Vladivostok: Labour brokers in Russia’s Pacific port city have handled North Korean work crews for decades, and the arrangement used to be visible. Men arrived, built things, and the wages travelled home through channels that customs officers and port authorities could in principle observe. European sanctions were designed for that world. They are now chasing a revenue model that never touches a quay.
The Union’s restrictive measures against the Democratic People’s Republic of Korea, catalogued by the Council, target weapons programmes, luxury goods, coal, seafood, shipping registries and the individuals who manage them. Successive rounds added names tied to sanctions evasion and, since 2024, to the military support Pyongyang supplies to Russia’s war against Ukraine. The listings are well drafted. They assume a physical transaction somewhere in the chain.
Multilateral monitoring published in January 2026 describes something else. It sets out how North Korean information technology workers obtain freelance contracts under false identities, most of them operating from China, with plans to place far larger numbers of labourers in Russia. It also documents cryptocurrency theft on a scale that dwarfs the trade Pyongyang used to run in commodities. The reporting attributes billions in losses across dozens of separate intrusions at cryptocurrency firms and their customers.
European exposure runs through three doors. The first is the freelance labour market. A software company in Lisbon or Tallinn that hires a remote contractor through a global platform performs identity checks the platform designed, not checks a sanctions regime designed. The second is payroll intermediaries, which convert contract fees into payments that leave no obvious counterparty risk signal. The third is crypto custody, where stolen assets are laundered through mixers and bridges before re-entering regulated venues.
None of this is a gap in political will. It is a mismatch between an enforcement architecture that sits at borders and a revenue stream that never crosses one. Customs authorities cannot inspect a repository commit. Port state control cannot detain a payroll file.
Brussels has instruments that could close part of the distance, though they were built for other purposes. The transfer of funds regulation already requires originator and beneficiary information to travel with crypto transfers, which gives supervisors a data trail if they choose to mine it for sanctions patterns rather than money laundering typologies alone. Market rules for crypto asset service providers impose governance duties that a determined supervisor could read as covering identity verification failures at scale. Neither instrument names Pyongyang, and that is precisely the problem for enforcement teams who need a hook.
The harder question is one of division of labour. Sanctions enforcement in the Union sits with national authorities of very different capability, coordinated rather than directed from the centre. A Dutch financial intelligence unit and a Bulgarian customs service do not bring the same analytic weight to an identity fraud investigation spanning four jurisdictions. Proposals to give the Commission a stronger enforcement role have circulated for years without resolution, and the DPRK file is an awkward place to test them because the underlying conduct is criminal as well as sanctionable.
There is also a deterrence problem. Listing a general who commands troops in Russia carries symbolic weight and imposes real costs on that individual. Listing a synthetic identity used for six months on a contracting platform imposes almost none, because the identity is disposable by design. Deterrence has to fall on the intermediaries who profit from lax verification, not on the fiction they onboarded.
European officials describe the file as a security matter rather than a financial one, and they are right. The money funds missiles. But the tools that would actually interrupt it belong to financial supervisors and platform regulators who currently treat North Korea as somebody else’s brief.
