Secret documents show how North Korea launders money through U.S. banks

North Korea carried out an elaborate money laundering scheme for years using a string of shell companies and help from Chinese firms, moving money through prominent banks in New York, according to confidential bank documents reviewed by NBC News.

Wire transfers from North Korean-linked firms with opaque ownership sometimes came in bursts, only days or hours apart, and the amounts transferred were in round figures with no clear commercial reasons for the transactions, according to the documents.

Graham Barrow, a London-based anti-money laundering expert, said these kinds of transactions are “red flags,” and are all hallmarks of efforts to conceal the origins of illicit cash.

A trove of confidential bank documents reviewed by NBC News offers a rare glimpse into how North Korea — and other rogue actors — move illicit cash across borders despite international sanctions designed to block Pyongyang’s access to the global financial system. The suspected laundering by North Korea-linked organizations amounted to more than $174.8 million over a period of several years, with transactions cleared through U.S. banks, including JPMorgan and the Bank of New York Mellon, according to the documents.

“Taken as a whole, you have what really, frankly, looks like a concerted attack by the North Koreans to access the U.S. financial system over an extended period of time through multiple different avenues in ways that were fairly sophisticated,” said Eric Lorber, a former official at the Treasury Department who worked on North Korea sanctions under the Trump administration.

The leaked documents are part of the FinCEN Files, a collaborative project with the International Consortium of Investigative Journalists, BuzzFeed News, NBC News and more than 400 journalists around the world, examining a cache of secret suspicious activity reports filed by banks with the Treasury Department’s Financial Crimes Enforcement Network, known as FinCEN, as well as other investigative documents. The leaked documents were obtained by BuzzFeed.

As NBC News and other media outlets prepared to publish stories based on the leaked documents, FinCEN announced plans on Wednesday, Sept. 16, for a major overhaul of the nation’s anti-money laundering rules.

Suspicious activity reports (SARs) are filed by banks and other financial institutions to alert law enforcement to potentially illegal transactions, but do not necessarily represent evidence of legal wrongdoing. The reports are highly confidential and closely guarded by both banks and U.S. authorities.

The Treasury Department’s Financial Crimes Enforcement Network condemned the leak of the documents, declined to comment on the content of the suspicious activity reports and said it had referred the matter to the Justice Department and the Treasury’s inspector general.

“As FinCEN has stated previously, the unauthorized disclosure of SARs is a crime that can impact the national security of the United States, compromise law enforcement investigations, and threaten the safety and security of the institutions and individuals who file such reports,” the department said.

The documents cover a period mainly from 2008 to 2017, during which both the Obama and Trump administrations steadily tightened sanctions against North Korea to try to prevent the regime from building up its nuclear weapons and ballistic missile arsenal. The sanctions in part are meant to block the regime’s attempts to buy or sell material for its weapons programs and to secure hard currency. But the records convey a cat and mouse game in which North Korea — often with the help of Chinese companies — found ways to slip under the radar, experts said.

“The documents you have in front of you, I think help explain why the North Koreans have been so successful at sanction evasion,” said Hugh Griffiths, who served as head of the UN Panel of Experts until last year tracking sanctions-busting by Pyongyang. “What you have is gold dust because so few journalists, or investigators generally, get access to banking internal compliance documentation.”

The leaked records underscore the enormous difficulties the U.S. and other countries face trying to block North Korea and other money launderers from penetrating the world’s financial markets, Griffiths said.

In one case, the bank documents convey in unprecedented detail how the chief of a firm in Dandong, a Chinese city on the North Korea border, conducted apparent money laundering even as she made no secret of her business dealings with the North.

U.S. authorities in 2016 and 2019 indicted Ma Xiaohong, her company, Dandong Hongxiang Industrial Development Corp., and other executives in the firm for money laundering and helping North Korea evade international sanctions.

No one has been extradited and charges remain pending. Federal prosecutors declined to comment.

One of the internal bank documents appears to have been written because of that federal investigation.

Before those indictments, Ma and Dandong Hongxiang routed money through China, Singapore, Cambodia, the U.S. and elsewhere to North Korea, using an array of shell companies to move tens of millions of dollars through U.S. banks in New York, according to the suspicious activity report filed by the Bank of New York Mellon.

According to the document, the bank reported in 2015 that it handled suspicious transfers of $85.6 million, and the document details $20.1 million of those transactions. The bank wrote that it was prompted to comb through its records because of a “government inquiry.”

The bank cited red flags in those transactions, including money that went to firms with obscured ownership that appeared to be shell companies. Some firms were registered in high-risk jurisdictions such as Cambodia, the bank wrote. Some transfers were sent in batches, only days apart and some on the same day. The bank also noted that there were no clear commercial reasons for the transactions and that they were in round amounts.

One transaction in 2009 featured a Singapore shipping concern called United Green PTE Ltd., whose directors included Leonard Lai. The Treasury Department later imposed sanctions in 2015 on Lai and his Singaporean company, Senat Shipping Ltd, for their links to a North Korean shipping firm that allegedly tried to move weapons from Cuba to North Korea. The sanctions are still in place. Senat and Lai could not be reached for comment.

The bank allowed dozens of transfers to go ahead despite media reports that showed Ma had talked openly about conducting business with North Korea. The Associated Press interviewed Ma in 2014 as part of a report on North Korean trade. North Korea Economy Watch, a newsletter affiliated with The Stimson Center, a Washington think tank, quoted Ma in 2010 looking forward to a new bridge that would increase trade with North Korea.

Tracking news coverage is a standard tool for banks trying to prevent money laundering, and the media accounts should have provided additional warning signs for the Bank of New York Mellon, said Barrow and other experts.

BNY Mellon said that under federal law it could not comment on any suspicious activity report that may have leaked. But the bank said it “takes its role in protecting the integrity of the global financial system seriously,” assists U.S. authorities and fully complies with applicable laws and regulations.

Another major U.S. bank, JPMorgan Chase, informed the Treasury Department in January 2015 about suspicious financial transactions possibly linked to North Korea. In its report, JPMorgan Chase said that it oversaw $89.2 million in transactions between 2011 and 2013 that benefitted 11 companies and individuals with ties to North Korea. The bank said it had previously flagged those companies in its own suspicious activity reports for sending funds to North Korea.

The firms included Faith Surplus Trading Development Ltd. of China, which the bank had noted in previous reports that most of its counterparties were suspected of sanctions evasion on behalf of North Korea and Iran.

The deals also featured SUTL Corp Pte Ltd of Singapore and Dandong Sanjiang Trading Co Ltd of Dandong, China. The bank wrote that its own “internal intelligence” was “linking them to considerable illicit activity involving the proliferation of weapons involving North Korea and transactions with entities in Iran.”

International shipping records maintained by Panjiva show Dandong Sanjiang has made at least 80 shipments to North Korea, and a 2014 United Nations report stated that the company was involved in North Korean shipping.

The bank reported that Faith Surplus Trading sent 14 wires worth $3.76 million to China Oil Singapore, a subsidiary of China National United Oil. That company had been cited in a previous suspicious activity report for allegedly violating U.S. sanctions on Iran, the bank wrote.

Faith Surplus went out of business in 2015. SUTL and Dandong Sanjiang did not respond to requests for comment.

It’s unclear why JPMorgan approved the transactions, given the suspicions raised previously about some of the entities involved. JPMorgan said it was prohibited by law to comment on specific suspicious activity reports. But the bank said it admitted to shortcomings in a report in 2014 and had invested in efforts to bolster anti-money laundering (AML) measures.

“We acknowledged in that 2014 report that our existing AML controls needed improvement, and have since devoted considerable resources to comply with the laws and regulations governing anti-money laundering, terrorist financing and economic sanctions. Today, thousands of employees and hundreds of millions of dollars are devoted to helping support law enforcement and national security efforts,” a bank spokesperson said.

A key to much of the money laundering described in the documents involves correspondent banking, when a financial firm like Bank of New York Mellon or JPMorgan provides services to a foreign bank for currency exchange or other transactions. The world’s financial industry relies largely on doing business in U.S. dollars, and correspondent banking is a routine and crucial part of the international financial system that enables global trade, allowing money to flow across borders instantaneously. But it’s also a financial highway that money launderers like North Korea try to exploit, hoping their transactions will be overlooked amid the vast volume of financial traffic, experts said.

The Treasury Department said in a recent report that money launderers often use correspondent banking services to move illicit money across borders. In a March 2020 report, the Treasury department said “the most significant vulnerabilities in the United States exploited by illicit actors” include “the significant volume of foreign funds and number of transactions that are intermediated through U.S. correspondent banks.”

According to the Treasury report, “U.S. financial institutions often unwittingly process these transactions.”

Lorber, the former Treasury official, said both private banks and U.S. authorities lack the manpower and the resources to keep up with all the money laundering and sanctions-busting that takes place. But in recent years, partly because of aggressive U.S. sanctions, Western banks have become more vigilant about scrutinizing transfers and requiring more information from foreign banks, according to Lorber and other former Treasury Department officials.

The day-to-day effort to counter North Korea and other money launderers is a grueling contest, Lorber said. Shell companies can be set up quickly, in a matter of days, but it can take months or years to dismantle a laundering network, he said.

“It’s a constant game of cat and mouse and the illicit actors really do have sort of the advantage in terms of how they move money,” Lorber said.

Bank compliance departments are focused on ensuring their company abides by the law, but they are not designed to operate like law enforcement agencies, Griffiths said.

“The compliance departments are there to do as much as possible to avoid consequences on the way they conduct business.” Griffiths said.

“Looking forward — if North Korean sanctions implementation is going to be a science again, at some point, then the only way for the U.S. and the wider international community to succeed is to really harvest information” from banks in the United States and Europe.