know your vessel

Case Studies in Steering Clear

of Sanctions Evasion

wnwd.com | insights@wnwd.com
(c) 2020 Windward Ltd.
know your vessel
Case Studies in Steering Clear
of Sanctions Evasion

TABLE OF CONTENTS
Introduction to Mitigating Maritime Sanctions Risk | 03

Radioactive Oil:
A Case Study in Concealed Origin of Iranian Crude | 05

Dirty Coal:
A Case Study in Concealed origin of North Korea Coal | 09

Putting Know your Vessel into Practice | 013

Staying Safe in a Sanctions World | 015

introduction
to mitigating maritime sanctions risk

Global trade financing is one of the most complex and, from a regulatory perspective, high-risk
services offered by financial institutions. Transactions involving vessels present an even greater
challenge to compliance teams.

Vessels associated with sanctions evasion, arms trafficking, smuggling of narcotics, and human
trafficking, among other illicit activities, may expose their financial institutions to myriad risks.

Many authorities, including the U.S. Office of Foreign Assets Control (OFAC), alongside national
anti-money laundering (AML) regulators, increasingly expect financial institutions to implement
sophisticated controls when it comes to shipping including screening and monitoring for potential
sanctions violations, trade-based money laundering, and other high-risk transactions.

Recent OFAC Advisories1 and UN reports2 list an array of deceptive shipping practices, thus enabling
sanctioned regimes to evade trade restrictions. As a result,

"THE NUMBER OF SDN DESIGNATIONS ISSUED BY OFAC AGAINST

VESSELS SOARED FROM 40 IN 2016-17 TO 321 IN 2018-19.3"
However, given the large volume of transactions and the need for timely processing of transactions,
it is not feasible to complete enhanced due diligence (EDD) on every transaction. Financial
institutions must therefore rely on a risk-based approach to protect themselves and keep their
business on track.

Introduction | 03

1
OFAC Syria Shipping Advisory 2019 and OFAC North Korea Advisory 2019 and OFAC Iran Advisory 2019
2
UN Panel of Experts Report on North Korea Sanctions March 2019
3
Sanctions by the Numbers (CNAS Publication)
red flags in standard screening

sanctioned owner

sanctions lists match internal policies *

possible fraud

negative news pep dual- use goods

internal black lists match nexus with sanctioned country

money laundering concerns

* other internal policies defined according to

risk appetite and jurisdiction

In practice, this means that financial institutions must rely on their operations department working with
automated screening tools to identify red flags in transactions. The compliance team will usually do a more
thorough check only if a case is escalated. Many banks have tools to screen vessels identified on shipping
documents for red flags, however, there are significant gaps in their ability to keep up with the increasingly
sophisticated tactics employed by sanctions evaders.

In the following case studies, we examine two public examples where standard screening tools failed to
identify red flags associated with a vessel involved in a transaction, thereby exposing transaction parties
to the risk of aiding sanctions evasion. We will then review how banks could have identified the risks
using Know Your Vessel processes such as considering the vessels’ prior behaviour based on open-source
information. We will end by describing how KYV can be incorporated in transactions screening process.

Introduction | 04
radioactive oil:
a case study in concealed origin of iranian crude

In 2018, the US reimposed sanctions against Iran's petroleum industry and other sectors of the Iranian
economy. Since then, they have issued several advisories4 detailing deceptive shipping practices they expect
financial institutions and other parties involved in maritime trade to screen for.
How does your sanctions screening solution measure up?

consider the following scenario:

Two banks, including the Asia-based subsidiary of a US financial institution, processed a Letter of Credit
(LC) that may have financed a shipment covered by primary and secondary US sanctions on the trading of
Iranian oil. Neither bank’s screening software flagged the transaction since none of the entities involved were
listed on sanctions lists. However, a careful examination at the activities of the involved ship would have
immediately raised red flags.

the details
On June 10, 2019, Chinese oil importer, Bright Star Petroleum Corporation, asked its bank, a large Chinese
financial institution, to open an LC in favor of its trading counterparty, Sky Energy Group Berhad, a Malaysian
oil trading firm. The SWIFT Message specified the product, crude oil, at a value of $140M USD. The port of
loading was Port Dickson, Malaysia and the port of discharge was Ningbo-Zhoushan, China. At this stage in
the LC transaction, the carrying vessel was not yet known to the applicant’s bank.

Case Study 1 | 05
4
See advisories listed in the introduction
standard screening

Importer applies for Letter of Credit (LC) to applicant bank

applicant bank - first round of screening

During the first round of screening, the applicant’s bank performs standard screening checks
on the payment beneficiary (exporter) in Malaysia, the beneficiary bank in Malaysia, loading
and discharge ports, and cargo. There are no sanction hits, and the underlying cargo and
transaction value fit well within the standard business profiles of importers and exporters.

Applicant bank requests confirmation from beneficiary bank

beneficiary bank - first round of screening

Upon receiving the LC advice from the issuing bank, the beneficiary bank, a Malaysia-based
subsidiary of a large US financial institution, also performs screening checks on all known
parties involved in this transaction, as well as the transaction details. Finding no hits, the
beneficiary bank advises the LC to its customer, the exporter/beneficiary.

On July 3, almost a month after the LC application, the carrier sends a bill of lading (BL) to exporter claiming the oil has

been shipped on the Tian Ying Zhao. On July 4, exporter forwards the BL to beneficiary bank and requests payment

beneficiary bank second round of screening

On July 4, 2019, upon receiving the exporter’s documents, the beneficiary bank performs
standard screening on all involved parties including the vessel now listed in the BL, Tian Ying
Zuo (TYZ). None of the parties is on a sanctions list, and no alerts are raised.

Beneficiary bank pays the exporter according to the terms of the LC and seeks repayment from

the applicant’s bank.

applicant's bank second round of screening

On July 5 2019, the applicant’s bank receives the exporter’s documents and performs another
round of screening on all parties involved including the TYZ. Again, no alerts are raised.

Applicant bank pays beneficiary’s bank and debits the account of their client. Applicant bank releases BL to importer

and closes transaction

the coast is clear, isn’t it?

It’s important to reiterate that throughout the entire screening process, this transaction did not generate any alerts
through the automated screening system. Once payment is settled no further tracking or checks will be performed.
As is typically the case, the bank’s compliance team would only see the case if it was escalated from their operations
colleagues, meaning they never got a chance to investigate this particular case. The importance will soon be revealed.

Case Study 1 | 06
 tian ying zuo revealed
According to an article published by the Financial Times on October 28 2019, the TYZ5,
(IMO 9224295) involved in the above transaction, was suspected of carrying Iranian
crude6. A satellite image showed the TYZ meeting an Iranian tanker in the Straits of
Malacca on July 10th, 2019 . After that, data transmitted by the TYZ showed that the
vessel was deeper in the water (a “deeper draft”). This suggests that it had taken on
cargo from the Iranian Tanker (a ship-to-ship transfer - STS).

what's the risk?

Given the timing of the shipment, along with the STS transfer involving the TYZ, it is highly likely this transaction involved
Iranian crude oil. What liability do the banks have in this scenario?

Primary and secondary sanctions administered by OFAC, the US State Department, and the US Department of Justice (DOJ)
threaten severe penalties for persons trading Iranian crude as well as Iran-related transactions involving the US financial
system. This scenario involved a subsidiary of a US financial institution and a USD payment likely cleared through a US
correspondent account.

The banks, as well as the exporter, importer, vessel operator, executives, and other parties involved in the transaction, could
all be exposed to investigation, financial penalties, and secondary sanctions. The banks may also be obligated to file a
Suspicious Activity Report (SAR) with their national AML regulator or Financial Intelligence Unit (FIU)8.

how could they have known?

Analyzing the behavior of the TYZ would likely reveal that the TYZ was involved in the dark Iranian crude trade
well before this incident. Below are two visits to the Persian Gulf taken by the TYZ. On the left is the TYZ and on
the right is the Pacific Bravo, a tanker named by OFAC on May 28, 2019 as suspected of taking part in a shipment
targeted by US secondary sanctions. Notice the similarity?

The TYZ path The Pacific Bravo path

Iraq Iraq

Reported Destination Reported Destination

Kwait Kwait
Iran Iran
Basra Oil Terminal, Iraq Basra Oil Terminal, Iraq
Kharg Island Kharg Island
Oil Terminal, Iran Oil Terminal, Iran

Sanctioned Goods AIS Transmissions

Transmision turned
Stopped
off Sanctioned Goods

Saudi Arabia Saudi Arabia

AIS Transmissions Stopped

Case Study 1 | 07

5
Renamed Judy II
6
US identifies Chinese tankers carrying Iranian oil (Financial Times)
Both vessels turned off their AIS transmissions before arriving at their reported destination, then turned around
without openly visiting a port, unexpected behavior for a ship that costs thousands of dollars a day to operate.
This is a consistent pattern displayed by vessels covertly trading in Iranian oil and looking to avoid detection.
A suspicious vessel such as this one could be added to internal watchlists to be flagged for enhanced due-
diligence before processing a transaction or onboarding a client.

what could have been done?

By screening for suspicious gaps with an automatic identification system (AIS),

transmissions could have detected “dark” activity taken by TYZ in Iranian waters
between May 29th, 2015 and June 6th, 2019

An audit of TYZ’s historical area of operations would have revealed it had visited
Iranian waters multiple times in the previous 12 months.

Reviewing the identity transmission profile of the TYZ would have revealed that
TYZ changed its name, country flag, ownership, and other identifiers, an unusual
number of times over the past few years.

If enhanced sanction screening checks had been integrated into banks’ front-line level
one compliance controls, the transaction would have been flagged as soon as the TYZ’s
name was provided, as early as July 4th, 2019. Once the case was escalated to the bank’s
compliance team, an investigation would have likely revealed the attempt to conceal the
true origin of the TYZ’s cargo, allowing the bank to interdict the transaction and avoid a
potentially damaging outcome.

Case Study 1 | 08
dirty coal:
a case study in concealed origin of north korea coal
U.S and UN sanctions against North Korea include prohibitions on the transfer of goods such as oil, coal, and
luxury goods to or from the country. The North Korean government frequently attempts to circumvent these
sanctions. Advisories in 2019 from both OFAC and the UN Security Council Panel of Experts on North Korea
detailed deceptive shipping practices involving sanctioned North Korean trade7. Based on these advisories,
financial institutions are now beginning to screen for vessels and other parties named on sanctions lists.
How does your sanctions screening solution measure up?

consider the following scenario:

Two banks, including the Asia-based subsidiary of a U.S. financial institution, processed a Letter of Credit (LC)
may have financed a shipment covered by both UN sanctions and U.S. primary and secondary sanctions on the
export of North Korean coal. Neither banks’ screening software flagged the transaction as none of the entities
involved were on sanctions lists. A careful examination of ships activities would have immediately raised
numerous red flags.

the details
On January 4, 2019, Vietnamese energy producer, Superior Energy JSC, asked its lender, a Vietnamese bank
with correspondent accounts with a U.S. bank, to open an LC in favor of AKA PJSC, a large firm exporting
coal from Russia to southeast Asia. The SWIFT Message sent by the applicant’s bank to the exporter’s bank
specified the product, coal, at a value of $2.7M USD. The loading port named was Vostochnyt, Russia, and the
port of discharge was Cam Pha, Vietnam. At this stage in the LC transaction, the carrying vessel was not yet
known to the applicant or beneficiary’s bank.

While this scenario is based on a real case, names of the involved parties and the particulars of the
transaction were changed to protect their privacy. The name of the ship and its activities are public knowledge
as reported in international media.

Case Study 2 | 09

7
See advisories listed in introduction
 dirty coal
standard screening
Importer applies for Letter of Credit (LC) to applicant bank

applicant first round of screening

During the first round of screening, the applicant’s bank performs its standard screening
checks on the payment beneficiary (exporter), beneficiary bank in Russia, loading and
discharge ports, and cargo. There are no sanctions hits and the underlying cargo and
transaction value fit well within the standard business profiles of importers and exporters.

Applicant bank requests confirmation from beneficiary bank

beneficiary first round of screening

Upon receiving the LC advice from the issuing bank, the beneficiary bank, a Russia-
based bank, also performs screening checks on all known parties based on available
documentation, as well as the transaction details. Finding no hits, the beneficiary bank
advises the LC to its customer, the exporter/beneficiary.

On February 8, almost a month after the LC is issued, the carrier sends a Bill of Lading (BL) to the exporter
claiming the coal has been shipped on the LUCKY STAR. On February 9th the exporter forwards the BL to
beneficiary bank and requests payment.

beneficiary bank second round of screening

On February 9th, upon receiving the exporter’s documents, the beneficiary bank performs
standard screening on all parties invovled, including the vessel, LUCKY STAR, now listed in
the BL. None of the parties is found on a sanctions list, and no alerts are raised.

Beneficiary bank pays the exporter according to the terms of the LC and seeks repayment from the applicant’s
bank.

applicant’s bank second round of screening

On February 10th, the applicant’s bank receives the exporter’s documents and performs
another round of screening on all parties involved, including the LUCKY STAR. Given the
high-risk profile of the product and geography they also trace the ownership of the ship
and review relevant UN and OFAC advisory lists of vessels possibly involved in trade with
North Korea. Once again, no alerts are raised.

Applicant bank pays the beneficiary's bank and debits the account of their client. Applicant bank releases BL to
importer and closes transactions.

the coast is clear, isn’t it?

It’s important to reiterate that throughout the entire screening process, this transaction did not generate any
alerts through the automated screening system. Once payment is settled no further tracking or checks will be
performed. As is typically the case, the bank’s compliance team would only see the case if it was escalated from
their operations colleagues, meaning they never got a chance to investigate this particular case. The importance
will soon be revealed.
Case Study 2 | 10
Over the past year the LUCKY STAR operated in a highly unusual manner for a ship of its type. It was “dark” for
long periods of time and had zero port calls detected. Such behavior is highly unexpected behavior for a ship
that costs thousands of dollars a day to operate, unless it was done for a reason, such as disguising the true
origin of its cargo.

AIS tracking data further shows that the LUCKY STAR made several trips to the Gulf of Tonkin area to discharge
cargo, but there were no port calls indicating the ship was loaded prior to this. Every such voyage to Vietnam
started after an extended period of dark activity not far from DPRK waters. This is a strong signal of disguising
the origin of sanctioned cargo.

With the right data and analysis, a ship featuring a suspicious pattern of behavior such as the LUCKY STAR
could be flagged for enhanced due-diligence and continuous monitoring at the time of transactional screening.
An extra step would have been to flag the vessel beforehand as a potential designation risk, and add it to an
internal watch-list. This could enable automatic escalation for enhanced due-diligence before processing a
transaction or onboarding a client known to be associated with the vessel.

what could have been done?

While at the time of the transaction9 the vessel was not found on any sanctions list, its past
behavior was consistent with a known pattern of covert DPRK coal trading.

Screening the LUCKY STAR’s historical transmission records would have

revealed multiple periods of dark activities in the Gulf of Tonkin area, and
long periods of dark activity around the DPRK.

A review of the LUCKY STAR’s operations would show that it deviated from
the expected pattern for a ship of its type - in this case it had fewer port calls
than normal.

Matching the BL against the actual port called during the voyage would have
revealed discrepancies between the documentation and the precise details
of the trade.

If enhanced screening checks would have been integrated into the banks’ frontline
level-one compliance controls, the transaction would have been flagged as soon as the
LUCKY STAR’s name was provided to the banks, as early as Feb 8th, 2019. Once the case
would have been escalated to the banks’ compliance team, an investigation would have
likely revealed the attempt to conceal the true origin of the LUCKY STAR’s cargo. This
would have enabled the bank to interdict the transaction and avoid the potential costs,
complications, and reputational risks of doing business with a party that would soon be
identified in the UN Report of March 5, 2019 and OFACs DPRK advisory, not to mention
multiple media outlets such as the Times10.

Case Study 2 | 12
9
The LUCKY STAR was later named in the March 2019 UNPanel of Experts Report on North Korea Sanctions March 2019.
10
OFAC North Korea Advisory 2019.
implementing know your vessel (kyv)

sanctions screening with kyv

Building an effective detection program requires incorporating KYV into existing operational processes. That enables
screening to take place in time to interdict potential risk. Consider, for example, a typical LOC transaction where a
KYV solution has been implemented.

Conclusion | 13
 LOC Application

Initial Round of Screening

Cargo Shipped

SECOND ROUND OF SCREENING

Here is where the vessel is screened

Trade operations receive and enter the vessel name or IMO into an integrated
screening system or standalone service

The software links the vessel name with its IMO using the latest ship registry
information and data fusion processes.

! The software returns a flag if the vessel has been rated as high risk. It also
provides a detailed explanation of the relevant behavioral risk indicators.

The case is escalated through a workflow tool to a compliance officer for more in-
depth investigation.

The compliance officer opens the case in a dedicated vessel analytics system
and reviews the risk indicators to determine if the particular vessel has a high
risk of attempting to evade sanctions.

The compliance officer requests additional information from the client to clear
the case. For example, they can ask to verify the origin of cargo with additional
documentation, such as a certificate of origin.

!
If the response was not sufficient to address concerns, the compliance officer
would make a decision to recommend to the business to reject the transaction.
The system automatically generates a supporting report with the relevant risk
indicators highlighted in the vessel activity timeline.

The compliance officer informs the operations team or account manager as to

why the decision to decline the transaction was made, and instructs them to
deny the settlement for an LC based on the bank’s standard terms regarding
sanctions compliance.

Conclusion | 14
 what should your kyv solution include?

Immediate vessel clearance recommendations for screening live transactions

Automatic identification of vessels associated with of deceptive shipping practices

Dark activity algorithms calibrated to filter out AIS lost signals

Searchable history of ‘Ship to Ship’ meetings

Ability to flag anomalous behavior such as uneconomic operational patterns

Investigative tools such as historical logs of activities and a dynamic map

kyv red flags

AIS disablement

suspicious ship -to - ship meetings

identity tampering

loitering in sanctioned country waters

staying safe in a sanctions world

Compliance and trade teams across the maritime supply-chain now recognize that existing sanctions screening
processes are not enough to help them know which vessels are safe for business. To mitigate sanctions evasion
risk and meet regulatory requirements, they are incorporating behavioral analysis to actively identify potential
sanction evaders before government authorities designate them. Using these new technologies allows them to
protect their organizations while keeping business on track.

To see how vessel behavior screening could help your business, visit wnwd.com/compliance or reach out to Ron
Crean, VP Commercial at ron@wnwd.com.

Conclusion | 15

Windward thanks Aamar Ahmad from London based Sigma Risk and Nick Turner, Of Counsel, Steptoe & Johnson Hong Kong
for contributing their thoughts to this report.