For years a clandestine fleet of tankers has been quietly transporting sanctioned goods – predominantly crude oil – around the world, bypassing trade restrictions and sustaining the very economies sanctions aim to restrict.

While the term “shadow fleet” has become more common since the Russian invasion of Ukraine in 2022, other nations like Iran and North Korea have long used these ageing, flag-hopping tankers to maintain trade activities, with the proceeds funding sanctioned regimes and ongoing conflicts.

Major regulators like the United States’ Office of Foreign Assets Control (OFAC), the European Union (EU) and United Kingdom (UK) have increased their focus on vessels; these designations made up significant portions of sanctioning activity in 2025.¹

Sailors working on a sailing ship's mast, set against a cloudy sky in Antwerp, Belgium.

Diverging Approaches

To understand how different jurisdictions are applying restrictions and to what extent, LexisNexis^® Risk Solutions analyzed Russia-related sanctioned vessel data from three of the world’s largest regulators: OFAC, the EU and the UK. The results show significant fragmentation, suggesting diverging approaches.

Note: Analysis was carried out on vessel International Maritime Organization (IMO) numbers (rather than names) for accuracy. Data analyzed was to April 28, 2026.

Let’s start with what was somewhat consistent: each regulator stepped up the number of sanctioned vessels in the last year and a half. However, the extent of these increases varied significantly.

	Individual Vessels Sanctioned
Issuer	January 2026	April 2026	Change (%)	Change (n)
OFAC	264	448	+70%	+184
EU	79	632	+700%	+553
UK	110	594	+440%	+484

Fig. 1 Sanctioned Vessel Increase Jan 2025–April 2026

Overlaps

There is some overlap between the three regulators, but anyone expecting relative global consistency with regional nuance may be in for a shock:

The EU, UK and OFAC list a total of 1,674 vessels designated under Russia-related sanctions programs. Of these, only 170 (10.2%) are sanctioned by all three (see Fig. 2)
357 vessels are only listed by the EU and UK (30% overlap)
27 vessels are only listed by the UK and OFAC (2% overlap)
13 vessels are only listed by OFAC and the EU (just 1% overlap)

Fig. 2 The Overlap of Russia-Related Vessels Sanctions

2026 Developments

On 24 February 2026, the UK designated an additional 50 ships. Of these, 48 were already listed by the EU (none by OFAC). However, eight of these were designated under a different name by the UK, meaning the ships were renamed since their designation by the EU.

On April 23, the EU published its 20^th sanctions package relating to Russia. The EU’s 20^th package included the designation of 46 new shadow fleet vessels and the removal of 11 (including one duplicate entry). Of the 46 new vessels:

Six were already sanctioned by both the UK and OFAC
Eight were sanctioned by the UK but not by OFAC
Two were sanctioned by OFAC but not the UK
30 were unique to the EU – it remains to be seen whether the UK follows suit on these designations.

On June 16 the UK sanctioned an additional 27 vessels involved in shipping Russian liquified natural gas (LNG) and Russian oil.

Then on July 23 the EU published its 21^st sanctions package; this included 41 new vessels of which:

Three were are already on OFAC and UK lists
One was sanctioned by OFAC but not the UK
One was sanctioned by the UK but not OFAC
36 were unique to the EU

Of the three vessels found on all three lists:

One was listed under the same name: PORT OLYA-3
Two were listed under unique names across all three:

IMO 9259599: EU = AKKORD; OFAC = HAI II ; UK = LAURYN

IMO 9274446 : EU = ADMIRAL; OFAC = HS STAR; UK = SORION

Evasion Tactics

For teams responsible for sanctions screening, tracking and screening ships can be a major challenge. That’s because vessels don’t behave like companies or individuals; they move, they change identities, they operate globally.

Frustratingly for authorities and compliance teams, the evasion tactics these ships use are often relatively unsophisticated.

Renaming

One of the most common tricks is renaming; the same ship sets off with a different name, and regulators need to play catch up to update their records. Different regulators may have the same ships sanctioned (by IMO number), but under different names. For any organization relying solely on screening vessel names rather than IMO numbers, this creates significant risk.

Our analysis found significant evidence of Russian shadow fleet vessels being renamed following sanction designations.

35% (60) of the 170 vessels sanctioned by all three bodies were operating under a different name to those featured in the sanctions lists – indicating the vessel changed its name since it was last sanctioned.
Of these 60, 34 had previously changed their name at least once following earlier sanctioning activity.
Of the 170, only 92 had the same name across all three lists. Further analysis against these 92 IMO numbers revealed that two thirds were operating under a different name.

We also saw examples of new ship names bearing close resemblance to old names.

In one case, a ship called NS Champion, sanctioned by OFAC in 2023, was renamed KOTLAS in June 2024, then sanctioned by the EU in Feb 2025, then renamed OTLA in April 2025, then sanctioned by the UK in May 2025.

We found several similar examples of renaming techniques:

TRIUMPH changed to TRIUM
DIAMOND to ALMOND
ANTARCTIC to ANTARKTIKA
NOVA ENERGY to NEW ENERGY
LEONID LOZA to LEO
AKADEMIC to AKADEMIK
ARSENYEV to ASENYEV

Many vessels have generic names like "Maria" or "Premier"; very hit-intensive names for screening teams. This creates ambiguity, forcing banks and other organizations to establish a complex set of rules and configuration to avoid being swamped by false positive alerts and missing true hits.

Reflagging

Reflagging (or “flag hopping”) sees ships changing their flag to hide their true origin, often using “flags of convenience” to evade sanctions. Flags of convenience come from countries that may be less inclined or less able to enforce Western sanctions.² According to the European Parliament, “The top countries whose flags are used by shadow tankers transporting Russian crude oil include Cook Islands, Eswatini, Gabon, Liberia, Malta, Marshall Islands, Panama, and Russia itself.”³

Frequent reflagging can put pressure on enforcement agencies to re-establish a ship’s true identity, complicating and delaying the process.

AIS Manipulation

More calculated evasion efforts come with Automatic Identification System (AIS) manipulation; this technique is used to mask a ship’s location, often to facilitate ship-to-ship transfers. In these cases, a sanctioned vessel offloads its cargo to a legitimate vessel in a remote location, while either hiding or faking their location details. With the origin of the goods masked, the receiving (and non-sanctioned) vessel can dock at their destination as normal and offload the seemingly legitimate goods into the supply chain.

In the past, AIS manipulation was typically limited to a transponder being turned off when a ship was somewhere it shouldn’t be (“going dark”) and turned back on when it’s back on the planned route. While this technique is still in play, today’s AIS manipulation is more refined, and includes broadcasting false location information⁴ to evade detection. This broadcasting may be carried out by the vessel itself, a second-party vessel (creating “ghost ships”), or in extreme cases, by hackers or nations to either ease or disrupt trade flows.⁵

“There are some clear takeaways behind these inconsistencies in vessel names. First, they demonstrate the relative ease with which owners register vessels under new names in an effort to obfuscate their sanctioned status. This in turn illustrates the jurisdictional limits of sanctions. Certain states and flag registries are not currently implementing sanctions on Russia or adhering to measures imposed by the EU, UK or OFAC.”
Vincent Gaudel, Global Regulatory Expert, LexisNexis® Risk Solutions

The Real-World Impact

A single sanctions violation potentially exposes businesses to costly penalties and reputational damage, while systematic failures may cause strategic risks ranging from correspondent banking restrictions to full asset freezes and criminal prosecutions.

In 2026 an India-listed company agreed to pay a $275m USD penalty issued by OFAC for purchasing fuel that turned out to be of Iranian origin.⁶

Beyond the risk to organizations, the shadow fleet has a detrimental effect on the environment and society. These vessels are often more than 20 years old⁷, well beyond the typical commercial lifecycle, yet continue to transport high-risk cargo. Age and corrosion, combined with poor maintenance, unsafe practices like ship‑to‑ship transfers, and a lack of insurance, significantly increase the risk of oil spills and accidents. If incidents occur, liability is often unclear, leaving coastal states and communities to bear the cost.⁸ At the same time, these networks enable sanctioned regimes to continue generating revenue, undermining global enforcement efforts and contributing to ongoing geopolitical instability.⁹

The scale of problem posed by the shadow fleet is too big to ignore, and requires a coordinated effort from law enforcement, governments, the public and private sector to shut these vessels and operators out of the financial ecosystem.

What's in a Number?

Why IMO numbers trump names in vessel screening

While shadow fleet operators can change names and flags to evade detection, there is one identifier they cannot change: the IMO number.

Assigned at a vessel’s creation, the IMO number remains constant throughout a ship’s lifecycle, regardless of how often it is renamed, reflagged or transferred between owners.

In practice, this makes IMO screening the most reliable way to:

Track vessels across jurisdictions, even if regulators list them under different names
Link sanctioned activity over time, despite identity changes
Reduce false positive alerts, particularly where generic vessel names are used.

For compliance teams, screening vessel names is no longer sufficient in an environment where these are deliberately manipulated to create ambiguity.

Using IMO numbers as the primary screening key allows organizations to move from reactive identification to consistent, defensible risk detection.

In a fragmented sanctions landscape, where the same vessel may appear differently across lists, IMO-based screening helps organizations to identify exposure with greater accuracy.

Trade documents may not include IMO numbers by default, so demanding this is included before moving ahead with a trade is key.

Conclusion

The shadow fleet offers a clear example of how even simple evasion tactics allow bad actors to take advantage of regulatory gaps. As the sanctions landscape grows increasingly fragmented, traditional screening methods can no longer keep up with the reality of global trade. Vessels change names, identities, flags and routes with ease, leaving enforcement agencies to play catch up.

How can you detect a moving target if you’re looking at the wrong identifiers? There needs to be a shift towards consolidated, multi‑jurisdictional vessel intelligence: screening against IMO numbers, looking into ownership and control signals, and continuous monitoring to detect material change. That’s where tools from LexisNexis^® Risk Solutions can help support teams in spotting evasion patterns earlier and aid in aligning sanction screening to how trade operates.

Vessel risk isn’t static. Your compliance framework shouldn’t be either.

A cargo ship sails on a vast ocean under a clear sky, showcasing maritime transport.

[1] LexisNexis Risk Solutions. Sanctions Pulse Full-Year 2025. LexisNexis Risk Solutions, 2025.
Taking the Pulse of Major Sanctions.

[2, 3] Caprile, Anna; Leclerc, Gabija. Russia’s ‘shadow fleet’: Bringing the threat to light. European Parliamentary Research Service (EPRS), Publications Office of the European Union, Brussels/Luxembourg, November 2024.
European Parliament briefing on Russia’s shadow fleet

[4] Lloyd’s List Intelligence. The secret lives of the shadow fleet: AIS spoofing & vessel identity manipulation. Lloyd’s List Intelligence (blog), United Kingdom. Lloyd’s List Intelligence blog on shadow fleet AIS spoofing

[5] Barakat, Manal. AIS Spoofing surges in Baltic and Barents Seas. Kuehne+Nagel (myKN News), Global Sea Logistics, 31 March 2025. AIS spoofing surges in Baltic and Barents Sea

[6] Basquill, John. Adani to pay US$275mn sanctions penalty after Iranian oil trades. Global Trade Review (GTR), London, 19 May 2026. Adani sanctions penalty article

[7] Domballe, Jeremy; McKinney, Byron; Nastali, Ines; Lin, Max; Koldova, Anna. Maritime shadow fleet – Formation, operation and continuing risk for sanctions compliance teams in 2025. S&P Global Market Intelligence, 26 May 2025.
S&P Global shadow fleet analysis

[8, 9] MaritimeHub Editor. The Shadow Fleet: How Sanctioned Oil Moves Across the Seas. Maritime Hub, 18 November 2025.
The Shadow Fleet: How Sanctioned Oil Moves Across the Seas

This document is for educational purposes only and does not guarantee the functionality or features of any LexisNexis Risk Solutions services identified.
LexisNexis^® Risk Solutions does not warrant that this document is complete or error-free. LexisNexis and the Knowledge Burst logo are registered trademarks of RELX Inc.

Change, Divergence
& Evasion

Navigating Shadow Fleets