94% of Hormuz transits are now outside the IMO lane — what that means for risk assessment

When almost every vessel avoids the formal shipping lane, deviation stops being a red flag. It becomes the baseline. And that creates a serious problem for compliance teams who have built their assessments around it.

Between 1 March and 19 May 2026, Kpler tracked 895 vessel crossings through the Strait of Hormuz. Only 58 of them — 6.4% of total traffic — used the IMO-designated Traffic Separation Scheme route. The remaining 93.6% moved either through the Iranian-defined alternative corridor (53.0%) or via dark or unknown routing patterns with AIS switched off (40.6%).

That single data point forces a fundamental rethink of how the TSS functions as a risk tool in the current environment.

‍

The TSS was never just a navigation system

The IMO Traffic Separation Scheme through the Strait of Hormuz exists to separate inbound and outbound traffic through one of the world's narrowest and most congested chokepoints. The formal shipping lanes are two nautical miles wide in each direction, separated by a two-mile buffer. Before the crisis, the TSS provided compliance and due diligence teams with a behavioural reference: a vessel following the TSS was doing what was expected. A vessel deviating from it warranted a question.

That reference function has not disappeared. But its meaning has inverted. In the current environment, the TSS is better understood as a benchmark for identifying anomalies within the broader context of disrupted routing — not as the expected norm from which deviations stand out.

The question is no longer "why did this vessel deviate?" when nearly all of them are. The question is what the deviation pattern looks like in combination with everything else known about the vessel.

‍

Route choice is already stratified by risk profile

Kpler's data on route choice by vessel risk category adds an important layer to this picture.

Among sanctioned vessels, only 2.6% used the IMO route. The majority followed the Iranian-defined alternative corridor or moved through dark and unknown patterns. Among shadow fleet vessels, the IMO route share was only marginally higher at 5.6%. Even among lower-risk commercial traffic — vessels not formally sanctioned and not classified as shadow fleet — only 9.8% used the IMO route.

What this tells risk teams is that route choice alone cannot distinguish between a sanctioned tanker deliberately concealing its movements and a commercially legitimate bulk carrier avoiding Iranian waters for entirely defensible safety reasons. The routing signal is the same. The risk profile is not.

That gap — between a shared observable behaviour and divergent underlying risk — is where the analytical work now has to happen.

‍

The vessel composition picture

The routing data becomes more significant when set alongside the characteristics of the vessels making up Hormuz traffic.

Of the 622 unique vessels Kpler tracked operating through the Strait between 1 March and 19 May, the risk profile extended well beyond formally sanctioned or shadow fleet categories. More than half — 365 vessels, or 58.7% — were aged 20 years or older. The non-sanctioned, non-shadow category recorded an average vessel age of 19.1 years, approaching the profile seen among sanctioned vessels (22.2 years average) and shadow fleet vessels (24.3 years).

The insurance and classification picture is similarly concentrated. In that 622-vessel sample:

• 55.5% operated outside International Group P&I cover — the thirteen mutuals that insure around 90% of global ocean-going tonnage and provide the high-limit third-party coverage most charterers and banks require
• 48.1% operated without IACS classification
• 27.3% had no identifiable ISM manager information

This is not primarily a sanctioned fleet story. These characteristics appear across the wider transit population. The finding is that as total transit volumes declined sharply from crisis levels, the vessels continuing to operate through the corridor are disproportionately those with weaker operational transparency, insurance coverage and classification profiles.

The convergence problem

Perhaps the most operationally significant finding is the degree to which different risk categories have converged within the same traffic flows.

Of the 895 crossings, 309 involved sanctioned vessels and 177 involved shadow fleet vessels. All three categories — sanctioned, shadow and lower-risk commercial — are increasingly navigating through the same corridors, at similar times, using similar routing patterns. Iranian-flagged vessels represented the single largest flag category at 18.6% of observed traffic; Panama and Liberia followed. Bulk carriers and crude oil tankers dominated by vessel type, with 75 of the 124 crude tanker crossings involving sanctioned vessels.

For compliance teams, convergence creates specific challenges. Proximity to sanctioned or shadow fleet traffic is already a risk signal in standard screening frameworks. When that proximity is structural rather than incidental — when it reflects the actual composition of available traffic lanes — the signal requires more careful contextualisation. Proximity alone becomes less useful as a discriminator. Combined with flag, age, ownership opacity and AIS behaviour, it remains meaningful.

‍

What a post-TSS compliance assessment looks like

Given that route choice cannot function as a standalone indicator, what should replace it?

The answer is not to abandon routing data. It remains one input in a more layered analytical picture. But risk and compliance teams need to build assessments that triangulate across multiple signals simultaneously:

1. AIS behaviour. Is there a gap in the vessel's AIS record near the Strait? Does its track show impossible speed changes or position jumps consistent with GNSS spoofing rather than deliberate manipulation? Has it switched off its transponder entirely, or does the gap have a plausible operational explanation?

2. GNSS disruption context. Large-scale GNSS interference has affected up to 3,000 vessels in a single day during the crisis period. A positioning anomaly in this environment carries a different implication than an equivalent anomaly in a stable operating area. The context of the disruption matters for interpreting the record.

3. Vessel profile. Age, flag, classification, P&I coverage and ISM manager status all function as risk multipliers when combined with anomalous routing. An older unclassed vessel with non-IGP&I cover following a dark routing pattern warrants a different level of scrutiny than a modern classed vessel from a mainstream registry doing the same.

4. Ownership and beneficial control. Opaque ownership structures have appeared across the broader transit fleet, not only among formally designated entities. Beneficial ownership tracing, particularly for vessels with multiple recent ownership changes, adds a layer that route or position data alone cannot provide.

5. Proximity and co-movement. The convergence of sanctioned, shadow and commercial traffic in the same corridors means that co-movement with higher-risk vessels requires careful interpretation. Involuntary proximity because no other route exists is different from a pattern of consistent co-movement or coordination.

None of these signals is definitive in isolation. The analytical shift required is away from binary flags toward weighted, multi-signal assessments that can account for an environment where normal routing behaviour no longer exists.

‍

The record-keeping implication

There is a practical documentation consequence that follows from this analysis.

If a vessel deviates from the TSS — which is now the case for 93.6% of transits — and that deviation later appears in a sanctions investigation, insurance claim dispute or charterparty arbitration, the relevant question will not be whether the deviation happened. It did. The question will be whether there is contemporaneous documentation of why it happened, what intelligence or operational factors drove the decision, and whether that decision was consistent with a reasonable risk assessment at the time.

Organisations that build the record as they go — capturing routing decisions, threat intelligence responses and compliance reviews before the voyage rather than reconstructing them after — are in a materially better position when that question gets asked.

The TSS deviation data from Hormuz is not primarily an alarm. It is a description of a new operational reality. The compliance infrastructure built to function in that reality looks different from what most teams have today.

‍

This is the second in a three-part series based on the whitepaper – Beyond Open or Closed: The Hormuz Crisis and the Future Architecture of Maritime Risk.