Flag-State Anomaly Detection for Sanctions Screening
Reflagging is the oldest trick in sanctions evasion. Correlating IMO registry records, spaceborne AIS, port-call history and high-resolution optical imagery of hull markings exposes the gaps between what a ship declares and what physics reveals.
Sensors
- Maxar WorldView-3: Panchromatic resolution of 0.31 m and multispectral at 1.24 m across eight VNIR bands. At this scale, hull name lettering, funnel livery and waterline markings are legible. Tasking latency is typically one to three days for non-priority orders; same-day tasking is available at premium.
- Planet SkySat: Panchromatic at approximately 0.5 m, multispectral at 1.0 m. Revisit over a named port can be arranged daily through commercial tasking. Useful for detecting name repaints or funnel recolours between passes, though colour fidelity is slightly lower than WorldView-3 due to narrower dynamic range.
- Sentinel-2 MSI: Ten-metre resolution in visible and near-infrared bands, with a five-day revisit at mid-latitudes when both Sentinel-2A and 2B are combined. Insufficient to read hull markings, but adequate for tracking a vessel's presence, berth position and gross hull-colour class across a port over time at no imagery cost.
- Spire spaceborne AIS: Spire operates more than 110 satellites carrying AIS receivers, achieving global message latency under 20 minutes for most ocean regions. The feed captures MMSI, flag-state declaration, vessel name and position, all of which can be compared against IMO registry records and optical observations for consistency.
Why reflagging works, and why it has limits
Reflagging a vessel under a different flag state is legal in itself. Panama, Liberia, the Marshall Islands and a handful of open registries collectively host the majority of the world's commercial tonnage, and legitimate operators use them routinely for tax and regulatory reasons. The problem arises when reflagging is combined with MMSI reassignment, ownership chain obfuscation and hull identity changes to place a vessel beyond the reach of a sanctions list that names the prior flag, owner or operator.
The physical constraint that sanctions evaders cannot easily escape is time. Repainting a hull name, changing funnel livery and reregistering a vessel all take days to weeks. High-resolution optical satellites can image a vessel in port at a resolution fine enough to read its name lettering and distinguish funnel colours. A vessel that declares one identity on AIS but shows a different name on its bow, or whose funnel colour matches a sanctioned operator's livery rather than the declared owner's, has a measurable discrepancy. That discrepancy is the analytic signal.
What a floating roof gives away: reading hull markings from orbit
WorldView-3's 0.31 m panchromatic band is the current commercial ceiling for this task. At that resolution, standard IMO-required bow and stern name lettering, which must be at least 200 mm tall under SOLAS convention, subtends roughly 0.65 pixels per letter stroke. Automated optical character recognition on hull names is unreliable at this margin; human analyst review of a cropped image chip remains the standard practice, with OCR used as a first-pass filter to flag candidates for review. Planet SkySat at 0.5 m is workable for confirming or denying a name change but is rarely sufficient for confident automated character extraction.
Funnel colour and banding patterns are more tractable. WorldView-3's eight VNIR bands allow colour classification of funnel livery against a reference library of operator colour schemes. This is not a perfect identifier: paint weathers, and a vessel may carry residual pigment from a prior owner. But a tanker whose AIS declares a Marshall Islands flag and a recently registered owner, yet whose funnel shows the banded colour scheme of a sanctioned Iranian state operator, is a candidate worth escalating regardless of the text on its bow.
One honest limit: cloud cover over ports in tropical or monsoon-affected regions can suppress optical collection for days at a time. Sentinel-2's free archive is useful for establishing a baseline of a vessel's normal berth and appearance during clear periods, but a targeted tasking campaign with WorldView-3 or SkySat may still miss a short port call if cloud persists.
The registry correlation layer
Optical imagery alone cannot establish ownership. It can flag inconsistencies. The analytical weight comes from correlating what the image shows against three independent data streams: the IMO Global Integrated Shipping Information System number, which is permanently assigned to a hull and does not change with reflagging; the AIS broadcast, which can be manipulated; and commercial registry records such as those maintained by Lloyd's List Intelligence, which log ownership transfers, flag changes and class society certifications.
A vessel's IMO number is physically marked on its hull and superstructure and must appear in official documents. If a vessel's AIS MMSI corresponds to a flag state and owner registered only recently, but the IMO number traces to a vessel previously flagged under a sanctioned state or owned by a listed entity, the chain of evidence is materially stronger than any single source alone. The combination of IMO-number confirmation from imagery, AIS flag declaration and registry transfer date creates a timeline that compliance teams can act on.
Port-call history adds a further dimension. A vessel that claims a new owner and flag but continues to call at ports associated with sanctioned trade routes, at the same seasonal intervals as its prior identity, is exhibiting a behavioural pattern that a registry change does not explain away.
Where the method reaches its limits
Several failure modes are worth stating plainly. A vessel that completes its reflagging and repaint while at anchor in international waters, away from port infrastructure, will not appear in a port-call database and may not be imaged unless a satellite is specifically tasked on that anchorage. SAR-based vessel detection in open ocean and anchorage dwell-time analysis, covered separately in this library, address that gap.
MMSI spoofing, where a vessel broadcasts a different vessel's identity entirely, is a distinct problem from reflagging and is covered in the AIS correlation and dark-ship detection page. This page addresses the case where the vessel is broadcasting its own (newly assigned) identity but that identity is designed to obscure continuity with a sanctioned prior identity.
Finally, open-registry flag states with limited oversight capacity may issue new registrations without rigorous due diligence on ownership declarations. The satellite data cannot verify the accuracy of the registry record itself; it can only surface inconsistencies between the record and what is physically observable. Compliance decisions require a human analyst to weigh the evidence.
Building the analytic workflow
A practical screening workflow runs in three stages. The first is automated AIS ingestion from a spaceborne feed such as Spire's, filtered for vessels whose flag state changed within a configurable lookback window, typically 90 to 180 days. This produces a candidate list. The second stage queries IMO registry and commercial ownership records against that list to identify vessels whose ownership chain includes entities on relevant sanctions lists, or whose prior flag state was a sanctioned jurisdiction. The third stage triggers optical tasking over the vessel's last known port of call to confirm or challenge the declared identity through hull and funnel imagery.
Satellize structures this kind of multi-source correlation workflow for government compliance clients. The Tonga crop-estimation programme is a different domain, but the underlying architecture, ingesting open constellation data, applying a detection model and escalating anomalies for analyst review, transfers directly to maritime screening.
Delivery formats for this use case are typically a structured alert feed (JSON or GIS layer) flagging candidate vessels, supplemented by image chips and an analyst summary for each escalated case. Revisit frequency for optical tasking is client-configurable; daily coverage of a specific port is achievable with SkySat, though cost scales accordingly.
Typical figures
| Best optical resolution (hull markings) | 0.31 m panchromatic (WorldView-3); 0.5 m panchromatic (SkySat) |
| Multispectral resolution for colour classification | 1.24 m (WorldView-3 VNIR); 1.0 m (SkySat); 10 m (Sentinel-2) |
| Optical revisit at a named port | Daily with commercial SkySat tasking; 5 days free with Sentinel-2A+2B combined |
| Spaceborne AIS message latency | Under 20 minutes globally (Spire, 110+ satellites) |
| Minimum legible hull lettering height | ~200 mm (SOLAS minimum); readable by analyst at WorldView-3 resolution, marginal for automated OCR |
| Spectral bands for funnel colour classification | 8 VNIR bands, 400–1040 nm (WorldView-3) |
| Cloud-cover impact on optical collection | Complete loss of optical data under overcast; SAR cross-check required for persistent cloud regions |
| Archive depth (Sentinel-2) | From 2015 (Sentinel-2A launch); WorldView archive from 2014 |
| AIS data fields correlated | MMSI, IMO number, vessel name, flag state, call sign, position, timestamp |
| Typical analytic latency from tasking to alert | 24–72 hours for commercial optical tasking plus analyst review |
Analytics Satellize can run
| Flag-change candidate list | AIS time-series filtering on flag-state field transitions within a configurable lookback window, cross-referenced against IMO registry records | Structured JSON feed or spreadsheet of candidate vessels with flag-change dates, prior and current flag states, and IMO numbers |
| Ownership-chain sanctions match | Graph traversal of beneficial ownership records (Lloyd's List Intelligence or equivalent) against published sanctions lists (OFAC SDN, EU Consolidated, UN) | Scored risk report per vessel, with ownership chain diagram and sanctions-list citations |
| Hull identity confirmation from imagery | Sub-metre optical image chip extraction at last known port call; analyst-reviewed OCR and visual comparison of bow/stern name lettering against declared identity | Annotated image chip with confidence rating (confirmed / discrepant / inconclusive) and analyst note |
| Funnel livery classification | Multispectral colour classification of funnel region against a reference library of operator liveries, using WorldView-3 VNIR bands | Livery match score with top-three candidate operators and associated ownership/flag-state data |
| Port-call behavioural continuity score | Comparison of pre- and post-reflagging port-call sequences (port, timing, cargo type where available) to detect unchanged trade-route behaviour inconsistent with a genuine ownership change | Timeline chart and written assessment of behavioural continuity for compliance file |
| Integrated escalation alert | Fusion of AIS anomaly, registry match, imagery confirmation and port-call pattern into a single evidence package using a weighted scoring model | Compliance-ready alert document (PDF and GIS layer) with evidence chain, confidence level and recommended next action |
Who does the work
We can get this done for you. Satellize runs its own analyst desk and a strong science team. You do not buy a data feed and work out what it means; our people source the imagery, run the analysis described on this page, and hand you the answer with its confidence limits stated. Discuss this requirement.