North Korean diplomat Han Tae Song in February 2018. With considerable diplomatic support from Russia and China in the UN, North Korea has been able to limit the impact of sanctions toward its government. (UN Office at Geneva)
This article is the second issue of a three-part series on North Korea-Southeast Asia ties.
Part 1—Signals of a Quiet Reconnection—maps Pyongyang’s phased re-engagement with Southeast Asia since 2023, showing how three distinct national logics exploit ASEAN’s gap between collective denuclearisation rhetoric and individual bilateral engagement.
Part 3—The Normalisation Dilemma—analyses the diplomatic convergence on Pyongyang: how Indonesia and Singapore’s divergent engagement logics, and ASEAN’s structural inability to reconcile collective denuclearisation commitments with individual normalisation, are not separate from the evasion network detailed, but its legitimising complement.
The Monitoring Regime Collapsed
On March 12, 2026, the US Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned six individuals and two entities for their roles in North Korea’s overseas IT worker scheme that, according to US officials, generated nearly 800 million US dollar in a single year. The sanctioned network operated across Vietnam, Laos and Spain. Among those named: Nguyễn Quang Việt, chief executive officer (CEO) of a Vietnamese firm that converted approximately 2.5 million US dollar in cryptocurrency for North Korean operatives between mid-2023 and mid-2025; and Yun Song Guk, a North Korean national who oversaw a group of freelance IT workers operating out of Boten, Laos, coordinating illicit payments and contracts for foreign partners. The sanctions were not only a law enforcement action, but also a map of a broader architecture whose expansion has been directly enabled by the collapse of the international sanction monitoring regime that might otherwise have constrained it.
In March 2024, Russia vetoed the renewal of the UN Panel of Experts (PoE) mandate, the body that had monitored sanctions compliance against the Democratic People’s Republic of Korea (DPRK) since 2009. China abstained. Russia’s veto was the third step in a systematic effort to undermine the sanctions regime. The PoE’s mandate expired at the end of April 2024, dissolving fifteen years of centralised monitoring. Six months later, eleven Western-aligned countries launched the Multilateral Sanctions Monitoring Team (MSMT) as a partial successor. The MSMT operates outside the UN framework, following the mechanism of the “Coalition of the Willings”. As well known, the nexus of North Korea’s most significant violations rests in Russia and China. The architecture monitoring those violations now excludes the states where they primarily occur. The result is a fragmented enforcement landscape in which North Korea has more room to manoeuvre than at any point since the sanctions regime was established and the 800 million US dollar IT worker scheme exposed in March 2026 is one visible consequence.
One Architecture, Three Faces
Representatives of the foreign ministries of North Korea and Laos during the signing of a new cooperation agreement last week in Vientiane, Laos, in 2020. (Lao Ministry of Foreign Affairs)
In at least three states where North Korea has deepened its diplomatic presence since 2024, the ideological and political channels underpinning official engagement have simultaneously served as institutional cover for sanctions evasion. Diplomatic normalisation and financial crime are the same track, running through the same states, sustained by the same structural conditions. A state maintaining ideological solidarity with Pyongyang faces a structural disincentive to disrupt North Korean networks on its soil. Disruption damages the bilateral relationship and requires regulatory capacity that Financial Action Task Force (FATF) grey-list status signals it does not yet fully possess. Consequently, 75% of jurisdictions either partially comply or do not comply at all with FATF standards. Furthermore, Vietnam and Laos remain on the grey list as of the February 2026 FATF update. The grey-list designation does not indicate political will to enable North Korea, but the absence of regulatory infrastructure to detect and stop it. That absence, structurally, functions as permission.
Vietnam: Where Bamboo Diplomacy Creates Grey Zones
Vietnam presents the most sophisticated version of this double structure. Hanoi maintains the deepest diplomatic engagement of any ASEAN state with Pyongyang. It is the only country to send multiple official delegations post-reopening including a deputy defence minister in September 2024, with military cooperation on the bilateral agenda. In October 2025, To Lam led a three-day state visit to Pyongyang. It was the first visit of a Vietnamese top leader in nearly 20 years, during which Vietnam and North Korea signed five bilateral cooperation documents, including a defence cooperation letter of intent and a foreign ministry agreement. On 5 May 2026, Tô Lâm appointed a new ambassador to North Korea.
Running alongside this diplomatic track is the network exposed by the March 2026 Treasury OFAC sanctions. Amnokgang Technology Development Company, a North Korean IT firm managing overseas worker delegations, used Vietnamese intermediaries to move its proceeds. Apart from Nguyễn Quang Việt, ĐỗPhi Khanh of Hanoi, allowed a US-sanctioned North Korean nuclear procurement facilitator to use his identity to open bank accounts and launder IT worker proceeds. These are nodes in a network that required local banking access, local identity documents and operational familiarity with Vietnamese financial infrastructure that sustained diplomatic presence provides and that FATF grey-list jurisdictions are structurally least equipped to monitor.
This “bamboo diplomacy” of Hanoi signifies the multi-directional flexibility that makes Vietnam a credible partner for both Washington and Pyongyang, creating grey zones that sanctioned actors are positioned to exploit. The policy is not designed to enable evasion. Its design creates the conditions under which evasion thrives.
Laos: The Training Hub
Laos presents a quieter but structurally similar case. The party-to-party relationship between the Lao People’s Revolutionary Party and the Workers’ Party of Korea provides the kind of operational familiarity that makes Laos useful to Pyongyang beyond diplomatic symbolism.
The March 2026 sanctions named Boten Special Economic Zone as the base for Yun Song Guk’s IT worker network. Boten’s relaxed oversight, predominantly Chinese business community and limited regulatory visibility from Vientiane make it structurally well-suited for front company operations. The MSMT’s October 2025 report on DPRK cyber and IT worker activities specifically identified Laos-based networks in its findings. Like Vietnam, Laos remains on the FATF grey list as of February 2026. In Boten, as in Hanoi, the diplomatic channel and the shadow network coexist without the state necessarily being a known participant in the latter. However, the structural conditions the state maintains are precisely what the network requires.
Cambodia: The Technical Compliance Paradox
In February 2023, Cambodia was removed from the FATF grey list after the watchdog cited its “significant progress” in strengthening Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) controls, including improved legal frameworks, risk-based financial supervision and enhanced prosecution of money laundering. The US State Department’s 2024 investment climate assessment independently confirmed the delisting. By the conventional benchmark, Cambodia had complied.
Yet, on May 1, 2025, US Financial Crimes Enforcement Network (FinCEN) proposed severing Huione Group from the US financial system, designating it as a “primary money laundering concern.” FinCEN found that Huione Group laundered at least 4 billion US dollar in illicit proceeds between August 2021 and January 2025, of which 37 million US dollar was directly linked to North Korea’s Lazarus Group. The rule was finalised in October 2025. Cambodian authorities even granted citizenship to a North Korean individual who had violated international sanctions.
This is the technical compliance paradox: a state can satisfy every formal AML benchmark while simultaneously hosting a node in North Korea’s cyber-finance infrastructure at a scale those benchmarks were never designed to detect. As a consequence, North Korea’s evasion networks are built specifically to exploit the gap between formal compliance and effective enforcement, operating through jurisdictions that have achieved the former without fully achieving the latter.
Sophistication Without Accountability
Students at Mangyongdae Revolutionary School, a prestigious academy in Pyongyang. North Korea’s elite hackers are often deployed to countries with faster internet speeds to target banks around the world. In the US, they’ve gone after Wells Fargo, Citibank and the New York Federal Reserve. (KCNA)
Today, the structural conditions have not been resolved. The MSMT is a genuine contribution to monitoring: its October 2025 report on DPRK cyber operations was the most detailed public accounting of North Korean IT worker activities since the PoE’s dissolution, and its findings directly informed the March 2026 Treasury sanctions. Yet, the MSMT faces a fundamental limitation as it is a like-minded-country mechanism operating in an enforcement environment where the states most relevant to North Korean sanction evasion (i.e., China, Russia, and the Southeast Asian states) are either excluded from membership or structurally non-compliant. The US State Department’s January 2026 briefing called for Russia to allow the Panel of Experts to be reconstituted. There is no realistic prospect of that while North Korean troops continue to serve in Russia’s war in Ukraine.
In this environment, the sanction evasion networks will grow more sophisticated. It is estimated that North Korean hackers stole more than 2 billion US dollar in cryptocurrency in 2025 alone, a 51% year-over-year increase setting a new record. That brings the country’s total stolen crypto to around 6.75 billion US dollar. Crucially, the trend reflects smarter attack mechanisms with fewer, larger, and laundered in smaller tranches to evade detection. This is a pattern of increasing operational sophistication. The infrastructure adapts, generating new front companies, new local facilitators, and new crypto-laundering routes as old ones are disrupted. The March 2026 Office of Foreign Assets Control (OFAC) action named eight targets. The network behind them involves dozens more.
The durable response requires deeper investment in the regulatory capacity of the states that function as grey zones, Supporting FATF compliance processes in Vietnam and Laos, sustaining pressure on Cambodia to translate its formal delisting into genuine enforcement, and establishing bilateral financial intelligence-sharing agreements that operate outside the paralysed UN framework will be the first step. The MSMT’s monitoring function needs a regional capacity-building mechanism that addresses the regulatory gaps that make grey-zone exploitation structurally viable in the first place.
Vietnam, Laos and Cambodia are the clearest cases of the double structure where diplomatic normalisation with North Korea and sanction evasion coexist within the same structural conditions. Two others present a more ambiguous picture. One is Indonesia who hedges across every axis, deepening its Seoul security partnership, reopening its Pyongyang embassy and building digital infrastructure that North Korean cyber actors have already been documented targeting. The other is Singapore who sent its Foreign Minister to Pyongyang on 26 May 2026, then to Seoul the day after, in the same week Xi Jinping departed for Pyongyang on his first overseas trip of 2026. It positions itself as the next venue for a diplomatic conversation, like the first US-DPRK Summit in 2018, that could reshape the entire framework within which these questions are being asked.
About The Author
