The predictive turn: how maritime compliance has shifted

The compliance landscape doesn't wait for quarterly reviews anymore. In a recent webinar, Kpler Risk & Compliance analysts reviewed key lessons from 2025 and explained why 2026 will be a tougher stress test for compliance frameworks. Drawing on vessel behaviour, sanctions data, and network analysis, this session explored how risk is migrating across routes, hubs, and counterparties—and why reactive, watchlist-based compliance is no longer sufficient. 

Between January and December 2025, vessel sanctions increased 77% year-over-year—over 700 first-time designations in twelve months. For maritime risk professionals, this acceleration represents more than enforcement intensity. It signals a fundamental shift in how sanctions operate, how illicit networks adapt, and ultimately, how effective compliance programs must function.

The past year taught us that enforcement comes in concentrated waves rather than gradual tightening. Three major regulatory surges—January, May, and October—defined 2025's sanctions architecture, supplemented by oil price cap updates in July. These weren't isolated actions. They represented coordinated pressure from US, EU, and UK regulators targeting shadow fleet networks with increasing sophistication. The result: a 373% increase in sanctioned vessels over five years, from under 400 in December 2020 to over 1,800 by December 2025.

What makes 2025 particularly instructive is not the scale of enforcement, but what happened afterward. Despite designating hundreds of shadow fleet tankers, the fleet didn't shrink—it adapted. A 6% decrease in identified shadow vessels in January 2025 initially suggested progress. Reality proved more complex. Those vessels didn't disappear; they modified behaviour, employing increasingly sophisticated deceptive practices to continue operations.

In 2026, sanctions risk will be increasingly defined by detectable escalation patterns observable through Kpler Risk and Compliance's proprietary risk scoring method, not surprise designations.

‍

The shadow fleet's operational evolution

The shadow fleet now encompasses over 3,300 active vessels globally, with approximately 30 joining monthly. These aren't just aging tankers operating without proper classification or insurance. They're increasingly sophisticated operations utilising layered evasion tactics that respond directly to enforcement pressure.

The correlation is striking. AIS spoofing surged to over 200 cases in May 2025, coinciding exactly with that month's major enforcement wave. Dark ship-to-ship transfers hit record levels exceeding 300 cases during the same period. July and October showed similar spikes. This isn't coincidence—it's adaptation in real time.

Ship-to-ship transfer patterns reveal the operational sophistication at play. Key hubs like Damieta in Egypt, the Eastern Mediterranean, and Cyprus don't just facilitate high-risk STS activity. They demonstrate higher utilisation rates per vessel, with the same tankers conducting repeated, coordinated operations rather than fleet expansion driving volume. These locations function as pressure valves, allowing sanctioned barrels to be blended and redistributed without direct entry into major importing markets.

The geographic shift matters. Traditional high-visibility chokepoints are giving way to jurisdictions with more complex enforcement environments—or higher tolerance for ambiguity. Mediterranean and Middle Eastern hubs increasingly handle operations that once concentrated in more scrutinised waters. This geographic migration reflects calculated risk management by shadow fleet operators seeking environments where enforcement remains fractured or inconsistent.

‍

Trade flows prove remarkably resilient

Here's the uncomfortable truth: despite significantly stronger enforcement throughout 2025, overall trade flows from key sanctioned suppliers remained broadly stable year-on-year. Iranian and Venezuelan volumes even grew slightly. Sanctions didn't remove supply from global markets—they complicated logistics.

Consider crude oil on water levels, which reached all-time highs near 400 million barrels in transit by January 2026. Sanctioned origins—Russia, Iran, Venezuela—drive this accumulation disproportionately. Those elevated volumes don't represent increased production. They represent barrels spending longer in transit, being rerouted, or stored offshore while waiting for viable discharge opportunities.

This creates a growing disconnect between sustained upstream loading and increasingly uneven import demand under sanctioned regimes. As enforcement tightens and compliance expectations vary across jurisdictions, the physical manifestation is barrels accumulating on water rather than flowing efficiently to destinations. India constraining purchases of Western Russian crude while China slows lifting of Iranian and Venezuelan cargoes contributes to demand-side pressure. Meanwhile, Russia maintains regular loading despite persistent infrastructure attacks, adding supply-side momentum.

The result: sanctions volatility has become a structural feature of oil markets rather than temporary disruption. It's no longer just a compliance issue—it's a fundamental driver of physical market dislocations.

‍

The structural reality

Sanctions volatility in 2026 won't be determined by single factors. It's an interplay of geopolitical developments, market reactions, regulatory coordination, and enforcement capacity. Markets should expect sustained unpredictability in both regulatory actions and their economic impacts.

The global commodity trade rarely stops altogether—it reroutes. Enforcement doesn't eliminate supply; it distorts logistics. The shadow fleet's behavioural adaptation demonstrates this clearly. Deceptive shipping practices have proven themselves not just as evasion tactics but as reliable early indicators of sanctions risk, appearing weeks or months before designations.

For compliance programs, this creates both challenge and opportunity. The challenge: reactive monitoring is structurally insufficient when illicit networks adapt in real time and intermediary structures grow more opaque. The opportunity: behavioural patterns are detectable, escalation is predictable, and risk can be assessed before designation rather than after.

The question isn't whether maritime compliance will remain complex in 2026—it will. The question is whether organisations can shift from reacting to enforcement waves toward anticipating them. In a landscape where 30 vessels join the shadow fleet monthly and deceptive practices spike with each regulatory action, predictive capability isn't a competitive advantage. It's an operational necessity.

The intermediary takeover

Perhaps the most significant structural change involves who's actually trading sanctioned crude. Non-traditional intermediaries have captured substantial market share by offering commercial terms that traditional trading houses cannot match under current sanctions and price cap regimes. Their competitive advantage comes from flexibility: discounting prices to accommodate delayed or rerouted cargoes, arranging financing outside price cap mechanisms through regional banks, tolerating non-standard routes and extended laytimes, and offering flexible payment arrangements particularly attractive to Asian refiners.

Three dominant intermediary structures have emerged. First, offshore special purpose vehicles featuring nominee arrangements, commonly registered in UAE, Hong Kong, or Turkish free zones. These SPVs typically feature nominee shareholders masking beneficial ownership, with equity held at minimum levels and corporate lifecycles aligned to specific trade windows. They provide legal insulation and can begin lifting cargoes within weeks of incorporation.

Second, logistics-integrated trading arms where tanker operators establish parallel trading companies in separate offshore jurisdictions. This integration allows operators to manage sanctions, shipping, and pricing risk within a single commercial framework.

Third, producer-adjacent private firms—legally independent entities with proximity to formal commercial operations that grants access to allocations and operational insight while maintaining legal separation. These structures aren't temporary workarounds. They're becoming essential features of sanctioned oil trade infrastructure.

‍

From reactive monitoring to predictive intelligence

The most consequential shift for compliance programs is the move from reactive monitoring to predictive risk assessment. It's no longer sufficient to track high-risk vessels and react to new designations. Markets need to assess who's next.

Analysis of 2025 designations reveals consistent three-phase escalation patterns detectable well before regulatory action. Phase one shows emerging risk through port exposure and AIS anomalies. Phase two demonstrates operational escalation via repeated STS events and sanctioned liftings. Phase three peaks with dark activity around key locations, continuous crude movements with spoofing, and sometimes detention.

The vessel Aquarius provides a representative case. Over twelve months in 2025, analytics flagged early port exposure and AIS anomalies, tracked escalation through repeated STS events and sanctioned liftings, then detected peak illicit activity around Kharg Island with continuous crude movements and spoofing in Indonesia, culminating in detention. OFAC designated the vessel on November 20, 2025—after the full escalation pattern was already visible in behavioural data.

Since launching forward-looking risk scoring methodologies in Q4 2024, over 50 high-risk vessels from predictive lists have been formally designated, confirming that specific behaviours reliably precede sanctions. Currently, 244 vessels are identified at varying risk of sanctioning in 2026 based on accumulated behavioural signals rather than isolated incidents.

The implications extend beyond individual vessel screening. Regulators now target entire networks—brokers, insurers, managers, intermediaries. Real-time compliance data has become a commercial differentiator as traders, charterers, and banks adopt integrated risk feeds to prevent operational and financial disruption before it occurs.

‍

What to do next: practitioner playbook

1. Implement pre-designation screening using the three-phase checklist

Don't wait for sanctions lists. Screen counterparty vessels monthly against Phase 1 and Phase 2 indicators. Flag any vessel showing 3+ signals for enhanced due diligence or commercial avoidance. Build internal watchlists that track vessels moving through escalation phases.

2. Enhance due diligence when intermediary hallmarks appear

Investigate beneficial ownership when counterparties exhibit SPV characteristics: recent incorporation in free zones, nominee shareholders, minimal equity, or tight operational windows. Require direct confirmation of cargo sourcing and financing structures when trading through logistics-integrated firms. Apply heightened scrutiny to producer-adjacent entities with preferential allocation access but claimed independence.

3. Monitor vessels accumulating on-water days in sanctioned flows

Track crude-on-water levels for Russian, Iranian, and Venezuelan origin cargoes. Extended transit times (14+ days above historical norms) or repeated course changes signal potential compliance issues even without designation. Flag vessels showing sustained loitering (10+ days) near high-risk STS hubs without documented commercial activity.

4. Apply region-specific protocols aligned to current hotspots

Require additional verification for any STS activity in Eastern Mediterranean, Damieta, EOPL Malaysia, or near Kharg Island. Treat extended AIS gaps (6+ hours) in these zones as red flags requiring explanation. Build geographic risk tiers into charter and financing decisions, with Mediterranean and Middle Eastern hubs receiving elevated scrutiny.

5. Establish behavioural monitoring cadence, not static checks

Sanctions risk is dynamic—one-time screening at contract inception is insufficient. Implement monthly rescreening of active counterparty fleets against updated behavioral signals. Set automated alerts for Phase 2 → Phase 3 transitions in your exposure portfolio. Treat AIS anomalies as early warning signals requiring investigation, not isolated technical issues.

6. Prepare for network-level enforcement escalation

Regulators now target entire facilitation networks—brokers, insurers, managers, intermediaries—not just vessels. Map your exposure to these service providers and assess their own sanctions compliance posture. Require attestations covering not just the immediate counterparty but second-order relationships (their managers, their insurers, their financing sources). Build contractual off-ramps for situations where your counterparty's network develops compliance issues even if they remain formally compliant.

‍

The compliance landscape doesn't wait for quarterly reviews anymore. In a market where 30 vessels join the shadow fleet monthly and deceptive practices spike with each regulatory action, predictive capability isn't a competitive advantage—it's operational necessity. The question isn't whether maritime compliance will remain complex in 2026. The question is whether your organization can shift from reacting to enforcement waves toward anticipating them.