44.3072 WOU) | 42.48.3072 “raroTs TOTAL: 116097 088.88 ‘Private ard Godan Copy 29 of $9 Mir. Andian Candy, te Speaker othe Parlamant of he Republic orMottove 7BD) Kroll. Project Tenor Phase | Report ‘Boh Sanin comparies appear tobe potently related tothe Shor Group, Sanin SRL is cutronty registred at the same address 2s Megasot International SRL, Unlenor 21, Chisnau. Megaset International SRL was previously registered at an adsress associated with Shor Group companies, Tighne 12, Chisinau, The company's webs states that was founded in 1996 as fan Israei-Moldovan joint venture and produces plastics products.“ Sarin Plus SRL is @ subsiclar of Sanin SRL and fs reportedly Dated ina duty free zone of Chisinau 7.4 Financial overview In the petiod porto the shareholder restructure In August, the largest movements on BEM balance sheet were a restructuring of assets, with custome: loans decreasing by MDL blion ‘largely due othe tan cession agreement with Reseau), wha deposis at ater banks incensed by MDLA.t bitlon.* Flowing the shareholder restructure in August 2013, the movements on BEM's balance sheet show deposts placed by GEM at ather banks increased by MDLZ6 bilion (MOLI. tilion of which was placed at UB, This increas sears to have been largely funded bya combination of Increased deposks at BEM of MDL!.Sbilion, an increase in cubordinated debt of MDLSSO tillon and a further reduction nthe customer lan pot of MOL200 milion. * Both ofthe above periods are characterised by BEM signifcanly increasing the amount of money ‘thad placed on deposit at other banks, which in turn may have alowed those banks to increase the value of ther customer loans. Further analysis wil be required to better understand the ‘movements of funds between BEM and athe banks during this period Bei Suanow | suomi | sana ‘MOL 00 DL 00. ML 0) ‘Demand depo and cash ea “seco | s0ssaas| 5.0s0.70) Loss apd Recevabes| 2207078] 1.400.858 221 78 ‘ner Asal 2.45,044 7689.7 Toul assets 32.822 882,768 dhe sain enseisy ‘Beat mony bane sents une 22 0scenbe 2016 pratt 7 ‘Pate and Condon! Copy 39 of 38 Mr. Adan Can, tho Spstor of to Parlement o th Repube 38BB) Kroll. Project Tenor Phase | Report ae ‘ano | Sera | _—_—_savianoas ‘Deporla ssouss7| _ap72ss0| 6426.97 ‘ote ition “rat 54742 56.508 Tota ab errara| —_eaziaei | rssaare Eau ware aries waa 7.5 Control of BEM ‘Aside rom the appointment of former vice-president of BS Ivan Crvceansch as president of BEM fon 8 May 2013, 2, contol of BEM appears to have slso been established tough the appointments of Stanislav Budza and Constantin Patadl to the BEM board on 28 October 2013. ‘According to information proved by NBM, both new board members were formerly employed by BS. Additonal, Stanislav Budza’s father Oleg Budzais the head ofthe National Conaderation (of Trae Unione of Moléova, which previously had dealings wth Shor's Durem company. The ‘rede union organisation placed bank deposits as guarantees for cel issued to Duero Further, lan Shor iso was appointed head of BEM's supervisory coun on 28 Ap 2014 ‘Pivate and Condon Copy 990 39 Mr Ardrlan Cand, the Speaker of he Paramant fie Repub ofitsBB) Kroll. Project Tenor Phase | Report 8. Unibank 2013 8.1 Financial overview During 2012, customer loans istved by UB increased by MDL2.7 Bion, slmostsolly dus to the Increase of MDL26 billon in loans to Shor Group companies. By the end of 2013, Shor Group loans comprised almost ninety parcent of he bank's loan porfolo at year-and."™ The large increase in loans was funded by @ surge i deposits placed st UB of MDLS.0 bition “This increase was primarly due to @ MDLAS dillon Increae in deposits trom other banks. BEM and Interromibank had the largest deposts at UB, with MOL. billon and MDL15 billon respectively, and BS, Mokoban, and Moldndconbank alo held lage deposits, Broaings by UB also increased in 2013 to MOLAG6 millon, with Gazprombank and Alef Bank making up MOLA28 of etal borrowings." UB aso Increased its depos placed at other banks in 2013 to MOLS. Bilton from MOLI. bition. The deposits were primal overight placements at non-OECD banks of MDL. bilon, snd # deposit st Moldindeonbank of MDLO.S bition * The purpose of the increase in overnight ‘deposits may have been to pass funds to Rustlan and Moldovan banks, who would simultaneously have deposited the funds back with UB. This would have increased US'S lquty and thus allowed it to Increase the value of customer loans. At the end of 2013, the value of ‘overnight deposits a other banks more than covered the loa loans outstangng from Sher Coup companies v8 uno | __saneros | ___sentanors MDL 000 TMDL 00 ‘MOL 00, Demand dedi and cok eu 1.148205 77a ror 3604408 ears ane Reeeiabias| 0390978 1.285.082 ‘3207 882 tr Asset 213821 Za "32.504 Total Asset s00.102 338.080 728.880 Devos asso Zara ema Other abies ‘318378 70284 “48857 Total Liabilities 88 86 2978.08 785.985 "kot ss of her eon exonue ————Tulbont nance sats 12a 20 Prvate and Canfdrti:Capy 29 of 23 Me Anaian Canc the Spasker of he Partamen! fhe Repube ofnoous 0BB) Kroll. Project Tenor Phase | Report ue aa Eau ante was ‘Prato and Condon: Copy 9 0 38 —ir.Andan Cans, te Speaker of the Parlamento the Repubie ofMoioveBR Kroll. Project Tenor Phase | Report 9. January-November 2014 During 2014, the vale of loans issued by Mokiovan banks to Shor Group companies increased by approximately 85% to MDLT.® billon. The movements on BEM's balance sheet during 2016 suggest thatthe increase in lending was funded though the mechaniem of Moldovan banks placing deposits at a numberof Russian banks, whe would then depost the same amount back at ‘he Moldovan bank, inceasing its landing sbiy. Thee isa significant risk, however, thatthe oposite reported st cacsved trom the Russian banks di notin fact occur, The deposits wore ‘recorded onthe daly balance shoot declrations gent to NBM, but no contects, Swit messages corotter evidence of payments were discovered by the NBM. 9.1 Increasing Shor Group exposure "ale Str Grou expen by bank on 38 Decne 20181981 Osher 2014" Teen Expocwremok | sinamors | simoaaoia| soneoia| sowerora | sinonoie wMot-cc0 [bt 000[ MOL G00 { —¥bL000 | — wou co m2 zos7ace | aseszee| sarz7ie| sozmaza| sousen ‘veto roou| sisez] steer] sta] sie BEM ous77| —asnaca | iisaas | 253.704[ 2067 BS wrozo1| scezs7 | 1.160508 | 1.373.006] 1681230 ln deonbani ‘350 7asa72|__szee7| 107.650 Grand Total as2s.258 | _6a3s,7a4] a te6.035| Tiseazae | 7ou7 906 ‘Analyse of Shor Group loan exposure Between 31 December 2013 and 3¢ October 2014 shows. ‘hat loans Issued by BEM, BS and UB increased significantly from MDLAB tillon to MDL7.9 Ditlon, The most signet Ineresse was inthe losn exposure at BEM, which Increased by MDL2.2 bilion, while the losn exposure et UB and BS incressed by MDLO. bllon and MDLO® bition respectively 9.2Funding the loans: Balance sheet analysis [Areview of the balance sheets for each ofthe three banks in 2014 shows significant increases in customer loans and deposts, The total increase in Shor Group exposure during the period of 'MDL3.1 bition accounts for 80% of the increase in custoer loans atthe banks nthe period ey ‘rvate and Consens Copy 29 of 29~ Me Anion Can, he Speaker of te Pariamant of the Repubic often 2BR) Kroll, Project Tenor Phase | Report 9.24 BEM Im Apr 2014, SSI reduced its stake Inthe bank tom 34% to 9%, around th size ots orginal holding prior tothe share issue, Tho shares wero sol to the Russian Bank VEB, which 25 & result became a 25% shareholder. Subsequent. at an AGM of BEM held on 28 Api! 2014, lan ‘Shor was elected to the Board of BEM, representing VEB. Shor’ aflaton to VEB and the reason fer his shareholder representation are not known at present During 2014, BEM increased its customer loan portoo by MDL2.2 billion all of which related to new customer loan lsued fo Shor Group companies.” Deposits placed by BEM with other banks increased by MDLI.1 biion during 2014, These Ineresses were countered by an Increase In deposits plsced at BEM of MOL3. tilion, of which 'MOL1.0 bition were deposits from other banks, whist the balance was from customer deposits A breskdown of these deposits shows that as at 3 Noverber 2014, they originated from Gazprombank, Ale Benk, Interpombank, Metrobank, and Molsindconbank “The increase in Shor Group lone Issued by BEM during 2014 wore funded by both deposits from ‘other banks, and new euetomer anc cerprate deposts coming into the bank, which grew by 'MOLZ. lon in the pesod. On 3 November 2014, MDL.S billion of BEM's Nostro depots at [Alot Bank, Metobank, Gezprombank, and Ilerprombank were effectively need off by deposits from those banks al BEM." The purpose of this may have been to incoase the lending ‘capabilies of BEM, allowing ito ise more loans to Shor Group companies. Ba aro anon MOL S00. TMDL 00 Demand depots and cash eau 55370 Tra Leonean Avanos zat 361.48 ‘har sets 558.07 1.544.057 Tota assets ‘3532768 Ti To8s7o epost 3426307 peor 8 Ate sane win, te aarti Cac rn SAL wih el Te inte, Vino Ga SRL a ‘eileen on ine an Sten Salar ow Une amples te whe {es pean sed ssn agua ne Preecom ofr fom Goa 2012 tay 201 rd saree ea ‘Stair we fomer rece of Sneha Ono! Company (OMA eee aor tbe Caan Sick ‘Belen bane shot June 2012 0nceet 204 ‘8 pa nen ‘vate and ConSdentak Copy 38a 3 tr. Anaran Cand the Speake of he Paton ofthe Republic of Motors 0BR) Kroll. Project Tenor Phase | Report Total abies 7.883.72 osrins Eaaty eas Tos 9.22 BS Between Janvary 2014 and the end of October 2014, BS increased the value of customer loans ‘by MDLO.S billion, ll of which were loans to Shor Group companies. Depesits at other banks also increased dung the period by 1.0 bilion. ‘The Increase in loans end deposits was mired by @ MDL1.9 bllon increase in deposts places 18S, AL31 October 2014 NDL'.0 bili ofthe inezease in deposits placed st 8S was dua to ‘epoats hom oer banks. ‘Acomparison ofthe deposits placed by BS at other banks with depots laced at BS shows thet 413 November 2014, MDL. billon of 8S Nosto deposts at Alt Bank an Interprombank were effectively nated of by deposits from the banks at 2S." The purpose ofthis may have been to Increase the lending capabilies of 8S, allowing [tt Issue mere loans to Shor Group companies. ‘aie 7 85 sane sheet portion at yearend 0 and 3 Ober 201" es [_____senanoia] raat | "MDL 000, Demand copes nd cash ea 220i ast Loans and Advances 3.406.108 Other sats 626.088 Tota sesate 5.423.408 Dele Som ae aa ‘er Lsbiies 414730 470.80 Total Lables Brae sane Ea Ta08 Ta ‘58 popu nostor ‘88 porate ~The lnc bat ne 201. Deac tT ‘Pate and Consent Copy 39 of 99~ Me Andon Cand he Speaker fhe Partament of te Republic ofMoise “BB) Kroll. Project Tenor Phase | Report 923 UB ‘other than customer loans, UB's asst pote dé not change signifeany between January and the end of October 2014. Customer loans increased by MOLOS bition and an Increase of Shor ‘Group fan exposure of MOL1.0 dillon demonstrates that tis increase wes dtven by loans to these companies.” Deposits placed at UB Increased by MOL'.0 billon dung 2014, A review of tho breakdown of ‘deposits at the bank on 3 November 2014 shows that the deposits st UB at thal time were prmaiy rom other banks, with MDLS.S Billon ofthe NOLZ.3 bill tial doposts coming frm ‘other benks. Of the total depestis placed at UB, MDL62 tillon wore from Metrobank, Interprombank and BEM. ‘Acomparison ofthe deposits placed by BS at other banks witn deposits placed at BS stows that ‘on 3 November 2014, MOL3.5 bllon of BS Nostto deposits at Alef Bank, Metrobank, and Interprombank were effectively netted off by deposits of the same value from those barks at UB. The purpose of this may have been to increase the landing capabities of UB, allowing Ito istue more loans to Shor Group companies, and would account for almost al of UB's loans to ‘Shor Group companies a this tne ws nano Sarat DL 000 ‘MOL 000 Darna peat nd cash eau 3504404 ezaaee eas S207 582 4213851 (Othe Asset 342.9% 344036 Total Assets Taiaseo ewa088 epost e028 Taras Other Lai 465097 408328 “otal Liabiisos| 795.985 7583.26 Eau wae ‘vs mony Elance sats une 272-Decembe 2014 Ka Sor Gop expose snes ‘spinel egw te Private and Conf: Copy 3 of 99 Mc Aden Cand, the Speaker ote Poament af the Repub ortotons 45BD) Kroll, Project Tenor Phase | Report 10. November 2014 10.1 Financial Overview The month of November 2014 can be spit into two stint periods. The fst period ran from 4 November to 24 November and the sed period ran fom 25 November to 27 November, which was then flowed by the banks going Into administration ‘The period 1 November 2014 to 24 November 2014 reuted Ina significant reduction in exsting loan balances at UB, BEM and BS of Sher Group companies, other than customer loans issued by BEM to four Shor Group companies: Provalrom SRL, Dracara SRL, Cartas Group SRL. and \Voximar Com SAL. During the period, the overall BEM lean porto increased by approximately [MOL10,7 bilon, sth 2 eignteant portion of funds loaned being used to pay down exsthg Shor (Group exposure within he thres banks. [UB and BS received a significant amount of funds to pay down eusiomer loans previously Issued. ‘This provided increased lui, which enabled them to place place interbank deposie, most notably with BEM. The increase in the overall oan exposure at BEM was party funded by tese Interbank depoats, together with deposits trom other Moldovan and Russian banks. Based on 2507634 2197112014 | Voxinar Com SRL Epovsen Leics 2796800 vva014 | Voxinar Com SRL | Hoste Level LLP 100408 Tota e048 10.2.3 Funding the loans at BEM 1023.1 Reducing existing Shor Group loan portfolios in UB, BEM and BS With the exception ofthe leans to Provolzam SRL, Dracard SRL, Cartas Group SRLané Veximar ‘Com SRL, the outstanding customer loan balances at UB, BS, and BEM ot 31 October 2014 creased significant during the period 1 to 24 November 2014, by total of MDL 65 bilon. UB's customer loan portfolio decreased by MOL3. bllon, the largest amount ofthe tree banks. In the period. The loan portale st BS reduced by NOL!.7billon inthe period, en in parcuar, byMDL!.67 bition on 12 November, which is taced in sacon 112.32 oes et Novator 244 Suh dt. ‘Pate and Condsntat Copy 99 89 Mr, Arian Gandy, te Speaker of he Parmer Republic otto on) Kroll, Project Tenor Phase | Report ‘The customer loan portflo of BEM, excluding loans to Provolrom SRL, Dracard SRL, Cartas {Group SRL and Voximsr Com SRL decressed dung the period by MOL. 34 bition ‘Shor Group companies accounted for @ decrease in customer loans of NDL1.88 billon at BEN, (MOL1.89 bilon at BS, and MOL3.44 bilfon at UB for the pariod 1 to 24 November. This accounted for almost the entre reduction In customer Joan exposure In November across the three bank. ‘The majo ofthe lan reduction of MOL. .5billon fs beteved to have been funded by he newly ‘soued loans totaling MDL13.1 bon, issued to Provoliom SRL, Dracard SRL, Cartas Group ‘SRL and Voximar Com SRL. How the balance has been utlses has not been frensicaly traced “abe 2 Only Los Part sana US, BEM a 86, ono th eee ar Prion BRL, cae SRL, Cartas Group SRL an Vesna Com SAL" ‘BER Toa Balance Sar ate sstoanoairee| uBioanoainee |“ oracard ‘Vimar TOL OD MOL 600 WOL000 oan 3408 680 20.821 067828 oara0%e 3482248 4071482 067.828 osna0%e 3402208 3.108.548 88.486 ogiva0%e 2348.47 3401860 2.228.854 2088 688 ornva0e ‘uss08tt 350488 2000277 379108 2044 7.980.511 358.245 1.510.208 5028 68 ‘010 7.980.528 ‘aero. 510.8 ‘3070400 ‘aa0%8 1.760207 "968 82 5487 409 760.895 ‘aurva0%4 "(280,767 1.045.48. 46.021 7804,757 arvana 1.286.674 180.061 544.640 7504,767 ‘a0 7,098,748 1,860,000 514.40 7,500,567 rerrvaors 1.006781 2008.76 339.408 ‘3010.967 rant 1,906,724 1.96602 nna. ‘372.888 zona01 1.006.668 1.820.031 1.019.653 ‘9735067 “Bina. 1.006464 7.818.606 316,058 “ore 262 aria 1.006484 1atirat 707038 72007804 Moana oS, and WE an ola Novbar Ne Pivate and Content: Copy 99 of 23 ir Anais Cand, the Speaker of he Pariamant of he Repubic ornoaove 2BD) Kroll. Project Tenor Phase | Report 10.232 Repaying the loans: transfers from BEM loan customers Krol reviewed the movement of funds relating o @ loan between BEN and Voximar Com SRL on 412 November, to demonstrate the movements of Shor Group lean funds from BS and UB to BEM ia the placement of new BEM loans wih Shor Group customers ‘The reviow domonstated that loan payment of MDL!.68 bilion to Voximar Gom SRL on 12 November was transtorred to an offshore entity, Expovision Logisies LP, on the same day. Later that day, numberof offshore eniies transferred, In total, en Kentcal amount to Shor Group ‘companies, who subsequent paid of thelr loans with BS. ‘The fund flows provide 2 strong Indication of a trace of funds ftom BEM to BS, via Shor Group ‘oan customer accounts and ofshore bank secounts. ‘Stage one: Placement of funds with Alef Bank, and return as a deposit (On 12 November 2014, BEM placed MDLI.74bifon ints Nosiro account at Alef Bank, and on the same day Alot Bank place an idence! depos of MDL.74bilon In BEN as a term deposit ‘Tho Intention ofthese actions was to se the Ale Bank deposts as collateral for lending at BEM, allowing BEM to increase ts customer lending. BEM's balance sheet eeakdown for 12 Novernber states that this placement was secured In favour of Voximar-Com SRL, demonstrating thatit was ‘sed as a guarantee ona loan to his company.” S08 SE ee Ak , i. va a Seong capa wen BEA” ‘Stage two: Loan to Voximar Com SRL, and transfer of fun offshore (On 12 November, BEM loaned Voximar Com SRL a Shor Group company, total of MOL! 68 bilion in MOL, Euros and US Dales. At 14:08 on the same day, Voximar Com SRL transfered [MOL{.88 bition in Euros and US Dols to Expovision Logistics LP, a UK based company with an ‘sccount atthe Latvian Bank, Prvatbank pana ape > apts At Bh, Ne Bon Doon EM ‘vate and Contéontat Copy 38 of 5M. Aran Candy, th Speaker othe Parament fthe Republic of Motors 33BD) Kroll. Project Tenor Phase | Report ‘be: kant VounarCom SRL anc rantr ttndsoteoe a Sraion eps” ano voc secs yuyu [At 16:44 on 12 November, ‘tom ofshore companies totaling MDL!.58 bllon. Al ofthe offshore companies had accounts ‘wit Prvatbank in Latvia, and are registred inthe UK. ‘On the same day, the Shor Group companies which had received the funds fom offehore ‘companies pad of total of MOL. 88 billon in loans t BS. Private and Cane: Copy 89 of 23 ~ Mr: Andian Cand, th Specker of he Paramen ofa RepubBB) Kroll. Project Tenor Phase | Report nn 3: Tanstr ef urd tom atte congas o Ste Coup an eustrer, ad renburament fans nya we sgh isu see miuns aetertuyng T Ree a Senet SL coe nro arex si Lavine gees raed Lesnhenomets 10.2.3.3. Similarities between BS loan transaction companies and those used by UB and BEM. ‘Araviaw ofa sample of the Uk-relstered companies connected to lean transactions at BEM, UB and BS, show striking simiaries. At least nine companies were incorporated on either the 13! or 14" of February 2014, have the same UK-registered corporate members, Dealt Secretaries ‘Limited and Tuepain Limited, and share one of two addresses, which ae in turn both inked tothe ‘same mailbox provier, Mall Boxes Etc. Tiree more companies were registered on diferent dates tat tment Sor ro, Ser Siolean payments ‘ivate and Condens Copy 33 of 8M. Artan Candy the Speaker af the Parlamont fhe RepuDicBD) Kroll. Project Tenor Phase | Report at a third accross operated by Wall Boxes Ete. AE least a futher tree companies ate all registered at 45 Resohaugh Road, a reson roo In Inverness, Scotland 10.234 UB and BS increased thelr net deposits with BEM. ‘As noted above, exsting customer loan balances at UB and BS decreased by MOLI. blion and MOLI. bition respectvely between 1 and 24 November 2014 (representing a to reduction crs the two banks of MDLS.2 billon). In the seme period the net deposits of UB and BS at ‘EM increased by MDL3. bition nd MDL2.7 bllon respectively, representing ota increase of MOUS. bition. There was, therefore, a crect carelaion between the loans at UB and BS an value of deposits by hese barks placed at BEM. duction In eon Compares tengo BM capa t 8 and UB wih doses em 86 a US customer scone Fe pare PLLLLLLLLLLLILLLLLELL 10.2.4 BEM Russian Bank Deposits ‘The value of BEM deposits at Russian banks increased significantly from MDL.35 tllon on 3 November 2014" to MDL12.96 bill on 26 November 2074. The increase was matched by deposits from Russian banks totaling MOLIS.85 bilon on 24 November 2014. Balance sheet reskdowne for BEM during tis period show that he placements from Alef Bank, Gazprombanke and Interprombank, were used lo secute the loans to Provliom SRL, Dracard SRL, Cartas (Group SRL and Vorximar Com SRL." co a of dapat ann ‘teat pracpan ees 2 oinananaee ‘rvate and Consent: Copy 33 of 38 Rc. Anan Can, he Speaker ote Parlement of fe Repubss otto ©BB) Kroll. Project Tenor Phase | Report [A comparison between the Inlerbank deposits end loans ffom Alot Bank, Gazprombank, and Interprombank at BEM throughout November and balances on BEM Nosto accounts at these Danks, fs set out n below, LOPOEOBOEDE DPR ERE RD IDS ‘A review of BEM balance sheet information demonstrate that in the percd + 1 24 November, ‘he large deposits in BEM's Nosto account at nterprombank were in tine withthe deposits made ‘at BEM by Intorprombank on the same dey This shows that the Nostio deposits at Interprombank, were effectively being passed back by Interprombank as 2 deposit at BEM, Similarly, the deposits made by BEM Ino it Nosto accounts Alef Bank and Gazprombank were assed through as deposits into BEM, “ane 24 Nest asour opt by BE at arranbane ve. pote arrember aE" ‘ate Company trom | Company to | Comment “amount TWDL 00 Taian | Bee Tntrrenbenk | Neste depos 375373 Triv0t4 | mtecronbank | BEM ‘Ter dopost B76378 sarvzovd [BEM ‘wlrenienk | Nose deposi "207.960 rorao14 | inerprontank | BE eam deposit 7.287.960 seriaor4 [BEM Tnlerpamtank | Noto deposi 575164 ‘eiz014 | inerrontank | BEW Teor depos 375.66 2aniaow | Be irierrenbank | Noste apes 758.809 ‘Prvate and Confident Copy 38 of 3 Mr Anan Cana, tbe Speatar fhe Paramant ote RepuBe or Moone 7BR) Kroll. Project Tenor Phase | Report a Company for | Conpanyte [Comment Taare 244 [eran | BEM Term pont 78,50 10.2.5 Placements in BEM from Moldovan banks Beween 1 and 24 November 20%4, Vicora Bank, Evacedtbank, Moldndconbank and ‘Aarondbenk placed a ot of MDL23 bilo on depos at SEM. BERTE ATT viciona Bank | Ewoeredtbank| Moldndconbank| Agroindbank| Total So OL S60 | wL'080| WL B00 waa coo asco 72261 20861 ari 000 70 “22.81 7.81 ernie soco0 7 ‘aa7e8 =] e768 earva4 eco0 ase 201286 =| setass rr 70.909 E ‘aaa =| maa ‘ornate 000 E 122,169 =| aas69 ‘arava soco0 so 22392 =| asaa92 ‘arvana eaco0 Ei 122890 = 2zza90 arv0%4 eoco0 E 102.90 =| a900 ‘raat ecco TE sagas] wos | —s08n00 sarsaate ‘s0cc0 15.00 asassa|—ssoaro | soos02 ser94e aeaate 15,00 assass| —ssiao1 | s24p0s orion [48705 2,00 assars| estar | 17659, auvovante | 180590 25,00 sages] 51.50) 170439 aarniane | s0aas 2,00 asiore| vea7oe]| 200581 ee ‘Prvate and Conder: Copy 39 of 38 Me Anon Cand, te Speaker of te Pertaent oe Repubse ortoBB) Kroll. Project Tenor Phase | Report 10.3 25 to 26 November 201 : Moving Shor Group loan exposure from BEM to BS, issuing new and higher value loans to Shor Group in BS and selling the loan portfolio During the two day period of 25 to.26 November 2014 a seras of transactions tok pace, which had the effect of transfering BEMTs outstanding Shor Group custome loan porto to BS ‘+ The exstng Shor Group lean exposure at BEM of MOL13.05 billon was pad back early ‘+The existing balances tetueen Russian banks and BEM ware cleared down; + BEM placed large deposte wih BS; ‘+ BS issued new loans to tve Snor Group companies; and 8S cold tho entire Shor Group loan pototio at beok valve pus interest. 10.3.1 The existing Shor Group loan exposure at BEM was paid back early (On 24 November 2014 the total Shor Group loan exposure at BEM of MDL13.05 billon was concentrated in loans provided by BEM to four Shor Group companies For reasons currently unknown, on 28 and 26 November, the ene portfolio of BEMs loans with Provolrom SRL, Dracard SRL, Cartas Group SRL and Voximar Com SRL, were repsic ‘amounting to atoll repsyment of MDL12.05 blo. TMDL 0 2eiaow rasan SRL 2,640,728 aio Provolrem RL 186,700 aio Voxinar Com SRE 35297 2aria044 Castes Gow SRL RETAET7 EET Provolion SRL, 054591 ‘The source of the funds to repay these loans was the offehore companies to which loan funds had originaly boon transfered throughout November. In toll, these companies traneorred 'MOL1S.08 billon to the loan customers between 24 and 26 November 2014 fo anya of Be an porto Never 214 Prvate and Contin: Copy 3 of 89 ~ Mr. rctan Cand, tho Speaker Oe Pranet the RepubieBD) Kroll. Project Tenor Phase | Report “aie 7 Ts ton ott capa Prova SRL, Onc SRL, Carte Group SRL and Vous om Date Range ‘Company From ‘Gampany To Total Bara Tosa Level P| VoxinarCom SRL 1628 2526/14R014 Net Proton SR aa16201 aarto44 ‘spovion Laioios P_| VoxinarGom BRL 3.128.578 2ariao14 ‘Specva Ventures | Cartas Group ORL ‘3570077 Tota To0n.038 ‘Analysis of Suit message data supplied by the NBM showed that a number of payments by separate ofenore enttes were made tothe loan customers atte same time, indleting that the ‘payments were being instructed concurrently ‘ale 2 Tg of concur paymens anole compan o Provlion SRL, rca SRL Calas Gp SRL ae Tae Conpaies oa [eonpaine To Te. Eevetor —| Prova SL asi wos Mju urrance | youu, ier Se sat zovirax 12 Negus, spears [Powe SRL Cats cmnnove “oe se. space | Prosi SL, Cotas artes Ee Sees 10.3.2 Russian bank deposits disappear (0125 and 26 November, deposits rom Alt, Gazprombank and ntrprombank at BEM reduced 10 20, Similar, the Nosto account deposits rom BEM at these banks reduced on 25 ond 28 November and stocd at ero on 28 November ™ [A roview of the BEM Nosto account actly at Gazprombank demonstrates that the foan repayments from Dracard SRL on 26 Novemter were brosdly inline with the size of Nostro ‘account withdrawals made on the same cay. Gazprombank reduced its term deposits at BEM by the same amount a¢ the Nosto wihsrawsle of MDLS.06 billoa. This demensrates thatthe repayment of Dracard SU's loans was funding the refund of deposits to Gazprombank, and ‘ithramal of funds from SEH’s Nosto account "kot ea of November 20 Sin ta “kot eu of Movoto 2014 Si ata TM aio EM aptareeéown Phat and Canfentat: Copy 39 of 23~ Mr Andria Cand, the Speaker ofthe Parlamen ofthe Repubic of Moora °2B) Kroll. Project Tenor Phase | Report 28 orca GR on repayments vB Host sc waht tm Garo Dae GORE Company to Commentary ‘ance Or ooo TBeWGTA raced SRL EM Contact Number 08-067756 ora 212014 Garprombank GEM ___ Novo secoun wihraval 7006 252014 racer SRL BEM Conia Number 0-06/158 30240 ATO Garponbank EM Nos secur wiheaval 72.20 25/2014 raced SRL BEM Cont Number 0-06158 02685 2eV2014 Gazprombenk 9M __ Novo exzoutwehéaval 107483 252014 racer SRL BEM Cont Number 0-06138 168.080 259014 _DracaedSRL_BEM___Conact Number 0.00182 so2aso ZITV0% Gazpronbenk EM Nosko azzunt withaval TAS 252014 race SRL BEM Contact Nmber 0-001775| 4760 2ev2014 Gazprombenk SEM Nos eozoun wihdaval esate Interbank deposits held at Moldovan Banks remained outstanding inthe parod 10.3.3 BEM placed funds on deposit with BS (0n 24 November 2014 BS had net deposits of MDL2.5 bilon al BEM, Four days ltr, on 28 "November the not dopost poston had swung by MDL1SS bition so that BEM had net deposits With 8S of MDL bllon. This increased Equity a BS increased is ably to iesue customer loans, rh 3: Dept by Sa Eve depot a BS by BE om 2419 28 Nove” —steemset anaes “Yt ani of SE an pte Novrber 214, EM Nee ssa a Carron ——TitoLanannat Ben coset esteem ‘Pate and Conteentat: Copy 38 of 3 Mr Anan Canau, the Speaker he Parent ote Repubte ofMoisore 61BD) Kroll. Project Tenor Phase | Report 10.3.4BS lesued new loans to five Shor Group companies (On 25 and 26 November, 8S Issued a toil of MOL13.7 bilon of loans to the Shor Group companies Danmira SRL, Oavera Com SRL, Cartas Group SRL, Contade SRL, and Voximar (Com, Two ofthese comparies, Cartas Group SRL, and Voxinar Com, were the reciiens of large loans kom BEM between 1 and 24 November, which were then paid off on 25 and 25 November. The loan references wore numbered sequently by day, demonetatng that they were issued a8 bate “a 0: Laas sey 36s Sar Croup ean aan | Dana SRL oan aor 850 2a/a014 | Osama SRL Loen 2a50%4 7205255 a/a0 4 | Dania SRL oan zonro%a 720888 a/sao14 | Daven Com SRL oan 2572044 a8. 2B/Vz014 | Vesinar Com SRL oan 200701 2485.289 evz0%4 | Conade SRL Lose 26072014 374.601 2evao%4 | Conede SRL Lean 2012074 {981.400 Beya014 | Care Group Lean 20272014 204272 BeyTVa014 | Cares Group ‘oan 20572004 Tse s02 Bera014 | Caras Group Leen 20072074 ‘Ba.172 Tots ase 308 ‘Tale: Paynt am oan tana ores” ‘Subseguenty the loan payments ware passed to offshore entities registered in the UK and Kong, in both Euros and US dots. Hong Date [ Company tom | Company to [Commentary ro 0. 00 carivaote [amie sr | SRE se | Peon 20%8.00 asrizov4 | amiasr | Senate | ey 88 awrimote | SxemACER TRoyaponuea | Prepeymentfor 398.452 erione | Cartan Grup | SRT _| pgnenor 2402, ernie | Cats croup _| SATSOEN [Popeater 043th aevrata | contade sn. | Day pact | repent or perma | Conade SRL | Danley inpexte | regeyment er arate "any of 6 an portato ‘el aa ef hvemoe 1S ety Prvate and Consent: Copy 39 of 38 lr Anan Gan, te Speeker of te Pateent oe Repubc of notreBB) Kroll, Project Tenor Phase | Report Da ‘Company rom [Company to | Commentary ‘Amount sianva | Woximar Com | Expovson. Prepayment OF are aaron | tagoteste | Sonus a Tata Taeee ae Al ofthe offshore companies used bank accounts at Privatbank in Latvia fo receive the fans, ‘There are a number of simiarties between these entities, which appear to be shell companies ‘created for the purpose of further channeling loans trom BS. All fve companies were created in the months leading up tothe transaction, betwoen 28 May 2014 and 6 November 2014, and to ‘dete have only fed incorporation documents. “Thee of the companies were incorporated les than one month belore the lean Wransscton: Royalpor Limited (Hong Kong), Expovision Logstes LP (UY, and Danlay Impex LP (UK). Thos ‘of the companies were incorporated in Scotand wih two being incorporated at alferent ‘addresses in Ecinburgh, Danley Impex LP and Expoviion Logistics LP. The third, United ‘Technologies LP. (UK) Is registered st residential bung at 4S Roschaugh Rost, Invemess, Scotland, which Is also the registered address of other companies that conducted loan ‘transactions with BS In November 2014 euch as Westand Allarce LP and Zenit Management Lp, Al five companies have furher offehore entities ae avers or perner. Notably, Vere! Soutons LLP and Royalpor Limited are contled by ents registered n the Marshal Iiands at Tst Company Complex, Aetake Road, Aftake Island, Majuro, MHSEB60. The Trust Company ‘Complex is aso the rgisterad aderess of entities disclosed in UK corporate records as partners ‘of Roseeu Allance LLP. The corporate parners of Danley impex LP. are registered in Dominica “The rogstoed adéress ofthe corporate partners of Unltd Technologles LP and Expovision Logistics L? are not cislosed in available records. United Technologies LP however, has the ‘seme corporat partners asthe above mentioned Westland Alance LP, 10.3.6 Transfer Currencies ~ US Dollars and Euros ‘A total of US8232.2 milion, and EURS44§ millon was transferred from the Shor Group fan ‘customers to offshore entities on 25 and 28 November “Teno 2: Tals n US Onl an Eros sh ie ofa congie ow an onde waren ate —_| Fem Te “amount | Cureney ‘siti | Danmira SAL__| Unied Teshnotoaiee UP 22680.900| US, ‘zante | Cartas Group | VerootSautone LP 600.000 [usp ——Houanamotoverter dota ‘rvate and Consdentat Copy 38 of 3M. Ardian Candy, th Speaker of the Paramant fhe Repubc of Moise 3BA) Kroll. Project Tenor Phase | Report Dae [From Te ‘Amount | Carney 26/7 | Conrade SRL | Daray Impex cP Za4s.500| USD 2eitiise | Vosimar Com SRL | Sxpovison opiice IF “e4000.900| uso aie [Deena SRL | Und Tecinoogis LP "s9.16;06| eR erie | Davena Com SRL | Royaper Lt “re00.900[ eur eiririe [Cartas Group | Verat Solione LP “e07.si4| EUR Davtirié | Contade SRL | Dany impor LP 7105.00000) EUR ‘Alfie offehore companies received the loan fun fem Shor Group companies inte accounts at the Lavian bank, Prvatbank, The sift code forthe beneicany accounts, PRITLVZXXK is that of Prvatbant’s headquarters in Riga, Leta. ‘Tove 3 Patan sunt Rr for eat eae cna hh as ae wre aan ‘Company ‘Recount Number Unt Teeioionee ‘yore Toaeen22020300 Royabor us ap ToaHN22 721600 Vera Sots UF ‘va2PRTTODH2212000 Desley mpex asp To2H6022121400 Exgowsion Logis UP ‘GV1OPRTT0266022067600 10.3.6 Selling the BS loan portfolio to Fortuna (On 26 November 2014, an extacranary shareholders’ meeting of BS shareholders is sald to have taken place in Caheves, Ukiaine. Dring this meeting the sale to UK-based Fortuna United LP of BS loans issued to Danmira SRL, Davorra Com SRL, Caras Group SRL, Contrade SRL, and Voximar Com was reportedly approved. Natlla Rshubs 8S Interim president, naa previously authorised the loans on 28 November 2014 According the Moldovan Law on Financial Instiutions, NBM should be Informed of and approve the atondees of any extraordinary general meeting at least seven days pir tothe meeting. No such approval was sought by BS from NBM, ¢0 the meeting can be sad tobe void. It appears that @ number of atles under the Law on Joint Stock Companies may also have bean contravened, surrounding how exracrdinary goneral meetings should be organized, approved, and voted on by proxy. According to the contract, the purchase pron of the losn contacts wae MDL16.56 ‘illon, consisting ofthe loan amounts, intrest, and a 3% dawn payment. . The addtional MOLA bllon sate tombe, aa wate and Content: Copy 33 of 33 Mr Anaian Cand the Speake of he Partamen’ fe Repub orMoiove aBD) Kroll. Project Tenor Phase | Report above the MDL13,7 billon of loans represented the value of future interest payments on the ‘one, Subsequent, the loans from the five Shor Group compan were repaid to BS. Fertuna United LP appears tobe typleal shell company, According to UK corporate records, the company was incorperated on 8 August 2014 and is curently registered at 18/2 Royston Mains ‘Street, Esinburgh, EHS 1LB, Scolnd, UK. This sao the current registered address of Noviand Ls, @ shareholder of UB. To date, Fortuna United LP hae only fled incorperation documents, wich reports general pariner as Brixton Ventures Limited, and Trafloré United Limited 9s limted parter, with both parmers belng registered in the Seychelles. The Incorpraton documents wore presented by a Remigius Mikalzuskas of Royston Business Concultany Lis, which Is also registered at 18/2 Royston Mains Street, Remighus Mikslauskas is aso the signatory for Brixton Ventures Limted, ‘As pat ef thi dea, 2 down payment of MOLES! millon was made by Fertuna United LP 08S on 26 November 2014, Te source ofthese funde can be traced back though Fortuna United LP to UK registered company, Tennant Sipping LP. Ithas been suggested tat the original source of {nds from Tennant Shipping LP are the loans made by BS to one of Danmira SRL, Dsvems Com SRL, Cartas Group SRL, Contrade SRL, of Voximar Com, Curent, we have reviewed no ‘account information to Support tis trace ‘xe Company rom [Company | Commentary Tian uD. 200 zai [FETED | oserpon um | Panter bala 5110 nazar | JesrponiP | Fonunatnneaur [Santas ez “1 zan04 7 [Fenune umes | Sea 64.10 Cone er ar120%¢ | Fonina Unt? | Bonen Sosiia | ovine on aarva014 | Fomina Unies | Baca Sola | Soa sed 8877 zevva0ia | FoninaUntestP | Baca Sonia | Sovuas ened 20,600 ‘Tennant Shipping LP was incorporated on 18 August 2014 ang has to date any fe incorporation cumerts. The company is registered at 12 South Bridge, Suite 1, Edinburgh, EHt 100, ‘Sealand, UX whichis aio the registered adress of Expovision Logistics LP, a company which ‘received funds losned to Moldoven companies by BS, Corporate records disclose the partners of Tennant Shipping LP as Headway Invest Ltd and Loyalty Services Lid, but do not repett the companies’ registered addresses ot jurditon of incorporation. ———Hvotanauen cttowoter Suit ane Forme United 2 aroun semen ‘rvate and Contéentat Copy 3 of 38M. Arran Candy, the Speaker of he Parlamont ofthe Repubc ofl csBD) Kroll. Project Tenor Phase | Report 10.4 Attempt to reverse Roseau contracts |A few dave prior to the bank's placement under special administration BEM's management attempted to reverse the wo cesslon agreemantsalgned wih Roseau Allance LLP on 18 March 2013 and 10 September 2013. According to an internal invesigation conducted by the bank in December 2014, the bani’e Councl issued Decision 161 on 26 November 2014, which allowed BEM acting president, Viorel Bice, to sign cancellation agreements with Roses. According to BERS investigation, the only basis for he Counell dectslon was a note Issued by BEM legal department. However, Vadimir Cre, deputy head ofthe legal department, informed BENS internal investigators that he recelved a request fo prepare the note om Viorel Birca on 25 November 2014, Subsequent, on 27 November 2014 he receiv a daft of he nate by email from Viorel Birca and Angola Osoianu, secretary ofthe bank's Counc. By 28 Novernber Viadimie Cijeu received two cancelation agreements rom Viorel Bre fr review. Vir! Brea was interviewed by BEM investigators and sltod that he signed the to cancelation agreements, but cher tasks such a5 re-establishing the bank’s rights over the credis was ‘assigned fo the egal department The BEM investigation concluded that the legal department was not infact sent the necessary sppendioes and individual casstion contracts, These documents were ao provided fo BEM at the point the cancellation contracts were signed. As thls return of documentation was pat ofthe cancelation contzacs, the caneetaion conse therefore appear to have not Been fuiled. The {EM Investigation described these contracts as suspclous and recommended the mater fo be passed on tothe Moldovan national Gente for Ant-Comuptio. 10.5 Suspicious loss of loan documentation at BEM, BS, and UB. A large amount of documents held by BEN, 8S and UB disappeared under suspicious croumstances only a few days prior 1o BEM belng placed under special administration on 27 Novernber 2014. A van used to transport BEM fl for archiving and operated by 2 company associated with an Stor was atlegedly stolen and ater found burned out ‘vate and Content Copy 39 of 39~ Mr Anan Cand, he Spoter ofthe Prisent of te Repuc orton eBB) Kroll. Project Tenor Phase | Report {An inornal investigation conducted by BEM in December 2014 estabished that on 26 November 2014 the acting presldent of BEM, Vier! Bes (Birc"), Issued an intemal order™ requiring certain documents to be archived. Fes marke for archiving included exignal documents held ‘within ereit dossiers of evain loan customers such a fles dscussed by bank's board and swt Confimations. Documents relating to placements and receipts of fnarca instruments with banks in Russia wer aleo due tobe archived “The order was communicated to relevant department heads and 12 secke of flee were lwanstered to Bless ofc. ture Burulana, head of BEN'S deparment for management, colection, and technical protection, was tasked wih procuring a vehicle to transport the fs to the archive, A vehicle was provided at 7pm on 26 November by Kiassiea Force SRL, = security ‘company which BEM sta have stated Is controlled by lan Shor. The sacks were loaded into the Vehicle by the erver under the supervision of lure Burana. As twas lat, the diver stated that ‘the documents would be transported to the achive te flowing day, on the 27, and the vehicle ‘would be held ina secure garage overnight “The folowing day, Klssles Force SRL informed BEM that the vehicle had been stlen and found burned out, a fact confimed by @ Molovan police reper issued on 1 Decomber 2014. Subsequanty, on 22 December 2014 Klassca Force SRL. cared to BEM thatthe vehicle was stolon while it was also transporting documents to UB's erchive, which was located inthe town of incest ‘A.BEM report onthe incident noted that was suspicious es numerous documents are stored al BEM's headquarters and that “no process transporting them to the archive has ever been inated. Th report sao highighted that a third party wes used to transport the fbs despite frie Burlanas departrent heving sufficient resources to transport the documents inhouse. The Investigetion comission also noted that during his interview Viorel Birca did not inform Investigator that he had received notice from Kiassice Force on 27 Noversber 2014 that the vehicle was ston. A ‘Pvate and Contoartat Copy 33 of 3 Mr Anarian Candy, he Speaker ofthe Panlamont ofthe Republic oruetsove orBD) Kroll. Project Tenor Phase | Report 11. Loan customer connections 11.4.4 Overview Areview of documentation provided by the NBM demonstrates tht the recipients of large loans ‘fom BEM and BS in November 2014, Cartes Group SRL, Provoliom SRL, Dracard SRL, Voximar-Com SRL, Davema Com SRL, Dania SRL, and Contade SRL are related to Shot ‘Group, and thus the lane were nota arms length ‘The Corporate Records ofthe companie shows that al re registered in Chisinau, and they were al opstored inthe as three years. onary Nene [bala Reged [Aine Omer Caras Gop SRL | YrOor2 | en = Gris, WO.100 | Ante Ne Conde SR rrrnaora | RARER es 27. CHINO TOT pontine Danni sat | rorvaora_| HeSST ARDS CHAU Tpaasratean Bavena Gon st teneaors | Stone 2 HARES cht rear ‘nents | Maan Talon Domi jot CPE, Ca Prowemsnt | wonaore | MBMEaG PRR? aa Voximar-Gom SRL | 20/04/2089 ‘Aparment 1, Hinessti pos 142, | Sergi lara ‘Senay isa, WD 002 11.4.2Connections 11.4.2. Loans at BEM, UB and BS All of the seven lage loan recbients had received loans ffom other banks between 2010 and 2014, Of the seven ent, the four lage loan recpiante from BEM, Cartas Group SRL, Oracard ‘SRL, Provlirom SRL and Voximar-Com SRL, had receved loans from each of the three banks ‘onpany cy us a aveas Gaup SRL x x x ‘entade SRL x x ‘Danmie SRL x x aver Com SAL x x * coor Rast Cate rag SRL, Crate SRL, Dania SAL, Der Com AL, acts SA Provelion ss Vocm on SR i asi of Se: top expe Private and Canina: Copy 28 of $3— Mr: Andian Candy, th Speaker of he Perea of he Republe toler 08BB) Kroll. Project Tenor Phase | Report ‘Gompany Be we co Dracard SRL Bs Pa x Provolron SRL x x x ‘Voxnar-Com SFL x x x 11.4.22 Offshore company payments, ‘Swift messages provided by NBM demonstrate that sb of the seven large loan customers at BEM and BS received funds from common offshore companiss, with soeounts st Prvatbank n Rig, Lat, inaleating Inks between the loan companies themseve “Company Fonmisoid LP ‘Sonya Fade OF ‘Gaas Grup SRL x Contade SF x area SL x Davoma com SAL x rset SRL x Provotrom SAL ‘esmar-Com SFL x 14.1.2.3 Requests for Internet Banking ‘A review of the aderesses designated fr Intamat banking st 8S links @ number ofthe loan ‘customers with one another and other Shor Group companies. On 4 December 2013, Voximar- ‘Com SRL, Dracard SRL, and Davera Com SRL, along with si other Shor Group companis, ‘were connected fo Internet barking by BS et Str Tighns 12, Chisinau. Under @ month late, on 1 January 2014, Provalrom SRL was algo connected to inlemet banking at BS at the same adress. A number of BEM customers were alco connectod to Internet banking al this aderees, Inctucing Dutterol SRL and Moldclasics International SRL." 111.24 Shared Tolophone Numbers: |An avertsement on the Moldovan recruiment site toplobs md fo @ secretary by Shor Holding ‘aves the telephone number 228-027 and the email adsraes irina@sherolsing com, This {telephone number was similarly used onthe account opening documents at BS by Contrade SRL, "cot ans of November St as "05 amet ang eqns Berne bang ears ———Miestemoe Teer ‘vote and Consdondak Copy 38 of 8 — Mir. Arian Candy, the Speaker he Parament ofthe Republic ornare eeDD) Kroll. Project Tenor Phase | Report Davema SR, Oracatd SRL, Provallom SRL, and Voximal-Com SRL on a request to BS for Intamet banking. * 114.25. Shared Addres ‘On request for Internet banking wth 8S in June 2012, Cartas Group SRL lists its address as ester Mancle 12, Chisinau, the eam eddeas at which Danmira SRL is current registered, > 114.28 “Shor Holding" as described by BS staft ‘The boi that companies involied in euspcious loan tansactons may have acted in concert ith Shor is further supported by @ schedule of "Shor Hoiing” companies dlscovered at BS, Emailed by BS staf before the bank was placed under special administration and identfiod by an NOM investigation, the fe describes the companies indicated below ae part of the “Shor Hoiding’, Companies such as Davema Com SRL, Provolom SRL, and Dracard SRL are known to have been loan customers of the three banks and are mentoned eacie otis reper. ‘Companis denied as "Shor Holding’ within this schedule incude: Ghermivat Eleomat Pim Vascovpeod Moline Grup Se SRL ‘lutus CON Arosa Pro ‘avena com Ccontrade obi Air Moldeassiee Intemational Desler CON Provoizem Lavi impox Dracard Biro Mecia ‘anes Stored Grup "cova Sr, beams Sra! RL Poa SL road cues, Provoon arabia tenet banna sees Piva and Contant: Copy 85 of 33 Ania Cand the Speaker of he Paramant of he Republe ormvaove 0BB) Kroll, Project Tenor Phase | Report 12. Where did the money go? Between 2012 and 31 October 2014, exposure of companies deemed part of the Shor Group incressed cramaticaly from MOL‘. billon to MDLS bilin, This compried what appears to have been ital, genuine lending sctivy which, as tre progressed was characterised by a complex tion, whereby loan funds were passed amongst the banks, between enite, via foreign entiles using Latvian bank accounts. The structure of the transactions and overall scheme was designed in an attempt to delberately disguise the true nature of lending activity, and maximise available credit. The general profle ofthese loan customers was not iypcal of normal, commercial tansactions and the fvel of conneetivty between the entities, demonstrates ‘a doliberate effort fo daguise rue exposure of he banks series of a ‘Atul forensic trace Is required inorder to establish the ultimate beneficiaries ofthe MDL 8 billion in exposure of Shor Group companies as at 21 October 2014 and how this developed overtime, It is however clear that llan Shor, and Individuals with which he is associated are stongly Impicated inthe scheme Between 1 November and 24 November, Shor Group exposure increased by a further MOL S bition, as a result of a massive increas In lenaing witin BEM to four compares: Provlrom SRL, Drecard SRL, Cates Group SRL and Voximar Com SRL, The precise reasoning forthe actions taken within tis period are unclear, however itis evident that at this pol, there was @ ‘concerted effort to extract capital rom the three banks, concentrate lending within BEM and reduce exposure elsewhere, This was only feasible, as a result of the Injection of capital ‘received, by four Moldovan banks Inthe form of Interbank deposits totaling MDL2.3 billon and further interbank deposits fom UB and BS. |As summarised in secon 1.2 itis believed that of the MDL1S. bilion in loans issued by BEM to Provolrom SRI, Dracaré SRL, Cates Goup SRL and Voxinar Com SRL, MOLE. tllon was Uuilsed, to clear down existing Shor Group loan exposure in the name of other Shor Group compari at he thos banks. How the balance of MDLS. lion was utilised rine unclear. For unknown reasons, there appears to have been a conscious decision atthe end of Novernber, to transfer exposure from BEM to BS. This culminated inthe issuance of row loans between 25 ‘and 26 November totaling MDL13,7 bition to Shor Group companies, Danmia SRL, Davema (Com SRL, Cartas Group SRL, Conade SRL, and Voximar Com by BS. These funds were transfered fo Latvian bark accounts, inthe nares of foreign entities incorporated inthe UK and ‘Private and Content: Copy 89 of 58 Mr. Anan Can, te Speaker o the Paamrt ofthe Republic ofan nBD) Kroll, Projet Tenor Phase | Report Hong Kong. Ouring that period, the BEM loans inthe name of Provoirom SRL, Drecard SRL, Caritas Group SAL ans Voximar Com SRL were rep ‘The concurrent events surounding the apparent deliberate destruction of losn documentation relating to comparies involved in the scheme, along with the atemst to reverse the cession ‘agreement with Roseau provides further indetion thatthe loans were fraudulent, and part of 2 Aatpeate attempt o siphon funds fom the banks, The actual quantfcation of oss and tacing of funds is part of a brosder exercise to be conducted inthe fture phase of investigation. It is however clear that at present, BS is owed MOLE. bition by Fortuna (MOL3.7billon betore accrued interest Is apples). Even If these funds were used in pert Yo clear down MDLI2.1 bilfon loan exposure at GEM in the name of Provoltom SRL, Diacard SRL, Casitas Group SRL and Voximar Com SRL, those ents have only been Identified as uslsing MDL 6.5 illon of funds loaned to them to clear down existing ‘Shor Group loan exposure, leaving MDL7.2 bilfon not accounted fr. Further losses have been incurred in relation to outstanding interbank deposits held by Moldovan Banks at BEM atthe tine of collapse. [Afull forensic trace ofthe beneicares of funds fs requled, In order to idently the tue extent of beveficaries to transactions, snd sppiy sn appropriate legsl strategy to recover funds fraudulent cssipted ‘Pate and Condon: Copy 33 0f 38 Mr Arcven Candy, he Speaker ote Parlament o he Repube corner 2BB) Kroll, 13. Appendix | Project Tenor Phase | Report Acquisiton Paice paid ‘Sank Uae Peer Linge s7mec012 1.099.313 oan apiomant aigod wih Resse Trae LLP (UG on 1907/12 for EURY26,600 ove 6 years TENE Riga, Latvia ano 2,900,000 on Tide: Avandia Tost sgreement on 155112 which added 'US0450,000'o amount brewed. 4900.00, Tar Sh oan Sonat of OTT or eine Apostolos siverz012 10977768 anosd Unfad Pr ean canal EURT28,000 sland on 1807/2 over 8 TLV Ba, liga, Latvia 2850000 sgpedon It sevrv2019 4720000 ‘Voranar Cam SRL (onsen anast focloan of MDL 4 760000 signed on 07/13 ver yrs Tare Mineseu sverz012 1,882,202 over Conaatirg Ud Eypa)a crac of 10072 for US097S,000 over years EFS Cypr aus. 2820000 Ta Coat Trade LP (UR oan conve of r/2 fe Usp4ao.c00 servz013 4,700.00 ‘Uva Invee SRL an oF OTS BF MOL 4700000 co seec012 “radaarial Natwona TTP (O Ta over yeare ig, Leia aarvao%e 2,798,000 arrogatoConsltng BAL (UW Loan arian 4960,000, TeaomaritNetwors UF (UW oan circ of 4/13 for EUR, 062.000 Tar Nagar sroer0%2 0740.47 aim LL (UG Tan contact of 2 U0TP2 for EURTOS.800 over 8 years Fa Ba, Fig, Latvia aanaote 2720000 Faimas LP (0K anandieato oar ona of 2/1112 for additonal uspes.co0 Prvate and Condon Copy 83 of 38 —M.Ardran Can, to Speaker o th Palament ofthe Repub ftir 13TA) Kroll. Project Tenor Phase | Report ‘Saha Dae of [Pree paid Soares oF Fane Sane Tae Acquistion | MOL “ius Gam SRL Tan agreone oT semimors_| 4860000 | 4118 fr MOLs 880000 over 5 yous Var Trvatex Sales LLP (UR) oan contact | Prva, Novorssue | rmosaore | 107.500 | roai2ror usDeas.000 ove year | Riga Latvia Farrage Conmling SAL (UK) Tos —[= zarirore | 2.74000 _| contacto ta t2 for USD486 00 Tat Ses CLP (UR) amendment |= sainors | 4a4n000 | eurs.0%5.200 Vena Turerst Ld (eyshaiagy Teen cova | Patan, Lapow sinerz0%2 | t0481,002 | of 2007/12 for U80000,000 over 6 years | Riga, Lala a Cota Trade LP (Uh an convacl |= 2arrirz0r2| 2.700.000 of srt v12 for US0475 000 over 6 years Wega rnatonl SAL™ Toa |= aac of 4/111 for MDL 460,00, Lupor ale the sole owner of rervaoss | 4600000 | togseoh. Tae ‘Sense Colon LLP nan corastat | Prva ‘Avashidce | srera012| 10.601,002| 240712 for US0854.000 oer @ yee | Riga Lai aniood Unies Us cenvacrat | RRS zwrraate| 2.760.000] tort fer Us0446 00 over6yoars | Banka ‘Soise Caton UP arerarentvo oan] crac of O41 fer ations tavrvzo%3 | 600.000 | EURT,048 200 ca oadinareh LLP an cnvectoT aoa, Tovser | rroaror2 | ro¢s1.082 | avert ter EuREGe 00 oer Sears | Rigo, Latin ondnareh LLP: aedentto ean |= contract of 2419/12 for aston zarsrorz [2760.00 | us04ss.000 sananots | 4200000 | rartets tr MoL4s00.000 OB arogate Conaiing LP (ORF an Aaa Bondarcive conkast of 1307/12 or Us0924000 | Banka, Ras sioazore | 1046842870 | over 6 yars Faget Conacing CLF TRY smenament oan contac of 107112 2arnimore | 2.700000) tor uso4ee,o00 aFRaGTS | —4 680 200 | Wed Caroge (CRERSUT aT 5 "commana pny ten sone ts apc -Tnina 2.chinas Prat and Cantera Copy 291 33- Mr Arian Candy, Be Spence Palanan tbe ReubeBB) Kroll. Project Tenor Phase | Report Shareholder | Date of | Pie paid Source of Fande Bank Uae Acquision | MOL Sa T TOT HOTA BOAT over yours a Pavan eskacnevek Drenwar LP (U):tan contact ot | Riga, Laie oe rman | 103882202 | 11072 fo EURT1SA00 ovr one year aimnac LIP UR) ean contacto? |= paramore | 2644208 | 1/1712 for us04o2.000 ‘Swedton Aance Panwa et |= sarvors | 4700000 | a1 or EUR272,500 over 8 yours Vera VRE To Cosa Trade LIP-loan eonact ot RSL Bank samaro%2 | 10964203 | rao7H2 oe EuRTaGc00 overs years _| Riga. Late Ta Cea Trade LIP aranaen oR [= conrat of 281112 for addon EUR aarsro1a| 275000 | vso470.000 ‘ire Gap SAL (Sau an : sariaor | 4610000 | overd yoo Paes aa Fa Bak Ener \ntarm Attance LLP: loan eontractot_| igs Usa Limead warn 28/1712 for US048E.000 over 6 year) ‘2arviaaiz | ~ 208,000 | Winalar Aiance LLP 5 ‘anos Alinco LP (UK oan corvaet {or EUR2TY 000 an OSH18 overs seria | 4980.00 | yere Tae “et Tech tos Ue Las San] Cains Pala Indstis va | rameror2 | 11,882-428 | okding acount in MO Banka, Riga “et Tech ndutioe Udo Lala Sane] - zarseo%2| 2.904.000 | ating acount in MO “at Tec ndstos Ud Laas Ban sar1013 | 4900090 | notting acount in MO Foye Tainay Wading SA (Pa a enagement ‘corel of 170712 pr USO 858000 ua rmarzor2 | 11439 970 | over 2 mons ‘Wistar ance ULF wan SteetaT = zarsuzar2 | 297a.900 | 277112 fr us04s4.000 ‘ita Allncs LLP: aiananant@a |= Joan eontal of 27111 er anal sarvzois | 4950.00 | euR2s7,000 s7waro%2 | 1.800:312| To Lats Pasta Sanka acount in MO Prvete and Cane: Copy 99 of $8 Mr. Anan Can, te Speaker o Oe Patamert the Repunie orton2) Kroll. Project Tenor Phase | Report ‘SHRTSGGY” [Oats of | Pee pal] Source oF Fane Baa TR Acquisition | Mou. BATTTROTE | FRI HOD| Te Lata Pats Dans SeeSURTA TD |= “a/ie013 | — 680900] To Las Pasta Banka aecounia WO |~ Tan TTD 7 sr002012 ‘To ABV. Sank AS aesountin MO TTR “Te ABYC Bank AS aerountn MO > ‘eet Group UP oan aanact a? |= sesrv2013 oars "Ta Gra ite ‘rmecor2 | 1.608.012 | ro ABV. Bank AS account In MO Zar | 2,8 00 | From arin bak assoant : Tetaeran LLP (Tan aaa sevrvzora | ase. | 11/1/13 for EuRa88 000 Dar 5 Cerperation ua srec0%2 a Latins Danke to oom acsountin MO Bara "Wa Lava Banko awn aosontin WO |= Ta Via Taviay ana aun asso |= ‘Prvate and Consent: Copy 99 0f33~ Mr Anion Can, te Speake othe Parament of Repubc oftotovs 7%8) Kroll. 14. Appendix II Project Tenor Phase | Report ‘Sharoholir | Bank ot [Company | Dateof Vale of Loan] itorest_ BankoF ‘saronotder | ssuing Loan | Loan Loan -Agrooment Provider Dater RC Prrase | THRIROTS, | USOZS0O,000 [SBR RELY Ban a aitsnoe 8.8, | amended on AS, Cerseove (Geyenetes) | z00ea013 Laie Tivape SRL ‘ilo | BOORRDTS, | USUR, 100,000 | SBR — RELY Ban = siena Indust ts | smended on 215, Fig, Menara @otzoy | 2002013 Lata ‘VlosePn | Base Kamei nar | ZGsaa"s | USORSOOSGO | SSR ABLV Ban srt-amen |sedala | comp avn 8 igs, Reminaaa Ba ean ETS, | USDE ROOTED | SRP RBLY Bae sri- | soda Comimarsal | amended on 8, aa, ergo wean | zvosz0rs awa Veronea “Tosa SRL] Base ‘SaRed | TBNERTS, | USDE ZOU TOO | SEH — | AGL Sank ~atacezse | ocala | Traded | amended on A, Figs, (Sain Vineant | 22082013 Late snd Cronadines) ‘rc | aes ‘Oesgen | SVaDIS | EUR soa g00 | ae | ABL Ban sat- | sociale | nerrises 8, Fga, Veacesay Ls (Betze) Late ardan ‘Cameae | TROIS | EURT sooo00 | 3% | Pivat Bank, Linea Riga, Latvia ole) Sorte Bare ‘nig Groop_| ATTRDTS | EUR S00mRO| TAH | RBLV Bane ‘SAL Nata | Soci is Gotz) AS. Figs, ana lala ‘ClGk | Tanan Pants | Coad Wass | aoaabTS | EURESTSee [aR awine mrraevA | parka, Riga, | Us Pasta Latvia (Goycel Bento, ge, ‘VETEANA [Taian Pana | Aqualine | 2000S EOREBS SOO — [OR [Tate PeTRENKO | Sanka, igs, | Management Pasta Laie us raha Banka, ga, tans ati ‘Pvato and Consdona Copy 3 of 38 Mr. Arian Candy, te Speaker ofthe Parament fhe Repubtic of totiovaDB) Kroll. Project Tenor Phase | Report ‘Shareholder Bank af ——[Eompany [Bale of Vator af Caan Toveet Sharaholder | teeuing Loan | Loan agreement TACEXANDR | Cans PoE | Waves NGG BODAROTS | EURGGT SOO] OR ZavAR2IN | Banka, gs, | Us (2M) awa ‘LEH [Tas Pata | Daveoper | osoaraois EURGGOSOO | o stepaners | Sena, age, | Ventures tis Pana aa (omnes) Bark Riga, Laie ‘SERGI [Cane Pasa | Tama Group | 17i0a01S | EURESEGOD [6 | Caine ANDRICHUK | Bana, Rge, | Com Pasta awa (anes) Banko, Riga, Late ‘SERGEY [Taree Pans “anamers | euReaa00 [77 | Tae eRKULOV | Banta ios, Pasta awa Banka io, Ta Tata Pana TROT | EDRESTSOT [7 | Tar KOSTIANKO | Banka, Ag Pasta ais Banka, Rigs, Lata TETARK | avin Pasa | Vac | OvaRoTS EURasoaGD [Tae —] Tae B0KO | Banka, Rigo, | Tracing Corp Pasta ata (Panama ‘Pato and Coden Copy 3 0 38 ~lr. Anan Can, tte Speaker ote Pariomento he Repubte 78BD) Kroll, Project Tenor Phase | Report 15. Appendix III: Forensic imaging report 15.1 Interviews, investigations, findings and recommendations (on February 24th and 25th 9 meeting wae held with Victor Civbutao and Radu Gages from the National Bank of Moldovs's forensiclsecurty IT team. Both had been part ofthe NBM team which secured dala fom the three alfeced banks in the weeks before, and both have @ good knowledge ofthe computer systems that ae in place at these banks This note and its attachments set out the araes discussed, the acions taken to date and recommendations for next step, “The findings In this not are based on mastings with NBM and have not as yet boon varied, 18.1.4 Data provided to Kroll ‘ro received copes ofthe following hard ves, which had bean aged by NBM + Amaut + Bezbabcenco + Mallsever Banka Socila + Faunze + love + Mocanu + Turcanu + Veseiovseni 16.4.2Priority next steps: Stage 4 NAM informed us that attempts have boon made to delete both renie and hard copy ocumentaion. Despite the deletion attemps, i may be possible to salvage at least part ofthe Goleted cr lest slatrenc data, In order to undertake this exereise it wll be necessary to acquire Images of the relevant computers and servers, This should take place 28 soon as possible to avoid the deleted spacefunallocted clusters being overwritten by new data, Due to impeding anger of losing relevant data we urgent recommend the folowing “immediate ations to take place: vate ad Confsontat Copy 33 0f 33 fhe Pariament ote Repunie often 9EM) Kroll. Project Tenor Phase | Report ulbiorensic image of tne email senier systems of BEM and UB Analysis ofthe email ystom of the threo banks is of significant importance, even though the communication might have bypassed the offcial systems. As we have not yet ascertlned the communication paths, is of uimost importance te secure at sources of emai, incucing email servers, prsonal workstations and backups of bath. Since the email server systems are sil In ‘se handing the dally mall tafe, the unallocated space, Le. the deleted data, is constantly ‘overwriten. The longer we watt with imaging these systems the les likely it wil be that useful Information can be restored. Therefore its absolutoly necessary to image these emall server systems immediate ‘A ful forensic image is oquiod in odor to analyz0 dolotons This task should be carried out by ‘he Net's frensiclsecurty IT team. est ws h [As data has already been deleted (hardcopy and electronic) there is a risk of futher data being Aeleted or overuiten. In oder to recover Offce documents, scans or ater relevant data every efor shouldbe made to image at east he machines af the curent suspects that are sil in ut, Al forensic image is required in oder to analyze deletions ‘Telia of peple/posiions and ther computers is yao be defined by Krall and NBM, This task should be cari out by the NBM forensicfsocurty FT team, ullforensicimage of ie le sve. tnossinle unite end of ne fst week of Match 2018, ‘The fle server systems hold the etwerk storage ofthe banks whore singlo peopl or groups can save business relevant data for shared use wh other coworkers and for conlzed backup, ‘These ‘personal shares’, group shares’ and ‘management shares’ shoulé be made avaliable for ‘urer anys. Since these eervers are etl in use and the deleted data i therefore constantly ‘overwrite, itis ingortant to secure ful forensic images of these machines as soon as possible. _Aful forensic image is required in oder to analyze deletions ‘This task should be carrie out by the NBM forensiclsecurty IT team. 16.1.8 Priority next steps: Stage 2 ‘Secuta ng files of proxy sorvas.as soon 28 possible. Include backups it availabe ‘vote and Ganson Copy 99 of 29 Me Andren Gand, he Seater ofthe Prtement of th Reruc oftoisva aB) Kroll. Project Tenor Phase | Report Log fes of proxy servers like ‘sul! (used in at last one ofthe barks) can provide Information regarding incoming or outgoing malls by dates and subject nes ard regarding connections to ‘all oF chat syslems outsize the banks’ systems (Le. mallu, gmalLeom, Skype et), This Information can provide an understanding of possible communication bypassing the banks’ oficial ‘ystems. Log fles shouldbe collected and analysed for relevant information. The log fs can be rovided bythe tree banks local IT departments. “This task should be carried out bythe NBM'sforensiclsecury I team. ‘Search for and secure every available backup of fle servers. email sewers, databsses ond ‘mocking as econ 9s possible ‘Since every backup done at some point in time before the deletion of relevant data may eteve proviousiy lost deta, i Is essential t search thoroughly for Backups. Media used for work or backups can sometimes become defective, and sometimes these are not Immediately deposed of ‘but stored ina cupboard or drawer o storage room ofthe IT department for later ation. “This task should be carried out by the NBs forensclsecuriy IT taam in cooperation wth the local banks'IT departments. (Check fr the existence of viuel machines ike VMwae os Vit box or hese especialy oc raduate Vive of servers present make a copy of elavantvitual css \Virel machines are 9 common technique to reduce hardware and maintenance. They can hold any Kind of information and can be backad up easly by making a snapshot at any point inte or ‘by copying the virual disk which is simpy a big file. Relevant systems would be eral servers, fle servers, backup servers, datsbase servers of banking systems, ORM servers, archiving systems or document management systems. ‘This task should be cared out by the NBs forensclsecurly IT team In cooperation with the ‘ocal banks’ IT department. ‘Check thece had been devioesbrouaht nto the bank afer the acqulslon by Mr. Shor and tyes. ltihese devi had bean removed again ater on Having outside equipment inthe banks’ systems (PCs, servers, inastucture cevices) would give Indications about the information that may be extracted, and how other infomation may have ‘been brought ito the Banks, With this knowledge it would be posable to search for particular Information regarcing these machines or devices in more detail ‘This task should be carted out by the NBW's forensicfsecuy IT team In cooperation with the local banks' IT departments. Pos or .ovesen wi vate ad Condon Copy 3 of $8 — i. Arden Cand, tte Speaker of he Parlamant ofthe Repubke oftoiora iBD) Kroll. Project Tenor Phase | Report 016 outotservce PCs or HDDS, potently defective but not dleposed of can be @ valuable source of Information. there are any fom the relevant tetame and from suspect users please transfer these to Krol for data recovery er lean room restrain, ‘This task should be cared out by the NBW's forenscsseunty IT team In cooperation with the local banks IT departments ‘Check forthe eof the Dissster Recovery sites ond eport back ‘The existence of a secondary operations ste is of relevance, but further information on the type ‘of data synchronization used to Keep these secondary shes up-to-date is required. fe “synchronized (mitroring deltions to the secondary ste) or is it in backup mode (miroing Mes ‘nly, no deletion}? Also check for backups ofthese secondary sos, be it by bank IT of thd patty. ‘This task should be csiied out by the NBN forenscsecuriy IT team in cooperation with the ‘ocel banks’ departments, ‘Secuie a baskupldma ofthe com bank sustems databases in the three banks. including the scat module ond pass a conv to Kio for further analsis ‘The core bank systems have already been eecured by NAM, The team has to conf yet whether the credit module Is part ofthe core bank systems, if ot, the database ofthe credit module systoms muct also be secures, ‘This tack should be caries out by the NBs foreneizieecuty IT team. Euloconsic image of tne secondary servers and get bold of ny backup madia found, ‘The data om the secondary sites servers canbe de-dupleated agains he data from the primary sites servers and the remaining data wil show the deleted or changed fies whlch can In turn be analysed in detail This task should be caried out by the NBN'sforenscescurty IT team In cocperation wth the local banks’ IT departments 15.2. Phase Il work ‘Securing and coletng data Is an important fist step. Analysis of the avaiable Information wl allow us, In conjunction with Krol, to dently the Information required for further work. The folowing fit is based upon our current knowiedge and may be expanded or reduced by the cent andlor azcording to the necesely of the ongoing investigation, i le therfore a fet but reasonable recommendation ofthe analysis work that should folw the tasks completed by NBM. ‘Prvale and Condon: Copy 39 of 33 le. Ander Can, he Speaker ote Pararnent of te Resubc fio 22B) Kroll. Project Tenor Phase | Report 1. Akoywerd let fora comprehensive keyword search regaring leet documents or other topics has to be crested by the teams of Kiol and the NBM. This should contain the English, ‘Romanian and Russian (Cyc) Keywords in every speling varia. 2. The email systems data (mall server mages and malls fom workstation Images as woll 2s log ‘les regaring emails) should then be anaiysed against these Keywords. The email cents on workstaton should be Outlook o” Outlook Express in POPS mode. This should also Include a special analysis for communication between the bank managements of the involved banks. ‘3. Workstation images (without mas) should also be analysed against those these keywords. We wil be sing X-Ways to look for deleted data (Signature search), USB activity (sbag and Sink le), printer speoer files, Internet based communication and office communication (ent, ob based ema, et), communication between bank managements ofthe Involved banks ‘outside the official mal system and erasing. We should also look or password protected or ‘encrypted tes and crack passwords necessary. These lypes of les are ot special inlerest, 4. The file sewer images and the backups of the fle servers avalable (Le. DVD backups for ‘Banka Econom should be analysed against the keywords Following the recovery of deleted ata with Ways. This should include an analysie for usage of erasing and of encryption software tke Trueerypt. We should also lok for password protected or encrypted fos and crack passwords i nacessary. These types of los are of special intrest 5. Data from printer servers, printers and fax machines with HDDs should be anaiyse, and may ‘ow he recovery of some lst documents. This includes Keyword searches, manus analysis land OCR, We may have to use he vendor support in ase of encryption or oer problems. ‘This shoul include tog fle to get a cortelation between the names of documents and IP ‘8éresses which ean in tur be corelated to veer by analyzing the OHCP/AD lo es. 1. mages and backups of secondary ses, shouldbe analysed, end then de-dupictod with the rimay ses to got te deleted or changed data only. This data can then be analysed in the same way as te primary stem (ele server. 7. The Journals of printers, fax machines and printer servers for communication channols (foxes), fle names and IP adérosses (printers and printer sewers) and twephonelix ‘numbers (axes) should also be analysed, This data can then be coreated to other sources to id out relevant custodians and documents. This step consists mainly of manual analysis and keyword searches [Al rolvant data should then be uploaded to the Electronic Discovery Hosting Centr to ensure ‘88 collaboration between Krol analysts andthe NBM analysts, ‘Prue and Content Copy 29 3 Mr. Aen Candy, te Speaker of he Param of he Republe ofMoliore 23kroll.com