The new face of maritime risk: How deceptive shipping practices are redefining compliance

The lines between sanctioned and non-sanctioned shipping have blurred. Once limited to rogue actors, deceptive shipping practices such as AIS spoofing, dark ship-to-ship (STS) transfers, and dark port calls are now creeping into mainstream operations, putting even non-sanctioned vessels under regulatory scrutiny.

According to Kpler's latest analysis, these behaviours are no longer just signal evasion—they're exposure vectors. Ships operating following patterns of sanctioned actors or in known high-risk zones with AIS discrepancies can inherit compliance risk through geography, timing, and cargo networks, even if their activities appear legitimate on the surface. This flows directly from OFAC’s risk-based expectations for maritime stakeholders, which single out location data manipulation, STS, and opaque ownership as red-flag behaviours to monitor across the transaction lifecycle.

The traditional model rested on clear boundaries: sanctioned vessels operated in one sphere, legitimate vessels in another, and compliance meant ensuring you didn't cross that line. Today's reality is far more complex and far more dangerous for the unwary.

‍

Understanding the shift: From binary to spectrum

The old paradigm was straightforward. Governments designated specific vessels under sanctions programs. Compliance teams checked transactions against sanctions lists—OFAC's SDN list, the EU's consolidated list, UN sanctions lists. If your counterparty wasn't listed, you proceeded. If listed, you blocked the transaction.

This binary approach worked when sanctions evasion networks were distinct from legitimate commerce. Today, risk exists on a spectrum. Between clearly sanctioned vessels and those with impeccable records lies a vast gray zone populated by:

• Vessels not yet sanctioned but exhibiting behaviours that predict future sanctions
• Vessels operating in high-risk zones without clear illicit activity
• Vessels associated with sanctioned networks through ownership or management
• Vessels that occasionally engage in deceptive practices alongside legitimate operations
• Vessels caught in complex cargo chains where sanctioned goods mix with legitimate commodities

This gray zone has expanded dramatically. Kpler's data shows deceptive shipping practices surging not just among obviously illicit operators but across a broader swath of the global fleet. Ships that would never have been considered high-risk five years ago now exhibit concerning behaviour.

Why the expansion? Russia-related measures catalysed the rapid growth of a large ‘shadow fleet’ moving Russian oil, materially expanding enforcement exposure across global trades. This scale required mobilizing significant shipping capacity, pulling vessels from legitimate trades into grey-zone operations. Price differentials for sanctioned commodities remain substantial—a single voyage carrying sanctioned cargo might generate profits equal to months of legitimate operations.

‍

Dark STS transfers surge

Over the past year (August 2024–July 2025), dark STS transfers surged sharply, overtaking other indicators of deceptive activity, while AIS spoofing remained persistently high. Even dark port calls—vessels with closed AIS while entering or leaving harbours—continue to appear in satellite imagery.

The sharp increase in dark STS transfers reflects adaptation to improved detection. As AIS-based surveillance became more sophisticated, evasion networks shifted tactics. Rather than risk spoofing detection, operators simply turn off AIS during critical operations—loading, transferring, or discharging cargo.

The geographic concentration shows strategic thinking. Vessels rendezvous in specific zones repeatedly—areas outside Singapore's port limits, waters off Malaysia, the Laconian Gulf off southern Greece (documented as a recurrent STS congregation area for Russian oil during 2023–2024), and regions off West Africa. These zones offer deep water for safe operations, distance from territorial surveillance, and proximity to shipping lanes.

Despite the rise in dark operations, AIS spoofing hasn't declined—it remains persistently high. This suggests operators use whichever approach best suits each specific situation. This tactical flexibility makes detection harder because compliance systems must monitor for multiple distinct evasion signatures rather than a single predictable pattern.

Modern sanctions evasion typically involves shell company structures, flag hopping, management complexity across different entities, and documentation manipulation. These tactics combine with AIS manipulation and dark operations to create comprehensive evasion packages that require equally sophisticated compliance approaches to detect.

‍

What was once binary is now layered

What was once a binary question—"Is the vessel sanctioned or not?"—has evolved into layered risk assessment across six dimensions:

1. ‍Formal sanctions status remains the foundation—vessels on sanctions lists are absolutely off-limits.‍
2. Behavioral indicators include AIS spoofing, dark operations, suspicious routing, unexplained gaps. These behaviours predict future sanctions even for non-sanctioned vessels.‍
3. Associative risk captures relationships with sanctioned vessels, operations in fleets alongside sanctioned ships, or employment of management firms that service shadow fleets.‍
4. Geographic risk involves operation in high-risk zones. Vessels operating regularly in areas known for sanctions evasion carry elevated risk simply through geographic exposure.‍
5. Cargo risk relates to commodities and trade routes commonly involved in sanctions evasion—crude oil, petroleum products, coal on routes like the Middle East to Asia or Venezuela to transshipment zones.‍
6. Ownership opacity represents risk even absent other red flags. Vessels owned through opaque corporate structures or flagged to jurisdictions with weak oversight carry higher risk.

‍

A vessel might score low risk on sanctions status but accumulate moderate-to-high risk across other dimensions, justifying enhanced due diligence or declining the transaction despite not being sanctioned.

‍

Why "clean" vessels are no longer low-risk

The risk is no longer just about what a vessel does—it's about who and where it operates with. A legitimate tanker anchoring near deceptive STS activity or shadow fleet hubs can still trigger due-diligence flags.

When regulators investigate a sanctions evasion incident, they examine all vessels in the vicinity. Satellite imagery showing multiple vessels near a dark STS transfer leads investigators to scrutinize all those vessels. Even if your vessel was conducting legitimate bunkering while nearby ships engaged in cargo transfers, your vessel enters the investigative record.

These adjacency risks have real consequences:

• Delayed cargo clearances or insurance complications: Vessels with compliance question marks face enhanced inspection, creating costs through demurrage and missed commercial windows
• Increased scrutiny from OFAC, UK, and EU regulators: Once a vessel appears on regulatory radar, future transactions receive closer examination for years
• Reputational exposure: Commodity traders whose cargoes move on vessels with compliance question marks face scrutiny from banks, customers, and regulators

Simply put, deceptive behaviour is contagious in terms of risk perception and regulatory treatment. The maritime industry operates on networks of relationships—once one participant faces compliance issues, everyone connected to them faces heightened scrutiny.

Perhaps most concerning is how legitimate operators can inadvertently acquire risk. A vessel conducting legitimate bunkering near illicit transfers, using an agent that also serves shadow fleet vessels, or loading cargo whose origin was obscured through complex transfer chains can find itself embroiled in investigations despite no intentional wrongdoing.