The Shadow Fleet: What It Is, How It Works, and How Legitimate Operators Get Caught in It

There is a version of the shadow fleet story that treats it as somebody else's problem. Sanctioned states move sanctioned oil on ships nobody reputable would touch, Western regulators chase them with designations, and operators running clean tonnage on legitimate trades watch from a safe distance.

That version is wrong in a specific and expensive way. The shadow fleet now represents a large enough share of global tanker capacity that legitimate operators share water, anchorages, ports, and ship-to-ship transfer zones with it as a matter of routine. Exposure rarely arrives as a decision to trade sanctioned oil. It arrives as a counterparty you did not screen properly, an STS partner whose ownership you did not trace, a collision with a vessel whose insurance certificate turns out to be fabricated, or a vessel you bought secondhand carrying a history you never checked.

This article covers what the fleet actually is, how it operates, why the insurance dimension is the sharpest edge of the problem, and what practical screening looks like for an operator who wants nothing to do with it.

How Big, and Why Nobody Agrees

Estimates vary enormously depending on who is counting and what they are counting. Some analyses put the fleet at roughly 600 to 800 tankers globally, around 10 to 15 percent of the world crude and product tanker fleet. Others count over 1,300 vessels. Windward, the maritime intelligence firm that has tracked the fleet most systematically, has described a figure closer to 1,900. The spread is not sloppiness. It reflects a genuine definitional problem that matters for your own screening.

At one end sits the dark fleet, vessels engaged in outright deception. Fraudulent flags, identity manipulation, GNSS spoofing, fabricated insurance, expelled or expired class certification, structured specifically to move sanctioned cargo undetected.

At the other end sits what analysts call the grey fleet, vessels that are not sanctioned and not overtly deceptive but that exhibit patterns requiring extra scrutiny. Newly formed offshore ownership structures. Frequent flag changes. STS operations or routing inconsistent with their own pre-2022 behavior. Trading commodities linked to Russia-related patterns.

The grey fleet is where legitimate operators get into trouble, because nothing about a grey vessel triggers a sanctions hit. It clears a name screen cleanly. The risk is only visible in the pattern.

Growth has come from two directions. Fleet acquisition, as Indian, Chinese, and Gulf-based buyers purchase older Western-flag tankers and move them onto shadow routes. And reclassification, as vessels that previously traded legitimately shift into sanctioned trade because the margins justify it. The Urals discount to Brent has run between roughly $8 and $25 per barrel, and that spread is the entire economic engine behind the fleet.

The Tradecraft

Shadow vessels share a recognizable operating signature. Knowing it is the basis of any useful screening process.

AIS manipulation. Transponders switched off to create gaps around loading or transfer, or spoofed to broadcast false positions. The tells include circular tracks, apparent teleporting between distant coordinates, and positions that place a vessel inland.

Ship-to-ship transfers in open water, frequently at night and away from designated transfer zones, specifically to break the chain of custody on a cargo. Recognized laundering nodes include waters off Ceuta, Kalamata, and Laoag, where Russian-origin crude is transferred before delivery to buyers in India, China, and Turkey.

Flag-hopping and opaque ownership. Registration under flags of non-sanctioning states including Gabon, Palau, Cook Islands, and Cameroon, with operation through single-vessel shell companies in jurisdictions that do not cooperate with enforcement. Sovcomflot has transferred dozens of tankers to newly incorporated shell companies in the UAE, India, and Hong Kong which continue trading sanctioned routes.

Age and condition. Shadow vessels skew heavily toward 15 to 25 years and older, frequently divested by Western owners who no longer wanted the maintenance liability.

Certification failures. Investigations have found shadow vessels operating on fraudulent or expired class certificates, or after expulsion by IACS members. Without class, these ships receive no periodic safety inspection or technical audit at all.

Fabricated insurance. This deserves its own section.

Why Insurance Is the Sharpest Edge

The insurance dimension is the most consequential part of the shadow fleet problem for legitimate operators, and it works in both directions.

Shadow vessels generally lack valid P&I cover from International Group clubs. Some carry no cover. Others carry certificates that are simply fake. When the Swedish Coast Guard boarded the Palau-flagged tanker Kiwala in the Baltic in February 2026, carrying 23,000 metric tons of Russian crude with AIS gaps and undisclosed cargo origin, the insurance certificate was fraudulent. Sweden seized the vessel, the first such seizure by a European nation.

That fact pattern is the risk. An aging, poorly maintained, uninsured tanker sharing a congested waterway with your vessel is not a compliance problem. It is a collision and pollution problem with no solvent counterparty behind it. A major spill involving a shadow vessel produces cleanup and third-party liability figures in the billions, and the shell company that owns the vessel will not be paying any of it. Whoever else was involved becomes the only party worth pursuing.

The practical implications for your own program are direct. P&I, hull and machinery, and charterers liability should all be stress-tested against a collision with an uninsured or fraudulently insured counterparty. Pollution and collision limits should be set against realistic worst-case scenarios rather than historic averages. And a crisis response plan should be agreed with your insurers in advance, because the first 48 hours of a major spill is not when you want to be improvising.

The other direction matters too. Withdrawal of P&I cover has become one of the sharpest enforcement levers available to regulators, precisely because a tanker without genuine cover struggles to enter reputable ports, pass port state control, or obtain terminal acceptance. That is why fabricated certificates proliferate, and why verifying cover rather than accepting a certificate is now a real due diligence step rather than a formality.

The Enforcement Picture

Enforcement has intensified but remains fragmented, and the gap between designation and effect is instructive.

As of February and March 2026, 623 oil tankers had been designated by at least one sanctions regime. In the same period, 111 of them continued loading Russian oil cargoes. Designation alone does not stop a vessel trading if the buyers, ports, and flag states involved are not enforcing.

The EU has moved furthest. Its 21st sanctions package, agreed in July 2026, added 218 designations covering Russia's banking system, energy infrastructure, cryptocurrency networks, and defense-industrial complex, and for the first time targeted vessels that refuel shadow fleet tankers at sea. That bunkering provision is a meaningful expansion, because it reaches service providers rather than only the carrying vessels themselves. The oil price cap was frozen at $44.10 per barrel in the same package.

Baltic states have become the operational front line. Denmark has blocked named vessels from its territorial waters around the Danish Straits, and Estonia, Finland, and Sweden conduct inspection operations in Baltic waters.

U.S. enforcement has been more mixed. It has been operationally active, particularly against Venezuela, but has not added new OFAC designations of Russian or Iranian vessels since January 2025, and the administration's approach to Russia sanctions remains unsettled. That divergence between U.S. and European enforcement is itself a compliance complication for operators subject to both.

How Legitimate Operators Get Caught

Five patterns account for most inadvertent exposure:

The unscreened STS counterparty. You conduct a legitimate transfer with a vessel whose ownership chain leads somewhere you would not have gone knowingly. Every STS counterparty needs to be identified, screened, and commercially explicable before the operation, not after.

The secondhand purchase. An older tanker looks attractively priced until you check AIS gaps, STS history, insurance authenticity, beneficial ownership, and sanctions history. A vessel with hidden sanctions history can render your acquisition unfinanceable, uninsurable, and unacceptable to charterers. The useful test is whether a reputable bank, insurer, charterer, and cargo interest would all be comfortable after reading the same diligence file.

The collision. Discussed above, and entirely outside your control except through routing decisions. Mapping the corridors where your vessels share water with shadow fleet hotspots is a legitimate input into route planning and risk appetite.

The cargo of uncertain origin. Crude that has been through an open-water STS transfer specifically to obscure its origin arrives with documentation that may not survive scrutiny. Price cap attestation gaps are a recognized weak point.

The charterer you did not look through. A newly formed trading entity in a non-sanctioning jurisdiction with no track record is not automatically a problem, but it is automatically a question.

Practical Screening

The consistent guidance across the compliance advisory literature is that checklists are no longer adequate and due diligence must be intelligence-led and dynamic. In practice that means the following.

Screen names, then look past them. A clean sanctions hit tells you the vessel is not currently designated. It tells you nothing about the grey fleet patterns that predict future designation. Behavioral risk scoring, which flags AIS anomalies, unusual STS activity, and dubious insurance certificates, identifies vessels before they appear on a list.

Verify insurance rather than collecting certificates. The question is not whether a P&I entered certificate exists but whether cover actually responds to this voyage, this cargo, this flag, and this ownership chain. Confirm entry directly with the club.

Trace beneficial ownership. Single-vessel companies with thin records and shared registered addresses are the standard shadow fleet structure. If the ownership chain does not make commercial sense, that is the finding.

Check flag and class history. Vessels deleted, rejected, or moved between flags or class societies in a pattern suggesting avoidance are telling you something.

Review AIS history, not just current position. Gaps around loading windows, spoofed positions, and unexplained waiting at known transfer areas are the primary behavioral markers.

Build the record. Maintain due diligence documentation so that if a counterparty turns out badly, you can demonstrate what you checked and when. That record is your defense in both an enforcement inquiry and a subsequent commercial dispute.

Put it in the contract. Sanctions clauses, warranties on ownership and insurance, and termination rights triggered by sanctions designation should be in your charter parties rather than assumed.

A Note on Masters and Crew

One dimension that receives less attention than it should. A master joining a vessel in grey employment is exposed personally in a way the shore organization sometimes forgets.

The protection available to a master is accuracy rather than assumption. Record what came aboard, where the transfer took place, which vessel was alongside, what documents were received, what cargo figures were declared, and what the ship actually did. Where the voyage pattern contradicts the paperwork, investigators will follow the pattern first, and shipboard documentation that has been adjusted to close gaps in a commercial story becomes evidence against everyone who touched it.

Operators should be clear with their masters that accurate recording is expected and protected, and that no one ashore will ask them to make the paperwork agree with something the vessel did not do.

The Bottom Line

The shadow fleet is now a systematized global trade network rather than a fringe phenomenon, and it has bypassed most of the traditional safeguards, class certification, insurance, flag registry, and vetting, through a combination of fraud and regulatory arbitrage.

For legitimate operators, the practical consequence is that the industry's inherited due diligence habits are no longer sufficient. Screening a name against a sanctions list was adequate when the deceptive fleet was small and crude in its methods. Against 600 to 1,900 vessels operating with sophisticated tradecraft and a supporting infrastructure of shell companies, complicit flag states, and fabricated documentation, name screening catches only what has already been caught by someone else.

The operators who stay clear of this are the ones treating counterparty verification as an operational discipline rather than a compliance formality. That is more work than it used to be. It is considerably less work than explaining to a regulator, an insurer, or a court why you did not notice.