What Is the Shadow Fleet, and Why Is It So Hard to Count?

At a Glance

• The shadow fleet is the ecosystem of tankers and support vessels using deceptive shipping practices to move sanctioned or high-risk cargo while concealing origin, ownership, or destination.
• Published estimates range from a few hundred vessels to well over a thousand, because there is no register and each organization counts a different set of vessels.
• Membership is behavioral rather than fixed, and once a vessel enters the trade, the commercial route back is largely closed.
• Sanctions lists work well for the fully segregated trades and poorly for the vessels that still touch Western insurance, ports, and counterparties without yet being designated.
• Identification depends on what a vessel does rather than what it declares, because the declarations are the part being manipulated.

There Is No Official Shadow Fleet List

The shadow fleet, also called the dark fleet, refers to tankers and support vessels that rely on deceptive shipping practices to move sanctioned or high-risk commodities while concealing their true origin, ownership, or destination.

That definition is broadly recognized in practice. It has no standing in law, and that is where the difficulty starts. No international convention defines the shadow fleet, no regulator maintains a register of it, and no two organizations use the term identically.

A vessel is treated as part of the shadow fleet because of how it operates. Its composition shifts as vessels are sold, reflagged, or designated, but vessels rarely leave it. Once a tanker is trading sanctioned crude with non-Western insurance and opaque ownership, the commercial route back to mainstream trade is largely closed.

The practical consequence is a mismatch. Compliance screening is built to verify identity, which means the vessel, its flag, its registered owner, and whether any of them appear on a sanctions list. The shadow fleet is defined by conduct instead. A vessel can return a clean result on every identity check and still be operating entirely inside it.

Why Every Published Estimate Is Different

Ask five organizations how large the shadow fleet is, and you will get five answers, sometimes differing by a factor of three.

Estimates vary widely, and the older ones are now substantially out of date. The European External Action Service, the EU’s diplomatic service, put the range at 600 to 1,400 vessels.

The spread reflects scope rather than disagreement. Counts differ on whether support vessels are included, whether the measure is vessels currently carrying sanctioned cargo or all vessels within the operating profile, whether unsanctioned vessels showing the same behavior are counted, and which trades are covered. Figures published more than a year ago describe a smaller and structurally different fleet than the one operating now.

Trade scope matters more than it sounds. The Russia-linked and Iran-linked fleets overlap but are not identical, and a count scoped to one will miss vessels operating in the other.

For a compliance team, the practical implication is that “is this vessel in the shadow fleet” is the wrong question to build a process around. The useful question is narrower: Does this vessel exhibit the behavior, and what is my exposure if it does?

For an enforcement agency, the constraint is legal rather than analytical. A vessel flying a legitimate flag has the right of innocent passage through the territorial sea, and on the high seas it is subject to the jurisdiction of its flag state. Carrying sanctioned cargo does not by itself change that. Statelessness does, which is why establishing whether a vessel’s flag is genuine is often the question that determines whether any action is available.

Risk Is Not Binary

Treating every vessel as either shadow fleet or clean fails in both directions. It clears vessels behaving exactly like designated ones that have not yet been designated, and it blocks legitimate vessels on thin circumstantial association.

What sits between those two outcomes is a judgment about degree. How many risk indicators a vessel shows, how recent they are, how they cluster, and what they mean for the specific trade and jurisdiction in question. A tanker with a single ownership change two years ago is not the same proposition as one with three flag changes, a dark period, and a ship-to-ship at a known transshipment point in the last quarter.

That judgment cannot be made from a list. It requires the underlying behavioral record.

Where List Screening Works, and Where It Doesn’t

Checking a vessel against sanctions lists answers part of the question. For the fully segregated trades, it answers most of it. Of approximately 430 tankers active in the Iran trade in Q2 2026, 87% were sanctioned, and 62% were falsely flagged, and those populations overlap almost entirely. These vessels operate outside Western services by design, so few commercial operators will ever face them across a fixture.

More than 650 tankers have been sanctioned for evading Russia-related measures. 

The exposure sits elsewhere. It is in vessels that still touch Western insurance, Western ports, and Western counterparties while behaving in ways that have not yet produced a designation. 

There is a lag between a vessel starting to operate as part of the shadow fleet and that vessel appearing on a sanctions list. Designation requires an evidentiary case, which takes time to build. During that gap, the vessel is detectable through its behavior and invisible to a list check. Commercial operators and enforcement agencies are looking at the same gap from opposite sides. One needs to avoid exposure to the vessel, while the other needs to build the case that eventually designates it.

Shadow Fleet Techniques Target the Sources Screening Depends On

Vessel screening draws on a small number of sources. What the vessel broadcasts about its position and identity, what its flag documentation says, what its ownership records show, and what its cargo paperwork declares. Each of these techniques attacks one of them.

Position data can be switched off or falsified. AIS was designed for collision avoidance between cooperating vessels, not for enforcement, so the system takes a vessel’s transmission at face value. A vessel can stop transmitting, or transmit a position generated elsewhere. Windward tracked 3,137 prolonged dark events in Q2 against 451 in Q1, involving 2,157 unique cargo ships and tankers over 10,000 DWT.

Flag documentation can come from a registry with no authority to issue it. Some tankers broadcast the flag of a country that maintains no international ship registry at all, or whose registry has been fabricated or misused by intermediaries claiming to act on the state’s behalf. Others broadcast a legitimate flag they were simply never registered under, which surfaces when the maritime administration confirms the vessel is not in its records. Either way, the paperwork looks valid, and the legal link to a flag state does not exist. Fraudulent registries issue documentation for flags they have no authority over. Vessels without a valid flag are stateless, and under Article 110 of UNCLOS, a warship may board a ship on the high seas where there are reasonable grounds to suspect it is. Once Western navies began exercising that right, reflagging to Russia gave these vessels a flag state again.

Ownership records can be structured to reveal nothing. Single-ship special purpose vehicles, rapid ownership transfers, and management entities in opaque jurisdictions mean the registered owner is often a shell with no operational relationship to the vessel.

Cargo documentation can be broken by transferring at sea. Multi-leg voyages with a ship-to-ship transfer in the middle severs the documentary link between load port and discharge port, so the paperwork at discharge describes a different movement than the one that occurred.

Screening that relies only on these four sources will return a result. It will not necessarily return a correct one.

Identification Depends on Independent Verification

A vessel controls what it broadcasts and what its paperwork says. It does not control whether a satellite sees it.

That is what all-source operational intelligence is for, as it incorporates all the sources needed to verify the location of shadow fleet vessels. Satellite detection across SAR, EO, and RF that confirms a vessel’s position, whether or not it is transmitting. Ownership and corporate intelligence that resolves the entity behind the registered owner. Meeting and port call history that establishes what a vessel did rather than what it reported. Behavioral models that read those inputs together and produce a finding, because no single source resolves a case on its own.

Fusion is the operative word. Each layer covers a gap the others leave open, which is why a vessel that defeats one of them does not defeat the picture.

Windward tracked one tanker that departed the Riau archipelago on April 12, 2026, went dark near Fujairah on April 26, and completed a four-day covert transit to Kharg Island for loading. 

Another sanctioned tanker in the same analysis had gone dark for 47 days, and when it reappeared, its ownership had changed, and a new identity had emerged, one of at least 18 names it has operated under.

None of that appears in the documentation. All of it is visible in the behavior.

What This Means in Practice

A risk finding is an input. Knowing a vessel shows shadow fleet indicators tells you what you are dealing with. What follows is a judgment about your own exposure, which depends on the trade, the cargo, the jurisdiction, and your risk appetite. Two organizations can screen the same vessel, agree on the tier, and reasonably reach different conclusions about whether to proceed.

Absence from a list is not evidence of absence of risk. Designation follows behavior. A behavioral screen sees what a list screen will see later.

Statelessness is established, not assumed. The interdictions carried out since December 2025 depended on showing that a vessel’s claimed flag was not valid, which is the finding that creates the legal basis for boarding. That determination comes from registry verification and the vessel’s own flag history, not from the certificate it presents.

Match the response to the finding. One ownership change three years ago and three flag changes with a dark period last quarter are both risk indicators, but they do not warrant the same response. A screen that returns only pass or fail cannot tell you which you are looking at.

The Fleet Adapts, and the Behavior Stays Visible

Every enforcement action reshapes the shadow fleet rather than shrinking it. The G7 Oil Price Cap pushed a share of Russian crude onto tankers operating outside Western services. Designations drove vessels toward fraudulent registries. Interdictions of stateless vessels drove them to reflag to Russia. Each measure worked on its own terms and produced an adaptation within months.

What the adaptations have in common is that they change what a vessel declares. The flag changes, the registered owner changes, the name changes. What does not change is that the cargo has to be loaded, carried, and discharged. Those movements happen in the physical world, on a timescale of weeks, in places that can be observed. 

That is the part the shadow fleet cannot restructure.

For commercial operators, the practical question is not whether the shadow fleet can be eliminated from their trade. It is whether they can see it clearly enough to make defensible decisions while continuing to do business. For government agencies, it is whether they can direct finite enforcement capacity at the vessels that warrant it, and support the action afterward.

Neither capability comes from a better list. Both come from being able to establish what a vessel actually did.

Written by Maya Romi, Windward Senior Maritime Intelligence Content Manager & SEO Specialist. Reviewed by Michelle Weise Bockmann, Windward Senior Maritime Intelligence Analyst, and Noam Rabinovich, Director of Product Marketing.