AIS anomalies and dark-activity indicators under OFAC: the essentials

A charterer has run the usual sanctions screening on a vessel. The name is clean. No hits. The deal proceeds. Three weeks later, the compliance team receives a query: the vessel went dark for eleven days mid-voyage, reappeared in a different sea area, and had its AIS signal manipulated twice during the period. OFAC has since issued guidance treating exactly that pattern as a red flag. The charterer is now explaining itself to its correspondent bank. This is the scenario we see with increasing regularity in our cross-border practice.

AIS anomalies and dark-activity indicators under OFAC rules are a recognised category of maritime sanctions risk. OFAC, acting under the authority of the International Emergency Economic Powers Act and related statutory instruments, has published detailed guidance treating automatic identification system (AIS) manipulation – including disabling, spoofing, and unexplained gaps in transmission – as significant red flags for potential sanctions violations. Name-only screening does not satisfy the due-diligence standard where behavioural indicators of this kind are present. As of January 2026, regulators in the United States, United Kingdom, and European Union all treat AIS dark-activity as a compliance trigger, though the legal framing and the obligations it activates differ between regimes.

This briefing explains who administers the OFAC rules, the legal basis and scope, the specific indicators that OFAC and related US agencies treat as red flags, the cross-regime dimension, the risk flags that require escalation, and when to involve counsel.

Who administers OFAC's maritime sanctions and what is the legal basis?

OFAC – the Office of Foreign Assets Control, a bureau of the US Department of the Treasury – administers US economic sanctions under a statutory framework rooted in IEEPA, the Trading with the Enemy Act, and a series of programme-specific executive orders. Maritime transactions fall squarely within that framework because OFAC's prohibitions extend to US persons wherever located and, in certain programmes, to non-US persons whose conduct facilitates a US-person violation or touches US financial infrastructure.

The practical consequence is wide. A foreign-flagged vessel calling at a US port, a dollar-denominated freight payment clearing through a US correspondent bank, or a US-domiciled commodity trader engaged in the voyage – any of these creates a nexus to OFAC jurisdiction. Compliance counsel advising on charter parties, voyage orders, or cargo financing must treat OFAC's rules as operative regardless of where the ship is registered or where the principal parties are incorporated.

OFAC does not administer maritime compliance in isolation. The US Department of State, the US Coast Guard, and the Department of Homeland Security have each contributed to published advisory documents – issued in coordination with OFAC – setting out the AIS-specific red flags that form the operational basis for this area of the law. Those advisories, while not binding regulations in the formal sense, define the standard of care that enforcement decisions reference. In our experience, a business that has not mapped its operations against those advisories will struggle to demonstrate the due-diligence record that OFAC's Enforcement Guidelines treat as a mitigating factor.

What are AIS anomalies and dark-activity indicators, and why do OFAC rules treat them as red flags?

AIS anomalies and dark-activity indicators are patterns of vessel behaviour that suggest deliberate concealment of a ship's identity, position, or trading activity. They are relevant to OFAC because concealment is a classic precursor to conducting a voyage that would trigger prohibitions if it were visible – calling at a sanctioned port, loading cargo from a sanctioned counterparty, or transferring goods in a ship-to-ship operation designed to obscure origin.

The main categories of indicator identified in US government advisories are as follows.

• AIS disabling. Switching off the AIS transponder creates a gap in the vessel's broadcast position. Under the relevant international maritime rules, ocean-going vessels of a defined size are required to keep AIS active except in limited safety or security circumstances. An unexplained gap – particularly one that coincides with a port call window in a sensitive jurisdiction – is treated as a significant red flag.
• AIS spoofing. A vessel transmitting a false position while physically located elsewhere. Blockchain analytics and satellite AIS data have made this increasingly detectable, but the practice continues. Spoofing to indicate a position far from a prohibited port while the vessel is actually alongside is a paradigm case.
• Manipulation of vessel identity fields. Changing a reported MMSI number, vessel name, or IMO number in AIS broadcasts. The IMO number is permanently assigned and does not change; a mismatch between broadcast identity and Lloyd's or IHS shipping databases is a direct red flag.
• Irregular or inconsistent voyage data. Speed, draft, and port-of-call data that are internally inconsistent – for instance, a declared draft inconsistent with the reported cargo, or a declared port of destination inconsistent with the vessel's actual track.
• Ship-to-ship transfers in high-risk areas. Offshore transfers in designated high-risk geographic areas, particularly where one of the vessels is not broadcasting AIS, are treated as a combined indicator of potential sanctions evasion. Maritime sanctions compliance turns on verifying insurance cover, monitoring AIS transmission gaps, and scrutinising ship-to-ship transfers, according to established cross-regime guidance.

OFAC's published advisories are explicit: these are not exhaustive lists, and a cluster of lower-level indicators may be as significant as a single prominent one. The analytical task is not to find a single threshold but to assess the pattern.

What does OFAC prohibit, and how does the strict-liability standard apply?

OFAC's core prohibitions are transactional. Under a list-based programme, US persons – and others within OFAC's jurisdiction – may not engage in transactions with Specially Designated Nationals (SDNs: individuals and entities on OFAC's SDN List whose property is blocked). Under comprehensive or territorial programmes, dealings with the designated territory or sector are prohibited more broadly. Both categories can be engaged by a maritime transaction where the vessel, the cargo, the counterparty, or the voyage route connects to a blocked person or a prohibited programme.

The liability standard is strict. OFAC's civil-penalty authority under IEEPA does not require OFAC to prove that the party knew the transaction was prohibited. A violation is established by the fact of the prohibited dealing. This is why the presence of AIS anomalies in a transaction's record matters so much: they are the evidence from which OFAC – and, subsequently, a reviewing court – can infer that a party proceeded despite red flags. Deliberate disregard, or even negligent disregard, of those flags elevates the characterisation of the violation within OFAC's Enforcement Guidelines.

Under those guidelines, a violation may be characterised as egregious or non-egregious, and voluntary self-disclosure (VSD: voluntary self-disclosure to OFAC before enforcement contact) is a recognised mitigating factor. The combination of egregious conduct and no VSD attracts the highest penalty base. By contrast, a VSD supported by a documented due-diligence record – one that shows the firm assessed and did not simply overlook the AIS indicators – is a meaningful mitigant even where the underlying violation occurred.

Blocked-property and rejected-transaction reports must be submitted to OFAC within 10 business days of the relevant event, and sanctions records must be retained for five years. Both obligations apply regardless of whether the firm is also pursuing a VSD. These are not discretionary; missing the reporting window removes an available mitigant and can itself become an aggravating factor.

How does the scope of OFAC's jurisdiction extend to non-US parties?

The extraterritorial reach of OFAC's rules is one of the features of US sanctions that most often surprises compliance teams outside the United States, and it is directly relevant to AIS-based diligence. OFAC's jurisdiction is not limited to US-flagged vessels or US-incorporated parties.

A non-US owner, charterer, or trader can be within OFAC's effective jurisdiction in several ways. First, if a dollar-denominated payment clears through a US correspondent bank – which is the default for most commodity and freight transactions – the US financial institution in the chain must comply with OFAC's rules. A payment that the US bank must block or reject exposes the non-US principal to the loss of the transaction and, depending on the facts, to secondary-sanctions risk. Second, if a US person in the chain – including a US commodity broker, a US-domiciled P&I club affiliate, or a US cargo insurer – facilitates or benefits from the transaction, that US person's conduct is directly regulated. Third, certain OFAC programmes assert jurisdiction over non-US persons for conduct outside the United States where the statutory basis permits it.

Facilitation is a critical concept. A US person who causes a non-US entity to engage in conduct that the US person itself could not engage in is itself in violation of OFAC's rules. In the maritime context, this means a US-domiciled charter broker who arranges a voyage that turns out to involve a dark-activity pattern directed at a sanctioned port can be liable even if the ship and the charterer are both non-US.

What does this mean practically for a non-US business? It means that OFAC's rules govern the architecture of the transaction even when every named party is outside the United States. A transaction structured to avoid US touchpoints – no dollar payments, no US-person involvement, no US port call – may still be within other regimes, as discussed below, and removing US touchpoints is a structural decision that must be made with full legal advice, not a compliance shortcut.

How do the UK and EU regimes treat AIS dark-activity, and where do they diverge from OFAC?

AIS anomalies and dark-activity indicators occupy the same conceptual space in the UK and EU regimes as they do under OFAC, but the legal architecture and the specific obligations they trigger differ in important ways. Understanding the divergence matters for any cross-border operator subject to more than one regime – and where two regimes both apply, the stricter prohibition governs.

Under the UK regime, OFSI administers financial sanctions under SAMLA and the relevant thematic regulations. The UK ownership-and-control test can catch a non-listed entity controlled by a designated person, which creates a specific issue in the maritime context: a vessel managed or commercially operated by a listed person – even if the registered owner is not listed – may be within scope. OFSI can impose monetary penalties on a strict-liability basis, and the maximum civil penalty is the greater of £1,000,000 or 50 percent of the breach value, as currently in force and subject to legislative change. There is also a legal obligation on relevant firms to report knowledge or suspicion of designated persons to OFSI, a reporting duty that is independent of any transactional prohibition. When a vessel exhibits a pattern of AIS dark-activity that a firm suspects is connected to a designated person, that suspicion may activate the reporting obligation even before any transaction has been concluded.

Under the EU regime, Council regulations impose asset-freeze prohibitions that extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. The EU control test, similarly to the UK test, can catch a non-listed vessel operator controlled by a designated person. The EU dual-use export-control regime, governed by the recast dual-use regulation, adds a further layer for certain cargo. The EU has also deployed an anti-circumvention instrument – applied operationally for the first time in 2026 – that can extend restrictions to operators in third countries where EU measures are being circumvented, a development with direct relevance to maritime routing decisions designed to avoid EU-nexus touchpoints.

A sharp change in trade flows to a neighbouring or transit jurisdiction is treated as a diversion red flag by both US and EU regulators. Transit through a third country does not change an item's controlled status, and origin and end-use analysis follows the item, not the route. For the compliance team analysing an AIS-anomalous voyage, this means that the question is not simply whether the vessel called at a prohibited port but whether the voyage pattern, taken as a whole, is consistent with a diversion strategy.

For a business with exposure to all three regimes, the practical implication is a single, unified diligence standard calibrated to the strictest applicable test. In our cross-border practice, we regularly advise clients on how to construct that standard and how to document it in a way that is defensible before OFAC, OFSI, and the EU simultaneously.

For detailed guidance on the EU dimension, see our related page on AIS anomaly indicators under EU sanctions.

What risk flags require immediate escalation and when should counsel be involved?

Not every AIS gap is a sanctions problem. Technical failures occur. The analytical task is to assess whether the pattern of anomalies is consistent with legitimate operational causes or whether it suggests deliberate concealment. The following indicators, individually or in combination, require escalation to legal counsel before the transaction proceeds or continues.

• An AIS gap of material duration – more than a day – coinciding with a sailing window that would place the vessel within range of a prohibited port or a known high-risk ship-to-ship transfer area.
• A mismatch between the vessel's broadcast identity and official shipping-registry records, including any discrepancy in the IMO number.
• A vessel that reappears after a dark period with a changed cargo declaration, changed destination, or changed draught inconsistent with the previous cargo record.
• A counterparty that is unable or unwilling to provide credible documentation of the vessel's activities during an AIS gap.
• A vessel on a charter to or associated with an entity in a jurisdiction subject to a comprehensive OFAC programme, even where the vessel itself is not directly listed.
• A P&I club or hull insurer affiliated with a jurisdiction subject to a broad sanctions programme – because a designation of an insurer can cascade into loss of cover for vessels it insures, which is itself a compliance trigger for charterers and ports.
• Port-access or port-call restrictions affecting the vessel, even where the cargo is not otherwise restricted – these operate independently of cargo-level prohibitions.

The myth that representations and warranties in a sale or charter contract remove the buyer's or charterer's sanctions risk is one of the most persistent misunderstandings in this field. Contractual protections can allocate loss between commercial parties. They do not remove OFAC liability. OFAC is not a party to the contract and is not bound by the seller's representations. A firm that proceeds with a transaction because the seller has warranted clean title – but that has not itself assessed the AIS record – has not satisfied the due-diligence standard.

Early involvement of counsel is most valuable at the pre-contract stage. Once a voyage is under way, options narrow. If an anomaly is detected mid-voyage, the immediate question is whether continuing the charter or taking delivery of cargo constitutes a prohibited transaction, and that analysis must happen quickly. For digital-asset counterparties with potential maritime exposure, see also our related analysis on digital-asset counterparty diligence under OFAC and digital-asset counterparty diligence under OFSI.

How does OFAC enforce in this area, and what does the enforcement record tell compliance teams?

OFAC's enforcement posture in maritime sanctions has become progressively more rigorous. The agency's approach to AIS dark-activity reflects a broader enforcement philosophy: the presence of red flags that a reasonable compliance programme would have detected, and that were not acted upon, is itself evidence of a culpable state of mind – even in a strict-liability regime where the legal standard does not formally require intent.

OFAC's Enforcement Guidelines set out the factors that determine whether a violation is characterised as egregious. Among those factors are the degree to which the violating party was on notice of the risk – specifically whether it was aware of red flags but proceeded anyway – and the quality of its compliance programme. An AIS-anomalous vessel in a high-risk trade route is a documented red flag. A compliance programme that does not screen for AIS data, or that screens but does not investigate anomalies, will be evaluated against a standard that presupposes access to satellite AIS data and basic voyage analytics. That data is commercially available. Its absence from the diligence record is not a neutral fact.

The statute of limitations for civil and criminal violations under IEEPA was extended to 10 years in 2024, which means OFAC can pursue a maritime transaction long after the commercial relationship has ended. Record-keeping obligations of five years are a floor, not a ceiling, in this environment; prudent practice extends document retention to match the enforcement window.

A voluntary self-disclosure submitted promptly, supported by a thorough internal review and a credible remediation plan, is the most effective tool available to a firm that identifies a potential violation in its own transaction record. VSD does not guarantee a reduced penalty, and OFAC retains discretion as to how it treats any submission. But in our experience, the difference in outcome between a well-prepared VSD and no disclosure – where OFAC identifies the violation independently – is material.

The enforcement dimension also interacts with the cross-regime picture. A matter that comes to OFAC's attention may simultaneously attract scrutiny from OFSI or EU member-state authorities, particularly where the underlying transaction involved a UK or EU nexus. Coordinating disclosures and ensuring consistent factual accounts across multiple regulators is a specialist task that is substantially more difficult after enforcement contact than before it.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.