# Screen chartered vessels for AIS gaps and sanctions red flags

> Every six hours we check each ship on your watchlist for unexplained tracking gaps and off-port transfers, then log real findings and alert your team.

- Workflow type: agent
- Services: MarineTraffic, Notion, Microsoft Teams
- Categories: Operations
- Published: 2026-08-31

## What it does

- Reads your chartering watchlist from Notion and checks every vessel on it four times a day, pulling last known position, recent events, port calls, flag and ownership.
- Looks for the three things compliance teams get asked about: a ship that has stopped reporting its position at sea, a ship to ship transfer made away from any port, and a call at a port in a country you have marked high risk.
- Uses judgement to drop the obvious false alarms, such as a vessel sitting quietly alongside in berth, a short dropout in a known poor coverage area, or a gap barely over the threshold.
- Writes each real finding into your Notion incident register with the vessel, counterparty, charter reference and a short assessment of what to ask the owner, then posts one Microsoft Teams message covering only what is new this run.

## What you'll need

- A MarineTraffic subscription. Their data products are sold separately and each one comes with its own key, so you will need the ones covering vessel positions, vessel events, port calls and vessel particulars.
- A Notion workspace with two databases: a watchlist holding each vessel's IMO or MMSI, the counterparty, the charter reference and a risk tier, and an incident register where findings get filed.
- A Microsoft Teams account with access to the chartering and compliance channel you want alerts posted in.
- Your own list of the jurisdictions and ports you treat as high risk.

## Prompt

Every six hours, on a cron schedule, check the vessels on our chartering watchlist for behaviour that would expose us under sanctions rules, and write up anything genuinely suspicious.

The watchlist lives in a Notion database. Read it with the Notion Query a Data Source operation. Each row holds one vessel's IMO or MMSI, the counterparty we are dealing with, the charter reference, and a risk tier. Work through every row on each run, and use the risk tier to decide how hard to look: a top tier vessel deserves the benefit of less doubt than a routine one.

For each vessel, pull four things from MarineTraffic. Single Vessel Positions (PS07) gives the last reported position with its course, speed and timestamp. Single Vessel Events gives event based intelligence including ship to ship transfers and bunkering. Single Vessel Port Calls gives recent arrivals and departures. Vessel Particulars (VD02) gives flag and ownership.

Three MarineTraffic details matter for getting this right. Each MarineTraffic API service carries its own separate 40-character key, so this workflow needs the position, events, port call and particulars keys connected individually. SPEED is returned in knots multiplied by ten, so divide before reasoning about whether a ship is moving. All timestamps are UTC. An empty response almost always means no data matched the request rather than an auth failure, so never treat a blank result as evidence that a vessel is dark: go back to the last known position timestamp and reason from that.

Flag a vessel in three cases. First, when it has been at sea with no AIS report for longer than the gap threshold, which should be a configurable input defaulting to twelve hours. Second, when it shows a ship to ship transfer away from a port. Third, when it called at a port in a jurisdiction on our high risk list, which should also be a configurable input.

Use judgement to suppress the obvious false positives, because false positive suppression is the whole game here: an estimated five to ten percent of global traffic is dark at any moment, and a channel that cries wolf gets muted within a week. A ship sitting alongside in berth is not dark, so check the speed and the port call record before raising anything about a stationary vessel with a recent arrival and no departure. A vessel in a known poor coverage area is not dark either. A gap only slightly over the threshold that ends with the vessel resuming on the same course and speed is a routine reception dropout, not a red flag. When in doubt, stay quiet and let the next run confirm it.

For every real finding, create a page in the Notion incident register with the Create a Page operation. Include the vessel name and IMO, the counterparty and charter reference from the watchlist row, how long the vessel was dark, the last known position with course and speed, the supporting events such as transfers, bunkering or port calls, and the flag and ownership if either is relevant to the concern. Then write a short assessment in plain language: why this matters commercially and legally, and the specific questions to put to the owner.

Before creating anything, query the incident register with Query a Data Source and check whether this vessel already has an open finding for the same gap or the same event. A vessel that is already logged and still dark must not be written up again and must not be re-alerted every six hours. Only raise it again when something has materially changed, such as the gap growing far longer or a new transfer appearing since the last entry, and say in the page what changed.

Finish by posting exactly one Microsoft Teams channel message to the chartering and compliance channel with the Create Channel Message operation, covering only the new findings from this run. Lead each finding with the vessel name, IMO, counterparty and charter reference, give the concern in a line or two, and link to the register page for the detail. If there are no new findings, post nothing at all.

## How to customize

- Change the gap threshold. Twelve hours is the default; tighten it for tankers in sensitive trades, or loosen it on routes where coverage is genuinely patchy.
- Edit the high risk jurisdiction list, and add the coverage blackspots you want the check to forgive so your channel stays worth reading.
- Change how often it runs or point the alert at a different Teams channel, and adjust which fields get written into the register.

## FAQ

### Does a tracking gap always mean the ship is hiding something?

No, and that is the point of the judgement step. Vessels lose signal for routine reasons: poor satellite reception, congested coastal areas, equipment faults, or simply sitting still in berth. The check compares the gap against your threshold, looks at what the ship was doing either side of it, and only writes up gaps that stay unexplained. Everything else is dropped silently.

### Will the same vessel be reported every six hours while it stays dark?

No. Before writing anything up it checks the incident register for an open finding on the same vessel and the same gap. A ship that is already logged and still dark will not generate a new page or a new message. Only genuinely new findings, or a material change such as a much longer gap or a fresh transfer, get raised again.

### Do I need every MarineTraffic data product to run this?

You get the most out of it with all four, since each check draws on a different one. If you only have vessel positions to start with you will still get the tracking gap findings, and you can add events, port calls and particulars later to turn on transfer and port risk checks.

### Can I send the alerts to Slack instead of Microsoft Teams?

Yes. The alert step is a single message to one channel, so it can be pointed at Slack, or at email, without changing anything else about how the checks or the register work.

### How many vessels can it watch?

As many as you keep in the watchlist. Every vessel means a handful of lookups per run, so a very large fleet checked every six hours will use more of your MarineTraffic allowance. Most desks watch the ships they currently have on charter rather than the whole market.

### Why does this matter commercially?

Regulators increasingly hold charterers responsible for how the vessels they hire behave. An unexplained tracking gap is not just a data problem: it can point to an undisclosed transfer or a cargo origin question, and it can put a voyage, a banking relationship or an insurance position at risk. Catching it early gives you time to ask the owner before someone else asks you.

Use this prompt in General Input: https://www.generalinput.com/prompts/screen-chartered-vessels-for-ais-gaps-and-sanctions-red-flags