Since mid-April, speculations about dire health or even death of North Korea’s leader, Kim Jong Un, intensified. His absence from the public eye for several weeks and reports about Chinese medical doctors traveling to Pyongyang fueled the rumor mill. With the North Korean leader having resurfaced on May 1, it is safe to assume there will be no significant changes in the course of the regime, and the United Nations (U.N.) sanctions against the country will not ease up any time soon.

In late April, the U.N. Panel of Experts¹ released a 200-plus page report tracking the implementation of sanctions against North Korea and providing valuable insight into North Korea’s evasion techniques. There is a financial component in all sanctions evasion activity, and North Korea continues to exploit global financial institutions (FIs) for its nefarious purposes. The information in the U.N. report can help compliance teams within FIs develop better ways to minimize exposure to North Korea’s illicit activities.

Below is a summary of the report’s main findings and an analysis of their implications for FIs.

Illicit Exports and Imports

U.N. sanctions prohibit or limit the export and import of certain commodities to/from North Korea. However, North Korea evades trade sanctions and often uses the maritime industry to do it.

U.N. sanctions prohibit North Korea from exporting coal, sand, seafood, rare earth minerals and even statues, among other goods, because part of the revenue from such sales goes toward its nuclear and missile programs. In violation of export restrictions, North Korea continues to sell these goods to overseas customers and often uses vessel-to-vessel transfers and self-propelled oceangoing barges.²

Similar to illicit export, North Korea relies on the maritime industry to bring illicit imports into the country. In accordance with the U.N. sanctions, North Korea can only import 500,000 barrels per year. But, as the U.N. Panel of Experts observes, it defies these limits and uses vessel-to-vessel transfers and direct delivery for import of petrochemical products.³

Since 2006, U.N. sanctions prohibit the import of luxury goods by North Korea to put pressure on the North Korean elite. Luxury goods include items such as high-end cars, jewelry, yachts and alcohol. Despite the ban, the North Korean ruling class continues to enjoy access to luxury goods via illicit procurement on the international market. During high-profile summits in Singapore and Hanoi where Kim met with President Donald Trump, and in Vladivostok where he met with President Vladimir Putin, the North Korean leader was seen being driven in a million-dollar Maybach.⁴

In this most recent report, there is evidence of Pyongyang’s continued evasion of the luxury goods ban. For example, multiple entities in North Korea continue to import luxury watches.⁵ In another example, the panel’s investigation revealed that two Mercedes-Benz S-Class 600 Sedans made it to North Korea via a scheme involving multiple jurisdictions, numerous transit destinations and final delivery by vessels.⁶

In addition, North Korean elite regularly import huge amounts of alcohol. In 2019, a shipment of 90,000 100-mL Russian vodka bottles was seized en route to North Korea. In another case, in 2019, Dutch law enforcement seized more than 4,000 cases of beer at the Port of Rotterdam. This shipment violated EU regulations under which beer is classified as a luxury good. The report mentions several cases involving companies in Southeast Asia that helped procure and ship luxury goods to North Korea.⁷

Implications for FIs

North Korea’s illicit exports and imports are directly relevant to global FIs as the payments for the goods and their transfer often involves the formal financial system. FIs should continue to exercise vigilance with respect to any transactions that might have North Korea as the beneficiary and keep in mind the various commodity-related sanctions that are in force.

North Korea’s extensive use of the maritime industry to evade sanctions should be a signal for FIs to introduce greater due diligence when providing services in support of maritime operations. For example, FIs should exercise caution when issuing letters of credit to trading and shipping companies that might end up facilitating illicit vessel-to-vessel transfers. Similarly, insurance companies should be careful about insuring and re-insuring vessels that could end up carrying illicit goods to and from North Korea. On May 14, the U.S. government published a detailed guidance on illicit shipping and sanctions evasions practices of North Korea and other countries that includes a special section devoted to risk factors that FIs may wish to consider.⁸

Cyberattacks and Crypto-Operations

North Korea is steadily increasing the use of cyber and cryptotools in circumventing sanctions.
It uses cyberattacks to steal sensitive information, including military technology, to blackmail and extort money and engage in illicit fundraising, such as transferring money by force from random bank accounts to accounts it controls.⁹ FIs remain very vulnerable to North Korea’s cyberattacks. The main challenges with confronting North Korea’s cyberattacks include difficulties in attribution and a lack of legal-regulatory frameworks to investigate and prosecute the attacks.¹⁰

In a worrying development, there are clear links between North Korean hackers and a cybercrime group from Eastern Europe called TrickBot Group. TrickBot developed a malware that specifically targets FIs.¹¹

In addition to traditional FIs, North Korea is aggressively pursuing new unregulated domains like cryptocurrency and blockchain technology. It mines cryptocurrency, converts it and reconverts it to obscure ownership, eventually converting the cryptocurrency into fiat. The U.N. Panel of Experts regularly reports on North Korea’s attacks on cryptocurrency exchanges. In one of the more recent examples, North Korean agents attacked one cryptocurrency exchange with a Trojan-type malware.¹²

In 2019, Pyongyang even hosted an international conference to discuss how to use cryptocurrency and blockchain technology for money laundering and sanctions evasion.¹³

Implications for FIs

Cyberattacks on FIs and cryptocurrency exchanges bring North Korea significant income. Therefore, cyberattacks will continue and grow in sophistication as well as frequency. FIs and cryptocurrency exchanges should invest in cyberdefense and learn how to minimize their vulnerabilities. For example, one of the methods employed by North Korean agents is social engineering. They are often successful with their attacks because they tailor phishing attempts to their victims’ profiles.¹⁴

Cryptocurrency exchanges can potentially expect tighter regulations if governments heed to the recommendations of the U.N. Panel of Experts to “ensure their legal and regulatory frameworks cover virtual assets (e.g., cryptocurrency) and virtual asset providers (e.g., cryptocurrency exchanges).”¹⁵

Use of Diplomatic Cover

North Korean diplomats and individuals with North Korean diplomatic passports continue to engage in illicit financial activities. Jo Kwang Chol, an employee at the North Korean Embassy in Vienna, tried to unfreeze and withdraw assets belonging to a sanctioned North Korean company—Korea Ungum Corporation—held in an Austrian bank. In 2017, the North Korean Embassy requested the bank to release the funds under the pretense of a fake labor contract between Korea Ungum Corporation and Jo. The bank refused.¹⁶

This is just one example of how North Korea abuses diplomatic accreditation to manipulate FIs. Its diplomats and those who are given diplomatic passports open multiple accounts under various names, conduct transactions on behalf of sanctioned entities and pay for illicit procurement.

Implications for FIs

FIs are in a strong position to clamp down on illicit financial activities by the North Korean diplomats since the number of officially accredited North Korean diplomatic personnel in any country, where North Korean diplomatic presence is permitted, is rather small. Managing know your customer protocols and transaction monitoring (TM) of their accounts is a manageable task.

Among the practical steps FIs can take to address risks from this specific group are:

• Confirming the person’s identity and their right to remain in the country
• Tying the life of the account to the period of accreditation
• Ensuring one person does not control multiple accounts
• Conducting TM for a timely discovery of any activity that does not match the profile

Continued Illegal Overseas Labor

By December 2019, all jurisdictions that are members of the U.N. were obligated to expel North Korean overseas workers. Overseas labor brings significant income to North Korea and funds its nuclear and missile programs.

As of late 2019, North Korea had at least 1,000 information technology (IT) professionals based overseas. The U.N. Panel of Experts estimates that the country earns $20.4 million annually from overseas IT labor.¹⁷ In addition, Pyongyang dispatched scores of manual workers and medical professionals to generate income overseas. For example, dozens of medical professionals worked in Angola, Mozambique, Nepal, Nigeria, Tanzania and Uganda.¹⁸ Another popular profession for export is restaurant labor. While the countries were obligated to expel North Korean workers, it remains to be seen if all fulfill this obligation.

Overseas workers are often employed by joint ventures established by North Korea. However, joint ventures with North Korea are prohibited under the U.N sanctions regime.

Implications for FIs

In the ideal world, there would be no North Korean overseas labor by the end of 2019. In the real world, it is safe to assume that the regime continues to dispatch its citizens to earn income overseas in contravention of sanctions.

FIs should keep in mind that joint ventures with North Korea and employment of North Korean citizens abroad are prohibited, and make sure they do not provide financial services to any companies, factories or enterprises suspected of employing North Korean laborers.

De-Risking and Implications for Humanitarian Assistance

The U.N. Panel of Experts acknowledges that sanctions “may be assumed to have some unintended negative impact on the civilian population,” partly as a result of “the continued absence of a banking channel.”¹⁹

A report on the humanitarian impact of U.N. and unilateral sanctions authored by a multidisciplinary panel of experts concludes, “Life-saving aid is being fatally obstructed by delays, red tape, and overcompliance with financial sanctions.”²⁰

Implications for FIs

One can understand why FIs engage in extreme de-risking in the context of a broad regime of U.N. and unilateral sanctions. Unfortunately, the net effect of overcompliance is devastating for the people of North Korea who are in dire need of humanitarian assistance.

Adopting a more nuanced approach that differentiates between prohibited activities and allowed transactions for humanitarian assistance will make a positive difference to the wellbeing of one of the most vulnerable populations in the world.

Conclusion

The U.N. imposed sanctions against North Korea because it poses immediate and serious risk to the international community. North Korea already possesses several nuclear bombs and continues to improve its missiles that can carry the bombs to their targets. A single bomb detonation will lead to mass destruction, countless casualties and economic collapse beyond the borders of an attacked country. This is not an abstract risk.

North Korea’s sanctions evasion allows it to raise funds for its military program and procure sensitive goods that are used for building its bombs and missiles. Preventing this from happening is a shared responsibility, and FIs are in a unique position to play their part.

Togzhan Kassenova, PhD, CAMS, senior fellow, Project on International Security, Commerce, and Economic Statecraft (PISCES), Center for Policy Research at University at Albany-SUNY; senior visiting fellow and adjunct faculty, Elliot School of International Affairs, George Washington University; nonresident fellow, Carnegie Endowment for International Peace, Washington, D.C., USA, tkassenova@albany.edu

1. The formal name of the panel is the Panel of Experts established pursuant to resolution 1874 (2009).
2. “Report of the Panel of Experts established pursuant to resolution 1874 (2009), S/2020/151,” United Nations Security Council, March 2, 2020, https://undocs.org/S/2020/151, 7-47.
3. Ibid.
4. Edward Wong and Christoph Koettl, “How North Korea’s Leader Gets His Luxury Cars,” New York Times, July 16, 2019, https://www.nytimes.com/2019/07/16/world/asia/north-korea-luxury-goods-sanctions.html
5. “Report of the Panel of Experts established pursuant to resolution 1874 (2009), S/2020/151,” United Nations Security Council, March 2, 2020, https://undocs.org/S/2020/151, 58.
6. Ibid, 59.
7. Ibid, 60-61.
8. “Sanctions Advisory for the Maritime Industry, Energy and Metals Sectors, and Related Communities,” Department of Treasury, Department of State, United States Coast Guard, May 14, 2020, https://www.treasury.gov/resource-center/sanctions/Programs/Documents/05142020_global_advisory_v1.pdf
9. “Report of the Panel of Experts established pursuant to resolution 1874 (2009), S/2020/151,” 64; Report of the Panel of Experts established pursuant to resolution 1874 (2009), S/2019/171, United Nations Security Council, March 5, 2019, https://www.undocs.org/S/2019/171, 59.
10. “Report of the Panel of Experts established pursuant to resolution 1874 (2009), S/2020/151,” United Nations Security Council, March 2, 2020, https://www.undocs.org/S/20120151, 64.
11. Catalin Simpanu, “TrickBot gang is now a malware supplier for North Korean hackers,” ZDNet, December 11, 2019, https://www.zdnet.com/article/trickbot-gang-is-now-a-malware-supplier-for-north-korean-hackers/.
12. “Report of the Panel of Experts established pursuant to resolution 1874 (2009), S/2020/151,” United Nations Security Council, March 2, 2020, https://www.undocs.org/S/20120151, 64.
13. Ibid, 65.
14. “Guidance on the North Korean Cyber Threat,” Department of Homeland Security Cybersecurity and Infrastructure Security Agency, April 30, 2020, https://www.us-cert.gov/ncas/alerts/aa20-106a
15. “Report of the Panel of Experts established pursuant to resolution 1874 (2009), S/2020/151,” 65.
16. Ibid, 63.
17. Ibid, 52.
18. Ibid, 54-55.
19. Ibid, 5.
20. “The Human Costs and Gendered Impact of Sanctions on North Korea,” Korea Peace Now, October 2019, p. iv, https://koreapeacenow.org/wp-content/uploads/2019/10/human-costs-and-gendered-impact-of-sanctions-on-north-korea.pdf