In the current international landscape, the Western-dominated international sanctions system is intensifying the blockade on energy exports from countries such as Iran and Russia with unprecedented force. Its core objective is to sever their oil trade lifelines and capital chains. Under such circumstances, maritime vessels and energy shipping operations in the relevant countries and regions have become the direct focus of supervision. This has given rise to a series of evasion tactics and high-risk shipping behaviors, while also posing brand-new challenges to the compliance of global supply chains.
Sanction List System and the Necessity of Maritime Supervision
The United States and the European Union adopt a multi-level list system to manage sanctioned entities. The most binding ones are the Specially Designated Nationals (SDN) List of the Office of Foreign Assets Control (OFAC) and EU Consolidated List of Asset Freezes. Entities included in these lists will face asset freezes and trade prohibitions. In addition, there are lists targeting specific industries, such as the Sectoral Sanctions Identifications (SSI) List. These lists are based on different legal foundations: OFAC mainly relies on U.S. presidential executive orders and a number of sanctions acts, while the EU's sanctions are based on decisions of the Council and take effect directly through regulations. Maritime sanctions play a crucial role in safeguarding international security. Approximately 90% of global trade depends on maritime transportation, yet sanctioned countries are increasingly adopting more concealed means to evade supervision. By monitoring vessel behaviors to detect non-compliant operations, it is possible to effectively curb illegal capital flows, prevent terrorist financing, and safeguard the integrity of maritime trade. In 2025, OFAC issued new regulations targeting the "dark fleet," requiring major traders to report evasion behaviors, which reflects the continuous strengthening of maritime supervision.
Evolution of Sanction Trends: Shift in Focus from Russia to Iran
According to sanction data released by OFAC, there has been an obvious phased shift in the focus of sanctions. From 2023 to the early part of 2024, Russia remained the primary target of sanctions, reflecting the Biden administration's prioritization of containing Russia in its foreign policy. Since 2024, the frequency of sanctions against entities related to "terrorist organizations" has increased significantly, indicating that non-traditional security challenges brought about by the Red Sea crisis and non-state actors are receiving high attention. With Trump's return to the White House in 2025 and his adoption of a tough stance, Iran has replaced Russia as the focus of a new round of sanctions. In June, the conflict between Iran and Israel escalated, and in July, the number of sanctions imposed on Iran reached its peak. The Trump administration adheres to a traditional energy strategy stance, strongly suppressing Iran's oil exports. Its aims are to consolidate the United States' dominant position in the global energy market and reshape its so-called "world police" role by strengthening intervention in the Middle East.
This policy orientation is clearly reflected in the sanction data: oil tankers have become the primary targets of sanctions, accounting for a significant proportion of sanctioned vessels. This fully demonstrates that "cutting off oil revenue" remains the core logic of the sanctions system. Table 1: List of Selected OFAC Sanctioning Authorities and Grounds for Sanctions Faced with the shift in sanction focus toward Iran and the continuous upgrading of evasion tactics, the industry needs to further enhance its ability to monitor and evaluate abnormal vessel behavior.
Table 1: List of Selected OFAC Sanctioning Authorities and Grounds for Sanctions
Figure 1: OFAC SDN Sanctioned Ship Project Time Distribution Analysis
Figure 2: Breakdown of Vessel Types on the OFAC SDN List
Behavioral Characteristics of High-Risk Vessels and Risk Determination
In terms of behavioral characteristics, high-risk vessels often exhibit one or more of the following behaviors: concealing Automatic Identification System (AIS) signals to cover up their actual positions and navigation trajectories; loitering or berthing at sea to conduct illegal cargo transfers; disappearing from AIS signals or vessel reflagging to evade tracking; turning back at sea to evade monitoring; and changing draft at sea, which may indicate cargo loading or unloading. The specific behaviors are as follows :
1. AIS Signal Disappearance
AIS signal disappearance refers to situations where the interval between AIS signals from a vessel exceeds 2 hours. Legitimate reasons for signal disappearance include severe weather conditions or equipment failures. However, if such disappearance occurs near the territorial waters of sanctioned countries (e.g., the Strait of Hormuz in Iran) or other high risk areas (e.g., Yemen), especially when accompanied by other suspicious patterns, it may indicate the intentional shutdown of AIS signals to transport embargoed goods. For instance, when Iran transports crude oil to other countries, vessels in the "dark fleet" will turn off their AIS signals in the first half of the voyage and reactivate them after passing through the Strait of Malacca. Vessels that experience repeated AIS signal disappearances in sensitive areas and have a low signal online rate will be marked as high-risk.
2. Slow-Speed Navigation
Slow-speed navigation refers to vessels sailing continuously at a speed of at 1–3 knots for over 30 minutes. Legitimate reasons include waiting to enter a port or being affected by severe weather. Nevertheless, if this behavior occurs in open sea transfer areas and is accompanied by abnormal signals, it may indicate illegal ship-to-ship (STS) transfers. For example, in 2024, the Ocean Ambition was found engaging in the transfer of sanctioned oil while sailing at a slow speed in the Gulf of Oman, and was eventually included in the SDN List.
3. Loitering
Loitering refers to vessels loitering at speeds below 2 knots within a 5-nautical-mile radius for 30 minutes. Legitimate reasons include anchoring and waiting for orders. However, if this happens in non-anchorage areas (e.g., the middle of the Strait of Malacca), it may imply preparations for illegal berthing or non-compliant operations. If a vessel also has a history of frequent flag changes (e.g., changing flags more than three times within a year), the risk level of such behavior will increase significantly.
4. Berthing
Berthing refers to two vessels approaching each other at the same time and location. Legitimate reasons include assistance from tugboats or supply operations. Yet, if this occurs in open seas and involves sanctioned vessels, it may be used for the transfer of embargoed goods. For example, in 2025, the Sea Prosper berthed with the sanctioned oil tanker Black Star in the Red Sea and was subsequently sanctioned for transferring Iranian oil.
5. Lingering
Lingering refers to vessels moving at speeds below 1 knot for over 30 minutes. Legitimate anchoring usually takes place in designated areas. However, if a vessel lingers in an unusual area for an extended period, it may be intended to wait for illegal transactions or forge documents. When the lingering time exceeds 12 hours without a reasonable explanation, the risk level of such behavior will rise significantly. 6. Vessel Impersonation (Spoofing) Vessel impersonation refers to multiple vessels using the same Maritime Mobile Service Identity (MMSI), which is a clear violation of regulations and usually involves identity forgery. For example, the Golden Horizon stole the identity of a scrapped vessel to transport sanctioned goods in the Persian Gulf, and was eventually tracked down and sanctioned by OFAC.
7. Turning Back
Turning back refers to vessels taking a detour that is obviously inconsistent with economic efficiency or regular routes. Although such behavior may have legitimate reasons, such as evading severe weather or sea conditions, abnormal route planning—for example, a vessel sailing from the Persian Gulf to India detouring to the waters south of Sri Lanka, resulting in an additional transit time exceeding 5 days—may imply an attempt to evade monitoring systems, cover up the actual destination, or engage in other non-compliant activities.
8. Signal Forgery
Signal forgery refers to the use of AIS signal simulators to generate fake signals and send them to base stations, falsifying the vessel's trajectory, while remotely turning off the real AIS equipment to hide the vessel's whereabouts. This is common among vessels heading to sanctioned countries to pick up oil, with the purpose of concealing the real source of the crude oil and creating confusion. There are obvious differences between forged signal data and real vessel navigation data, with typical characteristics including sudden changes in speed and unreasonable jumps in position. For example, in 2024, the Atlantic Dream was supposedly present in both the Mediterranean Sea and the Persian Gulf simultaneously. Subsequent verification confirmed this as a typical case of signal forgery.
9. Other Non-Trajectory Risk Indicators
Other non-trajectory risk indicators, such as complex vessel ownership structures, frequent flag changes, and unclear insurance sources, may all indicate sanction evasion behaviors and thus deserve attention.
Compliance Challenges and Future Outlook
Faced with an increasingly complex sanctions environment and the continuous upgrading of evasion technologies, the shipping industry is increasingly relying on artificial intelligence, multi-source data fusion analysis, and international regulatory cooperation to address the growing compliance risks. Against this backdrop, E-House Shipping is actively promoting innovation in compliance services. By deeply integrating navigation trajectories, vessel archives, and global sanctions blacklists, it provides round-the-clock vessel risk monitoring and early warning services for charterers, traders, and financial institutions. The core of its products is built around the concept of "Know Your Vessel (KYV)," which mainly includes: conducting in-depth due diligence on a vessel's history and associated networks, covering multi-dimensional attributes such as the vessel's flag, ownership structure, and navigation behavior patterns; and real-time monitoring of abnormal AIS data to accurately identify suspicious behaviors occurring in high-risk areas. Currently, building a resilient compliance system that can dynamically adapt to changes in sanction policies and ensure the safe and stable operation of global supply chains has become an urgent need for enterprises in the industry. We recommend that enterprises further strengthen contract management, exercise caution in providing port services, strictly verify vessel flag registration information and document authenticity, and actively introduce professional data services to enhance their risk assessment and early warning capabilities .