Combatting a New Era of Maritime Sanctions Evasion
Recent years have seen a notable increase in deceptive shipping practices (DSPs), particularly in the form of AIS spoofing and dark fleet activity. The implementation of Russia-related sanctions and a price cap on the sale of Russian oil and petroleum products has led threat actors to turn towards more sophisticated forms of sanctions evasion. They aim to deceive authorities and financial crime compliance programs via the creation of a shadow economy that operates outside of the confines of US, UK, EU, and G-7 law. Despite the new era of sanctions compliance challenges that such DSPs have created, it is possible to comprehend, detect, and mitigate these practices. Noyonika Bhaduri, CMO, of Pole Star, explains the 'Deep Blue Intelligence' research findings that the Pole Star Marketing Research team has conducted in conjunction with Blackstone Compliance research. The challenge: maritime sanction evasion Sanctions targets require access to allied countries’ markets, including commodities traders; financial institutions; flag registries; and ship charterers (“covered persons”) – all of whom have compliance obligations, including those relating to the price cap on Russian oil. The Office of Foreign Assets Control (OFAC) and other sanctions authorities have outlined an attestation process to document that Russian oil sales are within the Price Cap. However, this is not a mere record-keeping problem. The current price cap for oil leaves very little room for margin, meaning threat actors may attempt to falsify documentation, pass goods off as being of non-Russian origin, or violate other sanctions outside the Price Cap - such as acting on behalf of a blocked party or attempting to export oil to an allied country. The authorities have therefore warned covered persons to be aware of evasion attempts. For instance, in April, OFAC singled out P&I clubs, ship owners, flag registries, and commodities brokers to remain vigilant for DSPs as evidence of sanctions evasion. In addition, the UK’s National Crime Agency has warned the wider financial community that sanctions targets may use proxies and enablers to gain access to the financial system - access they would otherwise be denied. This advice is equally applicable to the maritime industry. Illicit dark fleet activity Two primary methods are emerging for sanctions evasion: the “dark fleet” and “AIS spoofing”. The Dark Fleet is a fleet of tankers owned and operated by persons outside of allied jurisdictions. These tankers – estimated to number around 600 vessels globally - are acquired for trading with Russia or other sanctioned countries. Owners will go to great lengths to disguise their stakes in these vessels. That said, dark fleet vessels are not used exclusively for sanctioned trade – and not all vessels will therefore present the same level of risk. For instance, they may be shipping oil within the confines of the Price Cap. However, they do present an increased risk to covered persons. Covered persons should therefore proceed cautiously when dealing with a dark fleet vessel and conduct enhanced due diligence on the provenance of the cargo, the buyer, and the seller. Determining whether a vessel is part of the dark fleet is a subjective process. Several criteria and factors must be considered before a ship can be categorised:
- Ownership: A vessel’s owner may be tied directly to Russia, Iran, or Venezuela. Likewise, threat actors may attempt to obfuscate their interest by owning the vessel through shell or front companies, or by making rapid changes to a vessel’s declared owners and operators.
- Movement: Dark fleet vessels may frequent Russian or sanctioned ports with deliveries to non-allied countries, and/or conduct ship-to-ship transfers in known high-risk zones, such as those used off the coast of Greece.
- Deceptive Practices: Consideration for vessels who engage in AIS spoofing or who opportunistically turn off their AIS transponder with the intent of avoiding sanctions.
- Timing: The timing of a vessel’s ownership change may indicate an intent to evade sanctions. For instance, moving vessels to new owners directly after the Russian price cap was passed. Likewise, if a vessel makes its first voyage – or routinely makes the same voyages – to Russia or a sanctioned country, this may indicate the vessel was purchased for sanctioned trade.
- Fleet coordination: Consideration of a vessel’s changes in conjunction with other vessels owned or operated by the same person. If a fleet of vessels change their flag simultaneously or incorporate into a new high-risk jurisdiction, this may signal that the owner and operators intend to misuse the vessel.
- “Anchor spoofing” simulates the vessel remaining in the same place for impractical amounts of time. The vessel may appear to be at anchor or may look like offshore storage. However, a review of the vessel’s signal activity or use of human or imagery sources allows us to confirm that it is not the transmitted location.
- “Circle spoofing” describes a situation where the vessel moves in geometric circles at a set location. Circle spoofing is generally used closer to shores and ports over a few days to a week - which is enough time to visit a sanctioned port and return to the station.
- “Slow roll spoofing” is when the vessel pretends to be moving in a general direction of travel at very slow speeds. This movement will lack an economic purpose and/or be inconsistent with local traffic patterns.
- “Pre-programmed route spoofing” is the most realistic technique used. The vessel is programmed to travel along feasible routes. This requires either duplicating or sourcing past AIS data to successfully mimic the vessel’s movements or more careful planning is used to ensure that the route appears to have an economic purpose. This methodology is hardly infallible, but is difficult to identify based on a visual inspection of the underlying data.