The enforcement landscape has shifted. Detection is no longer the challenge; proving involvement is.
In December 2025, a joint team from the U.S. Coast Guard and Marine special operations boarded the VLCC M/T Skipper near Venezuela and seized 1.85 million barrels of crude oil. Just ten days later, they took the M/T Centuries, which carried an additional 1.8 million barrels. A third vessel, the Bella 1, managed to escape across the North Atlantic but was intercepted with British military help in early January 2026.
These operations were not standard port inspections. Instead, they were military actions supported by carrier strike groups and international military collaboration. More importantly, they required solid evidence, not just a satellite ping or an AIS alert. Proof was essential.
This represents a new reality for enforcing maritime sanctions: governments are ready to use military force, but only when supported by adequate evidence. The key question for the industry now is not whether sanctioned ships can be found, but whether the findings can be substantiated.
The number of sanctions imposed in 2025 was unprecedented. On January 10, 2025, the Office of Foreign Assets Control (OFAC) sanctioned around 183 vessels, including 158 oil tankers linked to Russian energy. By the end of the year, the EU's sanctions list had nearly 600 vessels, while the UK sanctioned over 200 ships in several rounds, leading to a total of more than 1,400 sanctioned vessels across the West.
These actions are not mere symbols. According to the EU Sanctions Envoy David O’Sullivan, sanctioned vessels see a 73% drop in their capacity to transport Russian oil post-designation. Russia's oil and gas revenues plummeted by 24% year-on-year in 2025, resulting in a federal deficit that was the highest since 1996. By November, the price of Urals crude fell to $43.52 per barrel, the lowest since the Ukraine invasion.
However, designating a vessel and seizing it require different levels of proof. Adding a ship to a sanctions list needs a "reasonable cause to believe" standard at OFAC. To seize it in international waters or prosecute its operators, the Department of Justice (DOJ) must show intent to evade sanctions, backed by a documented history of deceptive actions. When Attorney General Bondi announced criminal charges against the crew of the BELLA 1, she referred to an extensive investigation, not just a minor AIS discrepancy.
This gap between being flagged as sanctioned and being actionable represents the true challenge in enforcement.
There is more maritime surveillance data available today than ever before. Satellite networks gather millions of square kilometers of images every day via optical and radar sensors. AIS data flows from hundreds of thousands of transponders in real time, and RF detection networks monitor electronic signals. Synthetic aperture radar can identify vessels regardless of weather or darkness.
The amount of data is staggering: on just one platform, SynMax’s Theia recorded over 35 million vessel detections in two years and ingested more than 45 million satellite images daily from various sources. While detection numbers are impressive, detection is merely a starting point, not the end goal.
When a satellite captures an image of a vessel, it provides a data point. To make this information useful for sanctions enforcement, an analyst must answer several questions: What vessel is this? Does the AIS track match the imagery? Has the vessel altered its identity, its flag, or its signal? Is it where it claims to be? Is it operating according to its documentation?
The challenge lies in the fact that those vessels most relevant to sanctions enforcement are usually the ones whose operators actively try to evade detection.
Manipulating AIS data has become a common tactic. As per OFAC’s April 2025 advisory on Iranian oil sanctions evasion, operators frequently employ AIS gaps, location manipulation, and falsified voyage data. The advisory expanded compliance responsibilities to insurers, financial institutions, and port operators, mandating “Know Your Vessel” due diligence because transponder data alone is no longer adequate.
Flag-switching has accelerated, overwhelming traditional registry checks. The Centre for Research on Energy and Clean Air (CREA) documented 113 vessels using false flags within nine months in 2025, carrying 11 million tonnes of oil valued at €4.7 billion. This rapid rise occurred from about 15 flagged vessels in December 2024 to nearly 90 by September 2025.
The trend intensified when legitimate registries tightened their regulations. After Panama banned older tankers from registering in August 2025, operators turned to less scrutinized flags, with Gambia becoming a popular destination for shadow fleet operators. Gambia’s maritime authority even deregistered 72 vessels due to fraudulent documents and imposed a registration moratorium until December 2025.
The absurdity reached its peak when Malawi contacted the IMO after discovering 24 sanctioned vessels falsely claiming its flag, even though Malawi lacks a legitimate ship registry.
Ship-to-ship (STS) transfers are the primary method used to obscure the origins of cargo. These activities happen at sea, outside of port state jurisdiction, usually involving multiple transfers before the oil reaches its destination. In 2025, satellite imagery detected over 84,000 STS events globally, with AIS data recording over 319,000 such events. Combining multiple datasets, like AIS and optical imagery, allows for the detection and gathering of evidence required to hold wrongdoers accountable. Regular analysis of satellite imagery enables the identification of offenders, even without existing knowledge.
MMSI sharing and identity manipulation are creating phantom vessels. In 2025, over 14,000 cases of MMSI sharing were noted, where different vessels transmitted the same identification number, making it extremely challenging to determine which ship corresponds to which electronic identity at any moment.
The data is available. What is lacking is the necessary interpretation.
The case of CCH GAS illustrates the complications when raw detections confront apparent deception occurring on multiple levels.
In October 2025, Theia detected CCH GAS (IMO 9307205), a 283-meter LNG tanker built in 2006, conducting a ship-to-ship transfer with PERLE (IMO 9630028) off the coast of Malaysia. PERLE is sanctioned by OFAC due to its ties with PJSC Sovcomflot and was recorded loading at the Portovaya terminal in Russia in February 2025. During the transfer from October 18 to 23, CCH GAS was sending out an AIS signal inconsistent with its actual location, suggesting it was in a different part of Malaysian waters. Meanwhile, satellite images confirmed its proximity to PERLE. SynMax's analysis supported that CCH GAS likely received a shipment of sanctioned Russian LNG.
An AI system would identify two things: one vessel showing an AIS position in Malaysian waters and a satellite detection of two vessels elsewhere. The AIS data and imagery told conflicting stories. By cross-referencing satellite detections with PERLE's movements and timing from Russian loading sites, evidence indicated that CCH GAS was involved in concealing a sanctioned cargo transfer.
On November 7, Theia detected CCH GAS leaving the South China Sea, confirming its movement despite continuing to broadcast an inconsistent AIS location. Over the following month, the platform detected the vessel anchored south of Hong Kong even as its AIS signal placed it hundreds of kilometers away. Each detection reinforced the conclusion: the transponder data was inconsistent with the actual position, and satellite imagery provided the reality check.
CCH GAS didn't simply disappear from radar; it maintained electronic visibility while being in a different location. This mixture of spoofing and ongoing AIS broadcasts complicates detection, as the vessel seems to be operating normally to anyone relying solely on transponder data.
In this context, “attribution” refers specifically to establishing, with sufficient certainty, that a particular vessel engaged in specific behavior at a given time, which may constitute a sanctions violation rather than just coincidental or legitimate commercial activity.
This distinction is crucial since enforcement agencies operate under legal standards, not algorithm-based ones. OFAC applies strict liability for sanctions violations, meaning intent does not factor into civil penalties. However, even under this standard, it must be proven that a prohibited transaction actually took place. The DOJ's criminal enforcement requires proving intent. The EU General Court has annulled certain sanctions designations in 2025 where the Council failed to provide adequate evidence, as seen in Ezubov v Council and Pumpyanskiy v Council. Any designation overturned on appeal undermines the credibility of the enforcement framework.
Single events rarely suffice as evidence. A vessel going dark for 48 hours near a known STS zone might be evading detection, suffering equipment failure, or simply passing through an area with poor satellite coverage. A single AIS gap, viewed alone, does not meet meaningful evidence standards.
What shifts the confidence level is pattern recognition. If the same vessel goes dark repeatedly in the same geographic areas, corresponds with arrivals at ports linked to sanctioned commodities, shows changes in its draft indicating cargo operations, alters its flag registration shortly after a sanctions designation, and has ownership traced through a chain of shell companies in low-disclosure jurisdictions, the overall behavioral profile shifts from “suspicious” to “compelling.”
Creating this profile requires extensive analysis over months or even years, correlating various independent data sources: satellite imagery for physical location, AIS data for transponder activity, RF signals for electronic emissions, port records for arrivals/departures, corporate registries for ownership mapping, insurance records for coverage changes, and flag state databases for registration history. The challenge lies in making all these connections.