by Noemi Klein

In conflict-affected shipping corridors, classic sanctions indicators can become ambiguous. The real challenge for trade finance specialists is no longer spotting anomalies, but interpreting what those red flags mean quickly, consistently, and defensibly distinguishing security-driven behaviour from illicit conduct.

In maritime trade finance, the challenge is no longer simply identifying red flags. It is determining what those red flags mean in a specific context. In peacetime, an Automatic Identification System (AIS) gap, an abrupt route deviation, clustering of vessels offshore, or an unusual anchorage departure may justifiably trigger suspicion of sanctions evasion. In conflict affected corridors, those same behaviours may instead reflect protection measures, specific naval instructions, known threat avoidance, or interference with navigation systems. The result is a tougher and more consequential control challenge: distinguishing deceptive conduct from security-driven behaviour without falling into the traps of false comfort or blanket de-risking.^{[1], [2]}

That distinction matters acutely in the Gulf and Strait of Hormuz. Recent reporting from UK Maritime Trade Operations (UKMTO)^[3] and the Joint Maritime Information Center (JMIC)[^4] describes a maritime environment shaped by projectile incidents, critical threat assessments, vessel drifting, congestion at anchor, and electronic interference affecting navigation and AIS reliability. Industry reporting, such as Windward, has also highlighted a sharp rise in Global Navigation Satellite System (GNSS) and AIS disruption in and around the Gulf, with one March 2026 assessment citing more than 1,650 vessels affected by GPS and AIS interference, and multiple spoofing clusters across the region. In such conditions a control framework that treats every anomaly equally will over escalate some legitimate trade and miss the more subtle indicators of actual evasion.^[5]

This does not mean classic maritime sanctions indicators have lost their relevance. The UK Office of Financial Sanctions Implementation (OFSI) continues to identify false flags, ship-to-ship (STS) transfers, irregular sailing patterns, complex ownership structures, false documentation, AIS disablement or spoofing, and altered vessel identifiers as common evasion practices. The U.S. Office of Foreign Assets Control’s (OFAC) maritime advisory likewise emphasises deceptive shipping practices such as AIS manipulation, false flagging, ownership opacity, and covert STS activity. The real shift is not in what constitutes a red flag, but the weight any single indicator should carry in conflict conditions, Vessel telemetry alone becomes less decisive, while the broader risk context, multi-source corroboration and documentary coherence become more important.

A classic, but useful comparison, is the age-old piracy risk off the coast of Somalia. Guidance connected to the International Maritime Organisation (“IMO”) principles and industry best practice has long recognised that if the master believes continued AIS operation could compromise the vessel’s safety or security, AIS may be switched off. At the same time, naval forces in some periods have preferred reduced or continued AIS transmission for monitoring through the Gulf of Aden.^[6] MARAD’s 2025 advisory^[7] also underlined that the piracy threat in the Gulf of Aden, Arabian Sea, and Indian Ocean remains real, including reported boardings, hijackings, and suspicious approaches far from the Somali coast. The lesson for compliance teams is simple: ‘going dark’ is not inherently illicit, but in times of conflict, it is not inherently benign either. The answer lies in the surrounding pattern.

Conflict vs peacetime: How the meaning of maritime indicators change

Indicator	Peacetime interpretation	Conflict -zone interpretation	Mitigation strategies
AIS dark zones / transmission gaps	Often a strong indicator of concealment, especially where combined with high-risk trade routes, STS history, or sanctioned geographies.	In the Gulf or other active threat corridors, AIS silence may reflect force protection or master discretion in response to a security threat; Somalia piracy guidance is the clearest comparator.	Master’s log entries, security advisories, UKMTO / Naval Cooperation and Guidance for Shipping (“NCGS”) reporting, company security instructions, and timing correlation with known threat windows.
False Iranian port calls / impossible positions	May indicate spoofing designed to disguise a sanctions nexus, destination, or origin.	In the Gulf conflict environment, false positions may instead reflect GNSS interference or AIS distortion; UKMTO and JMIC have warned of disruption affecting AIS and other systems.	Independent location cross-corroboration: satellite data, terminal logs, port agent confirmations, pilotage records, and timestamped bridge evidence.
AIS speed anomalies	In peacetime, implausible speeds can indicate manipulated AIS data or spoofing.	In the Gulf, UKMTO reported a marked increase in AIS speed anomalies around Bandar-e-Pars, the Strait of Hormuz, and wider regional waters during periods of GNSS disruption.	Ask whether the anomaly was isolated to one vessel or widespread across the area, and whether bridge teams recorded concurrent navigation interference.
Route deviations	May suggest positioning for covert STS activity, destination concealment, or sanctions evasion through indirect routing.	In conflict zones, route changes may reflect avoidance of strike zones, exclusion areas, military activity, or insurer or operator rerouting decisions.	Voyage instructions, rerouting notices, charter party instructions, insurer guidance, and evidence of regional threat alerts at the time of deviation.
Convoy clustering / mass concentration of vessels	In peacetime, close clustering may suggest coordination between illicit actors or pre-positioning for transfer activity.	In the Gulf conflict, clustering may instead be produced by electronic interference, anchorage congestion, blockades, security holding patterns, or ships waiting for safer transit windows.	Distinguish networked behaviour from shared disruption: compare counterparty linkages, cargo alignment, and whether unrelated vessels were similarly affected.
Abrupt anchorage departure	May suggest concealment behaviour, hurried STS positioning, or efforts to avoid scrutiny.	In conflict zones, departure from anchorage may reflect immediate reaction to nearby incidents, strike risk, or port security instructions.	Port authority notices, VTS instructions, security alerts, insurer or operator instructions, and chronology of nearby incidents.
Drifting / loitering	In peacetime, prolonged drifting can suggest a vessel waiting for covert contact, informal transfer, or evasive routing.	In a conflict setting, drifting may be a defensive posture while awaiting clearance, convoy coordination, or safe passage through a high-threat zone.	Determine whether drifting coincided with traffic freezes, military advisories, or regional attack warnings.
STS transfers	While STS activity remains a classic sanctions evasion indicator, particularly when conducted at night, in high‑risk waters, or involving opaque counterparties, it must be assessed in context, as STS operations are also a routine and legitimate feature of certain trades, geographies, and established mother/daughter vessel arrangements.	Times of conflict do not neutralise the risk of illicit STS transfers. If anything, conflict can provide cover for deceptive transfers, particularly where AIS reliability is already degraded.	Require full STS transfer records, counterpart vessel history, fendering or support data, cargo reconciliation, and six-month AIS and ownership review on both vessels.
Port closure / navigation suspension	In peacetime, unexpected cessation of movement around a port may sometimes suggest evasive behaviour or unexplained operational anomaly.	In the Gulf, navigation restrictions may reflect genuine safety concerns. Qatar temporarily suspended maritime navigation in October 2025 citing GPS malfunction affecting navigation accuracy.[8]	Seek official notices, port circulars, operator alerts, terminal instructions, and evidence that the vessel’s behaviour matched broader port-wide restrictions.
Bunkering disruption / force majeure	In peacetime, sudden changes in bunkering location or supply route may warrant review but are not automatically suspicious.	In the Iran linked Gulf crisis, disruptions to bunkering hubs such as Fujairah were reported alongside security incidents, suspended deliveries, force majeure declarations, and sharply reduced barge activity.[9]	Validate with supplier notices, bunker confirmations, revised port calls, price spikes, and contemporaneous operational alerts rather than inferring illicit motive from change alone.
War-risk insurance withdrawal / coverage shock	In peacetime, inability to secure normal insurance may raise questions about counterparties, voyage legitimacy, or asset risk.[10]	In conflict conditions, loss or repricing of cover can itself drive routing changes, delays, anchorage concentration, or selective transit behaviour.	Ask for broker correspondence, war-risk endorsements, premium changes, and whether behaviour changed immediately following insurer decisions.
Rapid ownership / manager rotation	A classic sanctions-evasion signal, particularly where multiple shell entities or frequent International Safety Management (“ISM”) company or manager changes are involved.	Unlike some movement indicators, this remains suspicious in both peacetime and at times of conflict. Conflict does not provide a natural operational rationale for serial beneficial ownership or manager opacity.	Enhanced beneficial ownership review, corporate registry checks, historical manager trace, and screening of linked entities and associated vessels.
False or inconsistent cargo documentation	Always a major indicator: mismatched bills of lading, origin inconsistencies, altered certificates, or pricing anomalies are central evasion tools.	In high interference conflict conditions, documentation often becomes more, not less, probative than vessel movement alone. When telemetry is noisy, paperwork coherence becomes the tie breaker.	Require inspection certificates, quantity or quality reports, market pricing checks, dual review of origin documents, and linkage between trade paperwork and observed physical movement.
Physically altered vessel identifiers	A strong evasion indicator in peacetime and a classic attempt to obscure vessel identity.	This remains highly suspicious even during conflict. Conflict may explain movement anomalies; it does not explain painted-over IMO numbers or disguised hull markings.	Independent vessel imagery, historical registry records, port inspection findings, and cross-platform identifier matching.

Why this matters for trade finance teams

The practical implications are that conflicts should change both the assessment and escalation logic, not lower the standard of scrutiny. Banks should not ignore AIS gaps, route changes, loitering, or unusual port behaviour simply because of conflict. But, nor should it treat those indicators as self-proving.

In conflict-affected routes some of the traditional movement-based signals become less diagnostic on their own, while ownership opacity, document inconsistency, implausible commodity economics, and multi-signal patterning become more important. The point is not that institutions need more alerts, but better judgement. They need to move beyond red flag detection alone and build the capability to make disciplined, defensible decisions under pressure, grounded in sanctions expertise, operational context, investigative rigour, and control frameworks that can withstand the realities of human performance in crisis conditions.

---

References

^[1] Financial sanctions guidance for maritime shipping – GOV.UK

[^2] OFAC Sanctions Advisory: Guidance for Shipping and Maritime Stakeholders on Detecting and Mitigating Iranian Oil Sanctions Evasion

[3] UKMTO Recent Incidents– recent incidents page documents attacks and suspicious activity affecting vessels in and around the Arabian Gulf, Strait of Hormuz and Gulf of Oman in 2026.

^[4] JMIC Advisories – 2026– March 2026 advisory update described a critical threat environment, drifting vessels, anchorage congestion and interference including EMI, AIS spoofing and jamming.

^[5] Windward, GPS Jamming Surges in the Middle East Gulf, 1,650 Ships Hit, 8 March 2026

^[6] IMO MSC.1/Circ.1339: Piracy and armed robbery against ships in waters off the coast of Somalia

Best Management Practices for Protection against Somalia Based Piracy, 14 September 2011 Microsoft Word – 1339.doc

^[7] 2025-003-Gulf of Aden, Arabian Sea, Indian Ocean-Piracy/Armed Robbery/Kidnapping for Ransom | MARAD

[^8] Qatar news agency

^[9] Force Majeure Declared at Fujairah As Iranian Attacks Disrupt Global Bunker Hub

^[10] Marine Insurers Cancel War Risk Cover as Iran Conflict Escalates

---

About the author

Noémi Klein has over ten years’ experience in financial crime investigations and compliance. She advises organisations on anti‑money laundering, fraud prevention, and anti‑bribery and corruption, supporting senior leadership, boards, counsel, and regulators.

She has particular expertise in sanctions advisory, high‑risk client portfolio management, trade finance and supply chain risk, and regulatory‑driven remediation programmes, including work under the FCA’s Skilled Person framework. Noémi has held both consulting and senior in‑house roles at global banks across Europe, the Middle East, Asia, and Africa.