GlobalKYCS

News

North Korean IT Workers: OFAC Sanctions the Network and Updates FAQs

By GlobalKYCS Compliance TeamPublished

OFAC sanctioned ten people and one entity over North Korea's IT worker fraud, settled with Extreme Networks for $1.5 million and amended 11 FAQs. A quick brief for compliance teams.

This week sends a clear signal to anyone managing sanctions risk: identity fraud and hidden ownership remain the entry point for prohibited transactions.

KYC/AML: OFAC Sanctions North Korean IT Worker Networks

On October 28, 2026, the U.S. Treasury designated ten individuals and one entity, the First Financial and Technical Development Center (FFTDC), for facilitating a scheme in which North Korean IT workers obtain remote jobs at U.S. companies using forged documents, stolen identities and invented personas. According to the release, the regime keeps much of the wages to fund weapons of mass destruction and ballistic missile programs.

Treasury points to Russia-based intermediaries that, since January 2025, allegedly converted several million dollars into crypto-assets and other currencies, and it mentions the use of artificial intelligence tools and sophisticated laundering methods. The designations rely on Executive Orders 13687 and 13722. For a regulated firm, the lesson is that the risk starts with identity verification of vendors, contractors and remote staff, and ends in crypto flows.

Sanctions: Extreme Networks. On October 27, OFAC announced a $1,529,685 settlement with Extreme Networks, Inc. over nine exports of networking equipment and services, between September 2018 and March 2022, to a Russian defense manufacturer that was blocked by operation of law because it is majority-owned by Almaz Antey. OFAC described the violations as voluntarily self-disclosed and egregious. The case is a reminder of the 50 percent rule.

Sanctions: new FAQs. On October 26, OFAC amended 11 frequently asked questions on blocking and rejecting transactions and on reporting to OFAC. The page does not say what changed, so it is worth comparing the updated text with your internal procedures.

Compliance reading. The three facts point to the same thing: the problem is rarely an unknown list, but a link that was not detected in time. A new counterparty, a crypto-asset payment with no economic rationale or a vendor whose beneficial owner is unclear all deserve the same due diligence discipline, with documented evidence and recorded decisions. That traceability also makes it easier to explain what happened to the supervisor.

GAFILAT

No official news in the last four days. The most recent item is still the regional proliferation financing risk assessment, which warns about sanctions evasion linked to North Korea and Iran and ties directly into this week's actions.

Dominican Republic

The Superintendency of Banks has published no new rules since circular letter CCI-REG-2026000015 of October 22, on the instant payments system. The Financial Analysis Unit (UAF) lists in its calendar a virtual session on October 29, from 3:30 to 5:00 p.m., on money laundering risks in virtual assets and virtual asset service providers, plus in-person reporting workshops on November 10 and 12.

Latin America

No verifiable news in the official sources reviewed. Argentina's FIU has not posted news since October 13, and there were no regional announcements changing obligations for reporting entities.

Practical takeaway

  • Strengthen identity verification for IT vendors, contractors and remote staff, with document and location checks.
  • Apply the 50 percent rule in screening, including counterparties for exports and recurring services.
  • Review the amended OFAC FAQs and adjust blocking and reporting procedures.
  • Calibrate alerts for crypto-asset transactions and currency conversions.
  • If you cover virtual assets, plan to attend the UAF session and its reporting workshops.

Sources