Dark STS transfers: The slow-burn compliance risk

When two vessels meet at sea with their AIS transponders switched off, it's called a dark ship-to-ship (STS) transfer, and it's one of the most persistent red flags in maritime compliance. These covert exchanges are used to disguise cargo origin or ownership, often in international waters such as the Singapore’s Eastern Outside Port Limits (EOPL) zone—widely used for legitimate services but associated with elevated STS-related risk when combined with AIS gaps, or offshore Venezuelan and Iranian waters.

While AIS spoofing attracts fast enforcement, dark STS transfers are the slow burn—taking months before sanctions are imposed, but leaving a clear data trail behind.

‍

Understanding the maritime compliance landscape

The global shipping industry moves approximately 90% of world trade, making it essential infrastructure for the international economy. However, this vast network also creates opportunities for illicit activities. Maritime compliance has become increasingly sophisticated in response, with regulators deploying multiple detection methods.

International regulations, for example, require vessels over certain sizes to broadcast their position, speed, course, and identity. When vessels manipulate this data (spoofing) or turn off transponders entirely (going dark), they trigger immediate red flags. 

AIS spoofing involves broadcasting false location data—perhaps showing a vessel in one location while it's actually somewhere else. This technique has become common among sanctioned fleets but is relatively easy to detect through pattern analysis and satellite cross-referencing.

Dark STS transfers, however, represent a more nuanced challenge. 

These operations involve two vessels rendezvousing at sea, typically in international waters beyond port authority jurisdiction, with both ships operating without AIS. The cargo, crew, or even vessel ownership details can be transferred between ships, effectively "laundering" the shipping trail. 

Unlike the digital manipulation of AIS spoofing, dark STS requires physical coordination and leaves satellite-visible evidence—but proving illicit intent requires more extensive investigation.

‍

The geography of deception

Certain maritime zones have emerged as persistent hotspots for dark STS activity, each serving strategic purposes.

The Eastern Outside Port Limits (EOPL) near Singapore sits at one of the world's busiest maritime crossroads. The Strait of Malacca funnels enormous shipping traffic, and the waters just beyond Singapore's jurisdiction offer convenient anonymity. Legitimate STS transfers do occur here for operational reasons—ships too large for port facilities, cargo consolidation, or fuel transfers. This legitimate activity provides cover for illicit transfers.

Venezuelan waters have seen increased dark STS activity as international sanctions on Venezuelan oil intensified. Ships load crude at Venezuelan ports or offshore terminals, then transfer cargo to other vessels in international waters, obscuring the oil's origin before it reaches buyers in Asia or elsewhere. This allows sanctioned Venezuelan oil to reach markets while bypassing direct trade restrictions.

Iranian waters, particularly in the Persian Gulf and Gulf of Oman, host similar operations. Iranian crude and condensate are transferred to vessels that may make multiple stops and transfers, creating complex chains that disguise the cargo's Iranian origin. Some operations occur in the South China Sea after Iranian vessels make the journey east.

Other notable zones include waters off West Africa (particularly near sanctioned regions), the Mediterranean, and areas of the South China Sea. What these locations share is distance from territorial oversight combined with proximity to shipping lanes or markets.

‍

Risk builds over time

Kpler's analysis of more than 900 sanctioned vessels reveals a striking pattern: only about a third (32.1%) of ships conducting dark STS transfers were sanctioned within a year, compared to 80% for AIS spoofers. This dramatic difference reflects the investigative complexity these operations present.

Enforcement may be slower, but it's far more enduring.

After the first year, sanctioning remained steady, with a notable surge more than two years after the initial STS event. This pattern suggests regulators employ a fundamentally different approach to dark STS activity. Rather than reactive enforcement, authorities appear to monitor vessels involved in dark STS for extended periods, watching for repeated behaviors, connections to known sanctioned entities, or patterns that indicate systematic evasion.

This extended timeline reflects several factors:

• Evidence accumulation: A single dark STS transfer might have legitimate explanations. But multiple transfers in sanctioned zones, connections to flagged counterparties, or cargo flows that align with sanctions evasion create a compelling case over time.
• Network mapping: Regulators increasingly focus on entire networks rather than individual violations. Dark STS transfers often involve multiple vessels, shell companies, and coordinated logistics. Building these network maps requires time and cross-referencing multiple data sources.
• Legal and diplomatic processes: Imposing vessel sanctions involves legal procedures, international coordination, and sometimes diplomatic considerations. The slower timeline for dark STS sanctions may reflect these procedural requirements rather than detection delays.
• Deterrent strategy: The knowledge that surveillance continues for years may serve as its own deterrent. Vessels and operators can't assume they've escaped scrutiny just because immediate sanctions don't follow.

Dark STS transfers don't just raise suspicion—they place ships under a compliance microscope for months or even years. This creates an extended risk window where vessels may appear compliant while actually operating under regulatory scrutiny.

‍

Why dark STS transfers persist despite risks

If detection is nearly inevitable, why do dark STS transfers continue? The answer lies in economic incentives and the fragmented nature of maritime enforcement:

• Price differentials: Sanctioned commodities trade at steep discounts. Iranian crude might sell for $10-15 less per barrel than comparable grades. For a Very Large Crude Carrier (VLCC) holding 2 million barrels, this represents $20-30 million in potential profit for buyers willing to navigate sanctions risks.
• Asset depreciation: Vessels engaged in sanctions evasion are often older ships nearing the end of their commercial life. Owners may calculate that even if the vessel is eventually sanctioned and loses value, the profits from illicit cargo runs will exceed the vessel's remaining legitimate earning potential.
• Enforcement gaps: While major economies like the US, EU, and UK maintain robust sanctions programs, enforcement isn't global. Vessels flagged to certain states, owned through opaque corporate structures, or operating primarily with counterparties in non-aligned countries face lower practical risks.
• Network resilience: Sophisticated sanctions evasion networks maintain fleets of vessels specifically for this purpose—the "shadow fleet." If some vessels are sanctioned, others continue operating. The sanctioning of individual ships becomes a cost of business rather than an existential threat.

‍

The operational mechanics

Understanding how dark STS transfers actually work reveals both their effectiveness and vulnerabilities.

A typical operation might unfold like this: A vessel loads cargo at a sanctioned origin—Iranian crude, Venezuelan oil, or North Korean coal. The ship then transits to international waters, often taking circuitous routes. Meanwhile, a second vessel, possibly with a clean compliance record, positions itself in a predetermined location—perhaps the EOPL or waters off Malaysia. Both vessels disable AIS transponders and conduct the transfer, which may take several hours to a full day depending on cargo volume and sea conditions.

After the transfer, the "dirty" vessel—the one that loaded at the sanctioned origin—may return for another load or seek other employment that accepts its tainted status. The "clean" vessel reactivates its AIS and proceeds to a destination port, now carrying sanctioned cargo under the documentation of a legitimate load.

Satellite detection has become the primary tool for identifying these operations. Synthetic Aperture Radar (SAR) satellites can detect vessels regardless of weather or AIS status. Optical satellites provide visual confirmation when conditions permit. By comparing satellite imagery with AIS data, analysts can identify vessels that appear in satellite images but have no corresponding AIS signal—the signature of dark operations.

Pattern analysis further enhances detection. Vessels that repeatedly visit specific zones, that show unusual deviations from normal trade routes, or that have gaps in their AIS transmissions correlated with satellite detections build profiles that indicate dark STS activity.

Intelligence integration combines these technical detection methods with intelligence about corporate ownership, financial transactions, port calls, cargo documentation, and communications. This comprehensive approach reveals not just individual transfers but entire evasion networks.