The predictive turn: how maritime compliance has shifted

The compliance landscape doesn't wait for quarterly reviews anymore. In a recent webinar, Kpler Risk & Compliance analysts reviewed key lessons from 2025 and explained why 2026 will be a tougher stress test for compliance frameworks. Drawing on vessel behaviour, sanctions data, and network analysis, this session explored how risk is migrating across routes, hubs, and counterparties—and why reactive, watchlist-based compliance is no longer sufficient. 

Between January and December 2025, vessel sanctions increased 77% year-over-year—over 700 first-time designations in twelve months. For maritime risk professionals, this acceleration represents more than enforcement intensity. It signals a fundamental shift in how sanctions operate, how illicit networks adapt, and ultimately, how effective compliance programs must function.

The past year taught us that enforcement comes in concentrated waves rather than gradual tightening. Three major regulatory surges—January, May, and October—defined 2025's sanctions architecture, supplemented by oil price cap updates in July. These weren't isolated actions. They represented coordinated pressure from US, EU, and UK regulators targeting shadow fleet networks with increasing sophistication. The result: a 373% increase in sanctioned vessels over five years, from under 400 in December 2020 to over 1,800 by December 2025.

What makes 2025 particularly instructive is not the scale of enforcement, but what happened afterward. Despite designating hundreds of shadow fleet tankers, the fleet didn't shrink—it adapted. A 6% decrease in identified shadow vessels in January 2025 initially suggested progress. Reality proved more complex. Those vessels didn't disappear; they modified behaviour, employing increasingly sophisticated deceptive practices to continue operations.

In 2026, sanctions risk will be increasingly defined by detectable escalation patterns observable through Kpler Risk and Compliance's proprietary risk scoring method, not surprise designations.

‍

The shadow fleet's operational evolution

The shadow fleet now encompasses over 3,300 active vessels globally, with approximately 30 joining monthly. These aren't just aging tankers operating without proper classification or insurance. They're increasingly sophisticated operations utilising layered evasion tactics that respond directly to enforcement pressure.

The correlation is striking. AIS spoofing surged to over 200 cases in May 2025, coinciding exactly with that month's major enforcement wave. Dark ship-to-ship transfers hit record levels exceeding 300 cases during the same period. July and October showed similar spikes. This isn't coincidence—it's adaptation in real time.

Ship-to-ship transfer patterns reveal the operational sophistication at play. Key hubs like Damieta in Egypt, the Eastern Mediterranean, and Cyprus don't just facilitate high-risk STS activity. They demonstrate higher utilisation rates per vessel, with the same tankers conducting repeated, coordinated operations rather than fleet expansion driving volume. These locations function as pressure valves, allowing sanctioned barrels to be blended and redistributed without direct entry into major importing markets.

The geographic shift matters. Traditional high-visibility chokepoints are giving way to jurisdictions with more complex enforcement environments—or higher tolerance for ambiguity. Mediterranean and Middle Eastern hubs increasingly handle operations that once concentrated in more scrutinised waters. This geographic migration reflects calculated risk management by shadow fleet operators seeking environments where enforcement remains fractured or inconsistent.

‍

Trade flows prove remarkably resilient

Here's the uncomfortable truth: despite significantly stronger enforcement throughout 2025, overall trade flows from key sanctioned suppliers remained broadly stable year-on-year. Iranian and Venezuelan volumes even grew slightly. Sanctions didn't remove supply from global markets—they complicated logistics.

Consider crude oil on water levels, which reached all-time highs near 400 million barrels in transit by January 2026. Sanctioned origins—Russia, Iran, Venezuela—drive this accumulation disproportionately. Those elevated volumes don't represent increased production. They represent barrels spending longer in transit, being rerouted, or stored offshore while waiting for viable discharge opportunities.

This creates a growing disconnect between sustained upstream loading and increasingly uneven import demand under sanctioned regimes. As enforcement tightens and compliance expectations vary across jurisdictions, the physical manifestation is barrels accumulating on water rather than flowing efficiently to destinations. India constraining purchases of Western Russian crude while China slows lifting of Iranian and Venezuelan cargoes contributes to demand-side pressure. Meanwhile, Russia maintains regular loading despite persistent infrastructure attacks, adding supply-side momentum.

The result: sanctions volatility has become a structural feature of oil markets rather than temporary disruption. It's no longer just a compliance issue—it's a fundamental driver of physical market dislocations.

‍

The structural reality

Sanctions volatility in 2026 won't be determined by single factors. It's an interplay of geopolitical developments, market reactions, regulatory coordination, and enforcement capacity. Markets should expect sustained unpredictability in both regulatory actions and their economic impacts.

The global commodity trade rarely stops altogether—it reroutes. Enforcement doesn't eliminate supply; it distorts logistics. The shadow fleet's behavioural adaptation demonstrates this clearly. Deceptive shipping practices have proven themselves not just as evasion tactics but as reliable early indicators of sanctions risk, appearing weeks or months before designations.

For compliance programs, this creates both challenge and opportunity. The challenge: reactive monitoring is structurally insufficient when illicit networks adapt in real time and intermediary structures grow more opaque. The opportunity: behavioural patterns are detectable, escalation is predictable, and risk can be assessed before designation rather than after.

The question isn't whether maritime compliance will remain complex in 2026—it will. The question is whether organisations can shift from reacting to enforcement waves toward anticipating them. In a landscape where 30 vessels join the shadow fleet monthly and deceptive practices spike with each regulatory action, predictive capability isn't a competitive advantage. It's an operational necessity.

The intermediary takeover

Perhaps the most significant structural change involves who's actually trading sanctioned crude. Non-traditional intermediaries have captured substantial market share by offering commercial terms that traditional trading houses cannot match under current sanctions and price cap regimes. Their competitive advantage comes from flexibility: discounting prices to accommodate delayed or rerouted cargoes, arranging financing outside price cap mechanisms through regional banks, tolerating non-standard routes and extended laytimes, and offering flexible payment arrangements particularly attractive to Asian refiners.

Three dominant intermediary structures have emerged. First, offshore special purpose vehicles featuring nominee arrangements, commonly registered in UAE, Hong Kong, or Turkish free zones. These SPVs typically feature nominee shareholders masking beneficial ownership, with equity held at minimum levels and corporate lifecycles aligned to specific trade windows. They provide legal insulation and can begin lifting cargoes within weeks of incorporation.

Second, logistics-integrated trading arms where tanker operators establish parallel trading companies in separate offshore jurisdictions. This integration allows operators to manage sanctions, shipping, and pricing risk within a single commercial framework.

Third, producer-adjacent private firms—legally independent entities with proximity to formal commercial operations that grants access to allocations and operational insight while maintaining legal separation. These structures aren't temporary workarounds. They're becoming essential features of sanctioned oil trade infrastructure.

‍

From reactive monitoring to predictive intelligence

The most consequential shift for compliance programs is the move from reactive monitoring to predictive risk assessment. It's no longer sufficient to track high-risk vessels and react to new designations. Markets need to assess who's next.

Analysis of 2025 designations reveals consistent three-phase escalation patterns detectable well before regulatory action. Phase one shows emerging risk through port exposure and AIS anomalies. Phase two demonstrates operational escalation via repeated STS events and sanctioned liftings. Phase three peaks with dark activity around key locations, continuous crude movements with spoofing, and sometimes detention.

The vessel Aquarius provides a representative case. Over twelve months in 2025, analytics flagged early port exposure and AIS anomalies, tracked escalation through repeated STS events and sanctioned liftings, then detected peak illicit activity around Kharg Island with continuous crude movements and spoofing in Indonesia, culminating in detention. OFAC designated the vessel on November 20, 2025—after the full escalation pattern was already visible in behavioural data.

Since launching forward-looking risk scoring methodologies in Q4 2024, over 50 high-risk vessels from predictive lists have been formally designated, confirming that specific behaviours reliably precede sanctions. Currently, 244 vessels are identified at varying risk of sanctioning in 2026 based on accumulated behavioural signals rather than isolated incidents.

The implications extend beyond individual vessel screening. Regulators now target entire networks—brokers, insurers, managers, intermediaries. Real-time compliance data has become a commercial differentiator as traders, charterers, and banks adopt integrated risk feeds to prevent operational and financial disruption before it occurs.

‍

What 2026 holds

Venezuela remains perhaps the most watched flashpoint. While flows to the US have stabilised under supervised legitimate loadings—part of an oil swap initiative to refill strategic petroleum reserves—satellite-confirmed dark activity continues simultaneously. Venezuelan crude continues moving through discount channels and STS transfers, primarily to China. Near-term buying activity will likely concentrate in the US while Chinese liftings pause pending clarity around PDVSA's authority and payment channels.

European dependence on Russian LNG presents its own complexity. Pipeline gas to Europe has largely collapsed, but LNG continues reaching global markets including parts of Europe. This isn't primarily about sanctions gaps—it reflects long-term contracts difficult to replace short-term. The strategy isn't immediate cutoff but long-term diversification toward reliable partners like Qatar, with phase-out targeted for September 2027. Until then, Russian LNG remains legally permissible but politically contentious, forcing buyers, ports, and financiers to manage reputational and compliance risk without formal prohibitions.

Iranian sanctions face three plausible trajectories. A negotiated deal could lower tensions while leaving most sanctions intact, resulting in limited relief and continued heavy compliance risk. Political change leading to credible democratic elections could open doors to gradual easing and wider engagement with Iranian flows under managed sanctions rollback. Alternatively, prolonged conflict with US hardening enforcement could trigger even tighter regimes with broader secondary enforcement and more aggressive pressure on both financial and maritime channels.