THE RISK AND COMPLIANCE GUIDES

Shining a light
on compliance
The OFAC knowledge needed to keep your business afloat
Last updated: February 2024
The context
The Office of Foreign Assets Control (OFAC) has
issued numerous shipping advisories to alert
and inform those connected to the maritime
industry of current and emerging deceptive
shipping practices, as well as sanctions/export
control circumvention and evasion tactics.
The guide, issued in December 2023, provides
additional recommendations on how non-US
financial institutions can take steps to identify and
minimise their exposure to activity involving Russia’s
military-industrial base and those that support it.
The new guidance continues to
expand what was outlined in May
2020, emphasising the fact that
baseline customer due diligence (CDD)
procedures are no longer sufficient
measures.
While the previous guidance uses notably measured
language throughout, it can no longer be denied that
actors in the maritime industry are now expected to
assume greater responsibility for ensuring sanctions
compliance. In short, there is now a heightened need
for transparency, efficiency, and absolute accuracy.
To provide clarity in an increasingly complicated
landscape, this white paper outlines what exactly the
latest guidance is, and why compliance is necessary.
It defines the specific challenges it presents to trade
finance operations, the consequences of not adhering
to it, and the risk mitigation methods you can take to
avoid US financial lock-out.
The risk and compliance guides: Shining a light on compliance
OFAC and what it means to you
OFAC uses restrictions and the blocking of assets to
accomplish US foreign policy and national security
goals. The US plays an important role in the
international fight against money laundering and
terrorist financing, among other financial crimes. This is
achieved through the enforcement of sanctions against
countries, entities, and individuals involved in such illicit
activities.
Beyond sanctions, OFAC’s enforcement actions can also
involve criminal and civil penalties. For example, in
2022, OFAC imposed a $6,131,855 penalty against a
freight forwarding and logistics company for causing US
persons to violate sanctions through the receipt of
2,958 payments related to shipments involving blocked
persons as well as North Korea, Iran and Syria. Since
violations of economic sanctions are strict liability
offences, fault or intent does not need to be proven;
OFAC only needs to determine whether an organisation
has failed to adhere to its standards. This is particularly
relevant to financial institutions that rely on third-party
software to screen for potential violations.
The heightened focus on compliance becomes even
more crucial given the developments first announced
by the Division for Counter Threat Finance and
Sanctions at OFAC in March 2020, which highlighted
critical areas of attention for the maritime trade finance
sector. These developments were subsequently
expanded upon in the communiqué issued two months
later. In it, explicit guidelines for compliance
programmes were laid out with a notable emphasis on
the active monitoring of vessels.
2
Deceptive shipping practices
As an overarching theme, the May 2020 guidance puts
the importance of complete, accurate shipping and due
diligence documentation firmly in the spotlight. Such
records have always been essential to ensure that all
parties involved in a transaction have a thorough
understanding of the goods, vessels, and counterparties
associated with any given shipment. But this guidance
should dispel any doubt that the US government is
focused on the shipping industry as a means by which
to enforce US primary and secondary sanctions.
There are several footnotes within the guidance which
reference the fact that the recommendations are not
legal requirements, and therefore, they should not be
interpreted as such.
The guidance covers
8 specific areas for focus
The risk and compliance guides: Shining a light on compliance
However, considering strict liability, a contravention will
likely be treated as doing exactly that. While there is no
formal requirement for a compliance programme, OFAC
does expect all companies to implement a 'risk-based
approach' to sanctions compliance by developing,
implementing, and routinely updating a sanctions
compliance programme (SCP). While the specifics of
each risk-based SCP will inevitably vary depending on
the organisation, every programme should encompass
at least five fundamental components of compliance:
senior management commitment, risk assessment,
testing and auditing, internal controls, and training.
OFAC will assess companies operating in the maritime
industry, or those interacting with them, against these
criteria when evaluating the effectiveness of their
compliance programmes in enforcement scenarios.
1: Disabling or manipulating the
Automatic Identification System (AIS)
2: Physically altering vessel identification
3: Falsifying cargo and vessel documents
4: Ship-to-ship (STS) transfers
5: Voyage irregularities
6: False flags and flag-hopping
7: Complex ownership or management
8: Spoofing
3
1: Disabling or manipulating the Automatic
Identification System (AIS)
The May 2020 OFAC guidance focuses heavily on the
use of AIS monitoring, encouraging companies to use it
to identify potential evasion activity. Previously, OFAC
had only suggested that companies 'monitor' AIS when
vessels were operating in high-risk areas.
Furthermore, the guidance suggests that companies
should be monitoring AIS using a risk-based approach.
In its sector-specific recommendations, OFAC
recommends that parties should 'continuously monitor
vessels' or have the 'capability to monitor AIS
transmissions continuously'. There is also an implicit
requirement for companies to have the ability to
research AIS history.
Fully applying these suggestions would shift many
compliance programmes from reactive to proactive AIS
monitoring throughout the entire lifecycle of trading or
counterparty relationships. It is commonly
acknowledged that AIS technology has imperfections
prone to manipulation and exploitation, which
underscores the importance of sourcing data from
reliable sources with expert guidance.
2: Physically altering vessel identification
Illicit activities have gone undetected as vessels have
painted over vessel names and IMO numbers to obscure
their identities and therefore avoid exposure. The May
2020 guidance reiterates that a visible name and IMO
number are an obligatory addition for cargo ships of
300 GT and over. The IMO number is a permanent and
unique identifier, irrespective of change of name or
ownership.
The risk and compliance guides: Shining a light on compliance
3: Falsifying cargo and vessel documents
OFAC has increasingly recommended that all parties
conduct 'know your customer’s customer' (KYCC)
analyses, which involves understanding the entities,
recipients, goods, and vessels involved in each
shipment, as well as acquiring ultimate beneficial
ownership (UBO) information. This is to prevent the
falsifying of documents and understand he underlying
parties within the transaction. The May guidance
extends these recommendations, suggesting
heightened due diligence for vessels in high-risk
sanction evasion areas. UBO checks may include
passport details, business and residential addresses,
phone numbers, and email addresses of individual
vessel owners where permitted by laws and
regulations.
4: Ship-to-ship (STS) transfers
This refers to the transfer of cargo between ships at sea,
which can be a perfectly legitimate practice. But the
May 2020 guidance reinforces that STS transfers that
take place at night or in areas determined to be high-
risk should be subject to heightened due diligence, as
they are frequently used to evade sanctions by
concealing the origin or destination of cargo.
The guidance issued in March 2020 focuses specifically
on the Iranian oil sector and its related supply chain,
but its contents are applicable elsewhere also. The need
to monitor any possible illicit trading through
ship-to-ship transfers is explicitly mentioned.
4
5: Voyage irregularities
It is encouraged that routes and destinations which
deviate from normal business practices are scrutinised
across the industry and by all parties. The transit and
transhipment of goods should be a particular area of
focus, alongside indirect routing and unscheduled
detours, so that the ultimate destination and origin of
cargo or recipients is always apparent.
6: False flags and flag hopping
The establishment of the Registry Information Sharing
Compact (RIS Compact) was announced in March 2020.
It is an agreement between vessel flag registries to
establish information sharing regarding what it refers to
as 'bad' actors.
It aims to discourage flag hopping (changing the flag of
a ship to reduce costs and avoid laws) by sanctioned
parties and share this information with relevant
authorities where laws permit. Initial signatories to the
RIS Compact included Panama, the Marshall Islands,
Liberia, St. Kitts and Nevis, Comoros, Honduras, and
Palau – although progress on information sharing is still
in its early stages.
An implied KYCC obligation
The May 2020 guidance extends existing Know Your
Customer’s Customer (KYCC) obligations by specifically
recommending that ship owners, operators, charterers,
and classification societies require that counterparties
maintain an 'adequate and appropriate' compliance
policy. While OFAC has frequently commented on the
risks that customers in the downstream supply chain
can create for companies, this is its most explicit
recommendation to date that these parties implement
a KYCC system.
The risk and compliance guides: Shining a light on compliance
7: Complex ownership or management
It is recognised that illict actors frequently exploit the
inherently intricate nature of global shipping. Its
multifaceted framework, characterised by numerous
interactions among various parties even for simple
transactions, rendering it susceptible to manipulation.
This manipulation can take various forms, including
intricate business arrangements often involving shell/
shelf/front companies, aimed at concealing the true
beneficial owners and thus avoiding accountability for
any wrongdoing. ‘Bad actors’ may also employ tactics
such as frequent changes in company ownership or
management, or manipulation of the International
Safety Management Code (ISM). Therefore, when the
private sector is unable to reasonably ascertain all the
actual parties involved in a transaction, conducting
additional due diligence to ensure its legality and
compliance with sanctions is advisable.
8: Spoofing
Spoofing occurs when a vessel deliberately transmits
false AIS data to pretend that it is at a certain location
when it actually is at another. According to OFAC’s
regulatory guidance from April 2023, this is an
increasingly common sanctions evasion tactic as
operators and traders attempt to find ways to
circumvent Russian oil price restrictions in light of the
Russia-Ukraine war.
5
Why this matters now
Contrary to the Bank Secrecy Act (BSA), the regulations
issued by OFAC apply not only to US banks, including
their domestic branches, agencies, and international
banking facilities – they also extend to their foreign
branches, overseas offices, and subsidiaries.
U.S. President Joe Biden’s December 2023 amendment
to Executive Order (E.O.) 14024 has broadened OFAC's
authority even further, enabling it to target non-US
financial institutions engaging in significant transactions
with entities designated under the order.
These changes empower OFAC to impose sanctions on
such institutions, especially those involved in specific
sectors of the Russian economy, such as technology,
defence, construction, aerospace, or manufacturing.
OFAC has emphasised the US Government’s
focus on the maritime sector
The risk and compliance guides: Shining a light on compliance
Additionally, foreign financial institutions may face
sanctions for facilitating transactions related to Russia's
military-industrial base, including the sale, supply, or
transfer of specified items.
Under these updated provisions, OFAC
can enforce full blocking sanctions or
restrict correspondent accounts in the
US for non-compliant foreign financial
institutions.
This underscores the urgent need for those in the
maritime trade to strengthen their risk-based compli-
ance programmes to align with the evolving sanctions
landscape and mitigate their exposure to prohibited
transactions and entities. Failure to establish and
maintain compliance could result in extensive penalties,
potentially disrupting even the most established
industry players.
6
Challenges the regulatory guidance presents to trade
finance operations

OFAC's move to formalise and offer guidance on the development of

compliance programmes sends a clear message about its expectations
and the future. It emphasises the importance of having comprehensive
and effective compliance policies in trade finance, warning that failure to
comply will be viewed unfavourably in the event of breaches. Complicating
matters further, international directives from sanctioning bodies are
constantly evolving, demanding continuous attention to compliance.

The primary challenge is ensuring access to, and understanding of the latest information
regarding sanction programs and regulations at all times, without exception.

Secondary to this is the challenge of implementing the regulations effectively in practice.

Challenges the sector faces

Geopolitical risks volumes, and is presented in formats that require

Geopolitical conflicts affect the maritime trade finance
sector on a global scale. Among these conflicts, two
significant events have garnered widespread attention:
the Red Sea crisis and the Ukraine War.
The Red Sea serves as a critical maritime route for
international trade, facilitating the movement of goods
between Europe, Asia, and Africa. However, escalating
tensions in the region, including piracy threats,
geopolitical rivalries, and military confrontations, pose
serious disruptions to trade flows and increase
operational risks for vessels and cargo. According to our
recent data, the fleet capacity that moved through the
Suez Canal fell more than 60% in the period from 18
December 2023 to 7 January 2024, compared to the
corresponding period last year.
time-consuming processing.
Time pressures
The relentless pressure on trade finance operations to
conduct checks quickly can result in frequent human
errors and inaccuracies, increasing the risk of
overlooking crucial information.
Integration
Inefficient and non-integrated software and processes
hinder effective management. Disconnected systems
and processes add complexity to research and the
sharing insights and reports between teams. A cohesive
system across departments, companies, and territories
allows for better communication and a more
streamlined process.

Similarly, the ongoing war in Ukraine has led to Fluidity of data

heightened uncertainty. Countries around the world
continue to announce new restrictions on various
Russian individuals, entities, and industries; this is
expected to persist with the prolonged conflict.
Technology
The ever-evolving technologies involved in the multitude
of data sources that trade finance operations deal with
daily pose a significant challenge to staying compliant.
Data origin
This challenge is exacerbated by the fact that maritime
data originates from various territories, arrives in large
While sailing schedules are typically planned in
advance, the data involved can change multiple times
during a single journey. Failing to keep up with these
changes means failing to comply. Trade finance
operations require access to live data in a consistent
and easily understandable format.
Compliance
Above all else, it is imperative to maintain compliance
at every stage, in every transaction, and throughout
every voyage. Any software or processes lacking a high
level of accuracy pose a considerable challenge for
trade finance operations.

The risk and compliance guides: Shining a light on compliance 7

The implications of not adhering
to the guidance

OFAC considers non-compliance with sanctions to be a

serious threat to both national security and foreign
relations.

As a result, the ramifications of non-

compliance have the potential to be
catastrophic. This is regardless of The implications
whether the action in question was
the result of being uninformed or
negligent. There are no exceptions US Financial Lock-Out
and highlights the harshness of
strict liability. You will be unable to do business, process any
transactions or have any commercial dealings with
Those who breach OFAC sanctions can face severe any US entity and vice versa until OFAC lifts the order.
legal repercussions. Violations could lead to
enforcement actions, criminal and financial penalties,
including exclusion from the US financial system. Implications also include:

Voluntary self-disclosure Addition to a sanctions list

OFAC has further incentivised companies through its
voluntary self-disclosure (VSD) programme. This
Civil Enforcement
enforcement approach is consistent with the US
Department of Justice’s updated policy on VSDs, which Criminal Penalties
was issued in December 2019 and includes a
presumption that companies that self-report 'will Loss of Reputation
receive a non-prosecution agreement and not have to
pay a fine, absent aggravating factors'. However, if
aggravating factors are present, such as 'exports of
items known to be used in the construction of weapons
of mass destruction', 'repeated violations' and 'knowing
involvement of upper management in the criminal
conduct’ this may still result in enforcement action'.

The risk and compliance guides: Shining a light on compliance 8

Risk mitigation measures
Between 80-90% of the world’s international trade is reliant on trade
financing. It’s therefore no surprise that the sector has long been
identified as a potential conduit for money laundering and facilitators
of sanction evasions, resulting in it increasingly being placed under the
spotlight. But this vulnerability can be addressed.
Mitigation involves the continuous monitoring,
assessment, and identification of vulnerabilities. These
weaknesses may exist within personnel, roles, processes,
audit trails, tools, data sources, technology, or
intelligence – any aspect that could hinder seamless
operations and the essential accuracy required to
prevent sanctions violations.
An effective compliance programme is not only a risk
mitigation measure but also a positive value proposition
for every company, including large financial institutions
and companies with no physical presence in the US.
The eight pillars of mitigation
Institutionalise sanctions compliance programmes
Establish AIS best practices and contractual
requirements
Monitor ships throughout the entire transaction
lifecycle
Know Your Cargo
Know Your Customer’s Customer
Exercise supply chain due diligence
Contractual language
Industry information sharing
Sanctionable activity or the processing of prohibited
transactions can be mitigated by implementing the
following measures:
Institutionalise sanctions compliance programmes
Adopt a single global sanctions policy standard – the
implementation of US standards on an international
scale has the potential to both simplify processes and
The risk and compliance guides: Shining a light on compliance
ensure that OFAC sanctions, (which come with the
heftiest civil and criminal penalties globally), are adhered
to. However, it should be acknowledged that all OFAC
sanctions aren’t necessarily accepted by the EU.
Take advantage of all resources – OFAC is constantly
updating its information and is a resource in itself, but
the sheer volume of material available can be
time-consuming to sift through and digest.
Organisations that provide commercial shipping data,
such as ship location, ship registry information and ship
flagging information, should be utilised to its best effect.
Similarly, those that offer technologies and systems that
streamline the access to, and use of, such data will prove
invaluable for both compliance and competitive
advantage. These systems should then be incorporated
into due diligence best practices.
Adhere to Financial Action Task Force standards – these
are designed to combat money laundering, as well as
the financing of terrorism and its proliferation. They state
that the adoption of stringent due diligence policies and
procedures by financial institutions and non-financial
gatekeepers is a necessity. Furthermore, financial
institutions should exhibit beneficial ownership transpar-
ency. This is to impede development and help ensure
that these beneficial owners (along with their associates
and facilitators) are not able to operate in secrecy.
Consider partial or full-scale automation – the
automation of data aggregation and alerts would vastly
simplify the screening process, whilst simultaneously
saving time and considerably minimising the margin for
error. Likewise, automated breach reporting procedures
would significantly accelerate incident response times.
9
Establish AIS best practices and contractual
requirements
Remain consistent and rigorous with regard to AIS
manipulation – any vessels that appear to have turned
off their AIS, especially those operating in the areas
determined to be high risk, should be investigated by
trade finance operations but also by ship registries,
insurers, charterers, vessel owners, and port operators.
It is strongly recommended that you research a vessel's
history to detect any past manipulation of AIS signals
and to actively monitor for AIS manipulation or
disablement during cargo transit.
Monitor ships throughout the entire transaction
lifecycle
Review all applicable shipping documentation – it is
encouraged in the May 2020 guidance that complete
and accurate shipping documentation should be
requested from all individuals and entities processing
transactions pertaining to shipments without exception
(including on vessels leased to third parties) and
reviewed accordingly. Details of the underlying voyage
should be thoroughly covered, and reflect the relevant
vessel(s), flag, cargo, origin, and destination. It is
likewise recommended that documents relating to STS
transfers should always demonstrate that the
underlying goods in question were delivered to the port
listed on the shipping documentation.
Know Your Cargo
The concept of ‘Know Your Cargo’, as outlined by the US
government’s December 2023 quint-seal compliance
note, introduces a new layer of significance to the
well-established practice of 'Know Your Customer'
(KYC). Entities operating in maritime and other
transportation industries are strongly advised to
institute or confirm the existence of appropriate
compliance measures that protect against the
manipulation of AIS data, the falsification of cargo
documents and illicit ship-to-ship transfers, that could
demonstrate risks related to the cargo.
Knowing Your Customer’s Customer
Knowing Your Customer’s Customer (KYCC) helps to
ensure that there is an internal awareness of all the
activities and transactions that a trade finance team
engages in – in short, it’s a matter of continuing to
conduct and extend existing risk-based due diligence.
This should also extend to all the parties, geographies,
and countries of origin and destination of all the goods,
involved in any underlying shipment. The May guidance
goes as far as to suggest photographic identification of
each customer’s beneficial owner, for example.
The risk and compliance guides: Shining a light on compliance
This includes companies and individuals, but also
vessels, vessel owners, and operators involved in any
contract, shipments, or related maritime commerce.
Exercise supply chain due diligence
Supply chain due diligence is recommended, including
the verification of origin and recipient checks for ships
that conduct ship-to-ship transfers, requesting copies of
applicable export licenses and completing shipping
documentation. Companies are also encouraged to
review the details of any underlying voyage.
Verify all cargo origin – the source of all goods, though
especially petroleum or petroleum products, must be
corroborated, ideally with export licences. This need is
heightened when goods are transported or delivered by
vessels previously exhibiting deceptive behaviours or
where connections to sanctioned persons or locations
are suspected. The testing of cargo composition to
reveal area-specific chemical signatures can be a huge
help here, though there is also a significant benefit to
publicising cases where certificates of origin are known
to be falsified. Efforts to resell illicit commodities to
alternative customers can be deterred in this way.
Similarly, private sector maritime entities are
encouraged (in line with their internal risk assessment)
to review the details of the underlying voyage. The May
guidance specifies that this includes the vessel, cargo,
origin, destination, and all parties to the transaction.
Communicate with all relevant partners – clear
communication is a critical step for international
transactions, especially those that involve differing or
multiple sanctions regimes.
Review contractual language
The May 2020 guidance specifies that trade finance
operations should incorporate the new compliance best
practice recommendations in their contract documents
wherever possible.
Industry information sharing
Facilitate and engage in industry information sharing
where laws permit. Successful sanctions compliance
programmes benefit greatly from the sharing of industry
challenges, threats and risk mitigation measures.
In summary, all companies with marine sector exposure
should closely review OFAC’s recommendations and
assess whether their current compliance programme
meets the standards expressed.
10
Access the new standard in
maritime trade risk analysis
Evaluate how sanctions – and links to sanctioned entities – affect your financial
institution with Lloyd’s List Intelligence’s risk evaluation suite of services.
Powered by a combination of in-depth sector expertise, advanced data,
analytics and AI, our solutions let you achieve maximum regulatory
compliance without compromising on efficiency.

To find out more about how Lloyd's List Intelligence can help
your business win, please contact us on:

America Tel: +1 646 477 5790

EMEA Tel: +44 20 8052 0628
APAC Tel: +65 9027 3024
lloydslistintelligence.com/findoutmore

name