Should You Treat IT Contractors as AML Risks?

You've built watchlist screening into customer onboarding and trained your team to spot suspicious patterns. But when your IT department hires a contractor to build an API integration or debug a payment gateway, does anyone run that individual through your AML controls?

North Korean operatives are exploiting this gap. They're using stolen U.S. identities to secure IT roles at American companies, earning salaries that fund ballistic missile programs while positioning themselves to steal data and extort employers. The U.S. Treasury Department sanctioned Russian and North Korean nationals in January 2025 for laundering cryptocurrency payments earned by these workers. One individual, Vitold Viktorovich Obertas, laundered at least $3.5 million in cryptocurrency since January 2025 on behalf of Amnokgang, a sanctioned North Korean shell company.

The question you face: Do you extend your AML/KYC framework to cover IT contractors, freelancers, and vendors who access sensitive systems?

Key Factors That Affect Your Choice

Your sanctions exposure
If your institution processes cross-border payments, holds correspondent banking relationships, or operates in jurisdictions with strict OFAC enforcement, a single sanctioned individual in your IT workforce creates reportable exposure. Treasury's actions target not just the workers but the financial intermediaries who launder their earnings.

Your data environment
IT contractors often need access to production databases, transaction logs, or customer records to perform their work. If cardholder data, personally identifiable information, or transaction patterns are accessible to these workers, you're creating an extortion risk. North Korean IT workers have monetized their positions by stealing corporate documents and threatening disclosure.

Your identity verification process
The FBI has warned that North Korea now targets low-income Americans, offering freelance gigs to host laptops or participate in interviews on behalf of the actual worker. If your hiring process relies solely on video interviews and document uploads without biometric verification or in-person validation, you're vulnerable to identity fraud.

Your cryptocurrency touchpoints
If your business involves cryptocurrency custody, exchange services, or blockchain analytics, you're a high-value target. North Korean IT workers have facilitated multi-million dollar crypto thefts. One sanctioned individual, Ilya Aleksandrovich Boykov, exchanged and converted about $3.5 million in cryptocurrency since 2024 for a North Korean company.

Path A: Apply Full AML/KYC Controls to IT Contractors

Choose this path if you meet any of these conditions:

• You operate under Bank Secrecy Act reporting obligations
• Your IT contractors access production payment systems or cardholder data environments
• You process transactions in cryptocurrency or maintain digital asset custody
• You're subject to OFAC jurisdiction and hold correspondent banking relationships

What this looks like in practice:

Run every IT contractor through the same watchlist screening you apply to customers. This means checking them against OFAC's Specially Designated Nationals list, the Consolidated Sanctions List, and any regional sanctions lists relevant to your jurisdiction. Update these checks quarterly, not just at hire.

Verify identity with the same rigor you'd apply to a Politically Exposed Person. Request government-issued identification and cross-reference it against public records. If the contractor works remotely, require biometric verification or in-person validation at a trusted location. The Treasury Department noted that North Korean IT workers use artificial intelligence to assist with job applications, so document uploads alone don't suffice.

Implement transaction monitoring for contractor payments. If you're paying a contractor in cryptocurrency or wire-transferring funds to accounts in high-risk jurisdictions, flag these for review. North Korean operatives often request payment through cryptocurrency exchanges or third-party payment processors that obscure beneficial ownership.

Document your due diligence. If OFAC later sanctions an individual you employed, your ability to demonstrate reasonable controls determines whether you face enforcement action. Maintain records of your screening process, identity verification steps, and any red flags you investigated.

Specific requirements that drive this path:

OFAC's 50 Percent Rule requires you to block transactions with entities owned 50% or more by sanctioned parties. If a contractor operates through a shell company controlled by sanctioned individuals, you've created a violation. The only defense is documented due diligence showing you attempted to identify beneficial ownership.

The Bank Secrecy Act requires financial institutions to file Suspicious Activity Reports for transactions involving $5,000 or more where you know, suspect, or have reason to suspect the funds derive from illegal activity. If you later discover you paid a sanctioned IT worker, you're required to file a SAR within 30 days of detection.

Path B: Apply Enhanced Due Diligence Without Full AML Integration

Choose this path if:

• Your IT contractors don't access production systems containing customer data
• You operate outside direct Bank Secrecy Act obligations (though you may still have sector-specific requirements)
• Your payment infrastructure is fully segmented from development environments
• You hire contractors exclusively for non-sensitive work like front-end design or marketing automation

What this looks like in practice:

Conduct identity verification but stop short of ongoing transaction monitoring. Require contractors to provide government-issued identification and verify it against public records. For remote workers, use video verification services that check for deepfakes or AI-generated video.

Implement role-based access control that prevents contractors from accessing production databases, transaction logs, or any environment containing cardholder data. If a contractor needs to test payment flows, provide them with a fully isolated sandbox environment using synthetic data.

Screen contractors against OFAC sanctions lists at hire but don't implement quarterly rescreening unless their role changes or they request access to sensitive systems. This reduces administrative burden while still catching known sanctioned individuals.

Monitor for behavioral red flags rather than transaction patterns. The FBI has identified tactics like requests to host laptops, reluctance to appear on video, or frequent changes to payment account details. Train your IT managers to escalate these signals to your compliance team.

Specific requirements that drive this path:

PCI DSS Requirement 7.2 requires you to establish access controls based on job function. If you've properly segmented your cardholder data environment, contractors working in isolated development environments don't create the same exposure as those touching production systems.

FFIEC IT Examination Handbook guidance on third-party risk management requires financial institutions to conduct due diligence proportionate to the risk and criticality of the service. A contractor building a marketing website presents different risk than one with database administrator credentials.

Path C: Exclude Contractors From AML Framework but Enhance Physical Controls

Choose this path only if:

• You hire IT contractors exclusively for on-premises work with no remote access
• You operate outside financial services and don't process payments
• Your business doesn't touch cryptocurrency or cross-border transactions

What this looks like in practice:

Require in-person interviews and on-site work. The North Korean IT worker scheme relies on remote work arrangements that allow operatives to obscure their true location. If you require contractors to work from your office and present identification in person, you eliminate most of the attack surface.

Implement physical access controls that prevent contractors from connecting personal devices to your network or accessing systems outside their assigned scope. Use network segmentation to ensure contractor workstations can't reach production environments.

Even under this path, conduct basic sanctions screening. Run contractor names against OFAC lists at hire. The administrative burden is minimal, and the downside of employing a sanctioned individual is severe even if you're not a financial institution.

Summary Matrix

The Treasury Department's January 2025 sanctions illustrate the scope of this threat. Six IT workers earned at least $750,000 on behalf of First Financial and Technical Development Center since 2025. One delegation leader, Kim Ki Hyok, transferred at least $500,000 to North Korea since 2024. Another transferred over $100,000 in an effort to evade sanctions.

Your choice depends on where IT contractors intersect with your financial crime risk profile. If they touch payment systems, customer data, or cryptocurrency, treat them as you would any high-risk counterparty. If they're isolated from sensitive systems, enhanced due diligence may suffice. But ignoring the risk entirely leaves you exposed to both sanctions violations and data theft.

The FBI's warning about targeting Americans "facing financial stress" suggests this threat will expand. Build your controls now, before you're explaining to OFAC why you didn't.