Overview
On November 13, 2025, the UK National Crime Agency (“NCA”) published an amber alert (“Alert”) that seeks to assist maritime and financial institutions to identify and prevent sanctions evasion involving commodities by sanctions evasion networks and shadow fleets that support regimes subject to sanctions such as the Democratic People’s Republic of Korea, Iran, and Russia. The Alert builds on the July 2025 NCA red alert on Russian shadow fleet sanctions evasion and avoidance networks and outlines various sanctions evasion typologies and warning flags that affected businesses should be alert to and incorporate into their sanctions risk assessments and compliance controls.
Sanctions Evasion Strategies
The Alert highlights the use of commodity export revenues by a number of sanctioned regimes such as Russia and Iran to fund state expenditures and elite networks. For example, the use of energy revenues by Russia to support its military objectives in Ukraine and by Iran to bolster its economy, advance its nuclear program, and procure military and dual-use technologies. The networks supporting these activities span a range of sanctions evasion typologies that are typically used in combination to reduce the risk of detection.
Sanctions Evasion Typologies
The Alert highlights the importance of maintaining access to global markets by using intermediaries and facilitators to support these revenue streams. These networks play a significant role in enabling illicit trade by moving commodities, concealing vessels and cargo identities, manipulating financial transactions, falsifying documentation, and laundering the proceeds of commodity sales. In return, these intermediaries and facilitators often receive preferential treatment and trade access, significant financial rewards, or protection from in-country scrutiny by the relevant regime. These networks often utilize front companies and reflag ageing vessels, often leveraging European or North American financial systems and professional services.
As sanctions have resulted in restricted access to some international markets, Russia and Iran have made increased use of sanctions evasion networks to sell energy commodities to countries willing to buy at discounted rates. The emergence of these parallel markets is enabled by the systematic use of so-called “shadow fleet” vessels to transport commodities. These vessels are often older with opaque ownership structures and are routinely renamed, reflagged in more permissive jurisdictions, and insured through shell entities. A range of techniques are used to conceal voyage data such as disabling or obscuring the Automatic Identification System (“AIS”) transponders used by these vessels through signal spoofing, particularly in areas such as the Persian Gulf, Gulf of Oman, and the Baltic and Barents seas. Efforts are also made to disguise sanctioned commodity cargos by blending or co-mingling sanctioned cargo with legitimate product during ship-to-ship transfers, fabricating paperwork, manipulating port call records to mask shipment origin and destination, and making use of circuitous maritime routes. The Alert identifies common destinations for these cargos as including Southeast Asia, the Arabian Gulf, and the Indian Ocean via the Mediterranean.
The Alert underscores the importance of the use of front companies to these operations. Entities are often incorporated in jurisdictions associated with low levels of corporate transparency and may lack a financial or trading history. The Alert also highlights the increased use of companies registered in reputable financial centres with seemingly plausible business operations that engage in unusual activity compared to normal business patterns. The financial flows associated with these networks are often complex. For example, transactions may be routed through non-transparent intermediary structures or payments are conducted via barter, alternative currencies, or digital assets to avoid scrutiny by financial institutions. The trade documentation supporting such payments frequently also misrepresents the origins of sanctioned cargo.
Sanctions evasion networks often deploy several of these typologies simultaneously, with the interlinking of these strategies giving rise to a level of network complexity that can be indicative of sanctions evasion. For example:
- sanctions evasion from illicit shipping may be signaled by the obfuscation of vessel identities, coupled with complex, multi-jurisdictional layering, and use of shell companies;
- concealment activities or front operations may be present when substandard vessels are being used registered under flags of convenience in association with companies that appear to have grown rapidly without a commercial track record; or
- a legitimacy illusion may be created by features including false or prestigious office locations, shell companies, proxy ownership, and misleading websites to obscure beneficial ownership, inflate credibility, and access financial channels.
Red Flag Indicators
The Alert underscores the importance of scrutinizing potential warning flags for sanctions evasion by performing additional due diligence into transactions and customers, including in relation to vessels, transactions, and routings. Among other indicia, businesses should be alert to:
- recently incorporated companies lacking evidence of operational history that often share addresses, directors, or email domains;
- vessels, counterparties, or cargo exhibiting sudden changes in name, flag, or corporate affiliation with no clear commercial rationale, particularly when linked to offshore jurisdictions;
- vessels involved in voyages with gaps or unexplained deactivation of AIS during transits near sanctioned jurisdictions or high-risk maritime zones;
- routing of commodities (e.g., gas, metals, oil, and petrochemicals) through trans-shipment hubs without a commercial rationale or inconsistencies in cargo documentation between the origin and routing of the cargo;
- entities with historic links to designated persons or engagement with clients, counterparties, or vessels linked to sanctions breaches;
- trade flows exhibiting circular routing or unnecessary complexity without a clear commercial rationale; and
- unusual or non-standard payment arrangements, including routing of payments through multiple intermediaries or payment institutions known to have weak anti-money laundering (“AML”) controls or used in connection with past sanctions evasion schemes.
Conclusion
Businesses and financial institutions active in the maritime sector should carefully review the amber alert and assess whether any updates are required to their sanctions risk assessments and compliance controls. Additionally, financial institutions that identify activity indicative of sanctions evasion of the type discussed in the amber alert should consider whether an obligation to file a suspicious activity report arises when they are operating in the AML regulated sector, or a mandatory report of a sanctions breach or frozen asset arises when qualifying as a relevant firm. For more information on these developments and their impact, please contact the author of this post, Alexandra Melia, in Steptoe’s Economic Sanctions team in London.
