When War Hits the Gulf: Risk Management for Traders

Sanctions risk does not wait for a full regional war. It appears in a single ownership link, a vessel’s history, a bank’s internal review, or a misclassified product. Build screening into onboarding, quotation, contracting, shipping, and payment. A trader without a sanctions guide is not managing regional risk — they are only managing the risks they can see.

Force majeure in the GCC is a statutory doctrine with a high threshold, not a commercial escape hatch. A regional war may justify relief — but only if the contract’s governing law, the specific clause, and the facts satisfy the local test. Before the next disruption, review the governing law of every high-value contract, compare the force majeure clause against the statutory default, and identify whether the realistic remedy is termination under force majeure or rebalancing under hardship. The difference between the two is often the difference between recovering costs and absorbing them.

5B. Cyber Resilience and Fraud Controls: The Operational Threat That Arrives Before the Crisis Does

⚠️ The overlooked front: Physical disruption in the Gulf is visible. Cyber and fraud risk is not. State-backed hackers have breached port systems and vessel networks in the region. Business email compromise now drives cargo theft and payment diversion. Trade document fraud — phantom shipments, manipulated invoices, falsified bills of lading — is the mechanism through which illicit finance moves under the cover of legitimate trade. A trader who plans for war-risk premiums but ignores a compromised inbox or a forged bill of lading has protected the wrong asset.

Regional instability does not create cyber and fraud risk from nothing. It accelerates it. Oversight becomes uneven, supplier substitution happens under time pressure, new intermediaries appear, and transaction volumes shift to unfamiliar routes. Legitimate and illicit actors converge on the same commercial ecosystems, and the controls that worked in stable periods become visibly inadequate.This section addresses three operational threats that materialise before physical supply-chain failure becomes acute: state-linked cyber attacks on logistics infrastructure, business email compromise (BEC) linked to cargo theft and payment diversion, and trade document fraud.

🖥️ State-Linked Cyber Attacks on Logistics and Maritime Systems

Iran and associated actors have moved from a “second-tier” cyber threat to one of the leading sponsors of geopolitical cyberattacks, blending state espionage with the broader cybercrime ecosystem. The operational record in the Gulf is concrete:

• A hacking group penetrated a vessel’s Automatic Identification System (AIS) network and accessed on-board CCTV cameras, obtaining real-time visual intelligence.
• An Iran-linked group claimed it exfiltrated 430,000 documents from the Port of Fujairah — including contract details, ship traffic, financial transactions, and pipeline maps — and passed targeting data to missile units hours before a kinetic strike.
• The same actor described the Fujairah attack as a “coordinated hybrid cyber and missile operation” that began with a breach of port systems and was followed by kinetic attacks “minutes later”.

The financial asymmetry is stark. Most ship owners spend only $300 to $1,000 per month on cybersecurity, while a single vessel can consume $175,000 to $3 million per month in fuel alone. A ransomware attack crippling a vessel in port can cost up to $100,000 per day. The question for a trader is not whether a carrier or port has been breached — it is whether you will discover the consequences through your own failed delivery, frozen payment, or misdirected cargo.

🛡️ Minimum cyber controls a trader should verify across critical partners

📧 Business Email Compromise: The Inbox Is the New Loading Dock

Business email compromise and cargo theft now share a single entry point: a compromised inbox, not the loading dock. Attackers use hijacked mailboxes for fictitious pickups, shipment misdirection, and payment diversion.The pattern is consistent across maritime and logistics targets:

1. Initial access — phishing, a reused password without MFA, or malware delivered through an impersonated supply-chain company.
2. Silent observation — the attacker reads the mailbox, learning shipment schedules, pickup appointments, bills of lading, carrier contacts, and routine communication tone.
3. Three plays — fictitious pickup (an impostor driver collects a high-value load), shipment misdirection (a message from the real address inside a real thread changes the consignee or delivery point), or payment diversion (an invoice arrives with new remit-to bank details).

In the second quarter of 2026, CargoNet recorded 158 fictitious pickup incidents across the US and Canada, with losses more than doubling to approximately $304.6 million. CargoNet identified BEC as the primary access point for many of the quarter’s most sophisticated schemes. The attacker does not need to break anything. They reply inside a conversation your team already trusts.

🚩 BEC red flags in a trade context

🚩 A payment-details change arrives by email, even from a known address, with an urgency justification.
🚩 A pickup or delivery change is requested “as a favour” or “to avoid demurrage” at the last minute.
🚩 A new bank account is introduced for an existing supplier with no prior documentary trail.
🚩 The sender’s display name matches a known contact, but the domain has a subtle substitution (e.g., “rn” for “m”).
🚩 A mailbox rule forwards shipment-related replies to an external address the owner does not recognise.
🚩 A carrier or broker portal login is shared among multiple staff, or a departed employee’s access remains active.

🔐 Out-of-band verification: the single control that defeats most BEC

Any change to a pickup time, carrier, driver, delivery address, consignee, or bank details must be confirmed by phone — using a number already on file, never a number from the message requesting the change. Require two people to approve payment-detail changes. Release freight only to the driver and equipment details confirmed in advance; treat a last-minute driver swap as a stop-and-call event, not a routine update.

Technical baseline: phishing-resistant MFA on every mailbox that sees shipments or money (shipping/receiving, customer service, accounts payable, administrators), external auto-forwarding disabled by default, alerts on newly created inbox rules, and DMARC at enforcement (quarantine or reject), not monitoring.These are platform settings, not new infrastructure. But they must be verified across your forwarders, brokers, and carriers, not only inside your own organisation.

📄 Trade Document Fraud: Phantom Shipments and Manipulated Paperwork

The strongest recent evidence on document fraud comes from the UAE Financial Intelligence Unit’s strategic analysis of trade-based money laundering. Based on 610 credible reports, the FIU found that 61% involved phantom shipments و 41% involved document manipulation, especially invoices and bills of lading.In a phantom shipment, the payment is real, the paperwork often looks real, and the trade finance facility may be real — but the cargo never existed, never moved as stated, or moved in a materially different way from the declared transaction.

🧩 How a phantom shipment is assembled

1. A front company, complicit trader, or shell importer/exporter is created or repurposed.
2. Commercial documents are generated — purchase orders, invoices, sales contracts, packing lists, bills of lading.
3. A payment channel is selected (wire transfer, documentary collection, or letter of credit).
4. Supporting evidence is manipulated: container numbers, shipment dates, ports of loading, buyer or seller names, cargo descriptions.
5. Funds are paid or financing is advanced.
6. The goods never move as represented, or a different cargo moves and the mismatch is never reconciled.

Where maritime evasion is involved, the scheme becomes more sophisticated: AIS disablement, signal spoofing, falsified cargo or vessel documents, complex ownership chains, and ship-to-ship transfers designed to obscure origin and destination. Public reporting in 2026 described Iranian-linked tankers broadcasting false positions while actually loading crude, then using falsified ownership or registry signals to support the appearance of lawful trade.

🚩 Document-level red flags drawn from UAE and CBUAE guidance

Open-account trade, where SWIFT messages carry minimal detail, is specifically flagged as high-risk and requires enhanced monitoring. The control architecture that works is not modular. Banks see documents, ports see cargo, customs see declarations, insurers see selected voyage information, and maritime intelligence sees AIS — rarely combined in time to stop payment or financing. A trader’s own verification process must therefore cross-reference what each party sees, rather than relying on any single document set.

✅ Minimum document-integrity checks before payment or shipment release

• Does the shipment exist? Cross-check B/L, port data, and warehouse receipts; for containerised cargo, verify container number and seal against terminal records.
• Is the counterparty genuine and commercially connected? Confirm the supplier’s business licence, operating status, and whether its stated main activity is related to the goods.
• Does the document set reconcile internally? Invoice ↔ B/L ↔ packing list ↔ LC terms ↔ customs declaration. Discrepancies are not clerical — they are risk signals.
• Has the same invoice or B/L been used elsewhere? Check for duplicate invoice numbers across financing requests and document presentations.
• Was the document issued by the authority it claims to be from? Contact the issuing body directly using a number or address sourced independently, never one printed on the document itself.

Logistics and marine insurance react first. War-risk premiums rise, some operators avoid the highest-risk legs, transit times lengthen, and freight capacity tightens. Financial channels tighten in parallel: correspondent banks become cautious, letter-of-credit confirmation slows, and cross-border settlement faces additional scrutiny. Physical cargo movement may continue, but the cost and friction around it change before any waterway closes.

Costs can move within days, not months. Additional war-risk premiums have historically moved from roughly 0.25% of hull value in quiet periods to 6–10% during elevated risk. For a $100 million vessel, that difference can mean millions of dollars per voyage. Rerouting via the Cape of Good Hope can add 10–15 days or more, plus higher fuel burn, demurrage, and detention risk at alternative ports.

Do not wait for a formal closure. Treat any of the following as an early trigger for review:

• War-risk premiums move materially above your contracted baseline.
• Mainstream carriers begin omitting or avoiding a route you depend on.
• Freight rates on alternative routes rise faster than your pricing can absorb.
• Your bank asks for additional documents or delays confirmation without a commercial reason.
• Your insurer introduces new exclusions or notice requirements.

The right threshold is commercial, not legal: the point at which your margin or delivery reliability is at risk.

It can be, but it is not a universal rule. A 70/30 split — primary flow under normal conditions, secondary capacity ready to scale — provides resilience without permanently destroying unit economics only if the secondary supplier or route is already approved, quality-qualified, and commercially engaged. For low-margin commodities, the right split may be 85/15. For critical or high-risk inputs, it may be 60/40. Calculate the split based on the cost of disruption versus the carrying cost of redundancy for each product line.

Regional resilience analyses often recommend 90 يوماً of coverage for essential goods and up to 180 يوماً for highly specialized or medical/industrial items that cannot be rapidly substituted. For SMEs, the realistic answer depends on carrying cost, storage location, and alternative sourcing lead time. A smaller buffer held in a lower-risk location — or through shared warehousing — can be more useful than a larger buffer held inside the same high-risk zone.

There is no universally “safe” Incoterm. The right choice depends on who can best arrange and price war-risk cover, and who can absorb diversion and demurrage risk. In some cases, terms that place greater responsibility on the seller for carriage and insurance — such as CIF or CIP with clear war-risk wording — give better control. In others, the buyer may prefer to arrange cover once goods leave a designated low-risk port. The critical step is to clarify who pays additional war-risk premiums, who absorbs diversion-related demurrage, and how freight increases above a defined threshold are shared.

Under onshore UAE law, force majeure (Article 273 of the old Civil Transactions Law; Article 236 of the new law from 1 June 2026) applies when performance becomes impossible. The obligation is extinguished and the contract is automatically rescinded. Hardship (Article 249 old; Article 224 new) applies when performance remains possible but becomes excessively burdensome because of exceptional and unforeseeable circumstances. A court may rebalance the obligation to a reasonable level; the contract continues. Force majeure ends the contract; hardship adjusts it.

No. UAE courts interpret Article 273 strictly. The event must be beyond the party’s control, unforeseeable at contracting, the direct and sole cause of non-performance, and genuinely impossible — not merely more expensive or delayed. A vessel rerouted, a war-risk premium that rises sharply, or a buyer who cannot obtain bank confirmation is not automatically force majeure if cargo can still move, even at a loss.

No. The GCC is not one legal system.

Screen every party, not just the buyer: supplier, end-user, consignee, notify party, agent, freight forwarder, carrier, vessel, beneficial owner, and bank. Classify the goods first, including HS code and any dual-use, military, nuclear, or chemical/biological trigger. Screen the route, including ports, transshipment hubs, and free zones. Obtain end-use and end-user statements. Review the payment route with the bank before cargo moves. Document every screening result and escalate amber or red flags to legal counsel before pricing, booking, or signing.

Secondary sanctions risk arises when a non-US trader deals with a designated person, sector, or transaction and then loses access to US banks, US-dollar clearing, insurance, shipping, or technology providers. Identify any US nexus in goods, banks, currency, insurance, vessels, or shareholders. Dual-use goods have a civilian description but a potential military, nuclear, chemical, or missile-related application. Classify them before quotation, obtain end-use and end-user statements, apply catch-all controls, and review routing and transshipment points for diversion risk.

Attackers compromise a mailbox, observe shipment schedules and payment routines, then use three plays: fictitious pickup (an impostor driver collects a high-value load), shipment misdirection (a message from the real address inside a real thread changes the consignee or delivery point), or payment diversion (an invoice arrives with new remit-to bank details). The control that defeats most BEC is out-of-band verification: confirm any change to pickup, carrier, driver, delivery address, consignee, or bank details by phone using a number already on file — never a number from the message requesting the change.

Watch for: the trading party on the invoice differs from the payment beneficiary; invoice amounts do not match payments; invoice and bill of lading show different amounts, prices, or goods descriptions; documents show signs of forgery or alteration; payment comes from unrelated third parties or shell companies; AIS data shows the vessel in a different location than the declared port of loading. Cross-check invoice, B/L, packing list, letter of credit, customs declaration, and port data. Discrepancies are risk signals, not clerical errors.

Verify that critical partners enforce phishing-resistant MFA on mailboxes that see shipments or money, disable external auto-forwarding by default, alert on newly created inbox rules, and set DMARC to quarantine or reject — not monitoring only. Ask carriers and forwarders whether they have a tested incident-response plan for a port-system breach. For chartered tonnage, confirm AIS transmission history is consistent with the declared route and port calls. These are platform settings, not new infrastructure, but they must be verified across forwarders, brokers, and carriers — not only inside your own organisation.

Maintain a live staff location and contact register, updated weekly and accessible to more than one person. Track every employee and dependent’s visa, residency, and passport expiry, and start renewals 90 days early. Define evacuation tiers with clear triggers, pre-arrange transport and accommodation for essential staff, and confirm medical and security coverage. Build a critical-role backup matrix so no single person holds the broker relationship, bank sign-off, or customs credentials. Map third-party dependencies — surveyors, customs brokers, warehouses, and transport providers — and confirm fallback options and notice periods in advance.

Use a small set of indicators that you can actually monitor:

• War-risk insurance premium thresholds and new insurer exclusions.
• Transit volume drops or carrier route omissions.
• Freight rate spikes on alternative routes.
• Bank friction: additional document requests, delayed LC confirmation, or payment scrutiny.
• Visa or border-processing delays affecting critical staff.
• Unusual email, payment, or document-change requests from counterparties.

Set a defined trigger for each indicator and assign an owner. An indicator without a trigger is just news.

A living document covering: early-warning indicators and thresholds; pre-qualified alternative suppliers and ports with current commercial terms; decision trees for switching Incoterms or activating buffer stock; pre-drafted force majeure notices and cost-sharing protocols; sanctions screening and escalation procedures; BEC and document-fraud verification steps; communication templates for customers and suppliers; staff evacuation, visa, and critical-role backup plans; and cash and working-capital buffers sized to the expected duration of disruption. Test it annually with tabletop exercises and update supplier qualifications and insurance relationships continuously.

Yes. Crises rearrange trade patterns. Cargo that once moved exclusively through the highest-risk chokepoint begins loading from alternative Gulf of Oman and Omani ports. Pipeline and overland transfers gain commercial importance. East-west corridors across the Arabian Peninsula and connections toward the Red Sea and Mediterranean receive renewed attention. Operators with multi-port capability, diversified supplier panels, and flexible contracts can capture volume that previously flowed through more concentrated channels. The same disruption that raises costs for unprepared traders creates demand for reliable alternative capacity.

Review your highest-volume or highest-margin flows against the seven levers in this guide: supplier and route diversification, sanctions and export-control screening, Incoterms and insurance clarity, buffer positioning, contract language, cyber resilience and fraud controls, and people and field-operations continuity. Close the largest gap first. Then test the playbook with a tabletop exercise and update it before the next period of elevated risk arrives.