skip to main content
skip to main content
Global Search Configuration

From suspicious to high-risk: the emergence of new vessel behavioural patterns

More Data Storytelling

The movement of illicit cargo across water is increasingly difficult to pinpoint. Tactics used by owners and operators to conceal the transport and exchange of materials that are sanctioned are evolving and becoming increasingly sophisticated. 

These new methods are explored in detail by two of our experts, Richard Meade and Michelle Wiese Bockmann, in their paper The Sanctions-Skirting Secrets of Shipping, which focuses on the illicit transport of oil from sanctioned countries. 

“Sanctioned oil and products are mostly shipped via a hub-and-spoke logistics system based around ship-to-ship transfers. Tankers shuttle to and from these hubs and do not need to call at ports. The cargo can be transferred to four or five different vessels during a voyage from Iran or Venezuela to its final destination, usually China or Syria.” Our experts go on to describe how the current subterfuge fleet developed from a template that originated in 2019, and how it continues to evolve at pace. The risk is always increasing.

What lies beneath

OFAC and other official sanctions lists create a firm red line for the highest risk vessels, flag states, owners, and operators. Our data and analytics show that over the last two years there have been over 6500 vessels engaging in suspicious and probable high-risk behaviour that are not part of an official sanctions list. This creates an increasingly difficult challenge for compliance risk professionals.

This activity includes:

vessel gap illustration


  • Suspicious AIS gaps: AIS gaps in high-risk areas that cannot be explained by factors such as weather conditions or reported malfunctions


AIS movement gap illustration


  • Loitering: patterns of waiting and directionless looping movements that cannot be explained in terms of normal operations or mechanical problems

  • Probable dark STS and dark port callings: based on the proximity of compatible ports and vessels with a noted change in draught, when a vessel that has ‘gone dark’ could have carried out these activities


These vessels need to be identified and rated for risk as soon as possible. If separate incidences begin to form a behavioural pattern, this could indicate that the risk is not by chance and the vessel is deliberately taking on illicit cargo and transporting it, and also attempting to cover up evidence.

Using maritime intelligence to shed light

Our analysts have used a clever flow of logic to create several layers of risk-related incidents, from simple AIS gaps in high-risk locations to more complex scenarios such as mirrored draught changes between compatible vessels stopping in the same vicinity when one or both were without AIS signals. When only a single isolated risk-related incident occurs, and there is no further evidence of greater risk, the logical context is that the risk is not particularly noteworthy – unless of course the behaviour changes and risk begins to add up over a reasonable timeframe. But when several risk-related incidents occur in sequence, accordingly the risk becomes higher and is perceived as a ‘voyage risk’, which becomes worthy of attention and further investigation. 

This kind of complex logic has been built into the AI modelling for Seasearcher Advanced Risk & Compliance. Details around incidents of medium to high risk are noted and aggregated so that the fuller context around the behaviour of the vessel can be quickly understood. 

This is key to empowering compliance risk professionals with the complete, accurate and reliable insight they need to answer questions such as: “How many of those 6500 vessels that have recently engaged insuspicious or high-risk behaviour include voyage risks that could be dark ship-to-ship transfers or dark port callings? How many of them are behaving in increasingly risky behaviour?” or “How many times has a certain vessel engaged in loitering with periodic AIS gaps in high-risk areas that can’t be explained in terms of normal operations?”

Armed with the answers to these questions, our customers can escalate cases, make recommendations, and make decisions that could tip the balance of safety to their favour.