Screen chartered vessels for AIS gaps and sanctions red flags

Every six hours, on a cron schedule, check the vessels on our chartering watchlist for behaviour that would expose us under sanctions rules, and write up anything genuinely suspicious.

The watchlist lives in a Notion database. Read it with the Notion Query a Data Source operation. Each row holds one vessel's IMO or MMSI, the counterparty we are dealing with, the charter reference, and a risk tier. Work through every row on each run, and use the risk tier to decide how hard to look: a top tier vessel deserves the benefit of less doubt than a routine one.

For each vessel, pull four things from MarineTraffic. Single Vessel Positions (PS07) gives the last reported position with its course, speed and timestamp. Single Vessel Events gives event based intelligence including ship to ship transfers and bunkering. Single Vessel Port Calls gives recent arrivals and departures. Vessel Particulars (VD02) gives flag and ownership.

Three MarineTraffic details matter for getting this right. Each MarineTraffic API service carries its own separate 40-character key, so this workflow needs the position, events, port call and particulars keys connected individually. SPEED is returned in knots multiplied by ten, so divide before reasoning about whether a ship is moving. All timestamps are UTC. An empty response almost always means no data matched the request rather than an auth failure, so never treat a blank result as evidence that a vessel is dark: go back to the last known position timestamp and reason from that.

Flag a vessel in three cases. First, when it has been at sea with no AIS report for longer than the gap threshold, which should be a configurable input defaulting to twelve hours. Second, when it shows a ship to ship transfer away from a port. Third, when it called at a port in a jurisdiction on our high risk list, which should also be a configurable input.

Use judgement to suppress the obvious false positives, because false positive suppression is the whole game here: an estimated five to ten percent of global traffic is dark at any moment, and a channel that cries wolf gets muted within a week. A ship sitting alongside in berth is not dark, so check the speed and the port call record before raising anything about a stationary vessel with a recent arrival and no departure. A vessel in a known poor coverage area is not dark either. A gap only slightly over the threshold that ends with the vessel resuming on the same course and speed is a routine reception dropout, not a red flag. When in doubt, stay quiet and let the next run confirm it.

For every real finding, create a page in the Notion incident register with the Create a Page operation. Include the vessel name and IMO, the counterparty and charter reference from the watchlist row, how long the vessel was dark, the last known position with course and speed, the supporting events such as transfers, bunkering or port calls, and the flag and ownership if either is relevant to the concern. Then write a short assessment in plain language: why this matters commercially and legally, and the specific questions to put to the owner.

Before creating anything, query the incident register with Query a Data Source and check whether this vessel already has an open finding for the same gap or the same event. A vessel that is already logged and still dark must not be written up again and must not be re-alerted every six hours. Only raise it again when something has materially changed, such as the gap growing far longer or a new transfer appearing since the last entry, and say in the page what changed.

Finish by posting exactly one Microsoft Teams channel message to the chartering and compliance channel with the Create Channel Message operation, covering only the new findings from this run. Lead each finding with the vessel name, IMO, counterparty and charter reference, give the concern in a line or two, and link to the register page for the detail. If there are no new findings, post nothing at all.