OFAC Sanctions 10 Individuals and One Entity Over North Korean IT Worker Fraud

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity over their alleged involvement in North Korean government-backed IT worker schemes targeting U.S. businesses.

According to the Treasury, these schemes use stolen identities, false documents, and fabricated online personas to help North Korean IT workers obtain jobs with legitimate companies. Much of the income generated is reportedly channelled to the North Korean government to support its weapons of mass destruction and ballistic missile programmes.

The networks also create cybersecurity risks. Treasury reported that some IT workers have used their access to corporate systems to deploy malware, steal confidential information, and extract sensitive business data.

The sanctions action targets facilitators operating across North Korea and Russia who allegedly helped manage IT worker delegations, convert cryptocurrency, and move funds. Among those designated is Russian national Vitold Viktorovich Obertas, whom Treasury says facilitated nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025.

Treasury also identified Ilya Aleksandrovich Boykov, who allegedly supported a North Korean IT network by converting the equivalent of $3.5 million in cryptocurrency since 2024. The First Financial and Technical Development Centre, a North Korean-controlled entity based in Russia, was also designated. Treasury stated that workers associated with this network generated more than $750,000 on its behalf since 2025.

The case highlights how fraudulent employment arrangements can connect cyber risks with sanctions evasion and financial crime. Cryptocurrency transfers and cross-border financial intermediaries can make it harder to identify the people behind these schemes and trace where the proceeds ultimately go.

Following the designations, property and interests in property belonging to the designated parties that are within the United States or in the possession or control of U.S. persons must be blocked and reported to OFAC. Entities owned, directly or indirectly, 50% or more in aggregate by one or more blocked persons are also generally blocked under OFAC’s rules. Transactions involving blocked persons are generally prohibited for U.S. persons unless an applicable authorisation or exemption applies.

Implications for compliance teams

This action shows why sanctions screening needs to extend beyond customer names and conventional payment data. Financial institutions and businesses should consider whether customer identities, employment records, beneficial ownership information, and payment activity tell a consistent story.

Compliance teams should pay particular attention to:

• Identity verification: Check for inconsistencies in identity documents, employment histories, and online profiles.
• Cryptocurrency flows: Review unusual transfers, repeated conversions, and payments involving high-risk intermediaries.
• Sanctions screening: Screen relevant customers, counterparties, beneficial owners, and connected entities against current sanctions lists.
• Third-party and remote-worker risks: Strengthen due diligence on recruitment agencies, contractors, vendors, and remote IT workers with access to sensitive systems.
• Escalation and reporting: Investigate suspicious activity, preserve supporting records, and meet applicable sanctions and suspicious-activity reporting obligations.

The broader lesson is that sanctions compliance, anti-money laundering controls, and cybersecurity cannot operate in isolation. Coordinated checks can help organisations identify suspicious connections before funds or sensitive information move beyond their control.