Washington Sanctions Rwanda's Defence Ministry and a North Korean IT Worker Network
On 28 October 2026 OFAC designated 13 parties in two actions. Under the Democratic Republic of the Congo programme it named the Ministry of Defence of the Republic of Rwanda, for supporting the Rwanda Defence Force that Treasury says fights alongside M23 in North and South Kivu, and Zigama Credit and Savings Society, a Kigali financial institution accused of paying for RDF weapons, moving gold from M23-held mines and handling tens of millions of dollars for M23 and the Congo River Alliance. Under the North Korea programme it designated the First Financial and Technical Development Center, a DPRK-controlled IT worker company in Vladivostok, six of its Pyongyang-born workers, Russian intermediaries Vitold Obertas and Ilya Boykov, and delegation leaders Kim Ki Hyok and Kim Hyo Dong. Several entries carry Ethereum and Tron wallet addresses. No general licence was issued, and none of the 13 is listed by the UK, the EU or the UN.
This issue
- New designations
- 13
- Removals
- 0
- Entries amended
- 0
- Sources monitored
- 100
A Ministry and Its Bank, Then the IT Workers and Their Cashiers
Treasury designated the Rwandan Ministry of Defence under Executive Order 13413 for supporting the Rwanda Defence Force, itself sanctioned in March, whose troops it says fight alongside M23 in North and South Kivu. Zigama Credit and Savings Society, which works for Rwanda's security services, is accused of paying for RDF weapons in China and elsewhere, moving gold from M23-held mines to Kigali and handling tens of millions of dollars for M23 and the Congo River Alliance. Treasury framed the action as holding Rwanda to the Washington Accords of December 2025.
The North Korea action targets revenue from IT workers who take jobs at foreign companies under false identities. The First Financial and Technical Development Center, a DPRK-controlled company in Vladivostok, and six Pyongyang-born workers were designated under E.O. 13722. Under E.O. 13687 OFAC named Russian intermediary Vitold Obertas, Russian national Ilya Boykov, who converted about USD 3.5 million in cryptocurrency for LLC Alis, and delegation leaders Kim Ki Hyok and Kim Hyo Dong. Several entries carry Ethereum and Tron wallet addresses.
Party detail
Every row below was read against the issuing authority's own notice, not against a press report. Aliases are reproduced in full, including non Latin script forms, because the alias field is where a screening run usually fails. Identifiers are published sanctions data.
| Party | Action and instrument | Identifiers | Grounds |
|---|---|---|---|
| First Financial and Technical Development Center | DesignationExecutive Order 13722 (North Korea: exportation of workers); SDN tag [DPRK3] | Identifier: Organisation established Jan 2024Address: North Korea; Vladivostok, Russia | Designated under E.O. 13722 for having engaged in, facilitated or been responsible for the exportation of workers from North Korea, including to generate revenue for the Government of North Korea or the Workers' Party of Korea. Treasury says the DPRK-controlled centre, located in Russia since at least 2024, uses DPRK IT workers who employ AI tools and complex cryptocurrency transfers and have generated several million dollars for the DPRK government. |
| Kim Kyong Ju | DesignationExecutive Order 13722 (North Korea: exportation of workers); SDN tag [DPRK3] | Date of birth: 2 Jan 2001Place of birth: Pyongyang, North KoreaNationality: North KoreaPassport: 845349260 (Korea, North), issued 1 Sep 2025, expires 1 Sep 2030Address: Russia | Designated under E.O. 13722 for having materially assisted, sponsored, or provided financial, material or technological support for, or goods or services to or in support of, the First Financial and Technical Development Center. Treasury says the six Russia-based DPRK IT workers have together generated more than USD 750,000 for the centre since 2025. |
| Ri Thae Chol | DesignationExecutive Order 13722 (North Korea: exportation of workers); SDN tag [DPRK3] | Date of birth: 24 Feb 1999Place of birth: Pyongyang, North KoreaNationality: North KoreaPassport: 845349262 (Korea, North), issued 1 Sep 2025, expires 1 Sep 2030Address: Russia | Designated under E.O. 13722 for having materially assisted, sponsored, or provided financial, material or technological support for, or goods or services to or in support of, the First Financial and Technical Development Center. Treasury says the six Russia-based DPRK IT workers have together generated more than USD 750,000 for the centre since 2025. |
| So Hyong Jin | DesignationExecutive Order 13722 (North Korea: exportation of workers); SDN tag [DPRK3] | Date of birth: 3 Feb 2002Place of birth: Pyongyang, North KoreaNationality: North KoreaPassport: 845136771 (Korea, North), issued 18 Feb 2025, expires 18 Feb 2030Address: Russia | Designated under E.O. 13722 for having materially assisted, sponsored, or provided financial, material or technological support for, or goods or services to or in support of, the First Financial and Technical Development Center. Treasury says the six Russia-based DPRK IT workers have together generated more than USD 750,000 for the centre since 2025. |
| Han Yu Song | DesignationExecutive Order 13722 (North Korea: exportation of workers); SDN tag [DPRK3] | Date of birth: 20 May 2000Place of birth: Pyongyang, North KoreaNationality: North KoreaPassport: 845349261 (Korea, North), issued 1 Sep 2025, expires 30 Sep 2030Address: Russia | Designated under E.O. 13722 for having materially assisted, sponsored, or provided financial, material or technological support for, or goods or services to or in support of, the First Financial and Technical Development Center. Treasury says the six Russia-based DPRK IT workers have together generated more than USD 750,000 for the centre since 2025. |
| Kim Sung Gwan | DesignationExecutive Order 13722 (North Korea: exportation of workers); SDN tag [DPRK3] | Date of birth: 7 Jan 1999Place of birth: Pyongyang, North KoreaNationality: North KoreaPassport: 845136774 (Korea, North), issued 18 Feb 2025, expires 18 Feb 2030Address: Russia | Designated under E.O. 13722 for having materially assisted, sponsored, or provided financial, material or technological support for, or goods or services to or in support of, the First Financial and Technical Development Center. Treasury says the six Russia-based DPRK IT workers have together generated more than USD 750,000 for the centre since 2025. |
| Hyon Se Il | DesignationExecutive Order 13722 (North Korea: exportation of workers); SDN tag [DPRK3] | Date of birth: 8 Sep 2002Place of birth: Pyongyang, North KoreaNationality: North KoreaPassport: 845349266 (Korea, North), issued 1 Sep 2025, expires 1 Sep 2030Address: Russia | Designated under E.O. 13722 for having materially assisted, sponsored, or provided financial, material or technological support for, or goods or services to or in support of, the First Financial and Technical Development Center. Treasury says the six Russia-based DPRK IT workers have together generated more than USD 750,000 for the centre since 2025. |
| Vitold Viktorovich Obertas | DesignationExecutive Order 13687 (Government of North Korea); SDN tag [DPRK2] | Date of birth: 18 Nov 1968Place of birth: Vladivostok, RussiaNationality: RussiaNational ID: 4613339474 (Russia), issued 20 Jan 2013Identifier: Digital Currency Address - ETH 0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510Identifier: Digital Currency Address - TRX TCV4qdpTxoMyqkn7sSPeRrXmhH5JFxMvmTIdentifier: Digital Currency Address - TRX TQCBdU4K92oxLAkzwexZpqVZJhmPbtLYMmIdentifier: Digital Currency Address - TRX TFksjBcHPYqgAax2USheQuaT1ydRKyZRdgAddress: Russia | Designated under E.O. 13687 for having materially assisted, sponsored, or provided financial, material or technological support for, or goods or services to or in support of, the Government of North Korea. Treasury says this Russian intermediary handles illicit DPRK transactions, including for Amnokgang Technology Development Company (designated 12 March 2026), and since January 2025 has made nearly USD 2 million of cryptocurrency conversions and at least USD 1.25 million of other currency transactions for DPRK officials. |
| Ilya Aleksandrovich Boykov | DesignationExecutive Order 13687 (Government of North Korea); SDN tag [DPRK2] | Date of birth: 30 May 1994Nationality: RussiaPassport: 620645580 (Russia), expired 17 Jun 2009Identifier: Digital Currency Address - ETH 0x12Ea80238C7d805D003ce793594e92d84A6f4E8dIdentifier: Digital Currency Address - ETH 0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510Identifier: Digital Currency Address - TRX TQKoDq5aCrWAciiNtete5pDYVN38i4qFN1Identifier: Digital Currency Address - TRX TXmrnVgsqCMJncYHTXchuJ5z111BXSj4g3Address: Russia | Designated under E.O. 13687 for having materially assisted, sponsored, or provided financial, material or technological support for, or goods or services to or in support of, Limited Liability Company Alis, a DPRK IT worker company subordinate to Chinyong Information Technology Cooperation Company. Treasury says that since 2024 he has exchanged and converted the equivalent of USD 3.5 million in cryptocurrency, monitored cryptocurrency transactions and given logistical support to Alis. |
| Kim Ki Hyok | DesignationExecutive Order 13687 (Government of North Korea); SDN tag [DPRK2] | Date of birth: 30 May 1980Nationality: North KoreaIdentifier: Digital Currency Address - ETH 0xE4C9a7F68B1EbA4508f54f07f7378847318dD1A3Address: Russia | Designated under E.O. 13687 for having materially assisted, sponsored, or provided financial, material or technological support for, or goods or services to or in support of, Chinyong Information Technology Cooperation Company. Treasury says this LLC Alis lead heads a Russia-based delegation of DPRK IT workers, monitors them against financial targets and since 2024 has transferred cryptocurrency worth nearly USD 500,000 for the delegation. |
| Kim Hyo Dong | DesignationExecutive Order 13687 (Government of North Korea); SDN tag [DPRK2] | Date of birth: 28 Dec 1989Nationality: North KoreaPassport: 108130286 (Korea, North)Address: Russia; Laos | Designated under E.O. 13687 for having materially assisted, sponsored, or provided financial, material or technological support for, or goods or services to or in support of, Chinyong Information Technology Cooperation Company. Treasury says he leads a separate Russia-based Chinyong-subordinate delegation and since at least December 2023 has given it logistical help, evaded sanctions and moved more than USD 100,000 equivalent in financial assets. |
| Ministry of Defence of the Republic of Rwanda | DesignationExecutive Order 13413, as amended (Democratic Republic of the Congo); SDN tag [DRCONGO] | Identifier: Established 1962Identifier: website https://www.mod.gov.rwAddress: Ministry of Defence, KG 1 Roundabout, Kigali, Rwanda | Designated under E.O. 13413, as amended, for having materially assisted, sponsored, or provided financial, material, logistical or technological support for, or goods or services in support of, the Rwanda Defence Force (RDF), which OFAC sanctioned on 2 March 2026. Treasury says that at the Ministry's direction the RDF has deployed thousands of troops in North and South Kivu, where they operate alongside M23 and supply it with equipment, logistics and training. |
| Zigama Credit and Savings Society | DesignationExecutive Order 13413, as amended (Democratic Republic of the Congo); SDN tag [DRCONGO] | Business registration number: RCA/546/2010 (Rwanda)Identifier: established 1997, alt. 19 Apr 2010Identifier: website https://zigamacss.rwAddress: KG 178 Street 3, P.O. Box 4772, Kigali, Rwanda | Designated under E.O. 13413, as amended, for having materially assisted, sponsored, or provided financial, material, logistical or technological support for, or goods or services in support of, the RDF, M23 and the Congo River Alliance. Treasury says this Rwandan financial institution operates on behalf of Rwanda's security services, paid suppliers in China and elsewhere for RDF weapons and ammunition, had a branch move gold from M23-held areas of eastern DRC to Kigali, and processed tens of millions of dollars for M23 and the Congo River Alliance. |
What this means for your organisation
- 01
Load the 13 designations today: Add the ten individuals and three entities with their passport, national ID, registration numbers and aliases, and run a retrospective screen across customers, counterparties and payments.
- 02
Block the wallet addresses: Load the Ethereum and Tron addresses carried by Obertas, Boykov and Kim Ki Hyok into blockchain analytics and transaction monitoring; one Ethereum address appears on both Russian entries.
- 03
Review Rwanda exposure: Identify payments to or through the Ministry of Defence, Zigama Credit and Savings Society and entities they own 50 per cent or more, including correspondent flows routed to Kigali; no wind-down licence was issued.
- 04
Check hiring and contractor channels: Remote IT contractors paid in cryptocurrency or through intermediaries in Russia or Laos are the typology Treasury describes; HR and procurement screening should run against today's names and passport numbers.
- 05
Note the Lukoil Bulgaria licence date: Update OFSI General Licence INT/2025/7895596 to its new expiry of 26 February 2027 in your licence register.
Where this issue came from
The map plots the sources Youverify monitors. The pulsing markers are the one authorities cited in this issue: US-OFAC. Hover any marker to name the sources read there.
Method statement
Every entry is read from OFAC's SDN data files of 29 October 2026 and matched to the Recent Actions notice of 28 October. Grounds are taken from the two Treasury press releases of the same day. Every name was searched on the UK, EU, UN, Swiss, Australian and Canadian lists.
Corrections
No corrections issued for this issue. Corrections are published on the issue they affect, dated, with the original text retained.Cite this issue
Vyra from Youverify. "Washington Sanctions Rwanda's Defence Ministry and a North Korean IT Worker Network." Youverify Sanctions Monitor, issue 156, 29 October 2026. https://youverify.co/en/sanctions/2026-10-29. Accessed 29 October 2026.