Vessel Due Diligence: The Major Sanctions Risks FIs Face

Intro: This is a two-part series focusing on the increasing risks, and costs, of maritime sanctions. This part will focus on the sanctions, economic, and environmental risks presented by the Dark Fleet, a group of tankers dealing in Russian, Iranian, and Venezuelan crude. The second part will focus on how financial institutions can counter these risks, and how to better use vessel screening and due diligence tools within the compliance process. See Part Two here.

Maritime sanctions, and the need to effectively screen and analyze a vessel’s behavior, have never been as important as they are today. Russia’s invasion of Ukraine precipitated the largest sanctions program in modern history, designed to cap the price on Russian crude (“Price Cap”) and stop shipments of armaments and dual-use goods to feed Putin’s war machine. Likewise, Hamas’ October 7 attack on Israel has caused the U.S. Office of Foreign Assets Control (“OFAC”) and some U.S. allies to double down on sanctions against Iran – Hamas’ state sponsor – and OFAC is focused on undercutting Iranian commodity sales.[^1]

It is no secret that the U.S. government and its coalition counterparts (“Coalition”)[^2] are expecting more robust due diligence on vessels and their cargo. While OFAC (and its counterparts)[^3] has historically produced guidance on an annual basis for the need to conduct vessel due diligence,[^4] the agency has published[^5] four[^6] advisories[^7] in almost as many months.[^8]

The U.S. Department of Justice (“DOJ”), which is in charge of enforcing criminal infractions of the sanctions regulations, has been even more active than OFAC in indicting companies for non-compliance and seizing maritime assets.[^9] It was no coincidence that the “Know Your Cargo” advisory’s centerpiece case study was a criminal indictment filed against a non-U.S. person.[^10] Other countries’ law enforcement authorities are equally keen on enforcement and the risk of prosecution for poor compliance has never been higher, even outside of the Coalition.

I. Increasing threat of maritime sanctions

Unfortunately, the intensity of new sanctions has also caused malign actors to use more advanced deceptive shipping practices to evade sanctions. Financial institutions, and trade finance departments in particular, are currently facing three major maritime sanctions risks:

• The rise of the “Dark Fleet”[^11] which consists of many companies operating tankers with the intention of circumventing the price cap on Russian oil or dealing in Iranian and Venezuelan-origin goods.
• A shift from simpler forms of sanctions evasion such as disabling the AIS transponder[^12] to more advanced forms of deceptive shipping practices such as spoofing – the act of faking a vessel’s location.[^13]
• The creation of a cottage industry of classification societies, insurers, and flag registries who offer dubious services (such as shoddy insurance) and cater directly to vessels engaged in sanctions evasion.

Coming to grips with any one of these threats would be a significant challenge, but OFAC and her sister agencies expect the financial crime compliance (FCC) community to address all three.

a. The Dark Fleet

The creation of a separate Dark Fleet, primarily to facilitate sanctioned transactions, is one of the greatest sanctions phenomena in recent history. Between 2022 and 2024, buyers rapidly acquired or co-opted at least 850 tankers to deal in sanctioned oil.^[1] Ostensibly, this allowed third parties to deal in over-cap Russian crude and Iranian and Venezuelan oil unfettered.

The Dark Fleet is also becoming increasingly cross-programmatic. Individual fleets are now dealing with multiple sanctioned countries which pose different legal risks to financial institutions. Take the example of vessels operated by Sislana Technik Ltd, an ostensibly Belizean ship managing company whose main employees are located in Turkey. The company’s 12 vessels have traditionally dealt in Venezuelan crude, oftentimes spoofing their location off the coast of Angola, but began dealing in Russian crude starting in mid- 2023.

As if keeping up with such a large group of vessels was not hard enough, the authorities’ response to the threat has been both late and uneven. The first sanctions were imposed by the U.K.’s Office of Financial Sanctions Implementation and were targeted towards three ship managers who had close connections with Sovcomflot, Russia’s state-owned tanker fleet. But by the time those sanctions had arrived, one of the designees, K&O Ship Management, had already transferred their fleet to a different front company in Hong Kong, who remains undesignated today. To make matters worse, OFAC has only designated one major Dark Fleet owner, Hennesea Holdings Limited, but left a quarter of its fleet and its main ship manager, Maritas Fleet Pvt. Ltd., unlisted.

The net effect of these sanctions is that much of the Dark Fleet still operates with impunity and the authorities have created a patchwork of sanctions that differs from jurisdiction to jurisdiction. At my firm, we foresee this creating multiple conflicts of laws and scattershot enforcement, as companies work to balance their local regulations and sanctions clauses with their compliance concerns.

b. Advanced Deceptive Shipping Practices

Spotting sanctions evasion has become significantly harder in the past two years as malign actors increasingly adopt advanced deceptive shipping practices (“ADSP”) such as spoofing and unsafe ship-to-ship transfers. Traditionally, sanctions evaders concealed their vessel movement by shutting off their vessel’s transponder, often referred to as “going dark.” This leaves a noticeable gap in their movement history and some basic analysis could extrapolate where the vessel may have been.

Today, over 20% of the Dark Fleet is engaged in “spoofing,” or the act of faking a vessel’s position. Providing false navigational information is not only an unsafe practice but has been an effective tactic for duping compliance departments into thinking that a vessel’s behavior is normal. Some of these spoofing tracks are simple – the spoofer often correctly assumes compliance departments won’t notice – but spoofing events are growing increasingly sophisticated.

For example, the Onrense (IMO 9196632) shows a range of spoofing tactics at varying levels of sophistication. Between April to July 2023, she appeared off the coast of Angola but was (likely) loading oil at Jose Terminal in Venezuela.^[2] This is a common spoofing typology for this program. However, her track then began to move to the Caribbean and appeared to depart from Venezuela in late July for Singapore. While this movement looks genuine, and eventually met up with her actual position off the coast of Brazil, other forms of signals intelligence show that until then, it was fabricated.

Fig. 1.1: The Onrense engaged in spoofing between April – July 2023. Some of the spoofing conforms to basic typologies, but other parts would not be detectable through a traditional review of AIS information.

There is no one algorithm or tool that can detect all spoofing. Document checkers and first-line compliance officers need to be trained to spot common typologies and suspicious patterns and escalate these transactions to their second-line FCC programs. Likewise, seasoned compliance officers will need to get adept at using multiple sources of information, including AIS data, imagery, and more bespoke systems to investigate suspicious alerts. Correspondingly, regulators need to become more accepting of compliance programs outsourcing the necessary threat intelligence to maritime intelligence providers, as OFAC recommended in their May 2023 alert on spoofing.^[3]

c. Additional legal challenges of high-risk enablers

Finally, the Dark Fleet presents not just a sanctions risk to financial institutions, but an environmental and economic risk as well. All vessels, including those involved in sanctions evasion, require safety certificates, insurance, and a flag to carry cargo and be allowed entry to a port. No sane port operator would allow a vessel without insurance to anchor or dock in their harbor.

While the Dark Fleet has not had any issue obtaining these maritime services from Coalition persons,^[4] a large portion of the Dark Fleet is insured, flagged, and receives safety certificates from companies which appear to cater primarily or exclusively to vessels engaged in sanctions evasion. This applies to vessels dealing in both Russian, as well as Iranian and Venezuelan crude. To be clear, we do not believe that these companies are providing actual insurance coverage or safety certificates, nor do the Dark Fleet operators believe they are obtaining actual insurance. Instead, they seek out these services to give them a veneer of legitimacy.

An oil spill can cost billions of dollars to clean up and typically results in an equal amount of lawsuits against all parties involved in the transaction. Large vessels, regardless of their cargo, always have the potential to cause massive damage during a mishap,^[5] but this is doubly so for tanker vessels conducting ship-to-ship transfers in unsafe conditions (e.g., open waters) or who are manipulating or hiding their position in crowded waterways.^[6]

Under normal conditions, a well-insured vessel could cover the cost of an oil spill and defray legal actions against those who were trading and financing in the cargo. However, an oil spill or major calamity within the Dark Fleet would be anything but ordinary. Take the example of the Liberty (now named the Vernal), a vessel who had loaded Venezuelan crude while spoofing her location off the coast of Angola, prior to running aground off the coast of Indonesia.^[7] It quickly became apparent that her insurance was false and could not cover the accident.^[8]

Fig 1.2: The Liberty (now Vernal) was spoofing her position as off the West Coast of Africa while loading Venezuelan crude. She would run aground in Indonesia a month later while delivering this cargo.

Luckily, her mishap did not create an oil spill. It is not clear who would have paid for the damage had she cracked open. If her insurer could not cover it,^[9] who would? Her classification society, which was responsible for certifying the vessel’s safety, is a tiny company in Odessa who also classifies other vessels for the false insurer. We do not know the true owner of this vessel, but even if we did, they would likely be in a jurisdiction outside of the law’s reach. The Liberty’s flag, Cameroon, is a private company run on behalf of the country of Cameroon.

Instead, those suffering damages, including governments, would turn to lawsuits against the other parties to defray the costs. Commodities traders, financial institutions, ship managers, and other external parties would be subject to numerous lawsuits. Even the costs of defending the lawsuits would outpace any penalties that would be leveled by OFAC. The ordeal would be disastrous for the entire maritime community. These incidents could also happen in Coalition waters – from a tanker carrying Russian crude in the Denmark Strait to a vessel lifting Venezuelan crude in the Caribbean and Gulf of Mexico.

Terrifyingly, this was not an isolated incident. The Pablo, a tanker insured by the same provider as the Liberty, detonated in the Malacca straits. She was suspected of just delivering Iranian oil,^[10] and had she still been laden, it would have created an oil spill and possibly shut down one of the world’s most strategic waterways.

Outro: This is the first part of a two-part series. In the next part, we will discuss how to best employ vessel due diligence tools to detect maritime sanctions evasion, and why it is increasingly important that financial institutions no longer consider their tool a “black-box.” See Part Two here.

David Tannenbaum started his career in sanctions compliance at the Office of Foreign Assets Control. David subsequently founded Blackstone Compliance Services, a consulting firm focused on anti-money laundering and sanctions compliance, in 2013. He frequently works with global financial institutions to help design, implement, and enhance their financial crime compliance programs, including half of all Top-10 global banks. He also frequently helps clients respond to regulatory requests and investigations, and has led the sanctions testing of three major monitorships on behalf of the DOJ, NYDFS, FRB, and other foreign regulators, and is currently serving as the FRB-appointed independent consultant of a fourth.

David, alongside his partners at Pole Star Global, also runs Deep Blue Intelligence, a maritime threat intelligence program that identifies malign actors engaged in sanctions evasion on the high seas, and helps develop tactics to counter advanced forms of deceptive shipping practices.

Disclosure: The author jointly runs a threat intelligence program with Pole Star Global, a provider of due diligence software. His work product is incorporated in this software and both Blackstone and Pole Star share a financial arrangement from it.

Trade Based Financial Crime Compliance

The all-in-one guidebook for trade and compliance teams to tackle TBML, sanctions, KYC, at the intersection of trade and compliance.

Buy now