Hormuz sanctions risk starts before payment — the OFAC warning every operator needs to understand

The compliance question most shipping companies have been asking about Hormuz is: will we face sanctions exposure if we pay for safe passage? It is the right question. But it starts too late.

On 1 May 2026, OFAC issued a warning that US and non-US persons could face sanctions risk if they make payments to, or seek guarantees from, the Iranian regime for safe passage through the Strait of Hormuz. The advisory confirmed that the payment form is irrelevant –cash, cryptocurrency, informal swaps, in-kind transfers and payments structured as charitable donations all carry the same exposure.

That warning has focused industry attention on the payment decision. But OFAC's framing makes clear that the risk does not begin when money changes hands. It can begin at the point of engagement — when a vessel operator shares ship details, requests clearance, coordinates with Iranian authorities, or accepts an escort linked to sanctioned parties.

For operators with vessels currently transiting or waiting near the Strait, the exposure clock may already be running.

‍

Why the IRGC designation matters

The sanctions architecture underpinning Hormuz risk is not new, but its application in this context is sharper than many compliance teams have accounted for.

The IRGC has been designated by the US State Department as a Foreign Terrorist Organization since April 2019, with parallel OFAC sanctions in place. That dual designation means any transaction involving an IRGC-linked entity triggers secondary sanctions exposure for non-US persons, regardless of where they are incorporated, what currency they transact in, or what their intent was at the time.

Secondary sanctions do not require a US nexus in the transaction itself. A European shipowner, an Asian charterer, a non-US bank financing the voyage — all can face exposure if the transaction involves a designated party, even if no US persons, US dollars or US financial institutions are involved.

In the context of Hormuz, the relevant question is not whether the Iranian entity requesting clearance or providing escort is formally identified as IRGC-linked. The relevant question is whether there is sufficient basis to conclude that it is not, and whether that conclusion is documented and defensible.

‍

The pre-payment exposure chain

The compliance community has largely focused on the binary of paying or not paying for passage. The OFAC advisory, read carefully, describes a broader exposure chain.

Consider the sequence of events for a vessel approaching the Strait in the current environment. Before any payment decision is made, the operator may have:

• Submitted vessel details, cargo information, ownership structure and insurance data to Iranian port or maritime authorities as part of a clearance or notification process
• Received or acknowledged guidance from Iranian authorities about routing requirements or escort arrangements
• Accepted or followed a transit instruction that moved the vessel through waters under Iranian operational control or into an escort formation linked to IRGC-adjacent entities
• Communicated through local agents or intermediaries who subsequently passed information or payments to Iranian-linked parties

Each of these steps carries potential compliance implications, not because they constitute sanctions violations in themselves, but because they create a record, an exposure and a set of questions that banks, insurers, P&I clubs and counterparties will ask when they review the voyage.

The compliance exposure that follows is not only legal. It is also practical. Banks that identify Hormuz passage-related submissions to Iranian authorities in a vessel's voyage record may decline to finance subsequent transactions. Insurers may treat the record of clearance coordination as a material fact in claims reviews. Charterparties with OFAC clauses may give charterers grounds to object to a transit that created undisclosed exposure.

The payment decision itself

If a vessel operator reaches the point of being asked for payment — whether framed as a toll, a security guarantee, an escort fee or a humanitarian contribution — they face a genuinely difficult commercial and legal position.

Refusing to pay is the legally defensible position. It protects against direct sanctions exposure for the payment itself. But in the current environment, it may also mean the vessel is delayed, denied access, stranded in the Gulf or diverted through Iranian waters under escort regardless.

Paying, or accepting an arrangement structured to look like something other than payment, may allow the voyage to proceed. But it may create sanctions exposure for the operator, the charterer, the insurer who covers the cargo, the bank financing the transaction and any other party the payment touches as it moves through the system.

Indirect routing through intermediaries does not remove the risk. The OFAC advisory was explicit: the form of payment and the identity of the immediate recipient do not determine exposure. What matters is whether the transaction, however structured, provides value to a sanctioned party.

There is no cost-free path through this decision. What distinguishes well-managed from poorly managed exposure is not which path is chosen — it is whether the decision is made deliberately, documented contemporaneously, and consistent with a legal and compliance review conducted before the voyage began.

‍

Insurance isavailable, but contractually complex

Coverage for vessels transiting Hormuz remains broadly available. Kpler data shows that between the pre-crisis snapshot on 27 February and 19 May, only 1.1% of observed vessels changed P&I providers, and overall IGP&I coverage in the transit fleet shifted only marginally — from 43.7% to 44.5%.

The constraint is not access to cover. It is the cost and contractual terms of using it.

As physical attacks on vessels escalated — reaching 38 IMO-verified incidents during the sample period, including drone and missile activity, attempted boardings and attacks near strategic chokepoints — war-risk pricing became volatile. Following Operation Epic Fury on 28 February, war-risk cover was repriced sharply from around 10 March. The subsequent naval cordon from 12 April added further uncertainty around transit timing, clearance procedures and breach-area clauses.

When insurance pricing moves abruptly, a set of commercial questions land simultaneously: who absorbs the additional premium — owner or charterer? Does the vessel owner have the right to refuse transit into a breach area? Does the charterer have the contractual right to require it? How is waiting time treated — time spent holding position awaiting escort clearance or a protected transit window? Is a deviation from the agreed route, taken in response to a threat, covered, or does it trigger a charterparty dispute?

These questions do not have universally correct answers. They depend on the specific terms of the voyage charter, the war-risk endorsement and the insurance policy in place. What they share is that they are far easier to answer, and far less expensive to resolve, when the answers have been established before the voyage begins.

‍

Documentation as the core risk management tool

The common thread across the sanctions, insurance and charterparty dimensions of Hormuz risk is the same: contemporaneous documentation is the foundation of a defensible position.

If a vessel deviates from an agreed route because of a credible security threat, the deviation needs to be supported by a record of the threat intelligence, the decision-making process and the reasonable judgment that the deviation was necessary. If a vessel delays transit awaiting escort clearance, the delay needs to be traceable to documented operational circumstances. If a payment decision is made, in either direction, the reasoning needs to be captured at the time, not reconstructed afterward.

In the current environment, physical security risk has become contract risk. The strength of an insurer's position, a P&I club's response to a claim, a bank's comfort with the voyage record and a counterparty's due diligence review all rest on the same foundation –verified incident data, consistent vessel tracking and clause review aligned in advance of exposure, not after it.

Organisations that treat documentation as an administrative afterthought are not just operationally exposed. They are commercially exposed, because the cost of an undocumented decision in a Hormuz transit dispute will materially exceed the cost of building the record as the voyage unfolds.

‍

This is the third in a three-part series based on the whitepaper, "Beyond Open or Closed: The Hormuz Crisis and the Future Architecture of Maritime Risk."