How Countries Continue to Underestimate Their Risk Exposure to North Korea

National authorities and private sector institutions with sanctions compliance obligations tend to underestimate their risk exposure to North Korea’s sanctions-evasion and weapons of mass destruction (WMD) proliferation activities. Although there are often political or economic reasons why a country may underestimate risk, the explanation is generally far simpler: a lack of resources, limited access to accurate information, and a flawed understanding about the scale and scope of North Korea’s sanctions-evasion and proliferation-related activities.

Among the most authoritative and detailed sources of information about North Korea’s activities are the reports by the UN Panel of Experts – a group appointed by the UN Secretary-General, which previously included this author, responsible for investigating and reporting on North Korea’s sanctions violations. The bi-annual reports chronicle new and ongoing investigations into North Korea’s sanctions-evasion activities, and the county’s progress on its ballistic missile and nuclear weapons programmes. While the reports are extraordinarily detailed, each often topping more than 300 pages in total, they are, unfortunately, subject to the political machinations of the UN Security Council. Moreover, the data within the reports is not in standardised formats and is often difficult to decipher.

To this end, in August, the Centre for Financial Crime and Security Studies at RUSI unveiled an initiative that catalogues and structures more than a decade of data contained in the UN Panel of Experts’ reports on North Korea into a freely available database. Containing nearly 6,000 individuals, companies, vessels and events spanning 139 countries, the database sheds light on the massive scale and scope of North Korea’s sanctions-evasion activities.

The objective is to not only provide national authorities and private-sector institutions with an authoritative source of accurate information to make informed decisions on sanctions risk but to highlight the sheer scale and scope of North Korea’s global sanctions-evasion operations, beyond that offered by the much more limited designation lists.

What Does the Data Show?

Despite over a decade of detailed investigation and documentation of North Korean sanctions evasion activity, only a small fraction of the parties that have facilitated North Korea’s sanctions-evasion activities have made their way onto official UN designation lists. In fact, the database makes clear that UN designated entities make up less than 5% of the total number of individuals, companies and vessels mentioned in the Panel of Experts reports over the last decade.

The reality is that designated entities are rarely, if ever, detected through screening alone. It is far more often the case that sanctioned persons or companies use intermediaries and associates to facilitate prohibited activities, which can appear to be legitimate commercial activity. North Korea’s revenue-generating activities, for example, are often overlooked or thought to be benign, compared to its oil smuggling and spate of cyberattacks. Yet, the revenue from its networks of overseas labour, restaurants and other businesses are funnelled directly into its ballistic missile and nuclear weapons programmes. These are precisely the activities that create both direct and regional risks that national authorities tend to overlook.

While North Korea’s sanctions-evasion activities are global, there is a significant concentration in East and Southeast Asia. Just over 30% of all persons, companies and events detailed in the Panel of Experts investigations, for example, are either located in China or have a substantive connection to China, like a company registered in Hong Kong. National authorities would be remiss, however, if they ignored threats from other regions.

Source: https://dprk-reports.org

Europe and Central Asia account for 14% of the number of individuals and companies in the database associated with North Korea’s sanctions evasion activities. Of this, almost half are linked to Russia.

States classified within the World Bank’s ‘small states forum’ designation – defined as having lower populations and unique development challenges – account for nearly 20% of North Korea’s sanctions evasion activities. These countries are predominantly concentrated throughout West and Sub-Saharan Africa, which is generally exposed to a higher degree of risk related to North Korea’s overseas labour networks and activities related to the illegal trade in wildlife.

Although North Korea’s sanctions evasion and proliferation activities are a risk to both high- and low-income countries, there is a very clear trend among the lower income countries. States that the World Bank categorises as ‘low-income’ and ‘lower-middle income’ countries account for nearly 30% of the entities associated with North Korea’s sanctions-evasion activities.

Perhaps not surprisingly, there is a clear correlation between risk exposure, as captured by the database, and results from the fourth round of evaluations by the Financial Action Task Force (FATF), the international standard-setting body for anti-money laundering and terrorist financing. According to the evaluations, 90% of low-income countries and 55% of lower-middle income countries were found to be either non-compliant or only partially compliant with FATF recommendation 7, which deals with the implementation of targeted international sanctions related to WMD proliferation (like those imposed against North Korea). It follows, of course, that sanctions-evasion activities would be more prevalent in areas with lower scores related to the implementation of targeted sanctions.

What’s Next?

What’s clear from more than a decade of data in the Panel of Experts’ reports is that understanding risk exposure to North Korea requires more than screening against designated entity lists. Unfortunately, an incomplete picture of North Korea’s activities continues to contribute to significant gaps in effective sanctions implementation and enforcement efforts.

Since 2018, for example, the UN Security Council has failed to adopt additional sanctions designations, despite the numerous recommendations by the Panel of Experts and other member states. It is not due to a lack of evidence, however. On the contrary, evidentiary packages submitted to the Security Council are often replete with transactional data and other records that accurately and thoroughly detail the alleged prohibited activity. Instead, designation recommendations, either made by the Panel of Experts or other 1718 Committee members, are relegated to the dissenting political views of the Security Council members, often, Russia and China.

Consequently, the rich data contained in the reports that could support countries’ understanding of their risk exposures goes underutilised.

There is also a misunderstanding among national authorities and data brokers about the importance or culpability of persons mentioned in the reports. Often, data brokers that serve the compliance and due diligence community do not include all information contained in the reports, but only those persons, companies and vessels that are either designated or recommended by the Panel for designation. The problem, as previously mentioned, is that there are thousands of additional high-risk entities that are otherwise excluded and thus not screened against by those seeking to protect the integrity of the financial system from sanctions evasion.

One solution that would help to alleviate this problem is for all UN expert reports that deal with sanctions investigations to include methodology statements and clear descriptions of evidentiary standards for including named entities. This would help both governments and enterprises make more informed decisions about risk.

Over the past two decades, open-source intelligence (OSINT) has increased in popularity, both to increase transparency among civil society and as an intermediary when government and private-sector information-sharing may not be feasible or adequate – in cases, for example, where information is classified or too sensitive to be shared outside of official channels.

There is no doubt that this trend will likely continue. In fact, if reports are accurate, risk exposure to North Korea’s sanctions evasion activities could increase substantially, even for countries generally considered at a lower risk, as Russia forges closer ties with Pyongyang. Last month, Russia’s President Vladimir Putin met with North Korean leader Kim Jong Un in Russia to discuss, among other things, military cooperation – a venture strictly prohibited under the UN sanctions regimes.

The US ambassador to the UN, Linda Thomas-Greenfield, described Russia’s possible military cooperation with North Korea as ‘shameful’ and stated that ‘... [Russia is] flouting its responsibilities as a member of the Security Council and propping up proliferating regimes – is unacceptable’.

Finally, it will be increasingly important for countries to have access to practical tools and information that not only support implementation efforts but also highlight key trends with North Korea’s sanctions-evasion and WMD proliferation activities to accurately assess risk. As governments, civil society and the private sector contend with developing and using novel OSINT tools for sanctions compliance and due diligence, it is increasingly important to begin conversations about standards and best practices. The FATF, for example, should begin these discussions with an OSINT summit to discuss emerging trends and key considerations for compliance.

Continuing to raise awareness about proliferation risks is important to buttressing international non-proliferation norms and upholding international sanctions obligations, but tools such as this new database can bridge the gap between awareness and practical implementation.

The views expressed in this Commentary are the author’s, and do not represent those of RUSI or any other institution.

Have an idea for a Commentary you’d like to write for us? Send a short pitch to commentaries@rusi.org and we’ll get back to you if it fits into our research interests. Full guidelines for contributors can be found here.