OFAC Sanctions North Korea IT Worker Crypto Network: What Accounting Firms and CFOs Must Act On Now

On 27 August 2025, the US Department of the Treasury's Office of Foreign Assets Control (OFAC) designated a Russian national and two additional entities for their roles in supporting North Korea's overseas IT worker scheme, a programme that uses cryptocurrency as a core financial rail to fund the regime's prohibited weapons activities. For accounting firms, auditors, and CFOs managing digital asset exposure, the action is a direct signal: the sanctions perimeter around DPRK-linked crypto flows is widening, and firms that rely on traditional AML controls alone are likely underscreened.

Who Was Designated and Why

Vitaliy Sergeyevich Andreyev

OFAC designated Russian national Vitaliy Sergeyevich Andreyev for facilitating financial flows on behalf of Chinyong Information Technology Cooperation Company. Chinyong is a DPRK entity previously sanctioned by both the United States and the United Nations, and it operates under the DPRK Defence Ministry. It deploys IT workers in Russia and Laos to generate hard-currency revenue for the regime.

According to the Treasury Department, Andreyev worked alongside a DPRK consular official named Kim Ung Sun to convert more than USD 600,000 in cryptocurrency into US dollars. That activity is reported to have begun at least as far back as December 2024. OFAC identified one cryptocurrency address associated with Andreyev as part of the designation, giving compliance teams a concrete on-chain data point to screen against.

The Two Additional Entities

Two entities were also added to the sanctions list alongside Andreyev. Shenyang Geumpungri Network Technology Co., Ltd., registered in China, was identified as a front company that supports Chinyong's operations and provides cover for DPRK IT worker delegations. Korea Sinjin Trading Corporation is a DPRK state entity subordinate to the Ministry of People's Armed Forces General Political Bureau; it served as a financial conduit within the broader network.

The inclusion of a Chinese registered company is notable. It reinforces that DPRK-linked entities are not confined to obviously high-risk jurisdictions, and that corporate structures registered in commercially active locations can serve as concealment layers.

How the Scheme Operates

The IT Worker Model

North Korea's overseas IT worker programme places technically skilled operatives at companies worldwide, including firms in the United States, often under false identities and using fraudulent documentation. Those workers earn wages through legitimate employment channels. The wages are then largely seized by the DPRK regime and directed toward sanctioned activities, including weapons development.

The scheme is sophisticated in its layering. Workers may be hired through third-party platforms, staffing agencies, or shell companies, making it difficult for employers and their finance teams to identify the ultimate beneficiary of payroll disbursements. In some cases, DPRK-affiliated operatives have also deployed malware within client networks to steal intellectual property, compounding both the legal and operational risk for affected organisations.

The Crypto-to-Fiat Conversion Layer

Cryptocurrency is central to how this scheme moves money across borders. In the Andreyev case, digital assets were converted to US dollars through an individual who had direct contact with a sanctioned DPRK entity. This crypto-to-fiat step is precisely the kind of transaction that traditional banking controls struggle to flag, because the fiat output often appears clean by the time it reaches a correspondent bank or payment processor.

Over-the-counter (OTC) brokers and informal conversion networks are frequently used to execute this layer. An earlier OFAC action on 8 July 2025, which targeted a separate individual alleged to have laundered millions in stolen crypto through front companies and OTC brokers, demonstrates that OFAC is systematically mapping and dismantling this infrastructure.

Accounting and Audit Implications

Sanctions Exposure Is Not Limited to Direct Counterparties

US sanctions law operates on a strict-liability basis for most violations. That means an accounting firm or corporate treasury function does not need to have known about a DPRK connection in order to face liability; transacting with a designated party, or with a party that is majority-owned by a designated party, is sufficient. The Chinyong network illustrates how that exposure can arise indirectly: a client contracts a developer, the developer is placed by a front company, and the front company funnels wages to a sanctioned entity.

For firms using digital asset accounting software or crypto bookkeeping software to record client transactions, the practical implication is that wallet screening must be embedded into transaction workflows, not treated as a one-off onboarding check. A wallet that was clean at client onboarding may subsequently be linked to a newly designated address.

What the OFAC-Identified Crypto Address Means for Screening

OFAC's publication of the cryptocurrency address associated with Andreyev gives compliance-focused firms an actionable data point. Any firm or client that has transacted with that address, received funds from it, or sent funds to it should conduct an immediate review. The review should cover whether a voluntary self-disclosure to OFAC is appropriate and whether the transaction should be reported under existing Bank Secrecy Act obligations if the firm has financial institution status.

For firms that do not yet have automated wallet-screening integrated into their digital asset accounting software workflows, this action makes the gap visible. Manual, periodic list checks are insufficient when OFAC designations can add new addresses at any point.

Contractor and Payroll Due Diligence

The IT worker angle creates an additional audit dimension that goes beyond financial transactions. If a firm's clients engage freelance or contract software developers, particularly through online platforms or intermediary staffing companies, there is a risk that some of those workers are operating as part of a DPRK-directed network. The wage payments themselves, whether made in crypto or fiat, could constitute a sanctions violation.

Auditors reviewing clients with significant technology contractor spend should consider asking whether identity verification was conducted at onboarding, whether payment channels have been reviewed against updated sanctions lists, and whether any unusual patterns in developer behaviour, such as requests for access beyond their stated role, have been documented.

AML and KYC Obligations Triggered

Enhanced Due Diligence for Crypto-Active Clients

Financial institutions, money services businesses, and virtual asset service providers operating under US Bank Secrecy Act requirements are already obligated to file Suspicious Activity Reports when they detect activity consistent with sanctions evasion. The Andreyev designation adds a specific behavioural pattern to watch for: crypto-to-fiat conversion activity originating from or routed through Russia, China, or Southeast Asia that is linked to IT-sector payments.

For accounting firms advising crypto-active clients, the duty is advisory rather than directly regulatory, but the reputational and legal risk of facilitating a transaction that later triggers an OFAC enforcement action is real. Enhanced due diligence reviews of clients with exposure to these geographies and payment patterns should be prioritised.

On-Chain Intelligence as a Compliance Tool

The action highlights why on-chain analysis has become a necessary complement to standard AML controls. Blockchain intelligence tools can identify behavioural overlap between wallets, cluster addresses to known entities, and flag indirect exposure that a simple name-screening check would miss. OFAC's identification of a specific address in this designation is an entry point into a broader transaction graph that compliance teams need to trace, not just a single data point to block.

Firms that position themselves as specialists in digital asset accounting software and compliance advisory should be able to explain to clients how on-chain screening integrates with their broader AML programme. Clients that cannot answer that question coherently represent an escalating risk profile.

Practical Steps for Accounting Firms and CFOs

Immediate Actions

The following steps should be taken without delay following this designation:

• Screen all active and recent digital asset wallet addresses against the newly published OFAC identifier and against the SDN list more broadly, including addresses associated with Chinyong and related entities.
• Review contractor onboarding records for any technology staff engaged since at least December 2024, checking identity verification quality and payment routing.
• Confirm that crypto bookkeeping software workflows include automated, real-time sanctions screening rather than periodic manual checks.
• Brief client-facing partners on the IT worker threat vector so they can raise it proactively with clients that engage significant technology contractor populations.

Medium-Term Controls

Beyond immediate screening, this action points to structural gaps that firms should address over the coming months. Sanctions clauses in engagement letters and service agreements should explicitly cover digital asset transactions and contractor payment flows. Internal AML policies should be updated to reference the DPRK IT worker pattern as a named red-flag typology. And firms should confirm that their digital asset accounting software can ingest updated sanctions lists on a rolling basis and flag affected transactions for review without manual intervention.

The pattern of OFAC actions over 2025, including the July designation of a separate DPRK-linked laundering network, suggests that further designations in this space are likely. Compliance frameworks built for the current enforcement environment will need to be scalable. For context on how broader white-collar crime trends intersect with crypto enforcement, see our coverage of white-collar crime trends accounting firms cannot ignore. Firms tracking the full scope of Treasury's crypto sanctions programme should also review our earlier analysis of US Treasury sanctions on Iranian firms accepting Bitcoin, which illustrates how OFAC is applying crypto-specific designations across multiple geographies simultaneously.

Frequently Asked Questions

Does an accounting firm face OFAC liability if a client unknowingly paid a DPRK-linked IT worker?

Potentially yes. OFAC sanctions carry strict-liability exposure for US persons, meaning intent is not required for a violation to occur. If a payment, whether in crypto or fiat, ultimately benefited a designated entity such as Chinyong, the firm or its client could face enforcement risk. A voluntary self-disclosure to OFAC, accompanied by remediation evidence, can be a mitigating factor, but it requires prompt action once the exposure is identified.

What does OFAC's publication of a crypto address mean practically?

It means that any US person or entity subject to US jurisdiction that transacts with that address, sends funds to it, or receives funds from it after the designation date is potentially in violation of sanctions. Firms should screen that address across all client transaction histories immediately and assess whether any matches require reporting or voluntary disclosure.

How should CFOs assess risk from technology contractors hired through third-party platforms?

CFOs should request documentation of identity verification procedures from any staffing intermediary or platform used to engage technology contractors. Contracts should include representations that workers are not subject to sanctions. Payment channels, including crypto wallets used for contractor compensation, should be screened against OFAC's SDN list at onboarding and on a periodic basis thereafter.

Is this action relevant to firms with no direct US operations?

Yes. US dollar-denominated transactions, US financial system access, and the involvement of any US person in a transaction chain can bring non-US firms within OFAC's jurisdiction. Additionally, the UN sanctions framework that DPRK evasion schemes violate applies globally. Firms in any jurisdiction that handle digital asset flows with exposure to Russia, China, or Southeast Asia should treat this designation as directly relevant.

How often should wallet screening be updated after a new OFAC designation?

Best practice is continuous or near-real-time screening for active transaction workflows. At a minimum, firms should update their screening lists within 24 hours of a new OFAC designation and run retrospective checks on recent transaction histories. Relying on weekly or monthly batch updates creates a window of undetected exposure that OFAC enforcement teams have consistently treated as a compliance failure rather than a mitigating factor.

Source: TRM Labs