The maritime compliance landscape is shifting from reactive to predictive—and 2026 will test who's prepared

Maritime risk management changed fundamentally in 2025. What started as isolated sanctions enforcement has evolved into something more systematic—a structural reorganisation of global shipping flows that's forcing the industry to rethink how it identifies, measures, and responds to compliance exposure.

After analysing over 700 newly sanctioned vessels this year and tracking behavioural patterns across thousands of shadow fleet operations, one thing has become clear: the companies still relying on static watchlists and reactive screening are already behind. 

The question for 2026 isn't whether enforcement will intensify—it's whether your compliance infrastructure can predict exposure before regulators announce it.

‍

2025 rewrote the enforcement playbook

This year delivered the most aggressive sanctions cycle on record. Three major regulatory waves hit in January, May, and October, each one expanding the net beyond individual vessels to target entire facilitation networks—insurers, brokers, flag registries, and service providers.

The January package alone designated over 180 shadow fleet tankers alongside major Russian producers like Gazprom Neft and Surgutneftegas. By May, both the U.S. and EU had coordinated actions against Iranian networks, and October's 19th EU package introduced phased restrictions on Russian LNG while tightening financial and maritime controls across the board.

What made 2025 different wasn't just the volume of designations. It was the shift in regulatory focus from cargo movements to the mechanisms enabling circumvention. Authorities started targeting the architecture of evasion itself: improper AIS usage, shell-company ownership structures, weakly verified insurance certificates, and trades brokered through lightly regulated jurisdictions.

The result? Enforcement is no longer about catching individual bad actors. It's about dismantling the systems that allow high-risk trade to operate at scale.

‍

The shadow fleet didn't shrink—it adapted

Despite stronger enforcement, the shadow fleet didn't collapse. It reorganised.

By December 2025, roughly 3,300 vessels were operating in shadow networks, moving approximately 3,733 million barrels of oil—about 6-7% of global crude flows. That's slightly down from 2024's 4,735 million barrels, but the decline reflects a reshuffling of trade structures rather than any meaningful reduction in illicit activity.

What's changed is operational resilience. The fleet has hardened itself against regulatory pressure through:

• Fragmented ownership networks that obscure beneficial control
• Rapid and repeated flag changes to stay ahead of enforcement
• Systematic AIS manipulation and spoofing to conceal movements
• Irregular ship-to-ship (STS) transfers in permissive jurisdictions
• Self-insurance and non-IG P&I coverage that sidesteps Western service providers

These aren't isolated workarounds. They're features of a parallel logistics system that's now embedded in global trade flows.

Key transshipment hubs have become informal redistribution points for restricted cargoes. Even when you exclude areas around Russia, Iran, Venezuela, and Syria, significant volumes still flow through high-risk zones. At Damietta, 17.3% of STS activity involves vessels with recent Russian port calls. At Istanbul, it's 31.4%. Pelepas sits at 23%, Cyprus at 19%.

The infrastructure supporting these operations—permissive flag states, opaque financing channels, and alternative classification societies—has proven remarkably durable. When one corridor closes, two alternatives emerge. Regulatory friction is consistently met with operational creativity.

‍

Deception scaled to industrial levels in 2025

Technology designed for maritime safety has increasingly been weaponised for concealment.

AIS spoofing hit 212 incidents in May alone—19% above the second-half 2024 monthly average. Dark STS transfers reached a record 316 events, averaging around 224 per month across January through November. That's a 129% jump from prior baselines.

These aren't marginal behaviours. They're core operational tactics that enable the shadow fleet to move hundreds of millions of barrels through channels designed to avoid formal oversight.

Our monitoring across Q1 through Q4 shows consistent patterns: vessels eventually sanctioned often displayed false AIS positions, frequent reflagging, irregular STS activity, and opaque ownership structures weeks or even months before enforcement actions. The behavioural signals were there—regulators just hadn't acted yet.

This creates a critical opportunity. If deceptive behaviours reliably precede designations, then compliance can shift from reactive vessel tracking to predictive risk scoring.

‍

Sanctioned trade didn't stop—it just became harder to see

Here's what enforcement pressure actually achieved in 2025: it didn't freeze commodity flows from sanctioned suppliers. It redirected them into less visible channels.

Year-over-year exports from Russia, Iran, and Venezuela remained broadly stable through October. The sanctions didn't disrupt the trade—they changed how it moves, who facilitates it, and how much opacity surrounds each transaction.

By Q3, roughly 12% of global oil and gas trade was flowing through networks that deliberately obscured cargo origin, vessel ownership, and final destination. Shadow crude movements still dominate this activity, but LNG is accelerating as political and commercial constraints intensify around Russian gas exports.

The Russia-China LNG corridor offers a clear example. After significant delays tied to sanctions on Arctic LNG 2, the operator managed to deliver approximately 19 discounted cargoes through the year. The first cargo unloaded at Pipechina's Beihai terminal in August, and since then, Beihai has exclusively received sanctioned Russian volumes.

This represents operational ring-fencing—not a formal change in ownership, but a deliberate configuration that limits Western insurer involvement, routes documentation through state-linked entities, and schedules Russian cargoes through dedicated berths. Beihai's relatively small scale and operational flexibility make it a manageable node for isolating sanctioned flows compared to larger, internationally integrated terminals.

Meanwhile, the crude market tells a similar story. Roughly 27% of Russian crude exports now move through shadow fleet channels and non-Western service networks, enabling many barrels to trade closer to market prices despite the G7 price cap. China and India continue anchoring demand, with Indian refiners importing discounted Russian crude and re-exporting refined products that fall outside sanctions once chemically altered.

This dynamic has made the "missing barrels" problem chronic. Gaps in the global oil balance increasingly reflect unreported exports, misstated demand, and supply that's effectively invisible to traditional monitoring systems.

From watchlists to predictive intelligence

The fundamental shift happening right now is this: sanction designations are increasingly following behavioural trails that analytics can detect first.

Using our proprietary risk-scoring methodology, we identified 302 active shadow fleet vessels at elevated risk of future designation in our October publication. Since then, 52 of those vessels have been sanctioned—17% of the cohort. The method worked.

Looking into 2026, we believe the remaining 250 vessels carry significant sanctioning risk, with 68 already scoring in critical ranges where multiple compounding risk indicators are present.

Here's what that risk scoring looks like in practice:

• ‍Emerging risk (50-59 score): 91 vessels showing first risk flags‍
• Elevated risk (60-80): 48 vessels with multiple indicators‍
• Severe risk (81-99): 43 vessels with compounding behaviours‍
• Critical risk (≥100): 68 vessels at threshold breach

Take the case of AQUARIS (IMO 9251822). Over the past 12 months, this vessel exhibited what we call a textbook escalation pattern—one that analytics flagged well before regulators moved.

It started with early indicators: repeated Iranian port calls combined with the onset of AIS spoofing and signal gaps. This evolved into an escalation phase with multiple dark STS events in Iranian zones, sustained AIS manipulation, and successive fuel oil and crude liftings from Bandar Abbas, Bandar Mahshahr, and Kharg Island.

By mid-2025, the vessel reached peak illicit activity—continuous crude movements from Kharg Island, dark STS operations with tankers in Iran-China shadow corridors, spoofing episodes near Indonesia, and a detention in Dalian for nine deficiencies.

OFAC sanctioned it on February 6, 2025. But the behavioural signals were visible months earlier.

‍

Three forces reshaping compliance in 2026

The transition to predictive intelligence is being driven by three structural shifts:

1. Network-level enforcement

Regulators are no longer just targeting individual vessels. They're going after entire facilitation ecosystems—brokers who arrange deals, insurers who provide coverage (or dubious certificates), managers who operate fleets through shell structures, and intermediaries who enable financial flows. If you're part of the network, you're in scope.

2. Real-time compliance as competitive advantage

Traders, charterers, and banks are starting to build integrated risk feeds directly into their operational systems. The goal isn't just regulatory compliance—it's preventing disruptions that freeze cargo, strand vessels, or trigger financing defaults. Companies with better data see risks earlier and adjust faster.

3. Transparency infrastructure becoming standard

Insurers and classification societies are reducing exposure to high-risk tonnage, which is forcing the broader market to adopt stronger verification tools. Flag-risk layers, compliance dashboards, API integrations, and automated attestations are shifting from nice-to-have features to baseline requirements.

‍

What 2026 actually looks like

Sanctions volatility will remain a defining factor, but the dynamics will differ by jurisdiction.

The United States will continue driving enforcement—and will remain the primary source of unpredictability. U.S. actions will align closely with the current administration's trade and diplomatic priorities, meaning enforcement patterns could shift based on political negotiations rather than pure risk assessments.

Europe, meanwhile, is moving toward more harmonised and stringent frameworks. The EU's phased approach to LNG restrictions and its tightening controls on refined products sourced from Russian crude signal a long-term commitment to compliance architecture, not just reactive designations.

For market participants, this creates a challenging environment. Illicit trade practices will keep evolving, which means ongoing pressure on oil and gas balances, heightened price volatility, and increased exposure to environmental incidents involving aging, poorly maintained shadow fleet tonnage.

The fleet itself will likely concentrate rather than expand. Fewer hulls, but more heavily utilised. More deeply embedded in permissive jurisdictions. More reliant on parallel service networks that operate outside traditional maritime infrastructure.

Risk won't recede in 2026—it will migrate. Expect tighter, more sophisticated diversion pathways, especially around the Eastern Mediterranean, Southeast Asia, and the Gulf of Oman.

‍

The compliance gap is widening

Here's the uncomfortable reality: companies still relying on static watchlists are managing yesterday's risks.

By the time a vessel appears on an OFAC list, it's already been exhibiting high-risk behaviours for weeks or months. The designation is the outcome, not the signal. If your compliance process starts with the sanctions list, you're always reacting—never anticipating.

The shift to predictive compliance isn't optional anymore. It's the difference between catching exposure before it materialises and discovering it when a vessel you chartered gets sanctioned mid-voyage.

2026 will test how much unregulated flow the global system can sustain before something breaks—whether that's enforcement capacity, insurance availability, or the operational resilience of the shadow networks themselves.

But for companies that invest in predictive risk intelligence now, it's also an opportunity. The firms that can see risks before regulators act will operate with less disruption, lower exposure, and stronger positioning in an increasingly fragmented compliance landscape.

The tides have already turned. The question is whether you're ready for where they're heading.

‍