A maritime sanctions compliance program is the set of policies, people, controls and records a marine insurer uses to avoid covering voyages, ships, owners or cargoes that sanctions prohibit, and to show that it tried. U.S. guidance built for the maritime industry names five components every program should have: management commitment, risk assessment, internal controls, testing and auditing, and training. UK guidance asks maritime insurers for a programme proportionate to their risk and leaves the measures to them. Most of a program is policy and people; its working core is screening, and screening cannot start until the insurer has brought nine things: its declarations feed, a year of past declarations and referrals, its watch list, the lists, tracking data, registries, its appetite settings, its listed areas and rates, and its authority matrix. Botminds' Marine Sanctions Screening runs that core on every declaration once those inputs exist. This guide is for the head of marine and the compliance lead starting the work.
Nine inputs to start screening, and who brings each
Data you already hold
Declarations feed
Broker bordereaux in their real formats (spreadsheet, CSV, PDF) with bills of lading, certificates of origin and P&I certificates.
Owner: Underwriting operations
Last year's declarations and referrals
Every referral, its outcome and why; the cases you later wished you had referred. This becomes the test set.
Owner: Compliance
Your own watch list
Managers, owners and brokers you have decided to look at harder, with the reason for each.
Owner: Compliance
Data you license or connect
Sanctions lists
US, UK, EU and UN, checked often enough to re-screen within the day.
Owner: Compliance
Vessel tracking
Terrestrial and satellite AIS positions for every insured voyage, with history.
Owner: Marine
Registries and filings
Ownership, management, flag and class history; casualty and inspection records.
Owner: Compliance
Decisions you write down
Appetite settings
Gap hours, distance to ports of concern, draught change, ownership warning, identifiers for a match, layers to trace, automatic-clear limit.
Owner: Head of marine
Listed areas and rate table
The war areas you rate and your additional premium, with the automatic limit above which the underwriter decides.
Owner: Head of marine
Authority matrix and wording
Who decides, who countersigns, who approves a setting change; the sanctions clause and the broker notice text.
Owner: Compliance and marine
What is a maritime sanctions compliance program?
It is the insurer's answer to one question asked in advance: how do we make sure we never cover what we must not, and how would we prove it? For a marine insurer that covers the whole policy life, because cargo declarations arrive daily, ships change owners and names, and lists change weekly. OFAC's insurance guidance puts the duty on underwriters, brokers and agents alike for as long as they are involved with a policy (OFAC FAQ 62).
The U.S. maritime advisory of May 2020, issued by the State Department, the Treasury and the Coast Guard, says each program "should be predicated on and incorporate at least five essential components of compliance: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training" (Sanctions Advisory for the Maritime Industry, 14 May 2020, Annex A). Those are the components of OFAC's 2019 Framework for Compliance Commitments, applied to shipping.
The five components, translated for a marine insurer
- Management commitment
A named owner for the program, an appetite the head of marine has signed, and resources to screen every declaration rather than a sample.
- Risk assessment
Which trades, cargoes, routes, flags and counterparties the book actually touches, and which sanctions regimes apply to the insurer, its reinsurers and its clients.
- Internal controls
Screening on receipt and re-screening on list changes; the thresholds; the authority matrix; the countersignature on sanctions refusals; the broker notice.
- Testing and auditing
Seeded replays of past declarations, measured for what the process misses, and an independent review.
- Training
For assistants, underwriters and claims staff on the red flags: tracking gaps, flag and name changes, single-ship owners, origin documents.
What due diligence do regulators expect from marine insurers?
The most specific answer is the 2020 advisory's section for maritime insurance companies. Beyond AIS monitoring, it suggests "Informing registrants (including owners of vessels) that activity inconsistent with relevant U.S. or UN sanctions may be cause for immediate termination of business", and contract wording that prohibits cargo transfers with ships "that are not broadcasting AIS consistent with SOLAS or have a history of AIS transponder manipulation inconsistent with SOLAS" (May 2020 advisory, guidance for maritime insurance companies). For ships operating near high-risk areas it suggests collecting owner identification and "the names and IMO numbers of all the vessels in the fleet of the individual ship owner".
The pattern in those recommendations is that diligence is partly data and partly contract. The data tells the insurer what a ship did; the contract gives it the right to ask, to investigate and to stop. A program that buys tracking data but never changes its wording has half of what the advisory describes. The five checks a marine sanctions screening tool should run covers the data half in detail.
What are the UK expectations for maritime insurers?
OFSI sets out principles rather than a checklist. Its maritime guidance says "It is important to remember that direct insurance, reinsurance and retrocession, insurance intermediation, and services auxiliary to insurance are considered financial services under UK sanctions regulations", and warns that "Proxy arrangements may involve a third person procuring insurance on behalf of a designated person" (OFSI, Financial sanctions guidance for maritime shipping, 6).
On the program itself it recommends "a strong sanctions compliance programme proportionate to the risk you face", with training and resources for staff, and suggests "ensuring that your sanctions compliance programme is routinely audited by qualified third parties to ensure both continuous improvement and effectiveness of your measures and controls" (OFSI maritime guidance, 3.1). For ownership it gives an example insurers can apply directly: when a company seeks insurance for a vessel, "all parties could ask for thorough documentation about the ultimate beneficial owner(s) of the vessel and verify this information using the provided documents".
What is a sanctions risk assessment for shipping?
It is a written view of where the insurer's book meets sanctions, before any screening rule is set. For a cargo and hull insurer the questions are concrete: which cargoes (crude, products, metals, grain), which loading regions, which flags and classification societies, which brokers and assureds, and which regimes apply. The answers decide the thresholds. A book of container shipments between European ports needs different gap settings from a book of tankers loading in the Gulf.
The risk assessment should also say which public advisories the insurer tracks. The U.S. Maritime Administration's active advisories in October 2026 include "2026-011-Persian Gulf, Strait of Hormuz and Gulf of Oman-Iranian Attacks on Commercial Vessels", active from 9 September 2026 to 8 March 2027, and "2026-013-Red Sea, Bab el Mandeb Strait, Gulf of Aden, Arabian Sea, and Somali Basin-Houthi Attacks on Commercial Vessels", active from 23 September 2026 to 22 March 2027 (U.S. Maritime Administration, MSCI advisories). War-risk additional premium in the London market follows the areas listed by the market's Joint War Committee; the insurer's rate table should name the version of the list it rates against.
What data is needed for vessel screening?
Five sources beyond the declaration itself: the sanctions lists, vessel tracking, registries and company filings, casualty and inspection records, and the listed areas with the insurer's own rates. Marine Sanctions Screening works from exactly those, plus the declaration documents: broker bordereaux with their bills of lading, certificates of origin and P&I certificates; sanctions and watch lists checked hourly; terrestrial and satellite AIS; registries and filings for ownership, management, flag and class history; casualty and port state inspection records; and the current listed-areas circular with the insurer's rate table.
The input most often forgotten is the insurer's own history. Last year's declarations, with every referral and its outcome, are what make the thresholds testable before they are live. Without them, the first months of screening are an experiment on live business.
Lists, listed areas and ports of concern: the reference data a program maintains
How do you set AIS gap thresholds?
Start from the book, not from a number. Rebuild the tracks for a quarter of past voyages, list every gap, and look at where the gaps that mattered sat, by length, distance to a port of concern and draught change. Then set the threshold that would have caught those without flooding the queue with open-ocean reception gaps. No regulator sets the hours; the 2020 advisory leaves "significant" to the insurer.
The appetite settings a head of marine signs, with the sample insurer's values
| Setting | Sample value | How to set it |
|---|---|---|
| Tracking gap that counts as dark | 12 h outside listed areas | Replay a quarter of voyages; set where real cases start and reception gaps thin out |
| Tracking gap inside listed areas | 12 h, proposed 8 h | Shorter where loading in the dark happens; test the change on the last week first |
| Distance to a port of concern | 50 nm | Wide enough to include anchorages and transfer areas off the port |
| Draught change across a gap | 1.0 m | Large enough to exceed crew-entry noise in AIS draught |
| Ownership warning | Listed shareholders shown from 25% | Show listed holdings early; then apply each regime's own ownership test to its own list |
| Identifiers for a list match | 2 | Never one: a name alone is a possible match, not a match |
| Automatic-clear limit | USD 25 m, no alert | The value above which a person looks even at a clean declaration |
| Additional premium without the underwriter | Up to 0.10% | Within the underwriter's delegated authority; above it, referred |
The sample insurer's head of marine tested exactly such a change. Lowering the gap threshold inside listed areas from 12 to 8 hours and re-running the last seven days added five events, all in the Gulf, none within 50 nautical miles of a port of concern. That is the information needed to decide whether the extra referrals are worth the underwriters' time, and it was available before the change applied. When an AIS gap is a red flag explains the three questions behind each threshold.
Settings: each threshold a number someone owns
Who should own a marine sanctions program?
Two people, with a line between them. Sanctions compliance owns the program: the policy, the lists, the procedure for alerts, the countersignature on refusals, and any report to a regulator. The head of marine owns the appetite: the thresholds, the listed-area rates and the authority limits underwriters work within. Senior management owns the commitment, the first of the five components, which in practice means paying for screening of every declaration rather than a sample.
The split matters because the two owners pull in different directions, and both should. Compliance wants more referred; marine wants fewer false alarms. A program where one person sets both the thresholds and the appetite has no tension in it and no check. In the sample insurer, settings changes are the head of marine's to approve, and every sanctions refusal needs compliance's countersignature.
The first ninety days: a start plan
A screening program can be live on real declarations within a quarter if the inputs are ready. The plan below is our suggestion for a cargo book; most of the time goes on proving the thresholds on the insurer's own history, not on connecting data.
Ninety days from inputs to every declaration screened
- Connect datawk 1–2
- Write settingswk 3–4
- Replay last year and tunewk 5–8
- Run in parallelwk 9–11
- Go livewk 12–13
The parallel run is the step most often cut and the most informative. For a few weeks the old process and the new one see the same declarations, and every difference is reviewed. The differences where the new process referred and the old one cleared are the program's first evidence that it works. Five measures of what a screening process misses sets out how to score them.
Where Marine Sanctions Screening fits, and where it does not
It fits the internal-controls component: screening each declaration against lists, owners, track, ports and documents, re-screening the book, drafting reasons and notices, and keeping a trail of every step and signature. It also produces the evidence the testing component needs. It does not write the policy, assess the risk, train staff, or audit itself; OFSI's suggestion of audit "by qualified third parties" is a reason to keep the audit outside the tool.
It also depends on its inputs. It brings no tracking data, registry access or lists of its own; it works from the feeds the insurer licenses and connects. Its thresholds start as the head of marine's settings and need the replay before anyone relies on them. And it decides nothing: agents read, screen and draft, the underwriter decides cover, and compliance countersigns every sanctions refusal or hold.
Questions people ask
Is a sanctions compliance program a legal requirement for marine insurers?
Complying with sanctions is a legal requirement; the form of the program is not prescribed. OFAC recommends a risk-based approach consistent with its Framework for Compliance Commitments, and OFSI does not mandate specific measures, but both treat the program's quality as relevant when deciding how to respond to a breach.
What documents should a marine insurer ask for on vessel ownership?
Documentation of the vessel's ultimate beneficial owners, verified against the documents provided, as OFSI suggests; and, for ships near high-risk areas, identification of individual owners and a list of the vessels in the owner's fleet with their IMO numbers, as the 2020 U.S. advisory suggests, where local law allows.
How long does it take to start screening every declaration?
With the inputs ready, a quarter is a realistic plan: two weeks to connect data, two to write settings and authority, four to replay last year's declarations, three to run in parallel and two to go live. The replay is the step that should not be shortened.
Should the program cover war-risk additional premium?
It should sit next to it. Listed-area days are counted from the same track the sanctions checks rebuild, and the same voyage can raise both a premium and a referral. In the sample insurer, premium within the automatic limit is applied without the underwriter and anything above it is referred.
Who should approve a change to a screening threshold?
The owner of the appetite, usually the head of marine, after seeing what the change would have done on recent voyages. In the sample insurer each change is saved as a new version of the settings and waits for that approval before it applies.