Since 2022, millions of tonnes of grain have been moved out of temporarily occupied Ukrainian territory. The route from a combine in Zaporizhzhia oblast to a bakery in Damascus or Tripoli rests on specific ports, specific vessels and specific flags. This is how the chain is built — and where it breaks under a serious check.
Grain theft is not a one-off episode. It is a mature logistics system, built from the summer of 2022 onward, when the first shipments left occupied Azov ports under satellite and AIS observation. Public estimates from the KSE Institute, the UN and SAIS at Johns Hopkins put the volume at six million tonnes or more, and the real figure is higher because several vessels switch off their transponders on the critical legs of the route.
For Ukrainian agriculture this is lost harvest and lost market. For an international trader, bank or insurer it is a different problem: accidentally buying, financing or insuring a cargo that has touched a sanctioned vessel or port. Dollar and euro payments always clear through correspondent banks in the US or EU, and that is where sanctions exposure is caught — no matter how clean the paperwork looks. Understanding the route is not journalism. It is a basic part of compliance in Black Sea grain trade.
The first node is the ports under Russian control. On the Azov side these are Mariupol and Berdiansk. The Mariupol port, rebuilt under military use after late 2022, began shipping grain again: satellite imagery captured truck queues at elevators and bulkers loading at the quay. Berdiansk has worked in parallel as a smaller but steady node.
The second is Crimea. Sevastopol and Feodosia operate as transhipment terminals: grain reaches them by road from elevators in occupied southern oblasts and across the Azov on small bulkers, then transfers onto vessels heading for the Bosphorus. The very fact that a vessel calls at a Crimean port breaches international law — Ukraine has formally closed these ports since 2014. So any vessel that calls there documents its own breach in its AIS log, unless it turns the transponder off.
International rules require large vessels to broadcast their position via AIS (Automatic Identification System) continuously. The signals are public: anyone with access to MarineTraffic, VesselFinder or paid services like Lloyd's List Intelligence can see where a ship has been and when. This is the foundation of maritime compliance.
On the stolen-grain route this is systematically broken in three ways. The first is a full AIS shut-off in the Kerch Strait or near occupied ports: a gap of several hours to several days appears on the track, and the vessel "reappears" already in the Black Sea, loaded. The second is ship-to-ship transfers in open water: two bulkers come side by side, the cargo moves between them in neutral waters between Crimea and the Turkish coast, and one of them heads for the Bosphorus as if nothing happened. The third is MMSI spoofing: a vessel broadcasts a false identifier or copies another vessel's signal. This last trick is technically harder but documented in Bellingcat and Lloyd's List reports on specific voyages.
Each of these deviations is, on its own, grounds for a compliance check. An AIS gap does not prove the cargo is stolen, but it lifts the vessel out of the "routine voyage" category and forces separate verification of cargo, route and ownership.
The hardest point to trace is the Russian deepwater terminals on the Black Sea. Novorossiysk, Kavkaz and Taman act as merging hubs. Grain arrives there from Crimea on small coastal bulkers, across the Kerch Strait from the Azov, and in parallel — Russian grain from elevators in Krasnodar Krai, Rostov and Stavropol regions.
At the terminal the cargo is re-bagged, certified by the Russian side as "Russian-origin", and loaded onto large Panamax or Capesize bulkers heading for the Middle East and Africa. On paper the cargo looks clean: the exporter is a Russian company, the terminal is a Russian port, the phytosanitary certificate is Russian. Without AIS forensics on the individual feeder vessels in the upstream chain, the Ukrainian origin disappears here.
That is what makes supply chain tracing demanding: one bulker carrying 60 thousand tonnes of "Russian" grain from Novorossiysk to Latakia can hold cargo from twenty smaller feeder vessels, some of which called at Feodosia and Berdiansk. Rebuilding the chain requires the AIS history of those feeders three to six months back.
The owners of vessels on this route mostly hide behind flags of convenience. These are jurisdictions with weak beneficial-owner checks, easy re-flagging and low cooperation with sanctions regimes. In public investigations and OFAC designations from 2022 through 2025, a few flags appear repeatedly: Cameroon, Togo, Gabon, Palau, with some Liberia and Seychelles.
The flag itself is not proof. The Liberian flag covers millions of tonnes of legitimate fleet, and Cameroon mostly flags fishing boats. The flag becomes a red flag in compliance only when combined with three other signals: the vessel changed name or flag in the last 12–24 months; its registered owner is an offshore company with nominee directors; its P&I insurance has moved from G7 clubs to opaque alternatives. Since 2022 this pattern has had a name — "the shadow fleet": vessels that systematically service sanctioned routes, from Russian oil to Iranian oil to North Korean coal, and now stolen grain.
Where the cargo goes after Novorossiysk, Kavkaz and Feodosia. Three primary destinations are publicly confirmed. Syria — the ports of Tartus and Latakia: shipments documented by satellite imagery and AIS comparison were supplied to the Assad regime through 2024, and the practice continued after the political transition. Libya — Tobruk and Benghazi: exports to the eastern part of the country controlled by the LNA, with minimal documentary control. Iran — Bandar Abbas and Bandar Imam Khomeini: mostly via swaps with Russian grain and through intermediary trading companies in the UAE.
Turkey is more complex. Turkey is both a legitimate importer of Ukrainian grain under official agreements and a hub where re-packaging into smaller batches obscures origin. The ports of Karasu, Samsun, Mersin and Iskenderun have surfaced in public investigations at different times. This does not mean all Turkish imports are stolen. It means that for a specific cargo, the chain needs a separate verification rather than a presumption of clean origin.
A separate trail leads into the Gulf and North Africa. Here stolen grain appears mostly through swaps and resale via trading houses in the UAE and Bahrain — companies that hold transparent contracts with European buyers and opaque ones with Russian suppliers. This is the classic hybrid of legitimate grain trade and sanctions evasion.
The documentary part of the scheme rests on two instruments. The first is a Russian Chamber of Commerce certificate of origin: the document legally exists, is formally valid, and is issued for a cargo that passed through a Russian terminal. It does not lie about the terminal, but it does not disclose the origin of the grain that arrived at the terminal by road or on smaller feeders. The second is the bill of lading: the carrier's document, in which the port of loading is shown as Russian, not as occupied Ukrainian. That is a legal falsity, but as a piece of paperwork it is a fully filled form.
The break in this layer surfaces under cross-check: the AIS history of the vessel for 30 days before the bill of lading shows the actual ports of call, not the one entered in the document. If a week before loading in Novorossiysk the vessel was sitting in Feodosia, the bill of lading will not say so — but the open AIS will. Most successful traces are built on exactly this mismatch.
Major European and US banks financing Black Sea grain trade have tightened cargo-level checks since 2022. The standard procedure looks like this: KYC of the vessel owner and charterer through the flag-registry chain; sanctions screening against OFAC, EU, UN and OFSI on all parties to the contract; AIS-track review of the vessel for 30 to 90 days; reconciliation of the bill of lading against the actual route.
Most red flags get caught at this stage. The most common is an AIS gap in the Kerch Strait or near occupied ports. The second is a vessel that has changed name in the last 6 to 18 months before the voyage. The third is an owner registered in the UAE or Cyprus through a chain of nominee companies with no financial history before 2022. No single signal is a verdict. Three signals together are grounds to refuse financing or demand additional documentation.
The buyer carries three risks. Regulatory: a cargo that touched a sanctioned vessel or port can be seized by EU, US or UK customs under sanctions regimes. Payment: the correspondent bank blocks the wire at SWIFT level, the money sits, recovery takes months and is not guaranteed. Reputational: a Reuters, Bloomberg or Lloyd's List investigation that names your company in the paperwork stays in search results and in the regulator's notes.
The bank sees these risks earlier, because it is the bank that runs sanctions screening when opening a letter of credit. A partial OFAC hit on the vessel owner — the LC is not issued. An AIS gap found after the fact — the bank risks its own dollar-clearing licence. That is why compliance teams in Zurich, Geneva, Singapore and London look at raw AIS, not only at paper.
The insurer is the third layer. The G7 P&I clubs (International Group of P&I Clubs) have withdrawn since 2022 from insuring vessels that systematically breach sanctions regimes. This means the shadow fleet is insured by Russian, Chinese or opaque Cypriot clubs with no international reinsurance. In a casualty — a spill, a grain loss — there is no real compensation. That is a separate reason to refuse participation in the supply chain even when no sanctions hit is yet visible.
The first three checks are within reach of anyone. AIS history for the vessel for the last 90 days — through MarineTraffic or VesselFinder, free or on cheap tiers. Flag and ownership records — through Equasis (free) or paid bases like IHS Markit and Clarksons. Sanctions screening of the owner, charterer and vessel — through the official OFAC, EU Sanctions Map, UK OFSI and UN Security Council Consolidated List.
Harder are the items that do not sit in open bases. A chain of nominee companies in Dubai or Cyprus, a beneficial owner hidden behind a trust, a real charterer different from the documentary one — that takes corporate registries in a dozen jurisdictions, access to maritime industry bases and experience telling legit patterns from scheme patterns. This is where Argus Supply Chain Trace pays for itself on a single unwound chain: from $349 for a Chain Map (route and parties for one cargo), from $599 for a Full Trace (with sanctions screening and AIS forensics), from $999 for a Deep Trace (with full beneficial-owner unwinding and satellite verification of ports of call).
A separate product is Sanctions Compliance DD in the Legal-Grade DD format (from $1,200): a full file on the buyer, supplier or charterer with every source documented for the bank's or counsel's compliance file. It is not a one-shot check, but a report that survives a regulatory audit.
The stolen-grain route is not a mystery. It starts at occupied Azov and Crimean ports, runs through AIS gaps in the Black Sea, gets re-papered at Russian terminals and exits as "Russian-origin" grain under a Cameroon flag toward Syria, Libya and Iran. Every step of this chain leaves a trail in open data — from satellite imagery of the ports to the AIS log of an individual bulker. The question is not whether it can be traced. The question is whether anyone in your supply chain did the tracing before you signed the contract.
Chain Map from $349, Full Trace from $599, Deep Trace from $999. A compliance-grade file your bank or counsel can use. Typically 3–7 business days.