The new face of maritime risk: How deceptive shipping practices are redefining compliance

The lines between sanctioned and non-sanctioned shipping have blurred. Once limited to rogue actors, deceptive shipping practices such as AIS spoofing, dark ship-to-ship (STS) transfers, and dark port calls are now creeping into mainstream operations, putting even non-sanctioned vessels under regulatory scrutiny.

According to Kpler's latest analysis, these behaviors are no longer just signal evasion—they're exposure vectors. Ships operating following patterns of sanctioned actors or in known high-risk zones with AIS discrepancies can inherit compliance risk through geography, timing, and cargo networks, even if their activities appear legitimate on the surface. This flows directly from OFAC’s risk-based expectations for maritime stakeholders, which single out location data manipulation, STS, and opaque ownership as red-flag behaviours to monitor across the transaction lifecycle.

The traditional model rested on clear boundaries: sanctioned vessels operated in one sphere, legitimate vessels in another, and compliance meant ensuring you didn't cross that line. Today's reality is far more complex and far more dangerous for the unwary.

‍

Understanding the shift: From binary to spectrum

The old paradigm was straightforward. Governments designated specific vessels under sanctions programs. Compliance teams checked transactions against sanctions lists—OFAC's SDN list, the EU's consolidated list, UN sanctions lists. If your counterparty wasn't listed, you proceeded. If listed, you blocked the transaction.

This binary approach worked when sanctions evasion networks were distinct from legitimate commerce. Today, risk exists on a spectrum. Between clearly sanctioned vessels and those with impeccable records lies a vast gray zone populated by:

• Vessels not yet sanctioned but exhibiting behaviors that predict future sanctions
• Vessels operating in high-risk zones without clear illicit activity
• Vessels associated with sanctioned networks through ownership or management
• Vessels that occasionally engage in deceptive practices alongside legitimate operations
• Vessels caught in complex cargo chains where sanctioned goods mix with legitimate commodities

This gray zone has expanded dramatically. Kpler's data shows deceptive shipping practices surging not just among obviously illicit operators but across a broader swath of the global fleet. Ships that would never have been considered high-risk five years ago now exhibit concerning behavior.

Why the expansion? Russia-related measures catalysed the rapid growth of a large ‘shadow fleet’ moving Russian oil, materially expanding enforcement exposure across global trades. This scale required mobilizing significant shipping capacity, pulling vessels from legitimate trades into gray-zone operations. Price differentials for sanctioned commodities remain substantial—a single voyage carrying sanctioned cargo might generate profits equal to months of legitimate operations.

‍

Dark STS transfers surge

Over the past year (August 2024–July 2025), dark STS transfers surged sharply, overtaking other indicators of deceptive activity, while AIS spoofing remained persistently high. Even dark port calls—vessels with closed AIS while entering or leaving harbors—continue to appear in satellite imagery.

The sharp increase in dark STS transfers reflects adaptation to improved detection. As AIS-based surveillance became more sophisticated, evasion networks shifted tactics. Rather than risk spoofing detection, operators simply turn off AIS during critical operations—loading, transferring, or discharging cargo.

The geographic concentration shows strategic thinking. Vessels rendezvous in specific zones repeatedly—areas outside Singapore's port limits, waters off Malaysia, the Laconian Gulf off southern Greece (documented as a recurrent STS congregation area for Russian oil during 2023–2024), and regions off West Africa. These zones offer deep water for safe operations, distance from territorial surveillance, and proximity to shipping lanes.

Despite the rise in dark operations, AIS spoofing hasn't declined—it remains persistently high. This suggests operators use whichever approach best suits each specific situation. This tactical flexibility makes detection harder because compliance systems must monitor for multiple distinct evasion signatures rather than a single predictable pattern.

Modern sanctions evasion typically involves shell company structures, flag hopping, management complexity across different entities, and documentation manipulation. These tactics combine with AIS manipulation and dark operations to create comprehensive evasion packages that require equally sophisticated compliance approaches to detect.

‍

What was once binary is now layered

What was once a binary question—"Is the vessel sanctioned or not?"—has evolved into layered risk assessment across six dimensions:

1. ‍Formal sanctions status remains the foundation—vessels on sanctions lists are absolutely off-limits.‍
2. Behavioral indicators include AIS spoofing, dark operations, suspicious routing, unexplained gaps. These behaviors predict future sanctions even for non-sanctioned vessels.‍
3. Associative risk captures relationships with sanctioned vessels, operations in fleets alongside sanctioned ships, or employment of management firms that service shadow fleets.‍
4. Geographic risk involves operation in high-risk zones. Vessels operating regularly in areas known for sanctions evasion carry elevated risk simply through geographic exposure.‍
5. Cargo risk relates to commodities and trade routes commonly involved in sanctions evasion—crude oil, petroleum products, coal on routes like the Middle East to Asia or Venezuela to transshipment zones.‍
6. Ownership opacity represents risk even absent other red flags. Vessels owned through opaque corporate structures or flagged to jurisdictions with weak oversight carry higher risk.

‍

A vessel might score low risk on sanctions status but accumulate moderate-to-high risk across other dimensions, justifying enhanced due diligence or declining the transaction despite not being sanctioned.

‍

Why "clean" vessels are no longer low-risk

The risk is no longer just about what a vessel does—it's about who and where it operates with. A legitimate tanker anchoring near deceptive STS activity or shadow fleet hubs can still trigger due-diligence flags.

When regulators investigate a sanctions evasion incident, they examine all vessels in the vicinity. Satellite imagery showing multiple vessels near a dark STS transfer leads investigators to scrutinize all those vessels. Even if your vessel was conducting legitimate bunkering while nearby ships engaged in cargo transfers, your vessel enters the investigative record.

These adjacency risks have real consequences:

• Delayed cargo clearances or insurance complications: Vessels with compliance question marks face enhanced inspection, creating costs through demurrage and missed commercial windows
• Increased scrutiny from OFAC, UK, and EU regulators: Once a vessel appears on regulatory radar, future transactions receive closer examination for years
• Reputational exposure: Commodity traders whose cargoes move on vessels with compliance question marks face scrutiny from banks, customers, and regulators

Simply put, deceptive behavior is contagious in terms of risk perception and regulatory treatment. The maritime industry operates on networks of relationships—once one participant faces compliance issues, everyone connected to them faces heightened scrutiny.

Perhaps most concerning is how legitimate operators can inadvertently acquire risk. A vessel conducting legitimate bunkering near illicit transfers, using an agent that also serves shadow fleet vessels, or loading cargo whose origin was obscured through complex transfer chains can find itself embroiled in investigations despite no intentional wrongdoing.

‍

From reactive to predictive compliance

To manage this landscape, compliance teams must move beyond static screening toward behavior-based risk assessment.

Static screening—checking vessels against sanctions lists at the transaction point—remains necessary but insufficient. By the time a vessel appears on a sanctions list, it's too late. Contracts may already be signed, cargo in transit, financial exposure locked in.

Behavior-based risk assessment identifies vessels likely to be sanctioned before formal designation. This means integrating patterns such as:

• Frequency and duration of AIS gaps: Multiple gaps, especially in high-risk locations, indicate systematic behavior. Multi-day gaps suggest deliberate disablement rather than equipment failure.
• Dark STS transfers or AIS spoofing events: Any confirmed incident should elevate vessel risk classification immediately. Multiple instances should disqualify the vessel from consideration.
• Correlation with sanctioned cargo flows: Vessels operating on routes commonly used for sanctions evasion or showing cargo patterns matching known evasion networks face elevated risk even without direct evidence of violations.

Kpler's research shows that treating deceptive behaviors as exposure vectors enables earlier detection and smarter mitigation. Instead of reacting to sanctions after the fact, traders, insurers, and operators can forecast risk trajectories and make informed decisions before enforcement strikes.

Predictive compliance provides multiple advantages:

• Exposure is prevented rather than managed after the fact
• Operations proceed smoothly because compliance decisions are made during normal workflow
• Regulatory confidence increases as organizations demonstrate sophisticated capabilities
• Reputation enhances because organizations are never caught with sanctioned counterparties

‍

Implementing predictive compliance

The shift requires concrete organizational changes:

1. Technology infrastructure: Implement platforms that continuously monitor vessels across multiple data sources—AIS feeds, satellite imagery, sanctions lists, cargo tracking, ownership registries. Manual periodic checks cannot match automated continuous monitoring.
2. Cross-functional collaboration: Compliance cannot be siloed from commercial operations. Traders, operators, and brokers must understand compliance priorities and recognize red flags in daily interactions.
3. Risk appetite definition: Senior leadership must explicitly define organizational risk appetite regarding pre-sanction exposure. These strategic decisions should be documented, clearly communicated, and consistently applied.
4. Performance metrics: Measure compliance effectiveness not just by absence of violations but by risk identification before sanctions announcement. Track how many vessels the organization avoided that were subsequently sanctioned.

‍

The competitive advantage

While compliance is often viewed as cost and constraint, sophisticated predictive compliance creates competitive advantages:

• Faster transactions: Organizations with confidence in their processes can act decisively when opportunities arise
• Better counterparty access: Premium counterparties impose strict compliance requirements—organizations demonstrating sophistication gain access to valuable relationships
• Lower insurance costs: Organizations with documented compliance programs pay lower premiums and obtain broader coverage
• Crisis resilience: When enforcement waves strike, organizations with predictive compliance emerge unscathed while competitors scramble

‍

Navigating the gray zone

The vessels that will be sanctioned next quarter are likely exhibiting concerning behaviors today. The ownership structures that will face enforcement next year are probably being established now. The cargo chains that will unravel under regulatory scrutiny are currently in motion.

Organizations using predictive compliance can see these risks approaching. Those relying on reactive compliance will discover them too late. In an industry measured in billions of dollars of capital and working across complex global networks, the difference between predictive and reactive compliance is the difference between sustainable success and costly crisis management.

The gray zone between clearly sanctioned and clearly compliant will continue expanding. But within that gray zone, sophisticated analysis can discern patterns, predict trajectories, and guide sound decisions. The tools exist, the data is available, and the methodologies are proven. What's required now is organizational commitment to implementing predictive compliance as core business capability.

In maritime operations, as in navigation, the greatest dangers are those unrecognized until too late. Behavioral risk indicators provide early warning—the equivalent of radar detecting hazards beyond visual range. The choice is whether to invest in that radar or sail without it, discovering risks only when collision is unavoidable.