Tallinn: European sanctions policy towards North Korea was built for a physical world. The restrictive measures adopted after 2006, and the autonomous layer the Council added in 2016, were designed to stop centrifuge components, missile subassemblies and ship-to-ship transfers of refined petroleum. They assume a cargo that can be inspected and a vessel that can be denied a port. The enforcement problem the European External Action Service has now put on the record is neither. It is a payroll problem.
The EEAS has stated plainly that Pyongyang’s cyber operations are causing significant financial harm to the Union, its member states and their partners, and it has singled out the so-called IT worker system, under which North Korean nationals sell remote software services under borrowed or invented identities and remit the proceeds home. The revenue is not incidental. Blockchain analysts attribute more than two billion dollars in stolen cryptocurrency to North Korea-linked actors in 2025 alone, and a majority of all hacked value in the first months of 2026. Set against an economy of North Korea’s size, this is not a sideline. It is a budget line.
What makes the IT worker scheme awkward for European enforcement is that almost nothing about it is illegal on its face. A company in Estonia, Poland or Portugal contracts a freelance developer through a marketplace. The developer’s documents look ordinary. The bank details resolve to an intermediary in a third country. Payment goes out as an invoice for services rendered, which is exactly what it appears to be. There is no shipment to intercept, no end-user certificate to check, and in many cases no single moment at which a European compliance officer could reasonably have known. The sanctioned party is not the counterparty on the contract; it is the state standing several steps behind it.
Washington has moved faster here, largely because it has a single Treasury designation machine and a domestic case record to draw on. Federal prosecutions have described operatives embedded in hundreds of American firms, and the March 2026 designations targeted the facilitators who convert the earnings into digital assets. European institutions do not work that way. Listings under the Union’s North Korea regime require unanimity in the Council, and the evidentiary standard for an asset freeze against a natural person is set by the General Court, which has annulled listings before on thinner files than these.
There is a second instrument available and it is arguably the better fit. The Union’s horizontal cyber sanctions regime, in force since 2019, allows designations for cyberattacks with significant effect regardless of the state involved. It has been used sparingly, in part because attribution decisions are politically expensive. But an IT worker network is not a single attack with a forensic signature; it is a recruitment pipeline, and pipelines are better disrupted through the intermediaries who move the money than through the individuals at the far end.
That points towards financial supervision rather than foreign policy. The Union’s anti-money-laundering package, and the crypto-asset service provider rules now bedding in under MiCA, give European regulators visibility over exactly the conversion step where this revenue becomes usable. Using them for a security purpose requires the EEAS and the financial supervisors to share a threat picture they have not historically shared.
The diplomatic conclusion is uncomfortable but clear. Europe’s leverage over Pyongyang through traditional trade sanctions is close to exhausted, because the trade it can restrict has already stopped. The leverage that remains runs through European companies’ own hiring and payment practices. That makes this a regulatory campaign that will be won or lost in procurement departments, and it will require the Union to tell its own firms something they will not enjoy hearing about who is on their books.
