Maritime sanctions screening has become increasingly sophisticated around tanker behaviour. RoRo vessels pose a different problem because the relationship between what the ship is doing and what its AIS track can reveal is much weaker.
Earlier this year, HUAX repeatedly surfaced an older RoRo operating in the Eastern Mediterranean. At first glance, there was little about the vessel that demanded attention. It had periods of AIS non-reporting, spent time at anchor near a familiar waypoint and occasionally transmitted the destination entry “ORDER”, but none of those features would have been unusual enough on its own to support a meaningful conclusion.
What made the vessel worth revisiting was the way those signals accumulated over time. Across multiple runs, HUAX recorded 179 AIS gaps, with the distribution of non-reporting periods standing out against comparable traffic in the region. Its peer-normalised Z-score was above 4.5. HUAX also identified STS-associated activity in the surrounding area, while the vessel’s historical record showed several changes of name and flag state.
There were plausible explanations for each element. AIS reception is imperfect. Ships change flags and names. Destination fields are often entered poorly, and an anchorage associated with one type of activity can also support entirely routine traffic. The combination nevertheless created enough friction to warrant closer examination.
That examination ultimately produced a more cautious result. The terrestrial AIS coverage around the relevant periods was not strong enough to determine whether the apparent outages represented deliberate non-reporting or insufficient reception. HUAX therefore did not escalate the vessel on the basis of the track. The appropriate next step was corroboration through satellite AIS or alternative sources.
The case was useful precisely because it did not produce evidence sufficient to support a sanctions-related finding. Instead, it exposed a broader analytical problem: many of the signals that have become familiar in maritime sanctions screening were developed around tankers, where vessel movement can reveal considerably more about the underlying cargo activity.
Tanker behaviour became the reference point.
The prominence of tankers in maritime sanctions screening is not accidental. Restrictions on Iranian, Venezuelan and Russian oil created a strong operational need to identify practices such as ship-to-ship transfers, extended AIS outages, unusual export routes, changes in draught and activity around offshore transfer areas. Over time, those patterns have shaped not only investigative practice but also the way automated screening systems interpret maritime behaviour.
For tankers, there is often a relatively strong relationship between the physical operation of the ship and the cargo movement an analyst is trying to understand. A significant draught change can provide evidence consistent with loading or discharge. Two tankers remaining alongside one another offshore may justify examining a possible transfer. Calls at crude terminals, storage areas or recurring offshore locations add further context. None of these observations proves what happened, but taken together they can make a voyage increasingly legible.
RoRo vessels offer fewer of those clues. Their commercial function is to move rolling cargo: passenger vehicles, trucks, trailers, construction equipment and heavy machinery among them. Most of this is ordinary commerce. Depending on the cargo, route, counterparty and end use, however, the same transport capability can also become relevant to sanctions or export-control analysis. The difficulty is that those differences may produce very little change in the visible operation of the vessel.
A RoRo can make the same port call on successive voyages while carrying materially different cargo. Reported draught is generally less useful as a proxy for what has been loaded or discharged, and AIS draught entries themselves may be stale, missing or manually entered. A vessel carrying passenger vehicles on one voyage and heavier machinery on another does not necessarily produce an observable change in its sailing pattern.
This is where tanker-oriented assumptions begin to lose resolution. The absence of an offshore transfer, a large draught change or an extended AIS outage says relatively little about what passed across a RoRo ramp. The vessel can remain commercially routine at the track level while the information needed to assess the voyage sits elsewhere.
That does not make RoRo traffic inherently higher risk; it changes the type of evidence that matters.
From individual events to recurring context.
For RoRo traffic, a useful investigation often depends less on one dramatic event than on whether the vessel and the network around its voyages remain coherent over time.
Identity is part of that assessment. Ships change names, flags, owners and managers for legitimate commercial reasons, so no single change should carry much weight. Repeated changes become more relevant when they make it harder to reconcile AIS records, registry information, ownership data and compliance sources. The analytical question is not whether a vessel has changed identity, but whether the available records still describe the same physical ship consistently and whether its operating history can be reconstructed with confidence.
Route behaviour provides another layer. A single port call or anchorage stay may be almost meaningless in isolation. Recurrence is more useful. Which ports does the vessel repeatedly connect? Which waiting areas does it use? Are those patterns typical for comparable RoRos operating on the same corridor, or does part of the vessel’s behaviour persistently sit outside the peer group?
Peer comparison matters because maritime behaviour has to be interpreted against an operational baseline. Four hours at an anchorage may be entirely normal if comparable vessels routinely wait there. The same four hours become more interesting if they recur in a location that similar ships rarely use, particularly when the pattern coincides with other inconsistencies in identity, destination reporting or voyage history.
Track integrity then has to be assessed separately from the apparent anomaly itself. AIS gaps are particularly vulnerable to overinterpretation. A missing terrestrial position does not establish that a vessel deliberately stopped transmitting, because the observation depends on receiving infrastructure as well as the transmitter aboard the ship. Geography, traffic density, antenna availability and other technical conditions can all affect what appears in the historical record.
The useful question is therefore not simply whether the vessel disappeared, but whether it should reasonably have been observable at the time. That requires enough surrounding fixes to understand the reception environment and, where necessary, comparison with other vessels moving through the same area.
Identity stability, corridor context and coverage-aware track integrity formed the core of the original HUAX assessment of the Eastern Mediterranean case. None is uniquely applicable to RoRo vessels, but together they provide a more useful basis for analysing them than applying tanker heuristics unchanged.
What the case actually established.
The investigation did not produce evidence sufficient to support a sanctions-related finding.
The vessel’s identity history, destination reporting and peer-relative AIS behaviour created enough uncertainty to warrant investigation. Once the reception environment was examined, however, the available terrestrial data could not support the stronger interpretation that the non-reporting pattern itself represented deliberate concealment.
Automated screening can identify anomalies at scale. The harder task is determining which of them remain meaningful once the quality and context of the underlying data are examined.
In this case, the correct result was not to discard the signals but to change the next analytical step. Satellite AIS or another tracking source could help determine whether the apparent gaps persisted outside the terrestrial dataset. Ownership and management records could strengthen or weaken the identity assessment. Port history and other external information could provide context that the movement data alone could not.
For RoRo vessels, that need for corroboration is particularly important because the track often reveals less about the cargo operation than it would for a tanker. There may be no equivalent of a large post-loading draught change and no offshore geometry that strongly suggests a transfer. Two voyages carrying very different rolling cargo can look almost identical when viewed only as movements between ports.
A useful screening output therefore cannot always tell an analyst what happened. In some cases, its more valuable function is to identify what remains unexplained and what additional evidence would be needed to resolve it.
The Eastern Mediterranean case says less about one unusual RoRo than it does about the limits of treating vessel type as a secondary characteristic in maritime screening. A pattern only becomes meaningful in relation to the way a particular ship is expected to operate. What is informative for a crude tanker may be weak evidence for a RoRo, while behaviour that looks routine at vessel level can take on different significance when identity, route history and commercial relationships are examined together.
AIS remains central to the analysis, but it describes the movement of the vessel rather than the cargo itself or the commercial purpose of the voyage. For RoRo traffic, the distance between those things can be substantial.
A useful screening model therefore has to preserve that distinction. It should separate what the available data shows, what it reasonably suggests, and what still requires corroboration.