False Flags, Fraudulent Registries, and the Dark Fleet

Executive Summary 

Open registries, also known as flags of convenience, play a pivotal role in facilitating the shipment of Western-sanctioned Russian, Iranian, and Venezuelan oil and gas. Fraudulent registries and flag hopping practices have surged in direct response to sanctions imposed on these countries’ oil and shipping sectors, with vessels exploiting weak oversight and provisional registration loopholes. 

 This analysis reveals a rise in both fraudulent registries and false flagging, with at least 12 fraudulent registries in operation and over half of sanctioned tonnage sailing under false or unknown flags. Flag hopping has reached record levels, as sanctioned vessels exploit provisional registration loopholes, rapidly cycle through permissive open registries, or transmit false flags to evade detection.

High risk vessels not yet sanctioned overwhelmingly prefer permissive open registries such as Panama, Comoros, and Gambia, alongside fraudulent registries like Curacao, highlighting the likely future direction of sanctions evasion. Case studies, including the rapid expansion of Gambia’s international registry, illustrate how small states with outsourced registry management are increasingly targeted for exploitation.

These practices create systemic risk. Uninsured and stateless ships threaten maritime safety, crew welfare, the environment, and the integrity of global regulatory frameworks. The findings show that fraudulent registries and opportunistic flag states have become critical enablers of sanctions evasion, requiring urgent and coordinated regulatory, diplomatic, and enforcement action.

Analysis of Falsely Flagged Ships in the Dark Fleet

As of August 9, 2025, Windward identified 1,942 tankers and gas carriers as being part of the dark fleet. Of these, 884 are Western-sanctioned and 929 are identified as high risk. Our analysis excludes vessels in the dark fleet that are flagged in Cuba, Russia, Iran, Venezuela, and North Korea, and only includes ships larger than 20,000 dwt – a size required to engage in international trade.

There were 634 sanctioned tankers and gas carriers over 20,000 dwt in the dark fleet, with an average vessel age of 22 years. A closer look at these vessels reveals key patterns:

• 57% (as measured by total dwt) were flying false flags or were identified as ‘not known’ in the International Maritime Organisation (IMO) or Equasis (managed by the European Maritime Safety Agency) databases.
• 11 fraudulent flag registries were identified, led by Guyana (36% of all falsely flagged, sanctioned ships, according to Equasis), followed by Malawi, Guinea, Curacao, Benin, St. Maarten, Eswatini, Aruba, Timor Leste, Mali, and Angola. A twelfth fraudulent registry, Mozambique, began operating later in August.
• Of those sanctioned vessels continuing under open registries: 
  • 38% were flagged with Comoros.
  • 11% were flagged with Gambia. 
  • Cameroon and Sierra Leone also provided flag services for Western-sanctioned ships.

False Flags and Fraudulent Registries: How the Loopholes Work

The IMO defines a vessel as flying a false flag “if it is confirmed by that country’s administration as not legally registered under that administration.” 

Fraudulent registries have grown significantly over the last 19 months, in direct correlation to increased sanctions imposed by the U.S., EU, and UK on ships facilitating trade of Russian, Venezuelan, or Iranian energy commodities.

Fraudulent registries operate through private companies that falsely claim to be contracted by a country’s maritime administration to operate their flag registry. These companies then issue fake certificates of flag registration.

While those behind this example have been identified, they continue to operate with impunity. 

Vessels in the dark fleet have transmitted flags of countries defined by the IMO as false because they do not operate an international registry: Angola, Aruba, Benin, Curacao, Eswatini, Guinea, Guyana, Mali, Malawi, Mozambique, St. Maarten, and Timor Leste.

Although the topic of fraudulent registries has been on the IMO agenda since at least 2017, their prevalence and scale of abuse have dramatically escalated.

There are now fewer open registries flagging sanctioned or sanctions-evading tonnage, particularly those of Barbados, the Cook Islands, Gabon, Palau, and Panama. These flags, and others, have amended or more strictly enforced policies to remove ships when they are subject to international sanctions. This likely reflects increased diplomatic pressure from the EU, U.S., and UK governments on these countries to implement greater oversight and control over their international shipping registries. 

With few exceptions, governments of minor registries flagging tankers in the dark fleet have engaged private contractors to manage the registry on their behalf. 

Sanctions Drive Flag-Hopping Ships to Maritime Fringes

Many of today’s falsely flagged ships have been engaged in flag hopping, switching between multiple open registries over several years. Sanctions are now driving them towards more permissive and high risk registries, as fewer minor registries are willing to flag these vessels.

Flag hopping, closely linked to sanctions evasion, involves switching flags across multiple open registries within short time frames. Flag hopping is now at record levels, driven by diplomatic pressures and changed policies among open registries previously associated with the dark fleet.

Many sanctioned ships have flown flags of at least four different countries within the past 24 months, both before and after being designated by regulators. Some have also cycled through multiple fraudulent registries within the past 12 months. 

The following practices have been observed among dark fleet vessels, particularly those subject to EU, UK, and U.S. sanctions: 

• Exploiting the provisional registration timelines of open registries, which allows entry on a temporary basis (typically three to six months) with minimal due diligence pending submission of all documentation. Vessels then ‘hop’ to another flag before the provisional period expires.  
• Using one of the 11 fraudulent registries identified.
• Continuing to transmit through AIS the flag of their previous registry.  

Ships flying false flags lack valid insurance and certificates of seaworthiness and safety from recognized organizations. This poses significant threats to maritime safety, security, the environment, and endangers crew welfare. In effect, these vessels operate as lawless and stateless actors.

Flagging Patterns Among High Risk Dark Fleet Vessels

In addition to sanctioned ships, there are a further 929 tankers assessed as high risk in the dark fleet. Of these, 394 are over 20,000 dwt and not flagged in Russia, Venezuela, or Cuba. All Iranian and North Korean-flagged ships are already under sanctions.

With few exceptions, currently sanctioned vessels in the dark fleet were previously assessed as high risk due to known deceptive shipping practices, port calls to sanctioned countries, and suspicious cargo. 98% of sanctioned vessels were flagged by Windward as high risk prior to their formal listing.

Therefore, the current composition and registry choices of high risk ships indicate the flags most likely to be used by sanctions-circumventing vessels yet to be targeted by regulators. Windward found that:

•  33% of high risk tankers and gas carriers broadcast they were flagged in Panama, the world’s second-largest open registry. Panama is overrepresented in this group, as its share of the global fleet is 16%, according to UNCTAD. 
• The second most common flag was Curacao (18%), a fraudulent registry, followed by Hong Kong (8%), and the Marshall Islands (5%). The use of a fraudulent registry by a high risk vessel suggests it may already be engaging in sanctionable activity or has been expelled from other open registries.
• The 394 vessels collectively transmitted 39 different flags at the time of analysis. 

Registries of note that flagged vessels in the dark fleet (over 20,000 dwt) between 2019 and 2025 include Antigua and Barbuda, Azerbaijan, Barbados, Belize, Cameroon, Comoros, Cook Islands, Djibouti, Gabon, Guinea-Bissau, Honduras, Hong Kong, Liberia, Mongolia, Marshall Islands, Oman, Palau, Panama, San Marino, São Tomé and Príncipe, St. Kitts and Nevis, Sierra Leone, Tanzania, Togo, Tuvalu, Vanuatu, and Vietnam.

Flags of Liberia and the Marshall Islands, the world’s largest and third-largest registries respectively, were significantly underrepresented during this period, relative to their size. This likely reflects higher due diligence standards, more robust technical oversight, beneficial ownership scrutiny, and greater compliance with international maritime laws.

The flags used and market share of smaller registries have shifted constantly over the past 19 months. These minor registries have been targeted for their permissive flagging policies and lax enforcement standards. 

The Role of Contractors in Flag Registry Administration

Most open registries are not directly operated or controlled by the national maritime authorities. Instead, governments contract private companies to manage their ship registries.  

Ownership details of these private companies, and their relationships with maritime agents who solicit business on their behalf, are not publicly disclosed. The management quality and oversight standards of these contractors vary widely. The high standard maintained by the Liberia and Marshall Islands registries, both operated for decades by U.S.-incorporated companies, is reflected in industry performance assessments. 

How Sanctions Are Reshaping Open Registry Practices

Between January 2024 and August 10, 2025, the EU sanctioned more than 440 ships, and the UK nearly 430. The EU and UK sanctions were issued specifically in response to Russia’s war on Ukraine. The U.S. has sanctioned around 600 ships, including more than 170 since February 2025.

Most vessels reflag after being sanctioned. The choice of the next flag depended on where the vessel was previously registered and which jurisdiction imposed the sanctions.  

Windward researched the flag hopping practices of sanctioned dark fleet vessels over 20,000 dwt that were not flagged with Iran, Russia, Venezuela, or North Korea. This was measured against sanctions timelines, the stated policies of open registries, and the sanctioning entity (UK/U.S./EU). We observed:

• Since an October 2024 executive decree, the government-run Panama Maritime Authority (AMP) has expelled all vessels from its registry that appeared on any international sanctions list. AMP removed 200 ships in the first five months of 2025. 
• If sanctioned by the U.S., most ships reflagged to Comoros, Gambia, or switched to fraudulent registries to continue trading. 
• EU and UK-sanctioned ships also moved to Comoros and Gambia, or fraudulent registries. However, at least two open registries – Sierra Leone and Vanuatu – have flagged EU and UK-sanctioned ships after leaving other open registries. Oman also flagged tankers beneficially owned by the Russian government-controlled shipowner, Sovcomflot.  
• Open registries of Barbados, Cook Islands, and Gabon – formerly prominent in flagging dark fleet tonnage – are now shrinking at a record pace. These registries grew at a record pace over 2023 and 2024, and in some cases tripled in size within 12 months, taking on 100-plus tankers. Upon being sanctioned in 2024 and 2025, these ships left their registries.
• In July, the EU and UK each sanctioned Intershipping Services LLC, a UAE-based company contracted by Gabon since 2019 to operate its international ship registry. Gabon-flagged, Russian-controlled ships were engaged in high risk shipping practices, according to the EU. This marked the first instance of a company operating an open registry being sanctioned internationally.

The Scale of the False Flag Problem

It is difficult to accurately define the size of the fleet of falsely flagged ships. Windward analysis indicates a 65% increase in 2025, with 332 vessels falsely flagged, compared to the 201 reported by the IMO Secretariat in January. This number may be much higher. 

The IMO identifies whether a ship is falsely flagged in its Global Integrated Shipping Information System (GISIS), a publicly available register. As of August 13, 2025, GISIS recorded 332 falsely flagged ships, including 229 tankers (which include gas carriers). This figure covers vessels flagged under fraudulent registries, as well as ships falsely transmitting the flag of a country with which they are not registered. It is not currently possible to query the database for additional tankers classified as having an “unknown” or “not known” flag. 

 According to the Equasis database, 183 oil and chemical tankers were falsely flagged under the 11 fraudulent registries listed above. Another 40 tankers were with established open registries but identified as falsely flying those flags. The Equasis platform does not provide a search function for flags marked “not known.” 

Windward’s platform identified at least 350 tankers and gas carriers broadcasting the flags of fraudulent registries, including Aruba, Benin, Curacao, Eswatini, Guinea, Guyana, Malawi, and the Netherlands Antilles. This figure is 53% higher than the IMO’s records.

The Protean Fleet: A Sanctions-Circumventing Subset of the Dark Fleet

Global security non-profit C4ADS identified a Chinese-owned subset of the dark fleet that has been circumventing sanctions in a June 2025 report. Supported by Windward, the report identified 56 tankers referred to as the Protean Fleet. These vessels relied on frequent deceptive shipping practices to transport at least 404 million barrels of Western-sanctioned oil to China and India since 2019, according to C4ADS.

At the time of the report’s release, 48 of these tankers had been sanctioned, and another 5 were flagged as high risk by Windward. Prior to being sanctioned, the vessels used open registries, including the Cook Islands, Comoros, Gabon, Palau, Panama, São Tomé and Príncipe, Honduras, and Barbados. According to C4ADS, loopholes in maritime, financial, and corporate infrastructures enabled these tankers to continue operating and trading sanctioned oil.

An Epicenter of Maritime Lawlessness

The dark fleet relies on minimal due diligence and weak technical oversight from minor open registries to undertake dangerous and illicit activities and continue trading, imperiling the safety and security of coastal states. This is clearly seen off the Riau Archipelago, in the waters off eastern Malaysia – a known hub for floating storage and unregulated ship-to-ship (STS) transfers of Iranian oil.

Over the past six years, this offshore hub has evolved into a strategic hotspot for deceptive maritime activity, characterized by dark activity and location (GNSS) manipulation. These practices create a serious hazard to navigation safety, environmental protection, and the integrity of one of the region’s busiest maritime chokepoints.

As many as 80 tankers are anchored in the area at any given time. 40% are falsely flagged. The insurance status of many other flagged tankers remains unclear. Open registries used by these vessels over the past four months included Comoros, Djibouti, Gambia, Cameroon, Panama, and Tanzania.

Case Study: Gambia

Windward’s AI identified 111 vessels broadcasting the Gambia flag in August 2025. Of these, 33 were tankers and gas carriers sanctioned by the U.S., UK, or EU. An additional 34 ships were assessed as high risk, and based on links to port calls in Iran, Russia, Syria, Venezuela, or North Korea, as well as a range of deceptive and evasive behavioral practices.

Gambia flagged its first dark fleet tanker in May 2024. The vessel – a 1999-built aframax tanker – had previously been registered under the flags of the Cook Islands, Gabon, and Panama since 2020. Gambia’s fleet, measured by gross tonnage, expanded by 1,038% over a 12-month period ending June 30, 2025, according to Windward analysis using Equasis data.

 The number of Gambia-flagged vessels grew to 99 from 43 in that time. Until Q2 2024, the Gambia registry was limited to small, coastal ships such as fishing boats and tugs. So what changed?

In October 2024, the Gambia Maritime Authority informed the IMO that Gambia International Ship Registry, a Cyprus-incorporated company, was now operating an international registry on its behalf.  The company is owned by MDIR Services Ltd, which had been contracted 6 months earlier to establish and run the registry.