Ship-to-Ship (STS) Transfers: A Sanctions OSINT Explainer

A ship-to-ship transfer is the at-sea transfer of cargo from one vessel to another, typically a tanker-to-tanker transfer of crude oil, petroleum products, or liquefied gas conducted at anchor or while drifting in international waters. STS is a routine and legitimate maritime operation governed by the IMO's Marine Environment Protection Committee under Resolution MEPC.186(59), by Chapter 8 of MARPOL Annex I, and by the OCIMF/ICS Ship-to-Ship Transfer Guide. It is also the central operational mechanism by which the Russian shadow fleet converts sanctioned, price-capped Russian-origin crude into cargo that arrives at refineries with a fresh bill of lading describing the contents as Malaysian blend, Kazakh CPC, or simply "Middle East crude," generated on the receiving vessel after the transfer is complete. This page explains what an STS transfer is, how the shadow fleet abuses it, where the principal global STS hotspots are, and the five-step open-source workflow we and other investigators use to identify a suspected shadow-fleet STS event from public data.

TL;DR

  • STS is a legitimate, century-old maritime operation governed by IMO Resolution MEPC.186(59) and Chapter 8 of MARPOL Annex I, used for lightering, cargo blending, bunkering, and trans-shipment.
  • Shadow-fleet abuse follows a four-step pattern: an AIS broadcast gap on approach to a permissive anchorage, an alongside transfer between two tankers, a re-issued bill of lading on the receiving vessel, and onward sale of the cargo as non-Russian-origin.
  • The principal anchorages are the Laconian Gulf (Greece), Fujairah outer anchorage (UAE), the waters off Ceuta, the Gulf of Oman holding areas, the outer anchorages off Singapore, the West African anchorage off Lome (Togo), and operations west of the Suez Canal.
  • The EU 14th sanctions package of 24 June 2024 introduced an explicit prohibition on STS transfers of Russian-origin crude conducted in EU territorial waters and EEZs and a port-access ban on vessels suspected of conducting such transfers.

What an STS transfer is

An STS transfer involves two vessels — conventionally the larger as the "STBL" (ship-to-be-lightered) and the smaller as the "service vessel," though in shadow-fleet practice the roles are frequently inverted — mooring alongside one another, deploying purpose-built Yokohama fenders to prevent hull contact, connecting cargo hoses, and pumping cargo from one to the other under the supervision of an STS superintendent or "POAC" (person in overall advisory control). The operation is regulated under IMO Resolution MEPC.186(59) (adopted 2009), incorporated into MARPOL Annex I Chapter 8, which requires advance notification to the relevant coastal state, an approved STS operations plan, and compliance with the OCIMF/ICS guide.[1][2]

STS exists because the global tanker fleet operates at scales that no single port can accommodate end-to-end. The principal legitimate use cases are: lightering — transferring cargo from a Very Large Crude Carrier (VLCC, around 320,000 deadweight tonnes) to one or more smaller Aframax or Suezmax tankers so the receiving vessels can enter ports with depth restrictions; cargo blending — combining crudes of different quality grades to meet a buyer's specification; bunkering — transferring fuel oil to a vessel underway; and trans-shipment — moving cargo between voyages where the origin and destination ports are served by different vessel classes. The volume of legitimate global STS activity is substantial; the operation is routine, documented, insured, and inspected.

How shadow-fleet STS works

The shadow-fleet abuse of STS follows a consistent four-step pattern documented by KSE Institute, CREA, Lloyd's List Intelligence, and Windward across hundreds of identified events between 2022 and 2026.[3][4][5]

Step one: the AIS gap. Under SOLAS Chapter V Regulation 19, all tankers of 300 gross tonnage and above on international voyages must continuously broadcast AIS data. A shadow-fleet tanker approaching an STS anchorage typically ceases AIS broadcast some hours before arrival and resumes broadcast some hours after departure. The reported track is therefore a clean voyage from a Russian load port to a declared discharge port, with a gap of six to seventy-two hours in the middle.

Step two: the alongside transfer. During the AIS gap, the suspect tanker arrives at a permissive anchorage, moors alongside a second tanker (which may or may not also be in AIS blackout), and transfers cargo. The transfer typically takes between six and twenty-four hours for a full Aframax-to-Aframax operation. From above — visible on Sentinel-2 if the satellite happens to pass overhead during the window — the operation produces a distinctive side-by-side rectangular signature of roughly 250 metres by 90 metres.

Step three: the re-issued bill of lading. On completion of pumping, the master of the receiving vessel issues a new bill of lading describing the cargo by reference to the receiving vessel's voyage. The cargo may be "blended" on paper with non-Russian crude (which may or may not actually be present in the tank), described as a different crude grade entirely, or simply re-labelled with a different load port and load date. The G7 price cap binds G7-domiciled insurers, banks, and shipowners to the documentation generated at the point of sale; a paper trail that begins on the receiving vessel after STS is, on its face, outside the cap perimeter.

Step four: onward sale as non-Russian-origin. The receiving vessel sails into a refinery or a storage terminal, the cargo is discharged against the re-issued bill of lading, and a quality certificate is generated by an independent surveyor whose sampling reflects the receiving-vessel tank contents rather than the original Russian load. The cargo enters the global market as a non-Russian product. The original Russian load tanker has, on its declared AIS track, made a voyage that does not show a transfer.

Where it happens

STS anchorages are selected for a combination of weather, water depth (typically 25 to 50 metres for safe anchoring of laden tankers), distance from territorial-water enforcement (or, in some cases, presence inside a sympathetic territorial sea), and proximity to onward refinery markets. The principal shadow-fleet STS hotspots identified in published reporting as of 2024-2026 are:

  • Laconian Gulf, Greece. The sheltered bay south of Kalamata in the southern Peloponnese has been the single most active shadow-fleet STS zone for Russian-origin crude bound for South Asian markets, with Lloyd's List Intelligence and Greek environmental NGO reporting documenting multiple simultaneous tanker pairings throughout 2023-2025.[5][6]
  • Fujairah outer anchorage, UAE. The deep-water anchorage east of the Strait of Hormuz is a primary node for STS into the Asian refining market and a recurring waypoint in Windward and Kpler tracking of Russian-counterparty crude flows.[7]
  • Ceuta and the Strait of Gibraltar. The Spanish exclave and surrounding waters have hosted STS operations linking Baltic-loaded Russian crude with Atlantic-basin tankers.
  • Gulf of Oman holding areas. The waters east of Hormuz, outside Omani territorial seas, function as a secondary STS zone supporting the Fujairah anchorage.
  • Outer anchorages off Singapore. The Eastern Anchorage and adjacent areas are dense with legitimate STS traffic, which provides cover for shadow-fleet operations.
  • Lome (Togo) anchorage, West Africa. A node for STS into West and Central African markets and onward Atlantic-basin trade.
  • West of the Suez Canal. Waters in the southeastern Mediterranean have seen documented STS activity coupling Black-Sea-loaded crude with onward Asian-bound voyages routed via Suez.

How to detect it from open sources

The following five-step workflow is what we apply to identify a suspected shadow-fleet STS event from public data. It is the same workflow used in published identifications by KSE Institute, CREA, and Windward, and it is articulated as a HowTo schema on this page for machine-readable use.

Step 1 — Pull AIS and identify gaps over 6 hours

  • Retrieve at least ninety days of AIS track for the suspect tanker from MarineTraffic, VesselFinder, or Spire Maritime.
  • Flag any broadcast gap greater than six hours that is not accounted for by a documented port call.
  • Gaps in the vicinity of known STS anchorages are the primary signal; gaps in mid-ocean with no obvious destination are a secondary signal of probable GNSS spoofing or AIS suppression.

Step 2 — Cross-reference a second vessel at the same coordinates

  • For the latitude and longitude at which the AIS track ends and resumes, query the same coordinate window (typically a 5-nautical-mile box and a 48-hour time window) for any other tanker holding station.
  • A second vessel of comparable class within roughly 500 metres of the gap centroid, with a coincident time window, is the signature of an STS event.
  • Investigate whether the second vessel itself has a broadcast gap of similar duration — paired blackouts are a strong indicator of a controlled pairing rather than an opportunistic encounter.

Step 3 — Check ownership chains of both vessels

  • Use Equasis and IMO GISIS to extract the registered owner, operator, manager, and full flag history of each tanker.
  • Cross-reference against OpenSanctions, OCCRP Aleph, and OpenCorporates for shared addresses, registered agents, directors, or beneficial owners that suggest a controlled pairing.
  • The recurring shadow-fleet pattern documented in our 287-tanker briefing is a single-ship LLC in a closed registry sitting under a UAE free-zone operator under a BVI or Seychelles upper tier.

Step 4 — Match satellite imagery to the AIS coordinates

  • Query Copernicus Sentinel-2 (10-metre resolution, 5-day revisit, free) or Sentinel Hub EO Browser for the relevant dates and coordinates.
  • A side-by-side rectangular signature of roughly 250 metres by 90 metres at a known anchorage is the visual confirmation of an alongside operation.
  • Where the Sentinel-2 revisit cadence does not produce a hit within the gap window, commercial sub-metre imagery from Planet SkySat or ICEYE SAR may be tasked.

Step 5 — Document with screenshots and source URLs

  • Capture each finding with a timestamped screenshot, including the source URL and the retrieval timestamp in the filename or watermark.
  • Cross-reference declared voyage cargoes from Kpler, Vortexa, or the CREA monthly Russian-tanker tracker for paper-trail inconsistencies between the load port and the discharge declaration.
  • The documented file is the deliverable. An STS investigation is only as strong as its evidentiary record — opaque sources or stale screenshots are not actionable for a downstream regulator.

Limitations

Open-source STS investigation has clear ceilings, and they are worth stating plainly. Investigators cannot directly observe a transfer in progress unless a satellite revisit happens to coincide with the alongside period, which is roughly six to twenty-four hours and falls outside the Sentinel-2 five-day free revisit cadence; commercial high-resolution tasking is expensive and not systematically applied. Investigators cannot see bills of lading, charter parties, or quality certificates issued on the receiving vessel; those are private commercial documents that surface, if at all, only through litigation discovery, leaked datasets, or regulator subpoena. Investigators cannot see the beneficial-ownership chain behind any single-ship LLC whose registry conceals its ultimate principal; the chain can be reconstructed inferentially but not definitively without flag-state cooperation. And investigators cannot directly evidence intent. The STS event itself can be documented; the decision to launder origin remains a prosecutorial determination based on the totality of the operational pattern.

Falsified BOLs issued after the fact are the single most consequential gap. Once a cargo has been re-papered on the receiving vessel, the onward trade is, from the perspective of any downstream counterparty that screens only the documentation in front of it, a clean non-Russian cargo. The remedy is upstream pattern-of-life investigation of the receiving vessel, not downstream document inspection of the discharge port.

See also

This page is one of a methodology series. Related pages on this site:

Sources

  1. IMO Resolution MEPC.186(59) and Regulation 41 of MARPOL Annex I: Ship-to-Ship Transfer Operations. International Maritime Organization.
  2. Ship-to-Ship Transfer Guide for Petroleum, Chemicals and Liquefied Gases. Oil Companies International Marine Forum (OCIMF) and International Chamber of Shipping (ICS).
  3. Assessing Russia's Shadow Fleet: Initial Build-Up, Links to the Global Shadow Fleet, and Future Prospects. Kyiv School of Economics, KSE Institute, June 2024.
  4. Policy briefing: tackling the Russian shadow fleet. Centre for Research on Energy and Clean Air (CREA), August 2024.
  5. Laconian Gulf emerges as Russian oil STS hotspot. Lloyd's List Intelligence.
  6. Aegean Rebreath: Documentation of STS Operations in the Laconian Gulf. Greek marine NGO field reporting and environmental monitoring archive.
  7. The Fujairah Effect: Russian Oil STS Transfers in the UAE. Windward maritime analytics.
  8. Sanctions adopted following Russia's military aggression against Ukraine: 14th package (STS transfer prohibitions). European Commission, June 2024.
  9. U.S. Treasury Designates Russian State-Owned Sovcomflot, Russia's Largest Shipping Company. OFAC press release JY2121, 23 February 2024.
  10. Equasis — IMO-backed ship information database.
  11. IMO GISIS (Global Integrated Shipping Information System) — ship registry and flag-state data.
  12. Copernicus Browser (Sentinel-2 imagery). European Space Agency Copernicus Programme.
  13. OpenSanctions — consolidated sanctions and PEP dataset.
  14. OCCRP Aleph — investigative dataset and corporate records platform.
  15. Russia's shadow fleet: Bringing the threat to light. European Parliamentary Research Service, 2024.

Need an STS event reconstruction or a vessel-pair dossier?

We build STS event dossiers that cross-reference AIS broadcast gaps, second-vessel coordinate matches, satellite imagery, and ownership-chain reconstructions for both tankers, written to be usable by compliance, legal, and insurance counterparties.

Request an Investigation