Treasury Sanctions 11 in North Korean IT Worker Crypto Scheme
The US Department of the Treasury's Office of Foreign Assets Control (OFAC) has designated 11 individuals as part of an ongoing crackdown on a North Korean state-linked operation that embedded covert IT workers inside companies around the world, collected wages partly in cryptocurrency, and routed the proceeds back to fund Pyongyang's weapons programmes. For accounting firms managing digital asset clients, auditors conducting contractor due diligence, and CFOs who have engaged remote technology talent, this action is a direct compliance signal, not background noise.
What the Sanctions Action Covers
OFAC added 11 individuals to the Specially Designated Nationals and Blocked Persons (SDN) list in connection with what US authorities describe as a coordinated scheme to place North Korean nationals in remote IT roles at companies across multiple jurisdictions. The workers concealed their true identities and locations, using false documentation and third-party facilitators to secure employment. The wages they earned, a portion of which were paid or later converted into cryptocurrency, were then funnelled back to the Democratic People's Republic of Korea (DPRK), generating hard currency that US and UN sanctions are specifically designed to deny the regime.
The role of cryptocurrency in the revenue pipeline
Crypto played a dual function in this scheme. First, some employers made direct payments in digital assets, which are harder to trace through traditional correspondent banking channels. Second, facilitators converted fiat wages into crypto before transmitting funds, exploiting gaps in cross-border payment monitoring. The pattern is consistent with prior OFAC enforcement: DPRK actors favour crypto precisely because under-screened exchanges and peer-to-peer channels can obscure the ultimate beneficiary. Any firm using crypto to pay contractors, freelancers, or service providers operating remotely needs to treat this action as a stress test of its current controls.
Who is named and what does designation mean in practice
OFAC has not simply issued a warning. Designation under Executive Order 13722 (and related DPRK-specific authorities) means that all property and interests in property of the listed individuals subject to US jurisdiction are blocked. US persons, and in many cases non-US persons acting through US financial infrastructure, are prohibited from transacting with them. For firms that processed payments to any of the named individuals before the designation, the obligation is to freeze any remaining assets and report to OFAC. Retroactive exposure depends on whether a transaction occurred before the listing date and whether the payor had reason to know, making record-keeping quality and timestamped audit trails critical.
Why This Matters Beyond the Headlines
OFAC's DPRK IT worker actions in 2026 form a pattern rather than isolated events. This latest round of designations follows OFAC's earlier DPRK IT worker crypto sanctions network action and signals that the regulator is widening the net to include not only the workers themselves but also the support infrastructure: those who recruit, house, fund, or otherwise facilitate the scheme. That shift in targeting strategy has significant implications for professional services firms.
Secondary sanctions and the global reach of US enforcement
Non-US accounting firms and CFOs at internationally operating businesses should not assume they are insulated. OFAC's secondary sanctions authority means that non-US entities that materially support designated parties risk being cut off from the US financial system. Given that most major crypto exchanges maintain US dollar settlement rails or hold US banking relationships, secondary exposure is a genuine risk for firms outside American jurisdiction. Screening workflows built only for domestic regulatory requirements will not be sufficient.
The contractor onboarding blind spot
The scheme exploited a specific vulnerability: the gap between standard employment verification and the deeper identity checks needed to catch sophisticated document fraud. Remote IT contractors hired through freelance platforms, staffing agencies, or direct solicitation rarely undergo the same KYC rigour applied to, say, a new banking relationship. Accounting firms that provide outsourced CFO services or that manage payroll and accounts payable for tech-sector clients are particularly exposed, because they sit inside the payment workflow without necessarily owning the onboarding decision.
Accounting and Bookkeeping Implications
From a pure accounting standpoint, payments made to sanctioned parties create a cascade of problems that go well beyond a compliance fine. Consider the ledger entries involved: if a firm recorded contractor payments as operating expenses or capitalised them as part of a software development project, those entries may need to be reversed or restated once a designation is confirmed. Any crypto payments made to a now-sanctioned individual would need to be valued at the date of transfer (using the applicable spot rate), blocked if still in transit or held in a wallet, and disclosed appropriately in the financial statements.
Audit trail requirements and crypto bookkeeping software
Firms relying on crypto accounting software or digital asset accounting software to record contractor payments in crypto have an advantage here, but only if those systems capture the counterparty wallet address, the transaction hash, the date and time, and the USD equivalent at the time of payment. A system that records only the fiat-equivalent amount misses the on-chain audit trail that regulators and OFAC's own investigators will examine. Compliance-grade crypto bookkeeping software should be generating immutable transaction records that can be exported for regulatory review at short notice. If your current stack cannot do that, this enforcement action is a reasonable prompt to evaluate it.
Expense recognition and restatement risk
Under US GAAP and IFRS, payments to parties that are subsequently found to be sanctioned entities may require disclosure as contingent liabilities or, in more serious cases, restatement of previously filed accounts. Auditors conducting year-end fieldwork should add a specific procedure to check contractor payment populations against the SDN list as of the balance sheet date, not just at the time of original onboarding. OFAC updates the SDN list on a rolling basis, and a contractor who was clean at hire may be designated before the audit opinion is signed.
Practical Steps for Compliance Teams
The action reinforces a set of controls that should already be in place but that this enforcement pattern suggests are not universally applied in the crypto-adjacent business community.
Immediate screening against the updated SDN list
Pull the current SDN list from the Treasury's official sanctions list service and run it against your full contractor and vendor population, with specific attention to remote IT workers engaged in the past 24 to 36 months. Include wallet addresses if your crypto bookkeeping software retains them, since OFAC now routinely publishes associated cryptocurrency addresses alongside individual designations. This is not a one-time exercise: automated, continuous screening is the standard that regulators expect.
Reviewing crypto payment workflows
If your firm or your clients make any portion of contractor payments in digital assets, map those workflows now. Identify which wallets are used, which exchanges or OTC desks are involved, and whether those intermediaries themselves conduct OFAC screening before processing transfers. The AI agents, crypto mixers, and what they mean for AML compliance piece published earlier this year highlighted how automated payment systems can route funds through obfuscation layers without human review. The same logic applies here: if a payment agent or API is instructed to pay a contractor wallet without a live sanctions check, the human at the top of that workflow carries the liability.
Updating onboarding procedures for remote contractors
Firms should revisit identity verification standards for remote contractors, particularly those engaged for software development, IT infrastructure, or related technical roles. At minimum, this means government-issued ID verification cross-referenced with the SDN list, a live video verification step where feasible, and independent corroboration of the contractor's stated location (for example, through IP geolocation logging or payment account jurisdiction checks). Where clients have delegated payroll or accounts payable to your firm, you may need to document that these checks are the client's responsibility or agree to perform them as part of an expanded engagement scope.
The Broader DPRK Enforcement Trend
This action sits within a sustained, multi-agency effort. The Federal Bureau of Investigation, the Department of Justice, and OFAC have all escalated DPRK-related crypto enforcement across 2026. The common thread is crypto as a sanctions evasion tool, and the common vulnerability is insufficient counterparty verification in digital asset payment flows. Compliance professionals who treat each individual action as a standalone event will keep playing catch-up. The more useful framing is to ask whether your firm's AML and sanctions infrastructure is calibrated for an environment where state-sponsored actors are actively probing every gap in crypto payment verification.
Frequently Asked Questions
Does this affect non-US companies that paid contractors in crypto?
Potentially, yes. OFAC's secondary sanctions authorities can reach non-US entities that materially support designated parties, particularly where payments were processed through US dollar rails, US-based exchanges, or platforms with US banking relationships. Non-US firms should take legal advice on their specific exposure and screen their contractor populations against the updated SDN list.
What should a firm do if it discovers it paid a now-designated individual?
Cease any further payments immediately. Block or freeze any crypto holdings still associated with that party. File a voluntary self-disclosure with OFAC, which the regulator treats as a significant mitigating factor in penalty determinations. Engage sanctions counsel promptly. Document every step taken, because the quality of your response record will affect the outcome of any OFAC review.
How should the payments be treated in the accounts?
Any payments made to a subsequently designated party that have been expensed should be reviewed for restatement. If the amounts are material, disclose the contingent liability in the notes to the financial statements. Crypto payments require valuation at the transaction date using the spot rate at that time. Your auditor should be informed immediately so that the audit scope can be adjusted.
Does crypto accounting software help with sanctions screening?
It can, but only if it is configured to capture counterparty wallet addresses and integrate with a sanctions screening data feed. Recording only fiat-equivalent amounts is not sufficient for OFAC compliance purposes. Firms should ensure their digital asset accounting software retains full on-chain transaction data and can flag wallet addresses against published SDN cryptocurrency address lists.
Is there a safe harbour for firms that unknowingly made payments before the designation date?
OFAC does provide some relief for transactions completed before a designation, particularly where the payer had no reason to know. However, this is not automatic. The agency examines whether adequate due diligence was in place at the time and whether the firm took prompt remedial action on discovery. Voluntary self-disclosure and robust pre-existing compliance procedures are the two most important factors in securing a favourable outcome.
Source: Decrypt