Vessel Identity Risk: How Flag State, Class Rarity, Phantom Fleets, and Name Changes Each Contribute to the Same Sanctions Exposure

Flag state stratifies fleets from 19.8 to 31.2 average risk. LNG carriers hit critical at 5.3× the tanker rate on a 42-vessel sample. Six fully anonymous vessels score 100 out of 100. Twenty-two renames and five MMSI swaps in 30 days — identity signals are not one signal, they are four, and they compound.

The Setup

The vessel risk score ingests four identity signals that most compliance pipelines treat separately: flag state, vessel class, identity completeness, and identity change velocity. Each contributes independently, and the highest-risk fleets are those that stack signals.

Flag state risk distribution (30-day average risk score):

• Sierra Leone / Comoros fleet (n=67): 31.2 — the highest open-registry risk in the dataset.
• Panama (n=537): 21.2.
• Liberia (n=612): 19.8.

The two flags everyone screens for — Panama and Liberia — are actually the mid-tier of the open-registry risk distribution. Sierra Leone/Comoros, the registry that grew fastest during 2024–2025 as Panama tightened vetting, is 50% riskier than Panama on average. Most sanctions compliance screens for Liberia and Panama as "open registry"; almost none screen for Sierra Leone/Comoros specifically.

Class-based risk:

• LNG carriers (n=42 scored): 4.8% critical-risk rate.
• Tankers (n=1,456 scored): 0.9% critical-risk rate.
• LNG critical rate is 5.3× tankers. Top risk vessels: GAS LUCKY, LNG NOBLE.

Identity completeness:

• 6 fully anonymous vessels (no name, no flag, no MMSI) scoring the maximum risk ceiling of 100.
• 5 named-with-partial-identity vessels (some fields present, some null).
• 11 null-type critical-tier vessels total.
• 1 of the anonymous vessels has a confirmed STS (ship-to-ship transfer) event.

Identity change velocity (last 30 days):

• 22 name changes.
• 5 MMSI changes.
• 3 shell-hop events (vessel jumps to a new ownership entity).
• MMSI changes carry a 100% obfuscation flag rate — every MMSI change in the 30-day window produced a risk flag.

The Chain

Each identity signal emerges from a different part of the detection pipeline, and each has a different evasive cost.

Flag state is the cheapest identity signal to change — a registry switch takes weeks — and the one compliance teams screen most often. It's useful but blunt. The stratification matters: the 31.2 average for Sierra Leone/Comoros is not a property of every SL-flagged vessel; it's driven by the tail of sanctioned-proximity vessels parking under the flag. Targeted screening at the SL/KM registry catches the tail without flagging the base rate.

Class rarity is where signals compound. LNG carriers are a small, watched fleet; any LNG carrier triggering a critical-tier risk threshold is almost certainly known to compliance teams already. The 5.3× differential against tankers reflects concentration — when 42 vessels include 2 known problem vessels, the rate looks high — rather than a systemic LNG risk property.

Identity completeness is the cleanest signal. A vessel transmitting no name, no flag, and no MMSI cannot be legitimate commercial traffic. The 6 fully anonymous vessels at risk score 100 are not false positives — they are genuinely unidentifiable, which means no compliance pipeline can screen them. They are the phantom fleet. The one anonymous vessel with an STS event is the cleanest single indicator of deliberate evasion in the dataset.

Identity change velocity is the newest signal and the fastest-moving. The 100% obfuscation-flag rate on MMSI changes is telling: MMSI numbers don't change during normal vessel operations — they are assigned per flag, and a MMSI change almost always accompanies a flag change, re-registration, or ownership transfer. Every MMSI change in the 30-day window corresponded to a compliance signal, which means MMSI changes are a nearly perfect leading indicator. The 22 name changes are noisier (vessels legitimately rename when sold) but the 3 shell-hop events — where a vessel jumps between ownership entities that share directors or beneficial owners — are high-quality signals on their own.

The four signals compound. A Sierra Leone-flagged tanker is not by itself high-risk; a Sierra Leone-flagged tanker that changed MMSI last week and is part of a shell-hop cluster is the highest-risk signal pattern the pipeline produces. The 11 null-type critical vessels are likely intersections: anonymous + (flagged or unflagged) + risk ceiling = fleet to watch.

The Implication

Sanctions screening should combine all four identity signals with explicit weightings, not treat them as separate screens:

1. Flag state is a prior, not a verdict. Use the stratified risk (31.2/21.2/19.8) as a Bayesian prior on a vessel's risk posture, not a binary flag for blanket flagging.
2. Class rarity should trigger case-level review, not fleet-level action. LNG's 5.3× critical rate reflects two vessels on a 42-vessel base; screen those two, not all 42.
3. Identity completeness is the highest-signal-to-noise identity feature in the dataset. Any vessel broadcasting null for name, flag, or MMSI should escalate immediately. Six vessels is a manageable cohort for human review.
4. Identity change velocity is the newest and most powerful signal. MMSI changes with 100% obfuscation-flag rate mean a screener can treat any MMSI change as an automatic investigation trigger. Shell-hop events (3 in 30 days) warrant similar treatment. Name changes (22 in 30 days) are noisier but worth ingesting into a broader temporal-edges graph for clustering analysis.

What to Watch

• The Sierra Leone/Comoros fleet size. If it continues growing past the 67-vessel threshold, the average risk may drift toward the Panama average as the base rate dilutes the sanctioned-proximity tail.
• The null-type cohort. Six fully anonymous vessels is a small, trackable set; any growth above 10 suggests deliberate anonymous-transmission tactics are spreading.
• MMSI change rate. 5 in 30 days is normal; any acceleration past 10/month is a coordinated-evasion signal.
• Whether the shell-hop detector surfaces recurring beneficial-owner clusters. The 3 shell-hop events may all trace back to 1–2 ownership networks; if so, those networks become the screening target rather than individual vessels.

Limitations

The flag-state distribution is based on average risk scores, which blend true compliance risk with detection artifacts (ports with denser AIS coverage inflate risk scores for the vessels transiting them). The LNG critical rate is based on 42 vessels; two specific vessels dominate the statistic and the rate would move materially with any single addition/removal. Identity completeness counts "anonymous" strictly — partial identity (e.g. name present but no flag) shows up in the named-with-partial-identity bucket instead. Identity change velocity may under-count: the 22 renames reflect confirmed changes; hidden changes (where a vessel was sold and re-registered simultaneously) are not captured unless the temporal-edges graph catches the continuity gap. The 100% obfuscation-flag rate on MMSI changes is based on 5 events — a larger sample may show 85–95%, not 100%.

Data current as of 2026-04-23. Source: Axiom Overwatch vessel risk scoring, flag state stratification from IMO registry data, identity change detection from temporal_edges graph. Consolidates prior posts on flag state risk, LNG critical rate, phantom fleet anonymous vessels, and vessel identity change velocity.