Advisory on North Korean information technology (IT) workers

Advice to Canadians and Canadian businesses

In response to its aggressive actions and illicit weapons programs, Canada has implemented sanctions against North Korea under the United Nations Act and the Special Economic Measures Act. As a result of these sanctions, it is prohibited for any Canadian, including Canadian businesses abroad or person in Canada, to conduct activities specified in the regulations under these Acts. Furthermore, every person or entity referred to in section 5 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) shall:

• report transactions suspected to be related to the commission of a money laundering, terrorist financing, or sanctions evasion offence to FINTRAC.
• implement the Ministerial Directive on the Democratic People’s Republic of Korea (updated March 2025) issued in response to North Korea's failure to address the significant deficiencies in its anti-money laundering and combatting the financing of terrorism (AML/CFT) regime, and the risk that North Korea may be facilitating sanctions evasion, to ensure the safety and integrity of Canada’s financial system.

These prohibitions may impact Canadian individuals and entities who are seeking the types of services described in this advisory.

Contravening sanctions is a criminal offence, subject to fines and/or imprisonment. Under the United Nations Act, the maximum penalty on summary conviction is a $100,000 fine or a 1-year prison term, or both. Convictions on indictment may result in a maximum 10-year prison term. Under the Special Economic Measures Act, the maximum penalty on summary conviction is a $25,000 fine or a 1-year prison term, or both. Conviction on indictment may result in a maximum 5-year prison term. Possible contraventions are investigated and enforced by the Royal Canadian Mounted Police and the Canada Border Services Agency.

Through privileged access to companies’ networks and critical infrastructure, North Korean IT workers may insert passive malware and backdoors in program codes that can collect information, monitor traffic, or facilitate future exploitation, thereby exposing companies to the risk of corporate espionage and data theft.

Small businesses and start-ups can be more attractive targets for North Korean IT workers, who seek to exploit these businesses’ need for qualified, relatively inexpensive labour, and the lack of dedicated resources for screening candidates during the hiring process.

Businesses are encouraged to share information with the Government of Canada, including on suspicious persons, account holders, financial transactions, and cyber and other incidents, via the contacts listed under “Resources”.

Background

For decades, the North Korean government has emphasized the importance of science and technology – including information technology – to national development. This focus was further strengthened in 2019, when Pyongyang reformed its education system to foster sci-tech talent. Given its multiple nuclear tests since 2006, the United Nations has adopted successive sanctions on North Korea to curtail its weapons of mass destruction and ballistic missile programs. In 2011, Canada imposed additional sanctions against North Korea under the Special Economic Measures Act to reinforce the message to the North Korean government that its aggressive actions are unacceptable. Despite international efforts, North Korea uses increasingly sophisticated tactics to evade sanctions, and continues to fund its weapons programs via illicit activities, including through payment remitted by IT workers located domestically and overseas. According to security firms, North Korea may also be responsible for cryptocurrency thefts amounting to billions of dollars since 2021 through hacking related service providers and infrastructure. The U.S. has further assessed that funds gained via these means directly support North Korea’s weapons programs. North Korean IT workers have also used their access to corporate systems for cyber espionage, money laundering, or to acquire sensitive materials for state-run enterprises.

Resources

More information on North Korean IT workers can be found in advisories published by the governments of:

• Australia
• the Republic of Korea
• the United States (PDF, 460 KB)

For cyber security advice and guidance, please refer to the Canadian Centre for Cyber Security’s website:

• Individuals
• Small and medium businesses

For reporting of suspicious transactions and implementing the Ministerial Directive:

• FINTRAC guidance related to the Ministerial Directive on the Democratic People’s Republic of Korea issued on December 9, 2017 (updated March 2025)
• Reporting suspicious transactions to FINTRAC
• Reporting transactions which violate sanctions to FINTRAC

For more information on fraud, scams and cyber-fraud and to report fraud and cybercrime incidents, please refer to the Canadian Anti-Fraud Centre’s website.

For more information about Canadian sanctions related to North Korea, please refer to Global Affairs Canada’s website.

You can also contact Global Affairs Canada at the following address:

Global Affairs Canada
Sanctions Operations Division
125 Sussex Drive
Ottawa, Ontario
Canada  K1A 0G2

E-mail: sanctions@international.gc.ca

All suspected sanctions violations must be reported to the RCMP National Security Information Network by phone at 1-800-420-5805 or at rcmp.ca/report-it. Service is available in Canada’s both official languages.