For well over a decade, sanctions have been the international community’s go-to answer to North Korea’s growing nuclear ambitions.

Despite an initially slow-to-expand sanctions regime, Pyongyang’s repeated missile and nuclear tests of 2016-2017 resulted in a sharp expansion of UN Security Council (UNSC) resolutions.

Efforts swiftly evolved from the precision targeting of the munitions sector and elite interest in luxury goods, to UNSC sanctions expelling North Korea from the international financial system and prohibiting it from buying or selling a wide range of commodities, among others.

Today UN measures are just a small part of the North Korea sanctions regime, too, with biting U.S. unilateral measures which can be used to prohibit almost every type of DPRK transaction conceivable.

But add European Union, Japanese, South Korean and dozens of other unilateral restrictions into the mix, and the wide-reaching nature of the North Korea sanctions regime makes it no wonder the country has resorted to increasingly illicit means to get around the measures.

Faced with this environment, how then do bankers and those in the financial sector avoid breaching so many rules and regulations? With so much risk on the cards, what is the point of even trying to process legitimate North Korea-related transactions?

Furthermore, in the event that renewed U.S.-DPRK diplomacy eventually leads to sanctions relief, how does one even begin to unravel such a wide-ranging layer of measures?

Finally, given the increasingly creative adversaries facing sanctions compliance officials worldwide, what more can be done to provide the financial sector the tools and information necessary for an effective fight?

To learn about all these topics and more, NK News spoke to a Southeast Asian sanctions specialist at one of the region’s largest banks. Due to their professional responsibilities, their identity has been kept anonymous.

This interview has been edited for brevity and readability

NK News: Firstly, how would you describe the current state of North Korea sanctions when it comes to your job in finance?

I think in Southeast Asia, what’s happened is there has been a tightening grip over the last three years. And in my country’s context, it has tightened to a point of zero tolerance.

Banks are expected to apply many controls to mitigate against the risks, so it’s a lot of pressure.

And on top of existing anti-money laundering (AML)/sanctions obligations, there is a lot of expectation to apply data analytics – which may not necessarily be helpful – because within the banks, we’ve only got so much information.

So if a particular entity does not sit within your organization – like with the Dandong Hongxiang kind of situation – there is no way you’ll find any direct/indirect links to North Korean related entities.

NK News: And in terms of due diligence, is it acceptable to simply avoid those entities listed by the U.S. Treasury Department and the UN Security Council, or do you need to do more than that?

Actually, it has to be more than that because all such companies would have certain types of red flags and typologies. As to any institution’s perspective regarding a blacklist, if those on it are subject to being an SDN there are other implications to external parties being involved. Even if they are not sanctioned, those will have to be included as well.

So yes, it’s more than just whatever is on the list.

NK News: How do banks like yours de-risk entities that do not violate sanctions, but work on North Korea issues?

It depends because financial institutions rely heavily on the burden of proof. So it’s not that we have to be atheist on North Korea transactions, but we heavily rely on transactional proof to evidence such risks.

However, what has happened is that in my country the regulator has specifically come out to us to say that the burden of proof lies within the bank.

“Pretty much, regulators have left it to the banks to de-risk”

We have to prove beyond doubt that a certain institution that’s probably near some sanctions exposure does not cause a sanctions exposure to come near to our bank.

So it’s the bank’s responsibility to call it. So, pretty much, regulators have left it to the banks to de-risk.

NK News: How would you be able to 100% de-risk, say, anyone working on North Korea issues at the moment? Is it possible?

It’s not possible because institutions heavily rely on screening – I think that’s general knowledge – but there is only so much you can get from the list (of designated entities and individuals).

And where we find that there could be certain hints of risk, this is usually handled by ring-fencing. So if certain types of accounts are restricted, or there’s a certain high-risk region like Liaoning/Dalian in China, then they will be ring-fenced off. This will be short of any proof of direct DPRK exposure being proven.

There are numerous controls from a bank’s perspective that we can apply, and this would be in absence of any provincial proof from an authority to say that they are directly DPRK-related.

That makes it all the more complicated. So the tendency largely for financial institutions is that if you can’t stomach the potential risk, then simply just do not do it.

“The tendency largely for financial institutions is that if you can’t stomach the potential risk, then simply just do not do it”

NK News: Is there really a business case for doing any of this? Surely North Korea transactions, even for a legitimate entity, are going to be so small?

Let me give you a very generic example of what would cause a bank to be hesitant.

So perhaps there is a Russian person – he’s a non-resident of Singapore and he lives in London. He is known to open and close a lot of trading companies and he does a lot of trading in the Asia region. He comes to our bank, opens an account, has a lot of business relations with China doing textiles, sugar, and, let’s say, rice.

I think that will be enough for us to say ‘no’ on the grounds of probable DPRK exposure.

NK News: There are supposed loopholes and exemptions for things like humanitarian activities. But practically, do they make any difference?

For example, say that medicine has been shipped from South Korea under what we call a general license by the UN and OFAC (for humanitarian aid). In those cases, we would need to cite the humanitarian documents to process the transaction.

If we need to we go back to UN and OFAC to check such licenses there will also be occasions when we will speak to our corresponding banks to further clarify.

So the margin in terms of loop-holing from a control perspective is very minimal, unless there is an entity intent to bypass the system and not be upfront. And again, I think it would be nearly impossible for banks to detect such ill-intent to loop-hole.

NK News: If we get to a situation where there is some rollback in UN Security Council sanctions, would that translate into practical changes at the bank level right away? Or is there still going to be a period where you are going to be concerned about risk and wait some years before deciding that it’s actually safe to proceed?

I think the challenge is even if they tune sanctions up or down, whichever is the case, legislatively, it takes time.

Even turning off sanctions, there is so much work – systems need to be changed, policies need to be updated, even on the process level – it’s really such a pain.

To add to that, our banks are not small. We have a presence in almost all Southeast Asian countries, and the bigger banks have a presence all over the world. So to draft a change alone would take two years.

And two years down the road, you say you want to leave JCPOA… What’s that going to do to people?

“Even turning off sanctions, there is so much work – systems need to be changed, policies need to be updated, even on the process level – it’s really such a pain”

If I take an example from Myanmar – when the U.S. said they wanted to roll back on Myanmar-related sanctions – in the end, it took a year or two. But consider that Myanmar wasn’t comprehensive because it didn’t have the UN-specific ties to it.

For North Korea, it will be far trickier because the financial systems are built as to be totally allergic to DPRK red flags.

And I think from a financial perspective, in the beginning there will be a lot of hesitancy on any changes to policy, on any changes to starting business with the DPRK. This is simply because if you’re rung so tight in the beginning, when you let lose of the belt your stomach has already shrunk so much that there’s only so much you can digest.

And in Southeast Asia, especially in Singapore, Hong Kong, etc, it’s currently literally zero tolerance.

So any changes will depend first on the stance provided by the industry. We will also need to look at the stance that comes from the regulator, and we would need to look at the stance coming from the domestic ministries.

Other questions will be about the larger implications to our clearing business – our U.S. dollar clearing businesses, our Euro clearing businesses.

There is just so much work to be done because this cuts across all agendas. So it will take a while, if it happens.

From a bank’s perspective, overall, I therefore think it will be a look-and-see thing. And on the practical side of things, we will be looking at U.S. banks to set an example.

If JP Morgan or somebody tells me, “we are looking at the DPRK,” – if they say something we will do something. Until then, we will not. That will be our approach (which is the same approach we took for Myanmar, as well.)

NK News: So with Myanmar, how long did it take for practical changes to take effect after the relief of sanctions?

A: I think two or three years at least. In contrast, if you take a similar leadership example to North Korea, countries like Iraq and Libya were actually far quicker.

With Iraq and Libya, after the fall of the regimes, the U.S. banks said, “yes, all is good, you can continue processing payments for them”. It was that quick because it was more like an end-of-dictatorship kind of thing.  But Myanmar was a bit tricky.

NK News: In that regard, is your work on North Korea in any way directly influenced by U.S. political tensions or political trends? Like when the U.S. started making more noise about sanctions in 2017? At such times do you feel more pressured from above to work on this issue, or are you always just trying your best?

I would say the pressure from the U.S. is definitely a top risk, from our perspective, simply because the U.S. is the one leading the talks and the resolution to the DPRK issue. So, any developments there would be taken as a priority. And we will also look to the local regulators.

Overall, it’s typically a three step approach.

First, look at what the U.S. says, which will usually end up in the statute, that is of course number one. Number two would be of course the regulators, which have often reinforced and revised the DPRK prohibitions over the last two to three years.

And the next would be from our correspondent banks as well, whose feedback has been very stringent of late. Last year a few of the banks seemed to have more information than I did, which was pretty frustrating, but that’s how we function. We function by virtue of this external intelligence.

We also get a lot of feedback from the authorities, who often have their own monitoring systems as well.

NK News: How complete is the information, you’d say, most banks receive when it comes to North Korea issues, and sanctioned entities, and so forth?

If it’s coming from the Treasury, by and large, it’s enough for us to act on.

So typically, we would go through the key identifiers –  you’ve got the name, you’ve got the owner behind it, you’ve got the vessel name and International Maritime Organization (IMO) number. So we do have sufficient information – if it’s from the Treasury or the authorities, it’s usually complete.

But what’s always catching us on the back-foot are the entities that are suspicious, sent by third parties like correspondent banks or even information that’s provided anonymously to us, if that is something we can’t prove at our level.

With information coming from the authorities, they are very careful and it would appear to us that a lot of care has been taken to ensure actionable material is provided to the financial world. That has been the case for North Korea – for the longest time – since sanctions were supplied.

“But what’s always catching us on the back-foot are the entities that are suspicious, sent by third parties like correspondent banks or even information that’s provided anonymously to us”

However, the advisories or requests for further information that are problematic for us are the ones that we receive as hearsay and those from the correspondent banks.

The ones from correspondent banks are a general question of “do you expect these companies to have any links with North Korea?”

As a bank how are you supposed to answer that? You are inferring something, but I can’t see anything. So that’s the-day-to-day challenge. It’s an issue for all banks and we talk a lot to each other this way.

I will ask some other bankers, “Hey guys, it seems there’s some talk about ABC company in Liaoning, is there any North Korean link?”

That’s a very viscous cycle. No one is going to say in that sense yes, because if that’s said, the burden of proof will then lie on that particular bank to prove to us that there is a link. So it’s basically left to us to manage the risk and potential exposure.

The U.S. banks take a zero tolerance approach to any of their agent banks. They will say “you guys directly/indirectly breached and caused us to breach UN sanctions because you have made us inadvertently process a DPRK-related payment because of your weak controls.”

Rather than go through the frustration and get our money locked up, I will say, “I won’t do your business, I’m sorry.”

There is no way to argue that line. So rather than go through the frustration and get our money locked up, I will say, “I won’t do your business, I’m sorry”.

NK News: What is the consequence of, say, your correspondent bank in the U.S. catching something? Is there a penalty? How does that work?

In most cases there are lots of banks that would do this: the agent bank knows that these guys are really far ahead, that they are the best money launderers in the world.

So this issue comes down to relationships.

If a relationship has really been very harsh between two banks – between bank-to-bank – there are key performance indicators, and responding in a detailed manner/providing proper responses is one of the KPIs of how agent banks operate. It’s an expectation.

So for us, fortunately we have a very good relationship with our agent banks.

For myself, I will get a call from somebody to say, “there is this payment that is really problematic and I can’t convince the U.S. guys about it.”

I won’t say at this point in my career I have ever spoken to people at Treasury. But we have joined calls with the Treasury and with agent banks to run through a whole case – there will be a non-disclosure for disclosure of information between the three parties – and when the Treasury or the agent bank have seen that we do good on our part, they will say: “no problem, you were not facilitating, you were just a product of the facilitation”.

And usually they will just tell us to be far more careful.

Usually, for such big cases, they confirm we are not the ones, but by the time it comes to us, it will not be a phone call, it will not be an email, it will be a letter. It really depends.

NK News: One of the things that we’ve noticed with the North Korea sanctions regime compared to, say, the Iranian one, is that the penalties are almost entirely absent. Most recently, there was a $1 million fine on a Californian company for importing eyelashes. And then on the Iran portfolio, you have penalties of multi-billions of dollars against banks. So isn’t North Korea actually low risk when you look at it on the big picture?

That’s the paradox of this whole thing. While we have a lot of pressure on securing North Korea in terms of transactional business, we see fines on Iran being far larger.

So we know there is a certain – I will not say bias – but I think we do see a certain amount of emphasis on Iran, in terms of fines.

As far as North Korea is concerned, it could be building up the networks that could be far more complex because once you mete a large fine, these shell companies go into hiding.  So I think parties like the Treasury and others are simply trying to see how they can detect and lock out North Korea.

I honestly don’t have an answer, but I know Iran for sure is a large holder of the U.S. dollar because Iran is more economic in nature – it involves a lot of oil, a lot of other commodities and such.

North Korea, from a banking perspective, is more about transfers and movement of funds. It does not involve certain commodities, so working on them in that sense will not affect the price of oil barrels.

And of course you know the world runs on barrels, so if I may point to the economic factor, I think that would be the big difference.

NK News: And does that have an impact on how much resources banks put into their North Korea sanctions compliance versus, say, Iran?

I think, from a financial institution perspective, I can share from both multinational banks and also the regional banks such as ours, the attention given is equal.

It’s all lumped under the sanctions portfolio. So Iran will have the same policy as North Korea, as Cuba, Sudan, etc. So in that sense, there is a specific team dedicated to sanctions compliance. It’s not specific to DPRK, but it’s largely applied to the whole sanctions agenda.

NK News: When it comes to banks in general working in North Korea – what could be that one big thing that could help?

I think one would be the ability to have an information center, for someone to have solid information.

We know a lot of data providers like Lloyds, IHS, and so on and so forth, but when it comes to specific information, it’s very easy to say that people don’t always want to provide it.

We know it’s problematic, and a lot of it, like I said before, depends on your own intel, where you subscribe to certain special monitors to be able to detect ship-to-ships transfers, etc.

So I think we would all like to be able to rely on a source of information that’s collectively agreed to by the financial institutions. One where we can say: “Guys, this is the information, I can use this to do something about it”.

Furthermore, while we are doing our work my biggest difficulty – especially around the trade area – is if certain transactions are grey or suspicious, for example, or if they are in certain parts of the waters in Japan, or near the seas of Korea.

In such cases, how then do I get evidence that the transaction is key? I can’t.

“Trading is all trading on documents, it’s all trading on papers. And that’s where the problem lies. If you are trading on paper, you have to trust the paper.”

I basically rely on the declaration that, yes, the goods actually arrived where they’re supposed to have. And then two weeks later I get smacked on the back: I get information that the goods actually stopped off at North Korea and they just went to nearby because they wanted to show that it looked like they had dropped off the goods in South Korea, for example.

What can I do? I’ve got no satellite data, I’ve got nothing.

Trading is all trading on documents, it’s all trading on papers. And that’s where the problem lies. If you are trading on paper, you have to trust the paper. How many resources do I have to put behind a piece of paper?

Commerce mainly depends on trade documents, so if you put many controls in the process, delays in trade commerce will occur, the economy will break. And having to subject all these documents to such heavy scrutiny, it defeats the purpose of commerce.

So that’s the number one question; how do we ring-fence the risk of such illicit trades? I mean the banks lack this information.

Edited by Oliver Hotham