The enforcement action
The US Treasury’s Office of Foreign Assets Control designated ten individuals and one entity on 28 October for supporting North Korean government-run IT-worker schemes. Treasury said the networks used fraudulent documents, stolen identities and fabricated personas to obtain work at legitimate companies, then moved proceeds through cryptocurrency conversions and other laundering methods. It also warned that some workers exploited corporate access to deploy malware, remove sensitive data and extort businesses.
Operational exposure for companies
The action blocks property and interests in property of designated persons within US jurisdiction and generally prohibits transactions involving them, subject to licences and exemptions. OFAC also reminded businesses that entities owned 50% or more by blocked persons are blocked, even if not separately named. The case combines sanctions, hiring, vendor and cyber risk: identity checks at onboarding alone may miss remote workers operating through facilitators, compromised identities or unusual payment routes. Treasury linked several facilitators to multimillion-dollar cryptocurrency activity, making wallet and counterparty screening relevant alongside employment controls.
What it means for merchants
Businesses using remote contractors should strengthen identity re-verification, device and location checks, privileged-access limits, payment-account validation and sanctions screening, with a documented escalation path for mismatched identities or crypto payment requests.
Read the original announcement
U.S. Department of the Treasury · 28 Oct 2026This brief summarizes the linked primary source. Claims and reported figures have not been independently audited by Payment Guide.