Different trackers define "shadow fleet" differently and produce very different totals: Brookings counted 343 Russia-linked ships (April 2025), S&P counted 940 by size threshold (May 2025), Windward's behavioural definition put its dark fleet subset at 2,186 (Q2 2026) [5]. This guide deliberately avoids quoting one figure as settled.
Series Introduction
Why insurance, not AIS tracking, is where this guide focuses
Much existing shadow fleet content covers a similar core set of mechanics: AIS transponders going dark, vessels changing flag, ownership hidden behind shell companies. All of that is real, and Part 1 already covers those mechanics. This part focuses instead on insurance status, which functions as more than a red flag, it carries its own separate legal dimension under the UK's maritime services and price cap framework, and it is a point in the chain where a shadow fleet vessel's paperwork can contain an outright fabrication rather than just an omission, as the Seaguard P&I case below demonstrates concretely. A vessel can be flagged in a jurisdiction that asks few questions, can be owned by a shell company incorporated recently, and can still present a certificate that looks completely normal on its face. The Seaguard case shows that certificate content and certificate authenticity are two separate questions, one that document review alone does not answer.
Builds directly on Part 1
This guide does not re-explain designated vs specified, IMO screening, or the ownership/control cascade, see Part 1 for those. What follows assumes you already know why IMO number beats name-based screening and how the ownership-and-control cascade works.
Real Case Study
Seaguard P&I
In April 2026, Ukraine's Foreign Intelligence Service assessed, reported by Bloomberg on 16 April 2026, that a company calling itself "Seaguard P&I" had issued insurance certificates to Russian shadow fleet tankers, including the Paz, a tanker already under sanction by the US, UK, and EU. Seaguard claimed to be based in Pinneberg, Germany. Ukraine's intelligence assessment found no such commercial entity registered in Germany; the address on the certificate corresponded to an ordinary residential apartment building [6]. This is presented here as an intelligence assessment, not a judicially established fact, that distinction matters and is preserved throughout this guide rather than flattened into certainty.
At least five tankers were confirmed at the time of the initial report to have used Seaguard certificates, one of them, the Deyna, flying the Mozambican flag, had already been seized by French maritime authorities in March 2026 under Article 110 of the UN Convention on the Law of the Sea, on suspicion of sailing under a false flag while carrying Russian oil out of Murmansk [7]. The Association for the Reintegration of Crimea's own follow-up investigation identified more than twenty vessels it assessed had sailed on Seaguard certificates since September 2025, several by IMO number [1], this later, larger figure traces to that single investigation rather than to separate independent verification. Seaguard's name closely resembled that of a legitimate, unrelated Nigerian maritime service, a similarity worth flagging as a pattern for readers to watch for, though the connection between the two names has not been established as anything more than a naming coincidence or deliberate imitation, this guide does not assert which. Seaguard's website went offline shortly after the story broke.
This is the mechanism worth teaching, not the individual vessel names. A certificate existing, formatted correctly, with a policy number and a claims stamp, is not evidence that real cover exists behind it. The only thing that actually establishes real cover is checking the named insurer against a source that isn't the certificate itself.
The Fix
The verification step this guide recommends adding
The International Group of P&I Clubs currently has 12 member clubs, following the February 2023 merger of the North of England P&I Association and the Standard Club into NorthStandard. Each of the 12 is independently named and verifiable through the Group's own published membership list, together covering roughly 87% of global oceangoing tonnage [8]. Most mainstream, Western-aligned commercial shipping is insured through one of these 12. A certificate naming an insurer outside that list is not automatically fraudulent, smaller regional and niche insurers genuinely exist, but it is a certificate that warrants one extra step: checking the named insurer against a real, independent, third-party source, not just trusting the document as presented.
12
IG member clubs
~87%
Of global oceangoing tonnage covered
Feb 2023
NorthStandard merger, last count change
1
Certificate names an insurer
→
2
Check against the IG Clubs' own published 12-name list
→
3
Not a member? Verify existence and registration independently
→
4
Accept, escalate, or reject based on what's actually found
This is a cheap check against an expensive fraud. It should be as routine as checking a vessel's IMO number against a sanctions list.
📄
Scenario 03 · Certificate authenticity vs certificate content
The Reassuring Certificate
The Unverified Insurer
⚖️
What do you do?Make the call
A UK trade finance desk is asked to confirm a letter of credit for a cargo of refined product loading from a non-sanctioned port. The chartered vessel's P&I certificate names "Seaguard P&I, Pinneberg," policy number formatted correctly, claims stamp present. The vessel itself screens clean by IMO number against all relevant sanctions regimes, and AIS has been continuous for the voyage so far.
Screening a vessel or counterparty?Run a free sanctions and PEP check before proceeding, no account required.
A correspondent bank processes a payment instruction relating to a cargo of crude oil. The counterparty, cargo, and vessel all screen clean. The payment references a price per barrel that sits exactly at the G7 oil price cap threshold, a level the compliance analyst has seen on several transactions from this same corridor over the past two months, each one just at, never above, the cap.
Three Patterns
Three patterns, three cards
Most insurance and price-cap misjudgments trace back to one of these three shapes.
📄
The Unverified Insurer
A P&I certificate names an insurer that isn't one of the 12 International Group member clubs.
Risk
Non-membership is a verification trigger, not proof of fraud, legitimate insurers do operate outside the IG, but a non-member name is exactly the case where a certificate's authenticity hasn't actually been checked against anything independent.
Signal
Unfamiliar insurer name, especially one closely resembling a real, unrelated firm's name.
Response
Check the named insurer against the IG Clubs' own published list; if not a member, verify existence and registration independently, don't reject automatically, but don't accept automatically either.
💷
The Cap-Line Pattern
Repeated payments cluster exactly at the sanctions price cap threshold.
Risk
Not proof of circumvention on its own, but a pattern that specifically warrants closer review rather than routine processing.
Signal
Multiple transactions from the same corridor or counterparty landing precisely at the cap, never meaningfully below it.
Response
Examine invoices, freight and ancillary costs, attestations, and market pricing for the pattern, analysed across the corridor, not transaction by transaction in isolation.
🏴
The Suspended Registry Period
A vessel's flag history includes a period under a registry later found to have serious fraud problems (Cameroon suspended new international ship registrations in February 2026 amid fraudulent registrations, and subsequently removed suspect vessels [9]).
Risk
A claimed registration during the affected period should trigger direct registry verification.
Signal
Flag history includes a jurisdiction that later suspended new registrations over fraud concerns.
Response
Verify directly against the registry for that period. A Cameroon-registry period should not automatically be treated as evidence the vessel knowingly used a fraudulent flag, verification, not assumption, is the correct response.
Knowledge Check
Five questions on the mechanics this guide establishes.
1. What did Ukraine's Foreign Intelligence Service assess about the Seaguard P&I certificates, and why is "assessed" the right word rather than "proved"?
2. Which of the following would catch a fake P&I certificate that a clean sanctions-list screen would miss?
3. In Worked Scenario 4, why does a single transaction at the price cap threshold differ from a repeated pattern at that threshold, and why is even the repeated pattern not proof on its own?
4. Which country's flag registry suspended new international ship registrations in February 2026 amid fraudulent registration concerns, and why should that history trigger verification rather than an automatic assumption of wrongdoing?
5. How many member clubs does the International Group of P&I Clubs have, and why does that number matter for verification purposes?
0/5
Frequently Asked
FAQ
If a vessel's insurer isn't an IG Club member, does that automatically mean it's fraudulent? +
No. Smaller, legitimate regional insurers exist outside the International Group. It means the certificate needs independent verification against a real source before being accepted, not automatic rejection.
Why did Seaguard's fraud work for as long as it did? +
Because a certificate that's correctly formatted, with a policy number and a claims stamp, looks sufficient on its face, and checking the named insurer against an independent source is a step that's easy to treat as unnecessary once the document itself looks complete. This guide doesn't have a documented methodology establishing how widespread that gap is across institutions generally, only that the Seaguard case shows it can go unchecked long enough for at least twenty vessels to rely on it.
Is checking the IG Clubs' membership list something a compliance team can realistically do for every transaction? +
Yes, it's a short, publicly available, 12-name list. The barrier isn't difficulty, it's that this specific check is easy to overlook when a certificate otherwise looks complete and correctly formatted.
How does this connect to the price cap pattern in Worked Scenario 4? +
Both worked scenarios in this guide make a related point: a single, isolated check (does a certificate exist, is one transaction within the cap) can look clean while missing the thing that actually matters, whether the certificate is genuine, or whether the pattern across a corridor tells a different story than any single transaction does. Neither scenario's pattern is proof by itself, both warrant independent verification or deeper examination before being cleared.
Quick Reference
At a glance
Three patterns, the risk that makes each one look routine, the signal that gives it away, and the response that fits.
📄
The Unverified Insurer
A P&I certificate names an insurer outside the 12 IG member clubs.
Risk
Non-membership is a verification trigger, not proof of fraud.
Signal
Unfamiliar insurer name, possibly resembling a real, unrelated firm.
Response
Check against the IG Clubs' list; verify independently if not a member.
💷
The Cap-Line Pattern
Repeated payments cluster exactly at the price cap threshold.
Risk
Not proof on its own, but warrants closer review, not routine processing.
Signal
Multiple transactions landing precisely at the cap, never meaningfully below it.
Response
Examine invoices, costs, and attestations across the corridor, not in isolation.
🏴
The Suspended Registry Period
Flag history includes a registry later found to have fraud problems.
Risk
A claimed registration in the affected period should trigger verification.
Signal
Flag history includes a jurisdiction that later suspended registrations.
Response
Verify against the registry; don't assume knowing use of a fraudulent flag.
Continue The Series
Cross-reference back to Part 1
The ownership-and-control cascade established in Part 1 (a designated person owning or controlling an entity, whether through the shareholding test or the separate control test) applies to any entity behind a confirmed-fraudulent insurer or a confirmed sanctions-circumvention structure, once a designated person is established somewhere in that chain, not automatically merely because an insurer looks suspicious or a payment pattern looks unusual. Part 1 sets out exactly when that cascade is, and isn't, triggered.
Start from Part 1Vessel Sanctions Fundamentals: designated vs specified, the six routes, and IMO-number screening.
Legal and regulatory sources were last reviewed on 24 August 2026. Vessel and counterparty status should always be checked against the applicable official sanctions sources at the point of decision. This guide is an educational resource for financial crime, sanctions, and maritime risk professionals. It does not constitute legal advice.
IntelAssociation for the Reintegration of Crimea, follow-up investigation, 21 April 2026 (20+ vessels sailed on Seaguard certificates since September 2025). Attribution: this is the source of the larger, later figure, not independent corroboration of the primary Bloomberg/Ukraine FIS finding below.
UKHill Dickinson, Sanctions update: August 2026 (19 designations, 6 August 2026 package); see Part 1 for the full corroboration record.
IndustryWorld Ports Organization, Skuld CEO worried about shadow fleet's lack of insurance cover, citing an S&P Global Market Intelligence study, data to May 2025.
IndustryCenter for International Maritime Security, 13 July 2026 (70% reflagging figure, Lloyd's List-derived methodology).
IntelBloomberg, via Insurance Journal, 16 April 2026 (Ukraine Foreign Intelligence Service assessment of Seaguard P&I). Attribution: primary intelligence finding, not a judicially established fact.
EnforcementUnited24 Media, 16 April 2026 (Deyna interception under UNCLOS Article 110).
IndustryInternational Group of P&I Clubs, published member list (12 clubs, ~87% of global oceangoing tonnage).
EnforcementCameroon Ministry of Transport (February 2026 registration suspension); International Maritime Organization fraudulent registration notices.
Worked Scenario 4 additionally cites GOV.UK, UK maritime services ban and oil price cap: industry guidance, the same primary source underpinning Part 1's insurer route (route 5 of the six-route breakdown).