This is a welcome development, and long overdue. It is concrete evidence of the IMO beginning to address the issue of sanctions compliance. The IMO is uniquely placed to make sanctions implementation easier for member states. In a 2018 discussion paper, Project Alpha at King's College London pointed out the IMO's lack of responsiveness to UNSC requirements,[ii] and such a database - albeit one which, according to some reports, may not be ready until 2021 - will give maritime service providers at least some of the information they need to support risk management and compliance activity.

There are some reservations. First, UN designations, notoriously difficult to achieve due to the need for consensus around the Sanctions Committee, can never provide more than part of the information picture stakeholders need. Second, it is hard to see why it should take until 2021 (the date reported in some sources) to create the database when, presumably, all the necessary data is already available. Nevertheless, this represents a positive response to an international need in governments and the private sector for information on vessels and maritime entities of concern, in support of law enforcement, compliance and risk management.

The other welcome news from the same meeting is the announcement that the IMO will set up a ‘register of registries’, a whitelist of authorised flag registries. The move is aimed at countering the widespread occurrence of fake registries, but also has welcome benefits for sanctions enforcement (sanctions evasion being one of the many forms of illicit maritime activity that have thrived under false registries). Indeed one of the recommendations was for flag states to conduct a sanctions check. This is an important step by the IMO towards active assistance on sanctions compliance.

Now that it has established a role in support of UNSCR implementation, the IMO may find that it has a uniquely useful part to play in other aspects of sanctions enforcement as well. This piece notes four such areas, and will deal briefly with them in turn. These are:

• Obtaining and sharing information on group beneficial owners.
• Guidance on best practice for running a registry
• Conducting its own sanctions checks
• Information sharing on de-registrations by flag states

1. Logging of information on group beneficial owners in the maritime domain. The group beneficial owner -sometimes seen as the beneficial owner or the ultimate owner - is the parent company of the registered owner. Most databases that draw on IMO data regarding ship ownership do not include details of the group beneficial owner. In the case of those that do offer group beneficial owner as a data field, this information is rarely available. It appears that IMO regulations do not require vessels or registered owners to provide the identity of the group beneficial owner. Nor does it provide any guidance to any other maritime stakeholders, such as flag registries, on the need to determine beneficial ownership.

The practice of separating legal and beneficial ownership has legitimate applications, but also lends itself to sanctions evasion, by allowing the identity of the true owner to remain concealed. In the case of North Korean-owned ships, the data trail often leads only as far as a one-ship company. As one of many such examples, the North Korea-flagged merchant ship Chong Un (IMO 8709333) is given in databases as owned by Chongun Shipping Company Ltd (IMO 6029021). A check of IMO-derived data suggests that approximately one in three North Korean-flagged merchant ships gives an eponymous one-ship company to the IMO as the registered owner. Such companies are, in effect, front companies. IHS Markit, in its role as the IMO’s data manager, issues the single-ship company with a unique IMO number, but the ultimate owner remains invisible.

It may be argued that the IMO can only publish information that it is given, and that therefore it falls to shipping registries to determine ultimate ownership. However, as setter of standards in the maritime domain, the IMO might nevertheless request such details, particularly as they are relevant to sanctions enforcement. Flag registries should already be seeking group beneficial owner details as part of their Know-Your Customer (KYC) checks, and if not should be encouraged to do so. Details should then be passed to the IMO. The IMO might then make such details publicly available (which would be of considerable use to the public and private sector), or at least make them available for specific, authorised uses.

Sanctions enforcement is not the only area that might benefit from such a change. Ship owners wishing to conceal their identity for any purpose can do so by setting up front companies as Registered Owners.

The EU’s Anti-Money-Laundering Directive 4 (AMLD4), explains that “the need for accurate and up-to-date information on the beneficial owner is a key factor in tracing criminals who might otherwise hide their identity behind a corporate structure.” It goes on to say that “[EU Member States] should ensure that entities incorporated within their territory in accordance with national law obtain and hold adequate, accurate and current information on their beneficial ownership, in addition to basic information such as the company name and address and proof of incorporation and legal ownership. With a view to enhancing transparency in order to combat the misuse of legal entities, Member States should ensure that beneficial ownership information is stored in a central register located outside the company, in full compliance with Union law. Member States can, for that purpose, use a central database which collects beneficial ownership information, or the business register, or another central register.[iii]

AMLD-4 thus provides a framework for EU member states to ensure transparency of beneficial ownership within EU jurisdictions, but in the case of North Korean merchant shipping, it appears that most single-ship companies and, presumably, the ultimate owners concealed behind them, are incorporated in jurisdictions outside the EU; meaning that, although the same need applies, implementation may be harder. Additional layers of anonymity can be achieved by giving a care-of address, or naming a shareholder, director, or other nominated third party, as the beneficial owner. A plausible solution is for flag registries to be required to seek beneficial owner information, and to pass it to the IMO. The IMO may be best placed to instigate this greater transparency in the matter of ownership.

1. Guidance on best practice for running a registry. UNSCRs place specific obligations on shipping registries, specifically to remove from their register any vessels committing sanctions violations, and to refuse registration to vessels de-registered by others for that reason. Such instructions imply a need for strong due diligence and information sharing practices, yet neither the UNSC nor the IMO provide any recommendations for how a shipping registry should go about meeting its new obligations. All responsibility for implementing sanctions requirements is devolved to the flag states themselves, while the UNSC makes no recommendations for how to do it, and the IMO appears completely silent on the subject. In its recent work with service providers, flag states and registries, Project Alpha (King’s College London) has found that the implementation of UNSC resolutions by flag registries is affected by several factors:

• The relationship between registries and maritime authorities. It should be noted here that many registries – particularly open registries (those flag states that place no nationality or residency requirements on ship owners), are run by private contractors, and that therefore seamless collaboration between registry and state cannot be assumed. Indeed, a wide variation is evident in how much control and oversight national maritime authorities have over their respective registries;

• Inadequate regulation. Not all flag states have the powers they need to order de-registration, set due diligence standards for the registry or indemnify themselves against claims by de-registered parties. Use of the flag without authorisation needs to be a criminal offence, as does operation of a flag registry without permission;

• Due Diligence practices by registries vary considerably. As well as more general risk management products, a range of free and subscription-based services and applications specific to the maritime domain are available.[iv] These typically draw on IMO data (concerning ownership, management, flag history etc), and AIS data (ship-shore communications concerning position, speed and heading) and enable screening and tracking. It is not clear how widely used these are. In its most recent report, the UN Panel of Experts on North Korea found that “None of the flag-of-convenience States that replied to the Panel’s letters on AIS surveillance currently monitor the AIS of the vessels that sail under their jurisdiction”. While the Panel might have raised particular concern about open registries (‘flag-of-convenience states’), the risks are not confined to them. Creation of companies under foreign jurisdictions (which then may be used to register a ship) is a sanctions evasion tactic frequently used by North Korea, according to reporting by the Panel of Experts and others. In addition, North Korea’s growing use of ship-to-ship transfers for illicit trade imposes obligations on closed and open registries alike to ensure their flagged fleet is not engaged in such activity.

• Information-sharing between registries. It should arguably be normal KYC practice to consult repositories of IMO data (such as Equasis or gisis.imo.org), and to consult former flag states, but the evident ability of vessels implicated in sanctions violations to obtain new flag services suggests practice varies considerably.

The IMO does not have a policing role, but does set standards, and therefore arguably has a role to play in helping define best practice implied by UN Security Council Resolutions. By defining standards in the above areas, the IMO might help to improve practices within registries, and the relationships between registries and their respective maritime authorities.

1. Conducting its own sanctions checks. This would complement, rather than replace, KYC checks by registries, and would allow any concerns to be usefully shared. The IMO has now taken its first steps towards active assistance by announcing a plan to create a whitelist of authorised flag registries. The move is aimed at countering the widespread occurrence of fake registries, but also has welcome benefits for sanctions enforcement (sanctions evasion being one of the many forms of illicit maritime activity that has thrived under false registries). The precedent is therefore in place for the IMO to move more actively into the sanctions sphere. Successive Panel of Experts reports have pointed to the growing scope, scale and sophistication of North Korean sanctions evasion tactics, yet responsibility for detecting these still falls to the flag states. The IMO might mandate its data manager (IHS) to conduct sanctions checks when entering details of flagged vessels onto its database and raise any concerns with flag states.
2. Information sharing on de-registrations by flag states. The recent announcement that the IMO is setting up a database of vessels designated by the UN sets a clear precedent in this area. Any sanctions-related de-registrations, and the reasons for those de-registrations, also need to be communicated among flag states, and the IMO may have a role to play. Although the UNSC clearly laid out the criteria for de-registering merchant vessels, it did not require notification of the deletion to the Security Council, nor indeed circulation of the information to any other interested parties. While requiring that flag states should de-register merchant vessels owned or operated by North Korea, and that other flag states should refuse to register any vessels de-registered for that reason, it omitted to explain how flag states might obtain information on sanctions-related de-registrations, or to establish a mechanism by which such information might be confidentially shared and sought.[v] Nor was any such guidance apparent when the UNSC reaffirmed the same point on 22 December 2017 under UNSCR 2397.[vi]

Current best practice appears to be for a flag state, when approached by an individual or company trying to register a vessel, to request sight of any deletion certificate, and to consult the previous flag state(s); and for any flag state de-registering a vessel to ensure that the deletion certificate makes clear the de-registration was for a sanctions violation. This devolved responsibility leaves a lot to chance, and seems unnecessarily risky when the IMO’s data provider may already have access to information on sanctions-related de-registrations (as flag states provide regular updates on their holdings). An improvement would be to formalise this process, making the IMO the central point. Flag states would be required to report to the IMO any de-registration for any infringement. This information would then be circulated by the IMO. The process would need to respond fast enough to prevent de-registered vessels from obtaining a new flag in the meantime. This might be a useful, and more dynamic, add-on to the database proposed at the 27-29 March meeting.

Conclusion

Information requirements in maritime sanctions implementation go well beyond the measures proposed at the recent IMO meeting. Risk management in both the public and the private sector is arguably more concerned with high-risk non-designated entities than a more easily searchable list of designated entities. Direct or indirect connections to any sanctions-related infringements, such as port denials, seizures, or involvement in ship-to-ship transfers, are relevant. It is impractical to lay all this at the door of the IMO. Nevertheless, the IMO’s increased engagement with sanctions implementation – as evidenced at the 27-29 March meeting, will be welcomed by the public and private sector alike.

 

[i] http://www.imo.org/en/MediaCentre/MeetingSummaries/Legal/Pages/LEG-106th-session.aspx

[ii] https://projectalpha.eu/discussion-paper-un-maritime-sanctions-and-the-international-organisation/

[iii] Official Journal of the European Union L/141/73, paragraph 14. The EU’s Anti-Money-Laundering Directive 4 (AMLD-4), also known as EU Directive 2015/849, may be accessed at https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ%3AJOL_2015_141_R_0003.

[iv] A description of some of these services can be found in “Use of Entity Screening and Vessel Tracking to Assist Implementation of UN Sanctions – a Whitepaper  https://projectalpha.eu/wp-content/uploads/sites/21/2017/12/Osborne-Whitepaper-Final-8-Dec-2017-v2.pdf.

[v] Para 24 of UNSCR 2321. “Decides that all Member States shall de-register any vessel that is owned, controlled, or operated by the DPRK, and further decides that Member States shall not register any such vessel that has been de-registered by another Member State pursuant to this paragraph”

[vi] Para 12 of UNSCR 2397 “Reaffirms paragraph 24 of resolution 2321 (2016) and decides that each Member State shall de-register any vessel it has reasonable grounds to believe was involved in activities, or the transport of items, prohibited by resolutions 1718 (2006), 1874 (2009), 2087 (2013), 2094 (2013), 2270 (2016), 2321 (2016), 2356 (2017), 2371 (2017), 2375 (2017), or this resolution and prohibit its nationals, persons subject to its jurisdiction and entities incorporated in its territory or subject to its jurisdiction from thereafter providing classification services to such a vessel except as approved in advance by the Committee on a case-by-case basis, and further decides that Member States shall not register any such vessel that has been de-registered by another Member State pursuant to this paragraph except as approved in advance by the Committee on a case-by-case basis”