Sanctions, Seizures, and the Limits of Maritime Visibility

The enforcement problem has changed. Detection is no longer the constraint. Attribution is.

In December 2025, a combined U.S. Coast Guard and Marine special operations team launched from the USS Gerald R. Ford to board the VLCC M/T Skipper off the coast of Venezuela, seizing 1.85 million barrels of crude. Ten days later, the M/T Centuries was taken in similar fashion, carrying another 1.8 million barrels. A third vessel, the Bella 1, fled across the North Atlantic before being seized with UK military assistance in early January 2026.

These were not routine port state inspections. They were kinetic operations backed by carrier strike groups and foreign military coordination. And they required something far more demanding than a satellite ping or an AIS alert. They required evidence.

This is the new reality of maritime sanctions enforcement: governments are willing to use military force, but only when the intelligence package meets an evidentiary threshold. The question facing the industry is no longer whether sanctioned vessels can be found. It is whether what you find can be proven. 

1. Sanctions enforcement has entered a new phase

The scale of designations in 2025 was staggering. In a single action on January 10, 2025, the Office of Foreign Assets Control (OFAC) designated approximately 183 vessels, including 158 oil tankers connected to Russian energy exports. The EU grew its vessel sanctions list to nearly 600 through five successive packages throughout the year. The UK sanctioned over 200 vessels across multiple rounds. By year end, combined Western designations exceeded 1,400 vessels.

These are not symbolic gestures. EU Sanctions Envoy David O’Sullivan stated that sanctioned vessels experience approximately a 73% decline in their ability to carry Russian oil following designation. Russia’s oil and gas budget revenues fell 24% year over year to 8.48 trillion rubles in 2025, with its federal deficit hitting the largest level since 1996. The IEA tracked Urals crude falling to $43.52 per barrel by November, its lowest since the invasion of Ukraine.

But designations and seizures operate on fundamentally different evidentiary planes. Adding a vessel to a sanctions list requires a “reasonable cause to believe” standard at OFAC. Seizing that vessel in international waters, or prosecuting its operators in federal court, requires something far more robust. The DOJ must demonstrate willful intent to evade sanctions, supported by a documented pattern of deceptive behavior that can survive judicial scrutiny. When Attorney General Bondi announced criminal charges would be pursued against the crew of the BELLA 1 (IMO 9230880), she was not referencing a single AIS anomaly. She was referencing an investigative package built over months of behavioral documentation.

This gap between “flagged” and “actionable” is where the real enforcement challenge lives.

2. The problem is no longer finding vessels

There is more maritime surveillance data available today than at any point in history. Satellite constellations ingest tens of millions of square kilometers of imagery daily across optical and radar sensors. AIS data streams from hundreds of thousands of transponders in real time. RF detection networks monitor electronic emissions. Synthetic aperture radar can identify vessels through cloud cover and darkness.

The scale of available data makes the point concretely: across a single platform, SynMax’s Theia, more than 35 million vessel detections were recorded over a two-year period, with over 45 million satellite images ingested per day from commercial optical and Sentinel radar sources. The raw detection count is enormous. But detection is only the beginning of the analytical chain, not the end of it.

Consider what a detection actually tells you. A satellite captures an image of a vessel at a specific location at a specific time. That is a data point. To make that data point meaningful for sanctions enforcement, an analyst must answer a cascade of questions. What vessel is that? Is the AIS track consistent with the imagery? Has the vessel changed its identity, its flag, or its broadcast signal? Is it where its paperwork says it should be? Is it doing what its documentation claims?

The challenge is that the vessels most relevant to sanctions enforcement are precisely the ones whose operators work hardest to frustrate these questions.

AIS manipulation is now standard operating procedure. OFAC’s April 2025 advisory on Iranian oil sanctions evasion explicitly identified AIS gaps, location manipulation, and falsified voyage data as baseline evasion tactics. The advisory expanded compliance responsibility to insurers, financial institutions, and port operators, requiring “Know Your Vessel” due diligence precisely because transponder data alone is no longer sufficient.

Flag switching has accelerated to a pace that overwhelms traditional registry checks. The Centre for Research on Energy and Clean Air (CREA) documented 113 shadow fleet vessels using false flags over a nine-month period in 2025, transporting 11 million tonnes of oil valued at €4.7 billion. The growth was rapid, from approximately 15 vessels operating under false flags in December 2024 to around 90 by September 2025.

The pattern accelerated when legitimate registries tightened access. After Panama closed its registry to tankers older than 15 years in August 2025, shadow fleet operators simply migrated to less scrutinized flags. Gambia’s registry rapidly became a destination for shadow fleet operators, to the point where the Gambia Maritime Administration deregistered 72 vessels for fraudulent certificates and imposed a moratorium on new registrations until December 2025.

The absurdity reached its logical endpoint when Malawi wrote to the IMO after discovering 24 sanctioned vessels claiming its flag, despite the country having no legitimate ship registry.

Ship to ship (STS) transfers remain the primary mechanism for obscuring cargo origin. These operations take place at sea, beyond port state jurisdiction, often involving multiple intermediate transfers before oil reaches its final destination. In 2025 alone, optical satellite imagery has recorded over 84,000 STS events globally, and AIS data has logged over 319,000. It is the fusing of multiple datasets, including AIS and electro-optical imagery, that allows for the detection and evidential proof of illicit transfers required to hold bad actors to account. Daily analysis of satellite imagery at scale enables the detection and identification of offenders, even without prior knowledge.

MMSI sharing and identity manipulation create phantom vessels. During 2025, over 14,000 cases of MMSI sharing have been tracked, where multiple vessels broadcast the same identification number, making it functionally impossible to determine which physical ship corresponds to which electronic identity at any given time.

The data exists. What does not exist, at least not automatically, is the interpretation.

The CCH GAS case demonstrates what happens when raw detection meets apparent deception across multiple layers simultaneously.

In October 2025, Theia detected the CCH GAS (IMO 9307205), a 283-meter LNG tanker built in 2006, conducting a ship-to-ship transfer with the PERLE (IMO 9630028) off the coast of Malaysia. PERLE is sanctioned by OFAC for its association with PJSC Sovcomflot and was recorded loading cargo at the Portovaya terminal in Russia in February 2025. Throughout the transfer, which took place between October 18 and 23, the CCH GAS broadcast an AIS position inconsistent with its observed location, placing itself elsewhere in Malaysian waters. Satellite imagery confirmed it was alongside PERLE. Based on SynMax’s analysis of satellite imagery and vessel tracking data, the available evidence is consistent with the CCH GAS having received a cargo of sanctioned Russian LNG.

An AI-based system would have seen two things: a vessel broadcasting a position in Malaysian waters, and a satellite detection of two vessels in proximity elsewhere. The AIS track and the imagery told conflicting stories. By cross-referencing satellite detections with PERLE’s known movements and the timing of its departure from Russian loading facilities, the available evidence is consistent with CCH GAS having received sanctioned cargo while actively concealing the transfer.

On November 7, Theia detected the CCH GAS departing the South China Sea, confirming movement despite the vessel continuing to broadcast AIS location signals inconsistent with its observed position. Between November 16 and December 21, the platform routinely detected the vessel anchored south of Hong Kong, even as its AIS placed it hundreds of kilometers away. Each detection reinforced the same conclusion: the transponder data was inconsistent with observed vessel position, and the imagery was the ground truth.

The CCH GAS did not simply go dark. It stayed visible electronically while being somewhere else. That combination of spoofing and continued AIS transmission makes detection harder, not easier, because the vessel appears to be operating normally to anyone relying solely on transponder data.

3. Attribution is the real bottleneck

The word “attribution” carries a specific meaning in this context. It is not simply identifying a vessel. It is establishing, with sufficient confidence, that a specific ship engaged in a specific behavior at a specific time, in a manner that may constitute a sanctions violation rather than a coincidence or a legitimate commercial activity.

This distinction matters because enforcement agencies operate under legal standards, not algorithmic ones. OFAC applies strict liability for sanctions violations, meaning intent is irrelevant for civil penalties. But even under strict liability, you must establish that a prohibited transaction actually occurred. The DOJ’s criminal enforcement requires willful intent. The EU General Court has annulled individual sanctions designations in 2025 when the Council failed to provide sufficient evidentiary support, notably in Ezubov v Council and Pumpyanskiy v Council. Every designation that gets overturned on appeal weakens the credibility of the enforcement regime.

Single incidents are almost never sufficient. A vessel going dark for 48 hours near a known STS zone could be evading detection. Or it could be experiencing equipment failure. Or it could be transiting a region with poor satellite coverage. A single AIS gap, taken in isolation, does not meet any meaningful evidentiary standard.

What changes the confidence level is pattern. When the same vessel goes dark repeatedly in the same geographic areas, when those dark periods correlate with arrival at ports known for sanctioned commodity loading, when the vessel’s draft changes between the start and end of a dark period (indicating cargo operations), when its flag registration changes within weeks of a sanctions designation, and when its beneficial ownership traces through a chain of shell companies registered in jurisdictions with minimal disclosure requirements, the cumulative behavioral profile shifts from “suspicious” to “compelling.”

Building that profile requires longitudinal analysis across months, sometimes years, of behavioral data. It requires correlating multiple independent data sources: satellite imagery confirming physical location, AIS data showing (or not showing) transponder activity, RF signals identifying electronic emissions, port records documenting arrivals and departures, corporate registries mapping ownership chains, insurance records tracking coverage changes, and flag state databases logging registration history. The analytical work lies in connecting them.

Theia has recorded more than 35 million vessel detections. Approximately 11.3 million have been attributed to specific vessels. The remaining two-thirds reflect the scale of the attribution challenge itself: vessels that were detected by satellite but whose identities could not be confirmed through automated means alone. Theia’s analytical tools, including Similar Ship Search and its extensive archive of historical imagery, enable analysts to systematically narrow that gap, matching unattributed detections against known vessel profiles through a process that combines platform capability with human judgment. In a commercial context, an unattributed detection is an open question. In an enforcement context, it is the line between a flag and a finding.

The TASCA case illustrates what continuity of tracking looks like in practice. The Panama-flagged VLCC TASCA (IMO 9313149) was sanctioned by the U.S. Treasury in December 2024 for transporting Iranian oil. Shortly after designation, AIS was no longer received from the vessel, and it began repainting its deck from red to green in the South China Sea, attempting to alter its visual signature. An AIS-dependent system would flag the gap, but once the transponder goes silent and the vessel’s appearance changes, the trail goes cold unless an analyst is actively maintaining visual continuity.

Theia continued tracking the 330-meter tanker throughout the dark period, with near-daily satellite imagery. Despite the color change, structural identifiers, deckhouses, derrick points, and pipeline configurations remained constant. The TASCA did not change its flag, its name, or its MMSI. It changed something more fundamental: its visual appearance. And it still was not enough to break attribution. The case demonstrates why longitudinal tracking through imagery matters, and why single-point alerts cannot substitute for sustained analytical attention across time.

AIS spoofing presents a different kind of deception. While the TASCA attempted to change how it looked, the REEF attempted to change where it appeared to be.

The Guinea-flagged chemical tanker REEF (IMO 9263382), sanctioned by the U.S. in 2024, was tracked by Theia as it completed a delivery cycle between Iran and Myanmar. At the beginning and end of each voyage, the vessel broadcast an AIS path that appeared to link Iraq and Bangladesh, hundreds of kilometers from its actual location. On paper, the REEF’s transponder data described a routine commercial voyage. Based on satellite imagery collected by Theia, the vessel was observed at the Port of Shahid Rajaee in Bandar Abbas, Iran, and subsequently observed in Yangon, Myanmar.  The vessel’s observed loading and discharge pattern is consistent with fuel supply operations to Myanmar. According to publicly available reporting, the Myanmar military has conducted more than 1,000 airstrikes on civilian targets since October 2024.

The discrepancy was identified through the fusion of satellite imagery and AIS. Theia imaged the REEF alongside in Bandar Abbas on January 20 and 21, 2026, while its AIS track placed the vessel elsewhere entirely. On February 10, the platform imaged the vessel in Yangon, enabling a tip and cue of Satellogic high-resolution imagery. Two days later, the REEF was captured departing the port. The AIS track was unreliable; the imagery provided the ground truth.

A single positional discrepancy could reflect a technical fault. But when a vessel’s AIS consistently diverges from its observed location at the start and end of every voyage, when those divergences align with sanctioned port calls, and when the pattern repeats across multiple delivery cycles, the conclusion shifts from anomaly to intent. That distinction, between malfunction and deliberate deception, is what separates a data point from an evidentiary finding.

4. Implications for commercial and government stakeholders

For operators and insurers, the compliance landscape has fundamentally shifted. OFAC’s April 2025 advisory did not merely recommend enhanced due diligence. It expanded the definition of who is responsible for detecting sanctions evasion to include the entire maritime services chain. Insurers, financial institutions, port operators, and classification societies are now expected to perform behavioral screening, not just list matching.

The International Group of P&I Clubs, which insures roughly 90% of global merchant tonnage, told the UK Parliament that the oil price cap “appears increasingly unenforceable” and that approximately 800 tankers had left International Group clubs as a direct result. The IG stated plainly that it is “impossible for an insurance company to determine whether traders are adhering to the G7 price cap” and that clubs “should not be expected to be an extended arm of enforcement.”

Yet enforcement agencies are proceeding as if the maritime industry should, in fact, function as an enforcement layer. The Office of Financial Sanctions Implementation (OFSI) penalty against Svarog Shipping in April 2025, its first ever for an information offence, signals that even failing to respond to an investigation carries financial consequences. The Maritime Mutual case in New Zealand, where police raided offices after the insurer was found to have covered at least 130 sanctioned cargo tankers handling $18.2 billion of Iranian and $16.7 billion of Russian energy products, demonstrates that insurance providers face criminal exposure, not just regulatory risk.

The ANDROMEDA STAR (IMO 9402471) collision in the Danish Straits exposed the fraudulent insurance problem in operational terms. After the vessel collided with a freighter, it presented insurance documentation from Gard AS, the world’s largest P&I provider. Gard confirmed it was not the insurer and did not cover the vessel. A secondary certificate from Russian state backed Ingosstrakh was also presented. The broader investigation found that Romarine AS, a Norwegian firm that claimed to insure at least 30 sanctioned tankers, was not even registered with Norway’s Financial Supervisory Authority and had used forged regulatory documents.

For the compliance officer at a mid tier P&I club or a commodities trading desk, the practical question is stark: how do you verify that a vessel is what it claims to be, doing what it says it is doing, and insured by who it says insures it? List screening catches designated vessels. It does not catch vessels that have changed their names, flags, MMSI numbers, and beneficial ownership since the last designation round. That requires a fundamentally different analytical approach.

For energy market participants, the uncertainty is priced into every barrel. Sanctioned flows that evade enforcement depress prices for compliant producers and create phantom supply that distorts market models. Russia’s shadow fleet carried an estimated 70% of its maritime crude exports in the first three quarters of 2025, according to CREA, with sanctioned vessels alone handling 44% and unsanctioned shadow tankers accounting for a further 26%. A significant share of global crude supply now moves through a parallel logistics system that operates outside normal commercial visibility.

For governments, enforcement credibility is now directly tied to analytical capability. The 14 nation declaration in January 2026, which classified non-compliant shadow fleet vessels as stateless and subject to seizure, sets a powerful precedent. But exercising that authority requires being able to demonstrate, in a legal or diplomatic forum, that a specific vessel lacks valid registration, insurance, or safety certification. That demonstration depends on accurate, current intelligence drawn across multiple sources.

5. Toward evidence led sanctions intelligence

The gap between detection and attribution is not a technology problem that can be solved by adding more satellites or faster data feeds. It is an analytical problem that requires trained human judgment applied systematically to multi-source data over time.

What distinguishes an intelligence product from a data product in this context is the analytical layer. A detection tells you something is there. An attribution tells you what it is. An intelligence assessment tells you what it means.

The environmental, financial, and security stakes all converge on the same analytical requirement: the ability to identify a vessel, establish what it is doing, determine who controls it, verify its insurance and certification status, and track its behavior over time with sufficient confidence to support enforcement, compliance, or risk management decisions.

This is what evidence-led intelligence looks like in practice. Automated detection and AI-driven analysis provide the scale and speed that no human team could match alone. But the final product, the behavioral profile that supports legal and commercial decision-making, requires analysts working across satellite imagery, AIS feeds, and RF data, connecting what the platform surfaces to the broader intelligence picture. Pre-sorted, extensive archives that document years of vessel behaviour are instrumental in forming this assessment.

The CCH GAS story did not end south of Hong Kong. On December 24, the vessel ceased all AIS transmissions. Two days later, on December 26, it re-emerged under an entirely new identity: the LNG SOARS, operating under the Barbados flag with a new MMSI. On December 29, Theia detected the vessel from satellite imagery, approximately 100 kilometers east of its previous location, now spoofing under the LNG SOARS identity.

This is where the full complexity of the attribution problem converges. A vessel that had already been tracked through a sanctioned STS transfer and weeks of location spoofing had now changed its name, its flag, and its electronic identity simultaneously. For any system relying on list matching or AIS-based tracking, the CCH GAS had effectively ceased to exist. The LNG SOARS was, on paper, a different vessel.

But the physical ship had not changed. Theia’s archival imagery provided the connective tissue. The platform had recorded the CCH GAS at anchor south of Hong Kong across dozens of satellite passes over a period of more than a month. When the LNG SOARS appeared nearby days later, the structural profile, a 283-meter LNG tanker with a distinctive deck configuration, matched the archival record exactly. The digital identity had changed. The vessel had not.

The CCH GAS, now LNG SOARS, represents the full spectrum of evasion tactics in a single vessel: AIS spoofing, going dark, identity changes, flag switching, and sanctioned cargo transfers. Each tactic individually might generate an alert. Taken together, understood in sequence, they constitute something more: a documented pattern consistent with deliberate sanctions evasion, built not from a single detection but from months of sustained analytical attention.

That is the gap between detection and evidence. The data was always there. Thirty-five million detections and counting. The question was whether the analytical capability existed to connect them. Theia’s sustained analytical capabilities demonstrated their value across this case.

The EU’s proposed 20th sanctions package, which would eliminate the price cap exemption entirely and ban all EU maritime services for Russian crude oil transport, represents the regulatory trajectory. The enforcement architecture is shifting from economic incentives to outright prohibition. But prohibition without the intelligence to enforce it is just words on paper. And intelligence, in this domain, means attribution.

The data is there. Thirty-five million detections and counting. The tools to narrow the gap, including automated spoofing detection, Similar Ship Search, sanctioned vessel tracking, and agentic systems that chain these capabilities together, are operational within Theia. The platform demonstrates that the analytical capability required to track these events exists and continues to advance as evasive tactics evolve.

That is the work.

---

Article written by Charles Cormack & Vivek Patil, SynMax, Inc.

This article reflects SynMax’s independent analysis and assessment based on proprietary and publicly available data sources. It is provided for informational purposes only and does not constitute legal, compliance, or investment advice. The analytical conclusions expressed herein represent SynMax’s professional assessment and should not be construed as statements of established legal fact. Vessel behaviors and regulatory designations described herein are based on data available at the time of analysis and may be subject to change. Data and statistics referenced in this article are derived from publicly available sources, government publications, and SynMax’s proprietary Theia platform. SynMax has made commercially reasonable efforts to ensure accuracy but does not warrant the completeness or accuracy of third-party data cited herein.

Editorial Standards · Corrections · About gCaptain