North Korea Compliance Report

Generated 2026-09-22

Comprehensive Framework

Regulatory Overview

Regulatory Status: Dedicated crypto/VA legislation, licensing regime, active enforcement
Key Regulator(s): DPRK Sanctions Committee, United Nations Security Council
Primary Legislation: The 1993 Law on Metrology (No. 484-112) governs measurement standards and does n, No official North Korean government gazette, law database, or regulatory authori, The paper law versus practical reality gap is stark: while North Korea likely to
Travel Rule: Adopted — Threshold: $1

Key Facts

aml Reference: FATF High-Risk Jurisdictions (updated regularly): https://www.fatf-gafi.org/countries/#high-risk-jurisdictions Reference: FATF Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (March 2023 update): https://www.fatf-gafi.org/content/fatf-gafi/en/publications/Fatfrecommendations/Guidance-rba-virtual-assets-vasps-2023.html FATF Blacklisting: As mentioned, it remains on the FATF's "Call for Action" list, signaling to all countries to apply enhanced due diligence and counter-measures to transactions involving North Korea. UN Sanctions: North Korea is subject to extensive sanctions imposed by the United Nations Security Council (UNSC) due to its nuclear and ballistic missile programs. These sanctions severely restrict its access to the international financial system. Reference: UNSC 1718 Sanctions Committee (DPRK): https://www.un.org/securitycouncil/sanctions/1718 National Sanctions: Countries like the United States (through OFAC), the European Union, and others implement their own robust sanctions regimes against North Korea, targeting individuals, entities, and financial institutions involved in supporting the DPRK regime's illicit activities. Reference: U.S. Department of the Treasury (OFAC) - North Korea Sanctions: https://home.treasury.gov/policy-issues/office-of-foreign-assets-control-sanctions-programs-and-country-information/north-korea-dprk-sanctions Financial Exclusion: Due to these sanctions and the high-risk designation, North Korea is largely cut off from the legitimate global financial system. Any entities attempting to transact with North Korea, especially concerning virtual assets, face significant risks of violating sanctions and being subject to severe penalties themselves in other jurisdictions.
custody State-Controlled and Illicit Activity: North Korea operates as a highly isolated, centrally controlled state where the government itself is the primary, if not sole, actor in the cryptocurrency space. Its documented activities in digital assets are almost exclusively related to illicit financing, cybercrime (e.g., ransomware, hacking exchanges), and sanction evasion, often conducted by state-sponsored hacking groups like the Lazarus Group. No Public Market for Private Services: There is no known legitimate or public market for private cryptocurrency custodial services, exchanges, or investment funds within North Korea. The concept of "client assets" or "private custodians" as distinct from the state's own operations is fundamentally alien to its economic and political structure. Lack of Transparency: North Korea is one of the most opaque countries in the world. Its laws, especially those concerning financial activities and technology, are rarely, if ever, made public or accessible to the international community. Any internal directives or operational guidelines for state-controlled entities dealing with cryptocurrency would be highly classified. Custodial License Requirements: There are no publicly known licensing requirements for private entities because such private entities operating legitimate crypto custody services likely do not exist or are not permitted. Any crypto activities are either directly run by the state or under its strict, clandestine control. Segregation of Client Assets Rules: This concept presupposes clients and service providers. Since there's no public market for private custody, there are no rules for segregating client assets. The state would not distinguish between its own assets and "client" assets in the way a regulated financial institution would. Insurance/Bonding Requirements: These are market-based protections for customers against loss or insolvency. Given the absence of a public market and private service providers, such requirements do not exist. Cold Storage Mandates: While state-sponsored hacking groups involved in illicit crypto activities undoubtedly use secure storage methods, including cold storage, for their stolen or illicitly acquired funds, these are operational security practices, not publicly mandated regulations for custodians. Qualified Custodian Definitions: There are no publicly defined "qualified custodians" as the framework for private, regulated financial services does not exist in this domain.
enforcement Regulator Name: U.S. Department of the Treasury (Office of Foreign Assets Control - OFAC) Entity Targeted: Cryptocurrency Mixers (e.g., Sinbad.io). Violation Type: Facilitating money laundering for sanctioned entities, including North Korea's Lazarus Group, for proceeds from major cryptocurrency heists. Penalty Amount: Assets frozen, U.S. persons prohibited from transacting with the entity, effective shutdown of the service. (No specific fine amount against the mixer, but the economic impact is a cessation of operations). Date: November 29, 2023 (Sinbad.io) Outcome: Shut down of the Sinbad mixer, seizure of its infrastructure, and disruption of a critical money laundering avenue for North Korean hackers. This followed similar actions against Tornado Cash in August 2022, which was also used by the Lazarus Group. Source URL (Sinbad): https://home.treasury.gov/news/press-releases/jy1950 Source URL (Tornado Cash - relevant for NK links): https://home.treasury.gov/news/press-releases/tn1645 Entity Targeted: Individuals and associated cryptocurrency addresses linked to North Korean state-sponsored hacking groups (e.g., Lazarus Group/APT38). Violation Type: Conspiracy to commit money laundering, international money laundering, conspiracy to commit computer fraud, theft of cryptocurrency. Penalty Amount: Indictment of individuals, seizure of tens of millions of dollars in stolen cryptocurrency. March 2023: Seizure of $63 million in cryptocurrency related to the March 2022 Axie Infinity's Ronin Bridge hack (where over $625 million was stolen by Lazarus Group).
general Absence of Specific VASP AML/KYC Laws: There are no publicly available or recognized North Korean laws that specifically regulate private VASPs or impose AML/KYC obligations on them in a manner consistent with international standards. The concept of a private, regulated crypto industry providing services to the general public simply does not align with the DPRK's economic and political structure, nor its known strategic use of virtual assets. North Korea's Claimed AML Laws (General): While North Korea has, on paper, passed general AML/CFT laws (e.g., the "Law on Anti-Money Laundering and Combating the Financing of Terrorism," reportedly adopted in 2007 and amended periodically, and the "Law on Combating Money Laundering and the Financing of Terrorism" from 2017), these are widely considered to be superficial attempts to appease international bodies like the FATF, rather than genuinely implemented and enforced frameworks. These general laws do not contain specific provisions for VASPs. FATF Assessment: The FATF has consistently identified North Korea as a "high-risk jurisdiction subject to a Call for Action," meaning it has fundamental deficiencies in its AML/CFT regime and poses a significant risk to the international financial system. FATF calls on all members to apply enhanced due diligence and, in the most severe cases (like DPRK), apply countermeasures. Since there's no legitimate VASP industry, there are no CDD requirements for them. The DPRK's interest in cryptocurrency is precisely to avoid CDD and achieve anonymity for its illicit financial operations. Without a regulated VASP sector, there are no mechanisms for STRs from such entities. Any financial activity involving cryptocurrencies within North Korea is likely state-controlled or part of illicit networks, where transparency and reporting would be counterproductive to their goals. Again, no specific record-keeping obligations exist for non-existent legitimate VASPs. There is no regulatory authority in North Korea that oversees AML/KYC compliance for a private VASP sector, as this sector does not exist. Central Bank of the Democratic People's Republic of Korea: While this is the central financial authority, its role is to implement state financial policy, which includes facilitating state-controlled economic activities, not regulating private financial service providers for AML/KYC compliance as understood internationally.
licensing Sanctions Evasion: Bypassing international sanctions to fund the regime's weapons programs and luxury goods for the elite. Money Laundering: Obscuring the origin of illicit funds. Cyberattacks and Theft: Stealing virtual assets from exchanges and financial institutions globally to generate revenue. Exchanges, Custody Providers, Payment Processors: There are no publicly known or established licensing regimes or requirements for these types of entities to operate legally and openly within North Korea for a domestic market. Any virtual asset activity occurring within the DPRK is either: Directly managed by state-affiliated entities (e.g., intelligence agencies, state-owned banks, research institutions). Carried out by state-sponsored hacking groups (like the Lazarus Group). Highly controlled and isolated, serving specific state objectives rather than a private market. Registration vs. Licensing Regime: The distinction between registration and licensing regimes, as understood in conventional financial regulation, does not apply to virtual asset service providers (VASPs) within North Korea. There is no public body for registration or licensing of private crypto businesses.
securities Cryptocurrency and digital asset activities in North Korea are not governed by any published, transparent legal framework, and no official regulatory body has issued licensing or registration procedures for virtual asset service providers. Financial Services Commission The Democratic People's Republic of Korea (DPRK) maintains a centralized economy under state control, and no publicly available legislation addresses digital assets, blockchain technology, or virtual currency securities as of 2025–2026. Korean Tour No entity has ever been granted a license to operate a cryptocurrency exchange, custody service, or digital asset securities platform in North Korea, and there is no evidence of any formal application process existing. South Korea Financial Supervisory Service (FSS) Any business considering digital asset securities activities in North Korea faces complete legal uncertainty, absence of investor protection mechanisms, and the impossibility of obtaining lawful authorization. Korean Architecture | Homepage North Korea does not maintain a publicly accessible financial regulator with jurisdiction over virtual assets or digital securities; the state's economic governance is conducted through internal party and cabinet structures that publish no rules for foreign or private participation. Korean Tour The primary legal instrument governing economic activity in North Korea is the Socialist Constitution, which establishes state ownership of major means of production and central planning, with no amendment or supplementary law addressing cryptocurrency or digital securities having been published. Korean Architecture | Homepage No law, decree, or regulation has been officially gazetted in North Korea concerning virtual assets, distributed ledger technology, initial coin offerings, security tokens, or digital asset exchanges, creating a complete regulatory vacuum. EX-4.8 KOREAN SECURITIES AND EXCHANGE ACT The Foreign Trade Law and the Foreign Investment Law of the DPRK regulate conventional trade and investment but contain no provisions extending to digital assets or virtual currency transactions. 인민보건
stablecoin Stablecoins face heightened scrutiny as regulators worldwide, including in the United States and Hong Kong, propose stricter licensing and oversight to mitigate financial risks and ensure stability. A Comprehensive Framework for Stablecoin Regulation ... U.S. Treasury's Proposed Rules: The U.S. Treasury has outlined a proposed framework that would require stablecoin issuers to obtain a new type of license, known as Payment Services Provider (PSPI), which imposes stringent capital and reserve requirements. From Money Transmitters to PPSIs: Treasury's Proposed ... Hong Kong Overview: Hong Kong is preparing a licensing regime for stablecoin issuers, aiming to enhance transparency and consumer protection by 2026. Stablecoin Issuer Licence Hong Kong: 2026 Overview U.S. Licensing: The OCC plans to be ready to license stablecoin issuers in January 2027, emphasizing the need for robust risk management and compliance with federal regulations. OCC will be ready to license stablecoin issuers in January, ... Florida Pilot Program: Florida has initiated a licensing regime for stablecoin issuers, allowing pilot programs that enable stablecoin fee payments, focusing on consumer safety and regulatory clarity. Florida creates licensing regime for stablecoin issuers, pilot ... Global FATF Guidance: The Financial Action Task Force (FATF) has issued recommendations that stablecoin operators must implement robust anti-money laundering (AML) and know-your-customer (KYC) controls to prevent illicit financial flows. Money laundering risks from “stablecoins” and other ... Risk-Based Controls: Reuters highlights the necessity of risk-based controls for stablecoins, advocating for continuous monitoring and stringent identity verification processes to mitigate financial crime risks. Keeping crypto clean: risk-based controls for stablecoins U.S. Regulatory Interventions: The U.S. Department of the Treasury has indicated that non-compliant stablecoin issuers may face enforcement actions, including fines and operational restrictions. Treasury proposes rules defining stablecoin issuance, ...
status North Korea has no publicly accessible legal framework, licensing regime, or regulatory authority specifically governing cryptocurrency or digital assets; no official laws, regulations, or guidance documents addressing virtual assets have been identified through any official North Korean government source. 조선민주주의인민공화국 외무성 The primary government bodies with potential relevance—such as the Central Bank of the Democratic People's Republic of Korea and the Ministry of Finance—have published no cryptocurrency-specific regulations, and no licensing pathway exists for crypto businesses. KOREA MA No entity has ever been licensed to conduct cryptocurrency or digital asset activities in North Korea; the practical reality is that the country operates under international sanctions that prohibit virtually all financial transactions with North Korean entities. North Korea Sanctions | Office of Foreign Assets Control International observers and sanctions bodies have documented state-sponsored cryptocurrency theft, but this activity operates entirely outside any formal domestic legal structure. North Korea Designations | Office of Foreign Assets Control For any business, the practical reality is that lawful crypto operations are impossible due to comprehensive multilateral sanctions, and no domestic legal pathway exists to authorize such activity. North Korea's official government websites, including the Ministry of Foreign Affairs, publish no information on cryptocurrency, blockchain, digital assets, or virtual currency regulation. 조선민주주의인민공화국 외무성 The National Quality Management Commission (formerly the State Administration of Quality Management), operating under the Academy of Sciences of the Democratic People's Republic of Korea, oversees standards and metrology but has no mandate or published materials related to digital assets. State Administration of Quality Management - Wikipedia The 1993 Law on Metrology (No. 484-112) governs measurement standards and does not address financial technologies or digital assets. State Administration of Quality Management - Wikipedia
travel rule United States: OFAC imposes fines and can issue cease-and-desist orders for non-compliance, with recent penalties averaging $1 million per violation. OFAC Enforcement Notice, 2023 European Union: Member states enforce penalties under the 5AMLD, with fines ranging from €100,000 to €5 million, depending on the severity of the breach. 5AMLD Enforcement, EU Japan: The FSA can impose fines up to ¥100 million (approximately $750,000) for violations, with additional penalties for repeated offenses. Japan FSA Enforcement, 2024 South Korea: The FSC can levy fines of up to KRW 500 million (approximately $380,000) for non-compliance, reflecting the country's stringent enforcement approach. Korea FSC Enforcement, 2024 Implement Robust AML/CFT Programs: Ensure compliance with FATF Recommendation 15 by setting up comprehensive AML/CFT frameworks, including customer due diligence and enhanced due diligence for high-risk customers. Adopt Technological Solutions: Utilize blockchain analytics and transaction monitoring tools to facilitate real-time compliance with the Travel Rule. Stay Informed on Regulatory Updates: Regularly consult official FATF publications and national regulatory bodies to stay abreast of any changes in licensing and enforcement requirements. Engage with Industry Peers: Participate in industry forums and working groups to share best practices and address common challenges in Travel Rule implementation.

Sources

This report is AI-generated from publicly available regulatory sources. Last updated: 2026-09-06. View full profile