OFAC sanctions 10 people and a Russia-based entity over North Korean IT worker revenue
The US Treasury's Office of Foreign Assets Control (OFAC) designated two Russian nationals, a North Korean-controlled entity in Russia and eight people it links to North Korean IT worker schemes that Treasury says generate revenue for the North Korean government.
On 28 October 2026 OFAC, the US Treasury office that runs economic sanctions, sanctioned 10 individuals and one entity for their roles in North Korean government-run IT worker schemes. Treasury says these schemes defraud US businesses and generate revenue for North Korea's weapons of mass destruction and ballistic missile programs.
According to Treasury, North Korea relies on fraudulent documents, stolen identities and fabricated personas to hide its IT workers and get them hired by legitimate companies, and the regime takes most of their wages. Treasury says some workers have also used their access to corporate networks to deploy malware and steal data.
Treasury says Vitold Viktorovich Obertas, a Russian national, acted as an intermediary for North Korean financial transactions and has conducted nearly $2 million worth of cryptocurrency conversions since January 2025, plus at least $1.25 million in other currency transactions, for North Korean officials. It says Ilya Aleksandrovich Boykov, also a Russian national, has exchanged and converted the equivalent of $3.5 million in cryptocurrency transactions since 2024 in support of Alis, a company OFAC designated in March 2024 as subordinate to the Chinyong Information Technology Cooperation Company, which OFAC designated in May 2023. Kim Ki Hyok and Kim Hyo Dong, who Treasury says each lead a Russia-based delegation of North Korean IT workers, were also designated.
OFAC also designated the First Financial and Technical Development Center (FFTDC), which Treasury calls a North Korean-controlled entity located in Russia, and six Russia-based North Korean IT workers linked to it. All property of the designated persons in the US or held by US persons must be blocked and reported to OFAC, and entities owned 50 percent or more by them are also blocked. Treasury says Australia and the European Union are also designating individuals and entities this month.
Why it matters to AML professionals
North Korean IT worker money often reaches the regime through crypto conversions and third-country intermediaries rather than direct transfers. AML professionals at banks, payment firms and crypto platforms should screen against the new designations and review past activity involving the named people. The case also shows that payroll and contractor payments can be a sanctions exposure route, not only trade or wire flows.
Red flags in this case
- Remote IT contractor payments routed to accounts or wallets in a different country from the contractor's stated location
- Frequent conversion of cryptocurrency into fiat through individual brokers based in Russia or other third countries
- Several freelancer accounts sharing the same devices, IP addresses, payout wallets or bank accounts
- Identity documents for remote workers that show signs of alteration or do not match the account holder's profile
If this landed in your queue
- Screen the customer, counterparties and linked wallets against the updated SDN list, including name variants
- Map where contractor or payroll payments end up and look for funnelling into shared accounts or wallets
- Review device, IP and login data for links between accounts that claim to be unrelated people
- If a match or strong link is confirmed, block or reject as required, report to OFAC within the required timeframe, and escalate for a SAR decision
Key terms
- SDN list
- OFAC's Specially Designated Nationals and Blocked Persons List; US persons must generally block property of anyone on it.
- 50 percent rule
- An entity owned 50 percent or more, directly or indirectly, by blocked persons is treated as blocked even if it is not listed by name.
- IT worker scheme
- A scheme in which workers hide their true identity and location to win remote technology jobs, with earnings sent back to a sanctioned government.
Interview angle
How would you spot a sanctioned remote IT worker scheme in a payments or crypto customer base?
Talk about linking accounts through shared devices, IPs and payout destinations, checking for mismatches between stated location and payment routes, and screening wallets and counterparties, not just customer names.
Sources
Go deeper on AMLift
Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.
Report an error
Every report is checked against the official source. If we got something wrong, the story is corrected.