Responding to an increasingly complex maritime sanctions landscape

The maritime sanctions landscape is evolving at pace and changing with it are organisations’ inherent risks. It is critical that maritime industry participants respond by re-assessing their potential sanctions risk exposure and corresponding risk appetite.

Maritime sanctions environment update

As the world attempts to stem the flow of Russian oil, scrutiny of the maritime industry’s critical role has intensified. In 2020 OFAC identified a set of ‘deceptive shipping practices’, prompting efforts to mitigate the sanctions risks associated with the maritime transport of goods. Over the last year these efforts have been tested by attempts to circumvent sanctions against Russia. One thing has become clear: bad actors have continued to innovate and, in some instances, outpace the regulators. In February this year, it was estimated that at least 22 million barrels of Russian crude and diesel were re-rerouted through ship-to-ship transfers.¹ Today, in addition to the ‘deceptive practices’ identified in 2020 we are seeing the use of increasingly sophisticated techniques, including AIS spoofing ² and use of ‘shadow fleets.’ ³

Authorities are catching up. As discussed in our last blog, the EU’s 11th sanctions package imposed the most extensive measures on the maritime industry yet in order to tackle circumvention. The industry anticipates similarly aggressive sanctions to be replicated for other foreign policy objectives.⁴ In light of these developments, it is clear that compliance with previous guidance will not guarantee the sufficient management of maritime sanctions risk. Now, more than ever, it is crucial that organisations review their exposure in order to stay clear of reputational, commercial, and increasingly, regulatory risk.

Three key components must be re-assessed:

• inherent risk of business operations;
• control framework effectiveness at mitigating developing risks; and
• maritime sanctions risk appetite ensuring the residual risk exposure is within agreed and communicated tolerances.

In this blog we look at some of the key considerations for shipping groups, logistics providers, and traders for conducting risk assessments and defining risk appetite.

Risk assessment

To combat the risk of sanctions breaches, maritime industry participants should have in place a robust maritime sanctions compliance framework. The bedrock of this is a thorough and detailed maritime sanctions risk assessment which reviews the inherent risk exposure of business operations, the effectiveness of existing controls, and identifies any residual risk.

Risk assessments are often carried out by Compliance functions. However, to accurately evaluate the risk associated with shipping practices, maritime expertise is also required. Without this insight, risk assessments can fail to account for the nuances of how risks materialise in physical operations and become little more than tick-box exercises. The best risk assessments typically involve individuals with both hands-on business and risk management expertise to bring the depth of understanding required. Additionally, risk assessments are not a one-off exercise; they require periodic and event-based reviews, such as in response to emerging circumvention typologies.

What are some of the key considerations and lessons learned when conducting maritime sanctions risk assessments?

• Leadership buy-in – Continued and visible buy-in from leadership, including ongoing communications with stakeholders, is critical to ensuring the relevant business areas are fully engaged and understand the importance of the risks being managed.
• Breadth of expertise – The complexity of marine-based transactions requires sanctions, shipping, and business subject matter expertise (“SME”) to identify relevant risks. It is also critical these SMEs learn from each other and work collaboratively, else the effectiveness of any risk assessment is reduced.
• Clear scoping of relevant business areas – Ensuring sufficient time is spent up-front determining in-scope business areas and risk assessment units based on a detailed understanding of their operations. If business strategy and service offerings change, this should be re-assessed.
• Risk validation – Leveraging the full range of SMEs is vital when validating potential risk exposure across the full lifecycle of a vessel movement according to the deal type. For example, a detailed understanding of business operations may highlight where certain deceptive shipping practices pose a reduced risk.
• Existing controls – Organisations are likely to already have in place business processes and controls which may partly mitigate inherent risks. For example, sufficiently robust customer onboarding processes could already address the deceptive practice of complex vessel ownership structures.

The risk assessment output will highlight any control gaps, residual risk exposure, and can be used to inform an updated risk appetite.

Maritime Sanctions Risk Appetite

Leveraging the risk assessment outputs, organisations should agree on appropriate, measurable risk tolerances to define what vessels will (and will not) be accepted. This should be set out in a maritime sanctions risk appetite statement and clearly communicated to the business to enable strategic and daily decision-making, balancing the limitation of risk with the impact to business operations and commercial interests.

What are some key considerations for maritime-based risk tolerances?

• Historical AIS period – What is the desired length of ‘lookback’ period for vessels’ AIS data? Is 12 or 24 months most appropriate for the organisation’s risk appetite?
• Port calls – Would a single port call at Cuba during the lookback period be deemed unacceptable? What if the vessel has since called at a US port?
• Voyage irregularities – What is considered irregular? How will an organisation determine between irregular and regular voyages?
• Flag hopping – How many flag changes in a given period is considered suspicious? What is standard practice in the market?

Once agreed, an organisation can then determine where its residual risks fall outside of its appetite and therefore where enhanced controls are required. See our blog for more detail on setting an appropriate sanctions risk appetite.

Deloitte view

Organisations continue to face challenges in this arena owing to the complexity of the maritime sanctions environment and breadth of expertise required to effectively identify, assess, and mitigate these risks. If you would like to discuss this topic in more detail, please reach out to a member of our team.

_______________________________________________________________________________________

References

1. Tanker switching for Russian oil hits record high as sanctions kick in | S&P Global Commodity Insights (spglobal.com)

2. AIS spoofing: new technologies for new threats (windward.ai)

3. Vessels which maintain a low profile – often unregistered with flag states, the International Maritime Organisation or insurance - and are used to mask movement of Russian oil.

4. Shipping groups press Chinese counterparts for sanctions-proof contracts | Financial Times (ft.com)