Executive Summary

This research provides a contemporary study of how and why the Democratic Peoples’ Republic of Korea (DPRK) chose to integrate cryptocurrency into its sanctions evasion strategy, as well as the US government’s response to this via its financial services regulatory and federal law enforcement agencies. The increased coverage and efficacy of US and international sanctions, especially during and since President Obama’s second term (2013-2017) forced the DPRK to find new sources of revenue to maintain elite domestic support and fund their weapons programs. The creation and proliferation of cryptocurrency, which allows for both a digital store of value and a means of exchange outside of the traditional international finance system, opened up an entirely new means by which the DPRK was able to obtain and move funds. Much the DPRK’s cryptocurrency is obtained by the through the use of illicit methods and their success has blunted the impact of sanctions as a policy tool. As a result, US financial services regulators and law enforcement have moved to regulate cryptocurrency and crack down on illegal activities associated with it, such as ransomware payments. However, US regulations regarding cryptocurrency remain largely fragmented across agencies and various local jurisdictions.

This research highlights the underappreciated role played by the US Treasury Department and the semi-independent agencies under its aegis in turning policy goals into enforceable administrative law. It also finds a high degree of continuity in the development and application of sanctions between the Obama and Trump administrations against the DPRK. Furthermore, this study demonstrates the need for policymakers to develop a more comprehensive US legal framework around regulation of cryptocurrency to close off growing illicit revenue generation by hostile actors. The study then briefly touches on the increased importance of the DPRK’s digital activities during COVID-19. Finally, this study outlines three potential methods by which to manage risks posed by cryptocurrency: 1) a public-private partnership to create s standards setting or certification organization to self-police the industry; 2) the US government using its sovereign authority to legislate and regulate; or 3) an outright banning of cryptocurrency activities in the United States.

Click here to download the full paper.