NCA Amber Alert Exposes Shadow Fleets Driving Sanctions Evasion

The UK’s National Crime Agency (NCA) has issued a high‑level Amber Alert warning financial institutions and maritime operators about the growing threat posed by “shadow fleets” and covert networks that enable sanctioned regimes such as Russia, Iran, and North Korea to evade restrictions and generate billions in illicit revenue.

Amber Alert: Networks & Shadow Fleets

The alert, published by the National Economic Crime Centre (NECC) in partnership with the Office of Financial Sanctions Implementation (OFSI) and the Foreign, Commonwealth & Development Office (FCDO), highlights how sanctions evasion networks exploit opaque corporate structures, deceptive maritime practices, and covert financial systems.

Investigators estimate that 700–1000 ageing vessels form part of these shadow fleets, routinely renamed, reflagged, and re‑insured via shell companies to disguise their true ownership and purpose. In 2025 alone, over 180 vessels and enablers were designated by sanctioning authorities, disrupting revenue streams that directly fund military and nuclear programmes.

Global Context

• Russia: Despite sanctions, Russia generated USD 120.5 billion in energy revenues in 2024, nearly 30% of state income. EU officials have described the shadow fleet as a “financial pillar” of Moscow’s war effort【Al Jazeera, July 2025】【United24 Media, Nov 2025】.
• Iran: The US Treasury has repeatedly sanctioned Iranian‑linked front companies and vessels, warning that Iran’s “dark fleet” of over 300 tankers is central to its sanctions evasion strategy【US Treasury, Dec 2024】【Jerusalem Post, Nov 2025】.
• North Korea: DPRK continues to rely on covert maritime transfers and falsified documentation to fund weapons development, often using Russian and Iranian networks as facilitators【RUSI Insight Paper, Sept 2025】.

Compliance Risks

The NCA warns of several typologies that compliance teams should treat as red flags:

• Maritime deception: disabling AIS transponders, falsifying cargo documentation, and ship‑to‑ship transfers.
• Front companies: rapid incorporation in permissive jurisdictions, often with misleading websites or proxy ownership.
• Financial laundering: offshore shells, barter trade, cryptocurrency, and complex routing through weak AML jurisdictions.

Implications for Risk Management

Th Amber Alert underscores the need to:

• Strengthen due diligence on maritime clients, commodity traders, and shipping intermediaries.
• Enhance transaction monitoring for crypto and third‑party payments linked to high‑risk jurisdictions.
• Integrate maritime intelligence into financial crime frameworks.
• Report suspicious activity to the NCA SAR Portal and OFSI, referencing Amber Alert code 0788‑NECC.

Key Findings

• The UK’s National Crime Agency (NCA), together with OFSI and the FCDO, issued an Amber Alert in November 2025 warning of sanctions evasion networks and shadow fleets.
• These networks are linked to Russia, Iran, and North Korea, exploiting opaque corporate structures, deceptive maritime practices, and covert financial channels.
• The shadow fleet comprises an estimated 700–1000 ageing vessels, routinely renamed, reflagged, and re‑insured via shell entities, enabling illicit transport of oil and gas.
• In 2025, over 180 vessels and enablers were designated by sanctioning authorities, disrupting revenue streams for sanctioned regimes.

Global Context

• Russia: The shadow fleet is central to Moscow’s sanctions evasion, helping generate USD 120.5bn in energy revenues in 2024 despite restrictions. The EU and France have pledged stronger action against these fleets, calling them a “financial pillar” of Russia’s war effort.
• Iran: Iran’s “dark fleet” has expanded to 320+ tankers, moving oil through ghost fleets, offshore shells, and crypto exchanges. The US Treasury and State Department have sanctioned multiple entities and vessels involved in deceptive shipping practices.
• North Korea (DPRK): DPRK continues to use covert maritime networks to fund weapons programs, often through ship‑to‑ship transfers and false documentation.

Compliance Risks

• Maritime deception: Disabling AIS transponders, falsifying cargo documentation, and ship‑to‑ship transfers to obscure cargo origin.
• Front companies: Rapid incorporation in permissive jurisdictions, often with misleading websites, dubious addresses, or proxy ownership.
• Financial laundering: Use of offshore shells, barter, cryptocurrency, and complex routing through weak AML jurisdictions.
• Geopolitical exposure: Revenues from shadow fleets directly fund Russia’s war in Ukraine, Iran’s nuclear program, and DPRK’s weapons development.

Lessons for Risk Officers

• Monitor for red flags: sudden vessel reflagging, inconsistent cargo documentation, rapid commercial expansion without track record, or suspicious payment arrangements.
• Strengthen due diligence on maritime clients, commodity traders, and shipping intermediaries.
• Enhance transaction monitoring for crypto, barter, and third‑party payments linked to high‑risk jurisdictions.
• Pay attention to front company typologies: meaningless names, prestigious office addresses without operations, or politically exposed persons using proxies.

Sources

• NCA Amber Alert – Networks & Shadow Fleets (Nov 2025)
• Al Jazeera – EU hits Russian oil shadow fleet with new sanctions (July 2025)
• United24 Media – EU set to tighten the net on Russia’s shadow fleet (Nov 2025)
• US Treasury – Pressure on Iranian Shadow Fleet (Dec 2024)
• Jerusalem Post – US sanctions Iranian shadow fleet (Nov 2025)
• RUSI Insight Paper – Countering Shadow Fleet Activity (Sept 2025)