The movement of sanctioned Russian goods presents a growing threat to western banks and traders. Evidence is emerging of vessels using sophisticated tools to evade detection, while regulators and port authorities are increasingly willing to take strident action if red flags are detected. Technology that can scrutinise a vessel’s history, behaviour and ownership has never been more important. John Basquill reports.
In early February 2023, two vessels met in the Alboran Sea, close to the Strait of Gibraltar. Maersk Magellan, a Singapore-flagged tanker, took delivery of a cargo of diesel fuel from a Vietnam-flagged tanker by the name of Elephant, and set sail north towards the port of Tarragona, around 100 kilometres south-west of Barcelona.
On the face of it, there was nothing unusual about the operation. Elephant was not subject to sanctions and did not present any immediate risk indicators, such as being owned by a single-vessel fleet owner or a recently established company.
Port authorities in Spain, however, suspected something was awry. They detected that the cargo on board Elephant had previously been loaded from another vessel, again by ship-to-ship transfer – and that vessel, a Cameroon-flagged tanker named Nobel, had strong and recent ties to Russia.
Until July 2022, Nobel had been registered under the Russian flag and was owned by Moscow-headquartered fuel trader Rusprimexport. That month, the tanker – at the time named Neatis – was sold to a Seychelles-based holding company and registered under a new flag.
Spain’s transport ministry announced that Maersk Magellan would be prohibited from entering the port of Tarragona, on the grounds that delivery could risk breaching EU legislation forbidding all imports of oil or petroleum – directly or indirectly – from Russia.
After weeks of legal wrangling, the vessel was eventually able to discharge the cargo in mid-April. It offloaded the fuel via another ship-to-ship transfer off the Greek coast, and was free to continue normal operations. Elephant, meanwhile, was detained for around a week at the port of Ferrol in Spain and fined €130,000.
The case is significant. It shows the need for vigilance, not just over the cargo itself – Spanish authorities have not publicly disclosed where the fuel originated – but also the vessel from which it is onboarded.
Parties are increasingly expected to look deeper into the details of a transaction. In the case of Maersk Magellan, an examination of Elephant’s historic activity would have revealed its ship-to-ship transfer with Nobel, showing it did not load fuel at a port.
The vessel has in fact been involved in Russian trade, having made multiple port calls in the country after the introduction of sanctions. Kpler data shows that after its release by Spanish authorities, the vessel went on to load 720,000 barrels of Urals crude oil from the Russian Baltic Sea port of Ust-Luga.
And further analysis of Nobel would have raised several more red flags. Historically, the tanker can be linked to trade in Venezuelan oil, having switched off its automatic identification system (AIS) in proximity to the country’s coastline – a practice known as going dark – says Byron McKinney, trade finance director at S&P Global Market Intelligence.
McKinney tells GTR that scrutiny of Nobel’s movements shows extended AIS outages in 2021, that the tanker rarely visits ports, and that it has more recently conducted numerous ship-to-ship operations in the Mediterranean Sea – often with vessels potentially carrying Russian-origin cargo. Its change in ownership last year was to a newly established company that owns no other tankers.
As it happens, Maersk Tankers – which owns Maersk Magellan – had been using screening technology and proceeded to onboard the fuel from Elephant after carrying out a sanctions check.
But after the denial of access to the Port of Tarragona, the company discovered a coding error in software provided by an independent compliance service provider, a spokesperson tells GTR.
“[This] meant that the flag information in the report was marked green and stated that no flag changes had taken place within the last three years,” they say. “This error has now been remedied. Maersk Tankers has also adjusted our procedure to ensure this does not happen again.”
The company, which is not accused of any wrongdoing, adds that it has had a strict policy on Russian business since February 2022 and “does not entertain any sanctioned business whatsoever”.
Oil on the high seas
The Maersk Magellan case may be an isolated incident, but is indicative of wider risks around potential circumvention of Russian sanctions.
Restrictions on Russian crude oil and petroleum exports have been comprehensive. Not only are EU companies themselves prohibited from buying Russian-origin fuel, but the EU, G7 and Australia prevent banks, insurers and shipping companies from facilitating trade in Russian crude in other markets unless the price is below US$60 per barrel.
One of Russia’s responses to the restrictions has been to amass an enormous fleet of vessels free of ties to those governments, ultimately in order to keep oil flowing. The International Maritime Organization (IMO) estimates that the country’s so-called shadow fleet includes as many as 600 tankers.
The scale of this operation is still not fully understood. A May report from S&P Global unearths nearly 900 maritime companies established in 2022 that have direct or indirect links to Russia, ensuring exports continue even “when more traditional and conventional fleet owners exited the Russian market”.
And evidence is mounting that ship-to-ship transfers have become an integral part of how those vessels operate. As the locations and frequency of transfers evolve, those trying to detect them are presented with a moving target.
Real-time cargo tracking company Vortexa warned in late January it had detected a recent spike in the number of offshore ship-to-ship transfers offshore near Ceuta, south of Gibraltar. It attributed the increase to transshipments of Russian Urals crude, ultimately destined for China and India.
Since then, however, the practice has shifted to “previously obscure locations”, according to a May 30 note by crude market analyst Armen Azizian. Though efforts to disguise cargo flows have dropped due to rising demand from countries that have not imposed sanctions, notably India and China, 44% of all ship-to-ship transfers of Russian Urals crude took place in the Atlantic in May, Vortexa’s Azizian writes.
He says the change has largely been driven by tighter restrictions from Spanish authorities coupled with tidal changes, but warns that a far higher proportion of vessels conducting such transfers in the Atlantic are known to have carried sanctioned crude in the past.
“This hints at tankers in the Atlantic Ocean to be of a higher risk profile than both offshore Ceuta and Kalamata,” says Azizian.
At the same time, the growing trend of various vessels making multiple transfers of the same cargo at sea without calling at a port – as seen in the Maersk Magellan incident – poses further challenges.
“Once upon a time, you would have someone take cargo onboard a vessel and move on. Now you have Russia often having a cargo of oil just float in the middle of the ocean for a couple of months,” says Ami Daniel, co-founder and chief executive of maritime analytics company Windward.
“Then, it is onboarded to a second vessel, then onto a third vessel, a fourth vessel, and so on until the final vessel,” he tells GTR. “We see this daisy chain of transfers and storage, and it’s a bit of a loophole because most owners or traders would just screen for the last entity.”
A rising tide
Ship-to-ship transfers have long attracted attention from sanctions authorities, notably in an influential advisory issued by the US Office of Foreign Assets Control (OFAC) in May 2020. For the first time, the regulator explicitly instructed financial institutions and traders to consider such operations – as well as AIS outages and complex ownership structures – as potential red flags for illicit trade.
The frequency of such warnings has only increased since the introduction of sanctions on Russia. OFAC said in April this year it believed US companies may be unwittingly facilitating trade in Russian oil above the US$60 price cap, saying tankers were likely making port calls in the country’s south-eastern port of Kozmino, switching off AIS signals and transferring the cargo to other vessels.
Just weeks earlier, the IMO’s Legal Committee published a note saying that ship-to-ship transfers in the open ocean, particularly tied to shadow fleet vessels, represent a “dangerous practice”.
The committee said information reviewed at a March summit in London suggested such operations “were high risk activities that undermined the international regime with respect to maritime safety, environmental protection and liability and compensation needed to be urgently addressed”.
The IMO’s involvement could see greater involvement of port authorities in scanning for suspicious vessel behaviour. It has already urged port authorities to ensure ship-to-ship transfers are conducted in keeping with IMO rules, and says if they become aware of tankers “going dark”, they should consider carrying out enhanced inspections.
That could lead to other vessels being turned away from ports if there is a history of transshipment associated with their cargo.
Greater attention is also being paid to the misuse of IMO identification when vessels are registered under a flag state. The Legal Committee has established a correspondence group to investigate how widespread the issue is, close loopholes in the system and define a new due diligence process.
Vessel ownership is emerging as another area of focus, after a shock report from S&P Global and the Institute of International Banking Law & Practice (IIBLP) found that 70% of ships whose ownership information is not listed by the IMO are likely to have potential ties to illicit activity.
“We don’t really see widespread understanding of this issue, and I think that’s partly because no one had ever pulled this data together before,” IIBLP chief executive Michael Byrne told GTR upon the report’s publication in April. He says the findings have since attracted significant interest from both the private and public sectors.
Illuminating the shadow fleet
Despite shifting patterns around ship-to-ship transfers, misuse of IMO numbers and opaque vessel ownership structures, detecting irregularities in AIS signals remains the bedrock of industry efforts to identify illicit activity.
Efforts to obscure the origins of cargo “still often rely on dark activity, where you don’t want to be seen carrying out that transfer or making that initial port call”, says S&P Global’s McKinney. “We’re also seeing more spoofing, where a vessel appears to be in one location but in reality is somewhere completely different. To pick that up, you do need relatively sophisticated technology.”
There is already a wide range of available technology that can analyse vessel movements and AIS outages, while drawing in information from other sources – such as vessel ownership information – to paint a picture of the risk posed by any individual transaction.
“You can’t expect a compliance team at a bank to be able to draw polygons around vessels or high-risk areas, then manually filter data out,” McKinney says. “But a lot of the data and technology available today can already get you very close to being able to spot most of that suspicious activity.”
Uptake of such solutions is increasing. Windward’s Daniel says that initially, many market participants were waiting to see how sanctions packages would be shaped and how the oil price cap would work in practice.
“Now, they know they need to do something,” he says. The introduction of sanctions on other Russian commodities, including US restrictions on gold miners and other metals companies as well as controls on agricultural exports, has “really expanded the applicability and the target market for us, way beyond oil traders”, he adds.
However, the extent to which banks, traders or other companies rely on technology varies. Windward’s customers establish their own risk settings, Daniel says, and though the emphasis is usually preventative rather than reactive, real-time vessel analysis is not widely used by trade finance lenders.
The IIBLP’s Byrne suggests that few banks are in a position to monitor ships’ activity on a continuous basis.
“Doing that is costly, it’s complicated and you still need a well-trained team to manage it,” he tells GTR. “I would say the majority of banks, especially outside the largest financial institutions, are catching most of this activity on a post-transaction review.
“From OFAC’s point of view, the immediate challenge is for banks to incorporate what they have learned from those post-transaction reviews into their next steps, rather than knowing everything that is happening with a particular vessel in real time.
For example, if a vessel has a history of risky behaviour but only once or twice a year – and the rest of the time is running normal trade routes – you would still be expected to pick that up.”
