KYC Mechanics: Decoding the Novorossiysk-Turkish-Med Origin-Laundering Pattern

Origin on a bill of lading is an assertion. It is a line of text a charterer or trader puts on paper. It is not a fact, and it is not verified by anyone in the documentary chain unless someone goes looking. That distinction is the entire weak point that the Novorossiysk-Turkish-Med pattern is built to exploit.

OilFlow's first-party investigation has auto-tagged a dark-fleet cluster operating a specific, repeatable mechanic: barrels loaded at Novorossiysk, re-routed through a Turkish-Mediterranean port call, and presented downstream on a bill of lading that claims neutral origin. The cluster was flagged at the AIS level, anchored at a Turkish anchorage, and cross-references OFAC's Russian Harmful Foreign Activities program and the G7 price cap. This is not a market story. It is a documentary-laundering teardown, and the deception lives entirely in the gap between where the cargo physically loaded and what the paper later says.

The mechanic, step by step

Strip the pattern to its three moving parts and it becomes legible.

Step one: the load. A vessel loads crude or product at Novorossiysk, the principal Russian export terminal on the Black Sea. This is the verifiable event. A loading is a physical act with a fixed geography, a draught change, and a port call that AIS records whether anyone wants it recorded or not.

Step two: the hop. Rather than sailing directly to a buyer with a clean Novorossiysk-origin document, the vessel calls at a Turkish-Mediterranean port or anchorage. The function of this call is not commercial in the ordinary sense. It exists to insert a break in the chain of custody. The cargo may transship, may co-mingle, or may simply touch and continue. The point is that a new geography now sits in the vessel's recent history, and that geography is not on a sanctions origin list.

Step three: the paper. A bill of lading emerges that claims neutral origin. The Turkish-Med call provides the cover story. The barrels, now documented as something other than Russian-origin, move into a buyer's compliance funnel where they will be assessed against the document, not against the track.

That is the whole machine. Load where it is real, hop where it is convenient, paper it where it is profitable. The Turkish-Med leg is the laundering step, and it exists for one reason: to break the audit trail between physical load port and paper origin.

Why the documentary layer fails

Compliance teams inherit the cargo at the document stage. By the time a bill of lading reaches an MLRO's desk, the loading happened weeks ago and several jurisdictions away. The document is internally consistent. The named load or transshipment port is real. The mandate chain looks plausible. Nothing on the page is technically false in a way that document review alone will catch, because the false claim is an omission of origin, not a fabricated fact.

This is precisely the failure mode FATF Recommendation 10 is meant to address. Customer due diligence requires understanding the source of funds and the nature of the transaction, not just verifying that the paperwork is filled in correctly. A bill of lading claiming neutral origin from a Turkish-Med port satisfies a documentary checklist while concealing the underlying source. The control passes. The risk does not.

The layer cake works because each layer is individually defensible. The Novorossiysk loading is invisible at the paper stage. The Turkish-Med call is a real port event. The neutral-origin claim is supported by the most recent port history. No single document lies loudly enough to trip a manual review. The deception is structural, distributed across the chain so that no one node looks criminal in isolation.

The track is the counter-record

The vessel does not get to choose its history. AIS reconstruction recovers the load-point and port-call sequence regardless of what the bill of lading later asserts. This is why detection has to move upstream of the document.

In the cluster OilFlow tagged, the trigger was the AIS anchor itself: vessels clustering at a Turkish anchorage with track histories that ran back to Novorossiysk loadings. The anchorage behavior is the tell. Legitimate cargoes do not need a Turkish-Med touch to establish origin, because their origin was never the problem. A vessel that loads at Novorossiysk and then routes through a Turkish-Mediterranean call before its cargo surfaces as neutral-origin is performing the laundering step in plain view of anyone watching the track.

This is the core of the thesis. AIS-confirmed loading geography is the verifiable counter-record to the BoL's assertion. When the two disagree, the track wins, because the track is a record of physical events and the document is a record of claims. Compliance teams that reconstruct the voyage before they read the paper catch the pattern. Teams that read the paper first are evaluating the cover story, not the cargo.

Why this gets harder right now

The macro backdrop matters because it reshapes what a normal flow looks like. Overnight the market ran risk-off, with Brent down four percent to $79.83, WTI at $76.23, and Dubai at $77.83. The Brent-Dubai EFS compressed to around $2.00, reopening westbound arbitrage and pulling legitimate barrels into routings that, on a busy day, can look superficially similar to a disguised-origin hop. When real arbs reroute genuine cargoes through the Mediterranean, the noise floor rises and a Turkish-Med call looks less anomalous in aggregate. Disguised-origin barrels hide better in a reshuffled flow. That is exactly when AIS-level discrimination matters most, because the document layer becomes even less reliable as a filter.

What the cross-references tell you

The cluster cross-references OFAC's Russian Harmful Foreign Activities program and the G7 price cap. Both regimes turn on origin and price attestation. The price cap mechanism in particular relies on attestations that follow the cargo through the mandate chain. A bill of lading claiming neutral origin is not merely an inconvenience to those regimes. It is an attempt to dissolve their jurisdictional hook entirely. If the barrel is not Russian-origin on paper, the price cap and the OFAC origin nexus have nothing to bite on.

This is the same logic that drives screening against the OFAC SDN list to be necessary but insufficient. A clean name screen on a counterparty tells you nothing about whether the cargo it is moving was loaded at Novorossiysk. Origin laundering is designed to survive name screening, because the names involved may carry no listings while the cargo carries the sanctioned geography. The dark fleet operates in exactly this seam.

What compliance teams should do

Reconstruct the voyage before you read the bill of lading. The single highest-value control change here is sequencing. Pull the AIS track first, establish the actual load port, and only then evaluate the origin claim on the paper. If the document says neutral origin and the track shows a Novorossiysk loading, you have your answer before the documentary review even begins.

Flag the specific red-flag sequence. Novorossiysk load, then Turkish-Mediterranean call, then a bill of lading asserting neutral origin. Treat that three-step sequence as a single composite indicator, not three separate low-priority observations. The pattern only resolves when you look at the steps together.

Treat Turkish-Med anchorage behavior as a question, not a comfort. A transshipment or anchorage touch that has no clear commercial logic, sitting between a Russian load and a neutral-origin claim, is the laundering step. Ask what function the call served. If the only function it served was to insert a non-sanctioned geography into the vessel history, you have found the mechanic.

Anchor the file to the regulatory hook. Document the OFAC Russian Harmful Foreign Activities and G7 price cap nexus explicitly, and apply FATF Recommendation 10 source-of-cargo logic rather than a documentary checklist. The origin claim is the control point. Make your MLRO escalation turn on the track-versus-paper gap, because that gap is the evidence.

The paperwork will always arrive looking clean. That is what it is built to do. The vessel track is the only record the cluster cannot rewrite, and it is available before the bill of lading ever reaches your desk. Detect at the AIS level, and the documentary layer becomes a confirmation step instead of a blind spot.