February 2024

2024 National 

Proliferation Financing

Risk Assessment 
Department of the Treasury

2024 National 

Proliferation Financing 

Risk Assessment 
2024 ◆ National Proliferation Financing Risk Assessment i

Table of Contents

EXECUTIVE SUMMARY ......................................................................... 1

THREATS ............................................................................................ 3

Russian Federation ..................................................................................... 3

DPRK .......................................................................................................... 4

Iran ............................................................................................................ 5

People’s Republic of China (PRC) .................................................................. 6

Syria .......................................................................................................... 7

Pakistan ..................................................................................................... 7

Non-state actors ......................................................................................... 7

VULNERABILITIES ............................................................................... 8

Economic Factors ....................................................................................... 8

Legal and Regulatory Factors ....................................................................... 9

CASE STUDIES ..................................................................................... 11

Part One: The “traditional” procurement 

and revenue-raising model .......................................................................... 12

Part Two: Cyber-Enabled Proliferation Financing: 

The “new” digital evasion model ................................................................. 18

EMERGING TRENDS ............................................................................ 23

Sanctions Evasion and State Complicity ....................................................... 23

New & Alternative Payment Infrastructure .................................................... 23

Emerging Technologies ............................................................................... 24

CONCLUSION ....................................................................................... 24

PARTICIPANTS .................................................................................... 26

SCOPE & DEFINITION ........................................................................... 27

METHODOLOGY ................................................................................... 28

LIST OF ACRONYMS ............................................................................. 30

APPENDIX: Recent Guidance/Alert/Advisory Documents......................... 31
2024 ◆ National Proliferation Financing Risk Assessment 1

EXECUTIVE SUMMARY

The 2024 National Proliferation Financing (PF) Risk Assessment (NPFRA) updates the United States’ two 

previous NPFRAs.1 In line with the Financial Action Task Force’s (FATF’s) PF risk assessment guidance,2

the United States finds that conducting an assessment to identify and better understand PF risk on 

a regular basis is essential to strengthen our ability to prevent individuals and entities from raising, 

storing, moving, and using funds, financial assets, or other economic resources in connection with 

the proliferation of weapons of mass destruction (WMD).3 This assessment was prepared according to 

Sections 261 and 262 of the Countering America’s Adversaries through Sanctions Act (P.L. 115-44) as 

amended by Section 6506 of the Fiscal Year 2022 National Defense Authorization Act (P.L. 117-81). 

Vulnerabilities identified in the 2022 NPFRA persisted over the review period.4 The size of the U.S. 

financial system, the centrality of the U.S. dollar in global trade, and the role of U.S. manufacturers in 

producing military and proliferation-related technology (including dual-use items) continue to make 

the United States a target of exploitation by PF networks. These structural vulnerabilities are mitigated 

to a significant extent by a strong culture of compliance with U.S. law5 by U.S. financial institutions and 

other private sector actors, though some gaps remain. Specifically, over the review period, the United 

States worked to finalize the implementation of the Corporate Transparency Act (CTA) to close gaps 

for collection of beneficial ownership information (BOI)6 that will aid in investigations involving shell 

and front companies. The varying levels of anti-money laundering (AML), countering the financing of 

terrorism (CFT), and countering proliferation financing (CPF) (AML/CFT/CPF) controls for the virtual 

asset sector globally, as well as some compliance deficiencies with U.S. Virtual Asset Service Providers 

(VASPs), also make the United States vulnerable to PF networks. 

Likewise, the threat actors the United States identified in 2022 still pose PF risks based on available 

intelligence and case studies provided by law enforcement. Over the review period, the United States 

has seen persistent efforts by PF networks, operating on behalf or at the direction of state actors, 

including the Russian Federation, Democratic People’s Republic of Korea (DPRK), Iran, the People’s 

Republic of China (PRC), Syria, and Pakistan, to exploit the U.S. financial system and other U.S. private 

sector actors to finance WMD proliferation. This activity includes both financing to procure goods for 

the purpose of developing WMD as well as revenue-raising that provides state actors the resources to 

1 Department of the Treasury, National Proliferation Financing Risk Assessment, (December 2018), https://home.treasury.gov/system/

files/136/2018npfra_12_18.pdf; Department of the Treasury, National Proliferation Financing Risk Assessment, (March 2022), https://

home.treasury.gov/system/files/136/2022-National-Proliferation-Financing-Risk-Assessment.pdf. 

2 FATF, Guidance on Proliferation Financing Risk Assessment and Mitigation, (June 2021), https://www.fatf-gafi.org/content/dam/

fatf-gafi/guidance/Guidance-Proliferation-Financing-Risk-Assessment-Mitigation.pdf.coredownload.inline.pdf, p. 7. This NPFRA 

also fulfills the requirements of FATF Recommendation 1, which requires all jurisdictions to “identify, assess, and understand 

the proliferation risks for the country.” FATF, International Standards on Combating Money Laundering and the Financing of 

Terrorism & Proliferation: The FATF Recommendations, (Updated February 2023), https://www.fatf-gafi.org/content/dam/fatf-gafi/

recommendations/FATF%20Recommendations%202012.pdf.coredownload.inline.pdf, p.10.

3 For a definition of WMD, see Crimes and Criminal Procedure, U.S. Code 18 (2001) § 2332a (c)(2)(A-D). 

4 From January 1, 2022 to January 1, 2024. 

5 For a more detailed description of the U.S. CPF legal and regulatory framework, see the 2022 NPFRA, pp. 2-3 and 16-17. 

6 In the context of legal persons, beneficial owner refers to the natural person(s) who ultimately owns or controls a customer and/or 

the natural person on whose behalf a transaction is being conducted. It also includes those natural persons who exercise ultimate 

effective control over a legal person. Only a natural person can be an ultimate beneficial owner, and more than one natural person 

can be the ultimate beneficial owner of a given legal person. 
2 2024 ◆ National Proliferation Financing Risk Assessment 

advance their WMD activities, in violation of international and/or U.S. law (i.e., evasion of financial or 

trade sanctions or export controls).7

Based on a review of the relevant data since 2022, two state actors—Russia and the DPRK—are the 

highest-risk threat actors and are highlighted because of the scope and sophistication of their illicit 

procurement and revenue-generation efforts: 

•	 Russia’s illegal, unprovoked, and unjustified full-scale invasion of Ukraine in February 2022 

cast a spotlight on its illicit procurement of a variety of goods and technologies with military 

applications, including delivery systems and dual-use items. As demonstrated by the case studies 

in this assessment, as well as recent U.S. government action, Russia continues to utilize complex 

transnational networks in Türkiye, the United Arab Emirates (UAE), the PRC, and other countries, to 

acquire much-needed technology and equipment for its war economy.8 In response, the United States 

and its allies and partners have launched an unprecedented multilateral effort to detect, disrupt, and, 

where possible, prosecute these activities.9 In December 2023, President Biden signed an Executive 

Order (E.O.) expanding Treasury’s authorities. The amendments to E.O. 14024 authorize sanctions on 

foreign financial institutions facilitating significant transactions relating to Russia’s military-industrial 

base.10 The 2024 NPFRA highlights how these networks targeted the U.S. financial system.

•	 The DPRK continued to conduct malicious cyber activity and deploy information technology (IT) 

workers to, at least in part, fund its WMD capabilities.11 This activity included efforts to illicitly raise 

revenue in fiat currency and virtual assets, including hacking of VASPs and, to a lesser extent, 

ransomware attacks.

•	 Russia and the DPRK have collaborated on arms purchases and military assistance in direct violation 

of United Nations Security Council Resolutions (UNSCRs). Specifically, the DPRK has provided 

military equipment and munitions to Russia for use in its full-scale invasion of Ukraine. The United 

States is concerned that, in exchange for such materiel, Moscow will provide military assistance to 

Pyongyang to expand its WMD program.12

7 FinCEN and BIS, “FinCEN and the U.S. Department of Commerce’s Bureau of Industry and Security Announce New Reporting Key 

Term and Highlight Red Flags Relating to Global Evasion of U.S. Export Controls,” (November 6, 2023), https://www.fincen.gov/

sites/default/files/shared/FinCEN_Joint_Notice_US_Export_Controls_FINAL508.pdf. 

8 Department of the Treasury, “Treasury Imposes Sanctions on More than 150 Individuals and Entities Supplying Russia’s MilitaryIndustrial Base,” December 12, 2023, https://home.treasury.gov/news/press-releases/jy1978. 

9 For relevant guidance and alerts released in response to Russia’s further invasion of Ukraine, see Appendix. 

10 Specifically, the new amendment to E.O. 14024 authorizes the imposition of U.S. sanctions on foreign financial institutions 

that are either (1) facilitating significant transactions on behalf of persons designated for operating in certain key sectors of 

the Russian economy that support the country’s military-industrial base; or (2) facilitating significant transactions or providing 

services involving Russia’s military-industrial base, including those relating to specific manufacturing inputs and technological 

materials that Russia is seeking to obtain from foreign sources. The White House, “Executive Order on Taking Additional Steps 

with Respect to the Russian Federation’s Harmful Activities,” (December 22, 2023), https://www.whitehouse.gov/briefing-room/

presidential-actions/2023/12/22/executive-order-on-taking-additional-steps-with-respect-to-the-russian-federations-harmfulactivities/. See the accompanying Compliance Advisory, Department of the Treasury, OFAC, “Guidance for Foreign Financial 

Institutions on OFAC Sanctions Authorities Targeting Support to Russia’s Military-Industrial Base,” (December 22, 2023), https://

ofac.treasury.gov/media/932436/download?inline. 

11 Department of the Treasury, “Treasury Targets DPRK Malicious Cyber and Illicit IT Worker Activities,” (May 23, 2023,) https://home.

treasury.gov/news/press-releases/jy1498.

12 Department of State, “U.S.-Japan-ROK Joint Statement Condemning DPRK-Russia Arms Transfer,” (October 25, 2023), https://

www.state.gov/u-s-japan-rok-joint-statement-condemning-dprk-russia-arms-transfers/. 
2024 ◆ National Proliferation Financing Risk Assessment 3

As with the National Risk Assessments for Money Laundering and Terrorist Financing, the 2024 NPFRA 

informs the forthcoming 2024 National Strategy to Combat Terrorist and Other Illicit Financing, which 

will discuss interagency progress on further strengthening the U.S. AML/CFT/CPF regime and will seek 

to assist individuals and entities subject to U.S. law in remaining vigilant against efforts to evade those 

laws through a variety of deceptive practices described in these assessments. These risk assessments 

also inform and complement the National AML/CFT Priorities issued by the Financial Crimes 

Enforcement Network (FinCEN).13

Threats

This section identifies the PF threat actors facing the United States and summarizes significant 

geopolitical and security developments since the 2022 NPFRA. State-sponsored or -affiliated actors 

continue to pose the most significant PF threat to the United States. Their WMD programs can leverage 

significant technical expertise to design and execute clandestine procurement and revenue-raising 

schemes at scale, even if they are subject to comprehensive multilateral and U.S. sanctions and export 

controls. 

Russian Federation 

Russia maintains the largest and most capable nuclear weapons stockpile in the world, as well as 

significant conventional capabilities, both of which it continues to expand and modernize.14 Russia’s 

unlawful invasion of Ukraine is the most significant geopolitical change since the 2022 NPFRA and 

has raised Russia’s PF threat profile. Because of heavy battlefield losses, Russia has engaged with 

close partners to replenish its stocks of conventional weapons. Those losses have also increased 

Russia’s reliance on nuclear, cyber, and space15 capabilities to maintain deterrence and project power 

elsewhere.16

Since February 2022, Russia has pulled back from its role or fully suspended its participation in certain 

international arms control and WMD mechanisms, including treaties. Russia has said it is suspending 

its participation in the New Strategic Arms Reduction Treaty (New START), which the United States has 

called legally invalid and irresponsible.17 The United States continues to certify that Russia is in breach 

of its commitments to the Chemical Weapons Convention, based on Russia’s use of chemical weapons 

in targeted assassinations, support for the Assad regime’s use of chemical weapons, and its ongoing, 

undeclared offensive chemical weapons program.18 In November 2023, Russia revoked its ratification 

of the Comprehensive Nuclear-Test-Ban Treaty, which prohibits any testing of nuclear explosive 

devices and is a cornerstone of preventing nuclear proliferation, a step condemned by the Secretary 

13 Department of the Treasury, FinCEN, “Anti-Money Laundering and Countering the Financing of Terrorism National Priorities,” 

(June 30, 2021), https://www.fincen.gov/sites/default/files/shared/AML_CFT%20Priorities%20(June%2030%2C%202021).pdf. 

14 Office of the Director of National Intelligence, 2023 Annual Threat Assessment, (February 6, 2023), https://www.odni.gov/files/ODNI/

documents/assessments/ATA-2023-Unclassified-Report.pdf, p. 14. 

15 DNI, Annual Threat Assessment, p. 15, for further discussion of the national security focused dynamics of Russia’s focus on space. 

16 DNI, Annual Threat Assessment, p. 14. 

17 Department of State, “Russian Noncompliance with and Invalid Suspension of the New START Treaty,” (June 1, 2023), https://

www.state.gov/russian-noncompliance-with-and-invalid-suspension-of-the-new-start-treaty/. 

18 Department of State, Bureau of Arms Control, Verification and Compliance, 2023 Condition (10)(C) Annual Report on Compliance with 

the Chemical Weapons Convention (CWC), (April 18, 2023), https://www.state.gov/2023-condition-10c-annual-report-on-compliancewith-the-chemical-weapons-convention-cwc/.
4 2024 ◆ National Proliferation Financing Risk Assessment 

General of the United Nations as well as the United States.19 

Due in large part to the imposition of sanctions by the United States and its allies and partners, 

Russia faces a degraded ability to fund its defense priorities generally.20 Based on the case studies 

below, Russia has prioritized overseas procurement of goods and technologies it may not be able to 

source directly because of multilateral sanctions pressure targeting its military-industrial complex. 

This course of action directly implicates U.S. financial institutions and other private sector entities. 

As demonstrated by the case studies, in some instances this is because the goods themselves are 

produced in the United States, and the underlying transactions are with accounts held by U.S. 

businesses in U.S. financial institutions. In other cases, Russia may illicitly procure goods from other 

jurisdictions, in which case the transaction chain touches U.S. jurisdiction through correspondent 

accounts with U.S. banks. 

Russian PF networks leverage front and shell companies to place orders for needed components. 

These networks often then obfuscate the end-user and destination for the goods, routing shipments 

through third countries before they are ultimately delivered to customers in Russia. Recent U.S. 

designations highlight the multinational networks of illicit actors that participate in procuring goods 

for Russia’s military-industrial purposes.21

Russia’s Procurement Relationship with the DPRK and Iran 

As a direct consequence of its battlefield losses, Russia has sought out cooperative procurement 

relationships with other states of proliferation concern including the DPRK and Iran. These activities 

directly undermine the integrity of the global nonproliferation regime. With respect to the DPRK, 

the United States and its partners have accused Russia of violating numerous UNSCRs by procuring 

military equipment and munitions from Pyongyang.22 The United States has also accused Tehran of 

exporting Unmanned Aerial Vehicles (UAVs) in violation of UNSCR 2231 in support of Russia’s further 

invasion of Ukraine, though the United States has not linked this proliferation to the use of WMD.23

DPRK

According to the 2023 Director of National Intelligence (DNI) Annual Threat Assessment, the DPRK 

continued to augment its WMD capability over the review period, most publicly through the testing in 

2022 and 2023 of multiple types of Intercontinental Ballistic Missiles (ICBMs), including the use of such 

technology to launch a military satellite.24 According to the Intelligence Community, the Kim Jong-Un 

19 UN Secretary-General António Guterres, “Secretary-General Deeply Regrets Decision by Russian Federation to Revoke Its 

Ratification of Comprehensive Nuclear-Test-Ban Treaty,” (November 6, 2023), https://press.un.org/en/2023/sgsm22022.doc.htm; 

Secretary of State Antony J. Blinken, “Russia’s Planned Withdrawal of Its CTBT Ratification,” (November 2, 2023), https://www.

state.gov/russias-planned-withdrawal-of-its-ctbt-ratification/.

20 Rachel Lyngaas, Department of the Treasury, “Sanctions and Russia’s War: Limiting Putin’s Capabilities,” (December 14, 2023), 

https://home.treasury.gov/news/featured-stories/sanctions-and-russias-war-limiting-putins-capabilities. 

21 Department of the Treasury, “Treasury Hardens Sanctions with 130 New Russian Evasion and Military-Industrial Targets,” 

(November 2, 2023), https://home.treasury.gov/news/press-releases/jy1871. 

22 Department of State, Office of the Spokesperson, “U.S.-Japan-ROK Joint Statement Condemning DPRK-Russia Arms Transfers,” 

(October 25, 2023), https://www.state.gov/u-s-japan-rok-joint-statement-condemning-dprk-russia-arms-transfers/. 

23 Department of State, “The United States Imposes Sanctions on Russian Entities Involved in UAV Deal With Iran,” (December 9, 

2022), https://ua.usembassy.gov/the-united-states-imposes-sanctions-on-russian-entities-involved-in-uav-deal-with-iran/. 

24 DNI, Threat Assessment, p. 20; Secretary of State Antony Blinken, “Designating Supporters of DPRK Weapons Programs Together with 

Allies,” (November 30, 2023), https://www.state.gov/designating-supporters-of-dprk-weapons-programs-together-with-allies/. 
2024 ◆ National Proliferation Financing Risk Assessment 5

regime sees the possession of nuclear weapons as critical for its survival and to deter perceived threats 

from its neighbors and the United States. 

The DNI Threat Assessment noted that the regime will increase its use of methods like cyber theft and 

illicit trade to raise revenue to support its strategic priorities, including its WMD program. The U.S. 

government has cited public estimates of the revenue the DPRK has generated through these means. 

According to the UN Panel of Experts, the DPRK attempted to steal as much as $2 billion between 

2015 and 2019 through cyber means. According to private industry estimates, the DPRK stole up to 

$1.7 billion in virtual assets in 2022 alone. It is important to note that these are just estimates, as the 

nature of the activity means any figure will not incorporate all proceeds and may include revenue 

misattributed to DPRK-linked actors.25

The September 2023 report of the DPRK UN Panel of Experts documents Pyongyang’s ongoing access 

to the international financial system through overseas banking representatives, joint ventures, 

cooperative entities, and illicit business activities.26 In November 2023, OFAC announced the designation 

of eight individuals associated with DPRK state-owned weapons exporters, financial institutions, and 

front companies, including the Reconnaissance General Bureau, the DPRK’s main foreign intelligence 

agency, and the Foreign Trade Bank (FTB), the DPRK’s primary foreign exchange bank.27

Iran

The United States has continued to monitor Iran’s resumption of nuclear activities. According to 

the DNI Threat Assessment, Iran is increasing the size and enrichment level of its uranium stockpile 

and is conducting advanced centrifuge research and development.28 According to the International 

Atomic Energy Agency (IAEA), Iran has taken steps detrimental to the implementation of the NonProliferation Treaty Safeguards Agreement, including the withdrawal of designations of inspectors, 

which negatively impacts IAEA verification activities.29 However, the Intelligence Community assesses 

that Iran has not undertaken the key nuclear weapons development activities that would be necessary 

to produce a testable nuclear device, though its current research and development trajectory brings it 

closer to producing the fissile material for completing a device following a decision to do so. 

25 In April 2023, the United States, South Korea, and Japan released a statement condemning the DPRK’s WMD activities. United 

States Department of State, Office of the Spokesperson, Media Note (April 6, 2023), Joint Statement by the United States, the 

Republic of Korea, and Japan Special Representatives for the Democratic People’s Republic of Korea (DPRK), https://www.state.

gov/joint-statement-by-the-united-states-the-republic-of-korea-and-japan-special-representatives-for-the-democratic-peoplesrepublic-of-korea-dprk/. 

26 UN Panel of Experts, 1718 Committee, Midterm report of the Panel of Experts submitted pursuant to resolution 2683 (2023), 

(September 12, 2023), https://www.un.org/securitycouncil/sanctions/1718/panel_experts/reports. Generally, DPRK banking 

representatives are individuals working on behalf of or at the direction of a DPRK bank or financial institution. They are often 

working abroad and U.N. member states are obliged to expel such individuals, as their activity is a violation of UNSCRs. 

27 Department of the Treasury, “Treasury Targets DPRK’s International Agents and Illicit Cyber Intrusion Group,” (November 30, 2023), 

https://home.treasury.gov/news/press-releases/jy1938. 

28 DNI, Threat Assessment, p. 18. According to State Department statements, “The production of high-enriched uranium by Iran 

has no credible civilian justification and the reported production at the Fordow Fuel Enrichment Plant and the Pilot Fuel 

Enrichment Plant further carries significant proliferation-related risks.” Department of State, “Joint Statement on the Latest 

Iranian Nuclear Steps Reported by the IAEA,” (December 20, 2023), https://www.state.gov/joint-statement-on-the-latestiranian-nuclear-steps-reported-by-the-iaea/#:~:text=The%20production%20of%20high%2Denriched,carries%20significant%2-

0proliferation%2Drelated%20risks. 

29 IAEA, “IAEA Director General’s Statement on Verification in Iran,” (September 16, 2023), https://www.iaea.org/newscenter/

pressreleases/iaea-director-generals-statement-on-verification-in-iran-0. 
6 2024 ◆ National Proliferation Financing Risk Assessment 

In October 2023, the United Nations’ restrictions on Iran’s missile-related activities under UNSCR 2231 

expired. The United States and partner countries remain committed to countering Iran’s procurement, 

development, and proliferation of missiles, UAVs, and other military weapons. On October 18, 2023, 

the Departments of the Treasury and State jointly acted to sanction the actors involved in Tehran’s 

missile and conventional arms activities and issued accompanying guidance to alert persons and 

businesses globally to Iran’s ballistic missile procurement activities.30 The United States also joined 

46 other Proliferation Security Initiative countries in affirming their shared commitment to Iranian 

ballistic missile-related counterproliferation efforts, regardless of the status of UNSCR 2231.31

As referenced in the Russia threat section, the United States also remains focused on Iran’s acquisition, 

development, procurement, and proliferation of UAVs, which Tehran has provided to Russia, as well as 

affiliated groups in the Middle East. It has also done so to (1) Iranian-aligned militia groups in Iraq, who 

have used UAVs to attack US forces in Iraq and Syria, and (2) the Houthis in Yemen, who have used the 

weapons to conduct strikes inside Yemen and against countries in the region, including Saudi Arabia, 

the UAE, a likely attempt to strike targets in Israel, and against commercial shipping in the Red Sea.32

Iran relies on foreign procurement of critical components for its UAVs. 

People’s Republic of China (PRC)

The PRC continues to pursue its goal of building a military that can protect its territory and 

government, make it a preeminent player in regional affairs, offset U.S. military superiority, and project 

power globally.33 The PRC has clearly stated its ambition to strengthen its “strategic deterrent,” and 

continued throughout 2022 and 2023 to accelerate the modernization, diversification, and expansion 

of its nuclear forces, and develop its cyber, space, and counterspace capabilities.34 To support its 

military modernization efforts, the Intelligence Community assesses that the PRC and those acting on 

behalf of PRC governmental entities will continue to engage in economic espionage and cyber theft 

to acquire technology and know-how.35 Analysis from the Department of Defense (DOD) supports this 

view, pointing to “multiple U.S. criminal indictments since 2015 involving espionage by PRC nationals, 

naturalized U.S. citizens or permanent resident aliens from the PRC, as well as U.S. citizens, for their 

efforts to illegally acquire information and technology to advance [Chinese military] modernization.”36

30 Department of the Treasury, “Treasury Sanctions Actors Supporting Iran’s Missile and UAV Programs” (October 18, 2023), https://

home.treasury.gov/news/press-releases/jy1820#:~:text=WASHINGTON%20%E2%80%94%20Today%2C%20the%20U.S.%20

Department,missile%20and%20unmanned%20aerial%20vehicle%20. See the guidance at Departments of Commerce, DOJ, 

State, and Treasury, “Iran Ballistic Missile Procurement Advisory,” (October 17, 2023), https://www.justice.gov/d9/2023-10/2023_

iran_ballistic_missile_procurement_advisory_10-17_final.pdf. 

31 Department of State, “Joint Statement on UN Security Council Resolution 2231 Transition Day,” (October 18, 2023), https://www.

state.gov/joint-statement-on-un-security-council-resolution-2231-transition-day/. 

32 Departments of Commerce, Justice, State, and the Treasury, Guidance to Industry on Iran’s UAV-Related Activities (June 9, 2023), 

https://ofac.treasury.gov/media/931876/download?inline; U.S. Central Command, “Houthi Attacks on Commercial Shipping in 

International Water Continue,” (December 3, 2023), https://www.centcom.mil/MEDIA/PRESS-RELEASES/Press-Release-View/

Article/3605010/houthi-attacks-on-commercial-shipping-in-international-water-continue/. 

33 DNI, Annual Threat Assessment, p. 7. 

34 Department of Defense, 2023 China Military Power Report Fact Sheet, (October 19, 2023), https://media.defense.gov/2023/

Oct/19/2003323427/-1/-1/1/2023-CMPR-FACT-SHEET.PDF, p. 1.

35 DNI, Annual Threat Assessment, p. 9. 

36 DOD, Military and Security Developments Involving the People’s Republic of China, (October 19, 2023), https://media.defense.gov/2023/

Oct/19/2003323409/-1/-1/1/2023-MILITARY-AND-SECURITY-DEVELOPMENTS-INVOLVING-THE-PEOPLES-REPUBLIC-OF-CHINA.PDF, p. xii. 
2024 ◆ National Proliferation Financing Risk Assessment 7

Syria 

The United States and its partners continue to seek accountability for the Assad regime’s past use of 

chemical weapons.37 Syria’s capabilities have been built in part on illicit procurement and fundraising 

which, in the past, transited the U.S. financial system. This assessment does not include any case 

studies that demonstrate this activity during the review period, but U.S. financial institutions and 

other private sector entities should remain vigilant of the sanctions and export control risk arising 

from the activities of the Syrian government. 

Pakistan 

In testimony for the 2022 DNI Annual Threat Assessment, the Director of the Defense Intelligence 

Agency noted that Pakistan will continue to perceive nuclear weapons as key to its national survival in 

the face of neighboring India’s nuclear arsenal and conventional force superiority. To this end, Pakistan 

has continued its ballistic missile development. In October 2023, the United States, for the first time, 

imposed blocking sanctions under E.O. 13382 on three PRC-based suppliers to Pakistan’s ballistic 

missile program.38 While the PRC remains a key defense partner for Pakistan, individuals and entities 

acting on behalf of Pakistan have engaged in illicit procurement for specific U.S.-origin goods, violating 

relevant U.S. export control laws and where the underlying transactions have passed through U.S. 

financial institutions. 

Non-state actors

The 2018 and 2022 NPFRAs noted that the United States remains concerned about the efforts of 

terrorist groups and other non-state actors to acquire WMD capabilities. In November 2022, with 

significant support from the United States and like-minded countries, the UN Security Council renewed 

the mandate for UNSCR 1540, focusing on preventing the proliferation of WMDs, knowledge, or 

precursor material to non-state actors.39 In March 2023, the United States released a National Security 

Memorandum (NSM) on WMD Terrorism and Advance Nuclear and Radioactive Material Security.40

The NSM seeks to provide a framework to prevent non-state actors from acquiring WMD and related 

materials. To date, we have not assessed that those efforts have involved exploitation of the U.S. 

financial system, placing those activities outside the scope of this assessment. 

37 Department of State, “Joint Statement on OPCW Report Finding Syrian Regime Responsible for Chemical Weapons Attack in 

Douma, Syria on April 7, 2018”, (January 27, 2023), https://www.state.gov/joint-statement-on-opcw-report-finding-syrian-regimeresponsible-for-chemical-weapons-attack-in-douma-syria-on-april-7-2018/. 

38 Department of State, “United States Sanctions Entities Contributing to Ballistic Missile Proliferation,” https://www.state.

gov/united-states-sanctions-entities-contributing-to-ballistic-missile-proliferation/#:~:text=13382%20for%20having%20

engaged%2C%20or,weapons)%2C%20including%20any%20efforts%20to. See also the updates to the SDN List at Treasury, 

OFAC, “Balkans-related Designations and Designation Removal; Non-Proliferation Designations,” (October 20, 2023), https://ofac.

treasury.gov/recent-actions/20231020. 

39 UN, “Security Council 1540 Committee: Security Council Extends Mandate of Committee Monitoring Nuclear, Biological, Chemical 

Weapons for 10 Years, Unanimously Adopting Resolution 2663”, https://press.un.org/en/2022/sc15123.doc.htm. 

40 The White House, “Fact Sheet: President Biden Signs National Security Memorandum to Counter Weapons of Mass Destruction 

Terrorism and Advance Nuclear and Radioactive Material Security,” (March 2, 2023), https://www.whitehouse.gov/briefing-room/

statements-releases/2023/03/02/fact-sheet-president-biden-signs-national-security-memorandum-to-counter-weapons-ofmass-destruction-terrorism-and-advance-nuclear-and-radioactive-material-security/. 
8 2024 ◆ National Proliferation Financing Risk Assessment 

Vulnerabilities

Consistent with the findings of the 2018 and 2022 NPFRA, the case studies in the threats section 

demonstrate that weapons proliferators and procurement agents seek to illegally acquire U.S. 

technology, including dual-use items, and access to the international and U.S. financial system to 

disguise their payments for goods and services, or to raise funds to evade U.S. and UN sanctions to at 

least partially support WMD programs. This activity often involves the falsification of BOI, obfuscating 

end-user/end-use and ultimate destination, and is challenging to detect for both the public and private 

sector as shell and front companies are routinely used to either illegally acquire goods or to transship 

goods to a third country for diversion. More recently, some state actors, such as the DPRK, have 

resorted to illicit cyber activity and deployment of IT workers as additional revenue streams. These 

vulnerabilities were highlighted in the 2022 NPFRA, and threat actors continued to exploit them in the 

review period.

Economic Factors 

The U.S. financial system’s size, sophistication, stability, and openness makes it particularly vulnerable 

to misuse by illicit proliferation networks. The financial sector in the United States provides access to a 

broad range of financial services to private sector actors, including banks in foreign countries, through 

correspondent banking and other financial services relationships. While this access is important for 

promoting international commerce, trade, and overall economic growth, proliferators have exploited it 

to raise, store, move, and use funds. 

The preeminence of the U.S. financial system is due to the U.S. dollar’s status as the preferred currency 

for many functions of the global economy, especially for holding international reserves, serving its 

use as a “currency anchor,” and facilitating cross-border transactions.41 According to Federal Reserve 

analysis, the U.S. dollar is overwhelmingly the world’s most frequently used currency in global trade, 

accounting for 96% of trade invoicing in the Americas, 74% in the Asia-Pacific, and 79% in the rest of 

the world. Additionally, about 60% of international and foreign currency claims (primarily loans) and 

liabilities (primarily deposits) are U.S. dollar denominated. While other currencies have seen a relative 

increase in their share of these categories, the relatively stable dominance of the U.S. dollar means 

that a significant volume of global illicit procurement or sanctions evasion activity occurs in U.S. 

dollars and transits U.S. bank accounts. 

Industrial and technological factors also contribute to proliferation networks seeking to illicitly 

acquire goods from firms based in the United States. The United States has the largest defense 

sector in the world. According to the Congressional Research Service, the defense industrial base 

is generally understood to comprise all organizations and facilities that provide the U.S. DOD with 

materials, products, and services. The same analysis cites a figure from the National Defense Industrial 

Association that this universe includes nearly 60,000 companies employing approximately 1.1 million 

people as of 2021.42

41 Carol Bertaut, Bastian von Beschwitz, and Stephanie Curcuru, “The International Role of the U.S. Dollar: Post-COVID Edition,” 

Board of Governors of the Federal Reserve System, FEDS Notes, (June 23, 2023), https://www.federalreserve.gov/econres/notes/

feds-notes/the-international-role-of-the-us-dollar-post-covid-edition-20230623.html. 

42 Congressional Research Service, “Defense Primer: U.S. Defense Industrial Base,” (Updated April 17, 2023), https://crsreports.

congress.gov/product/pdf/IF/IF10548. 
2024 ◆ National Proliferation Financing Risk Assessment 9

Many of these firms produce high-quality military technology and dual-use items, including for export. 

Such arms sales and transfers are subject to robust controls, including a comprehensive export control 

regime administered by the Department of Commerce and with oversight by the Department of 

State and DOD. But as demonstrated in the case studies, PF networks pursue a variety of obfuscation 

techniques to evade those controls. These networks deliberately falsify export-related paperwork, 

including license applications, bills of lading, insurance, and other documentation, making it difficult 

for U.S. manufacturers to confirm the intent to divert items to improper end-users. 

Legal and Regulatory Factors 

As documented in the 2018 and 2022 NPFRAs, the United States maintains a robust legal regime for 

AML/CFT/CPF, sanctions, and export controls. All natural and legal U.S. persons must comply with 

OFAC and State Department sanctions and Department of Commerce export control regulations.43

Additionally, U.S. financial institutions and other entities with AML program requirements under 

the BSA must mitigate PF risk through the appropriate, risk-based implementation of their BSA 

requirements, including customer due diligence, transaction monitoring, and the filing of suspicious 

activity reports (SARs). 

Notwithstanding those strengths, previous NPFRAs also identified gaps in the U.S. AML/CFT/CPF 

framework that, based on case study analysis, contributed to the ability of proliferation networks 

to conduct their activity. While U.S. financial institutions generally have a strong track record of 

compliance with U.S. and UN sanctions, these gaps can make those efforts less effective or more 

difficult to implement. Therefore, U.S. authorities have prioritized new legislation, regulations 

(including recent rulemaking), and guidance to address or mitigate these gaps. 

Beneficial Ownership. Proliferation networks routinely create legal entities to obfuscate financial 

activity linked to states of proliferation concern.44 Domestically, since the Customer Due Diligence 

Rule became applicable in May 2018, the United States has required financial institutions to identify 

and verify the identity of the beneficial owners of companies opening accounts, and this BOI has been 

available to law enforcement agencies as appropriate. The United States, however, has not required 

companies formed or doing business in the United States to report BOI to the U.S. government. The 

CTA, enacted as part of the Anti-Money Laundering Act of 2020, established a legal framework for the 

U.S. government to require the reporting of BOI directly to FinCEN.45 

Specifically, the CTA requires certain U.S. and foreign companies registered to do business in the 

United States to disclose BOI to FinCEN. The CTA also requires FinCEN to build a secure, non-public 

43 OFAC sanctions compliance works on a strict liability standard. The presence of a strong compliance program can, depending on 

specific circumstances, reduce penalties associated with breaches of U.S. sanctions. Financial institutions are encouraged to consult 

the OFAC compliance commitments document. The Federal Functional Regulators promulgate regulations and conduct examinations 

of covered entities to ensure compliance with the BSA and examine for OFAC sanctions compliance. For a compendium of BSA 

information by relevant regulators, see Office of the Comptroller of the Currency, “Links to Other Organizations’ Bank Secrecy Act (BSA) 

Information,” (n.d.), https://www.occ.treas.gov/topics/supervision-and-examination/bsa/links-to-otherorgs-bsa-info/index-links-toother-organizations-bsa-info.html. On OFAC compliance, see Department of the Treasury, Office of Foreign Assets Control, A Framework 

for OFAC Compliance Commitments, (May 2, 2019), https://home.treasury.gov/system/files/126/framework_ofac_cc.pdf. 

44 2018 NPFRA, pp. 37-39; 2022 NPFRA, p. 24. 

45 This would be outside of what is collected under FinCEN’s CDD rule by financial institutions, such as banks and broker-dealers. 

https://www.fincen.gov/resources/statutes-and-regulations/cdd-final-rule#:~:text=The%20CDD%20Rule%20requires%20

these,Rule%20has%20four%20core%20requirements. 
10 2024 ◆ National Proliferation Financing Risk Assessment 

database to store the BOI and to disclose reported BOI to authorized government authorities and 

financial institutions subject to safeguards and controls. Pursuant to the final BOI Reporting Rule, 

implementing the reporting requirements of the CTA and effective January 1, 2024, FinCEN began 

accepting BOI. In parallel, in December 2023, FinCEN issued a final BOI Access Rule to establish who 

may request and receive BOI, how recipients may use it, and how they must secure it.46 This rule 

becomes effective on February 20, 2024. Considering the impact of the CTA, future risk assessments 

will continue to monitor the ability of proliferation networks to create legal entities in the United States 

considering the impact of the CTA.

Compounding the absence of a BOI reporting framework in the United States prior to January 1, 2024, 

the lack of effective implementation of the FATF standard related to beneficial ownership transparency 

for legal entities on a worldwide basis exacerbates PF risk as the inability of some jurisdictions to 

share this information naturally hinders cross-border investigations. According to the FATF’s Report 

on the State of Effectiveness and Compliance with the FATF Standards, only slightly more than half of 

countries have the necessary laws and regulations to understand, assess the risks of, and verify the 

beneficial owners or controllers of companies. Even fewer—9%—meet the effectiveness requirements 

of the relevant Immediate Outcome.47

Virtual Assets. PF networks often seek to exploit the lack of effective implementation of AML/CFT/

CPF measures for illicit finance through virtual assets across jurisdictions. Uneven (and often 

inadequate) regulation and supervision internationally allow VASPs and illicit actors to engage in 

regulatory arbitrage, which could potentially expose the U.S. financial system to VASPs with deficient 

or nonexistent AML/CFT/CPF controls operating abroad. Based on FATF assessments, jurisdictions 

are making limited progress (73 out of 98 jurisdictions rated as only partially or not compliant), and 

a FATF-administered survey found that many jurisdictions had not taken basic steps to assess risk or 

determine an approach to virtual assets.48

While VASPs in the United States are subject to AML/CFT/CPF and sanctions obligations, there are 

cases in which VASPs fail to comply with them. In some cases, VASPs may not implement AML/CFT/

CPF controls or other processes to identify customers, enabling misuse by illicit actors, including PF 

networks. Additionally, VASPs may perceive that they are not subject to U.S. regulatory requirements 

for AML/CFT/CPF based on their geographic location or the services they provide. As demonstrated 

by recent enforcement actions, including those referenced in the case studies section below and in 

the National Money Laundering Risk Assessment, some firms do not adopt AML/CFT/CPF programs to 

adequately mitigate risks within the sector. 

The United States also recognizes the risks posed by the extensive use of CVC mixing services by a 

variety of illicit actors throughout the world. In October 2023, FinCEN issued a notice of proposed 

rulemaking (NPRM) pursuant to section 311 of the USA PATRIOT Act that identifies international 

convertible virtual currency mixing (CVC mixing) as a class of transactions of primary money 

46 FinCEN, Beneficial Ownership Information Access and Safeguards, 88 FR 88732, (December 21, 2022), https://www.federalregister.

gov/documents/2023/12/22/2023-27973/beneficial-ownership-information-access-and-safeguards. 

47 FATF, Report on the State of Effectiveness and Compliance with the FATF Standards, (April 2022), https://www.fatf-gafi.org/content/

dam/fatf-gafi/reports/Report-on-the-State-of-Effectiveness-Compliance-with-FATF-Standards.pdf.coredownload.pdf. 

48 FATF, Targeted Updated on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers, (June 2023), 

https://www.fatf-gafi.org/content/dam/fatf-gafi/guidance/June2023-Targeted-Update-VA-VASP.pdf.coredownload.inline.pdf, p. 11. 
2024 ◆ National Proliferation Financing Risk Assessment 11

laundering concern.49 FinCEN identified CVC mixing as a primary money laundering concern in part for 

its use to launder proceeds of large-scale CVC theft and heists and support the proliferation of WMD, in 

particular, by the DPRK. FinCEN’s proposal would require covered financial institutions to implement 

certain recordkeeping and reporting requirements on transactions that covered financial institutions 

know, suspect, or have reason to suspect involve CVC mixing within the United States or jurisdictions 

outside of it.

Case Studies

The NPFRA, like the risk assessments for money laundering and terrorist financing, relies on a case 

study approach to describe the intersection of threats and vulnerabilities. This case studies section is 

divided into two parts. 

Part One describes activities that fit traditional PF typologies, where networks seek to acquire 

goods or raise revenue by exploiting financial institutions and products generally used in global 

commerce – such as open account wire transfers, where banks will process the transactions between 

two parties involved in the buying/selling of goods but otherwise will not have access to supporting 

documentation describing, for example, the nature and purpose of the transaction or the underlying 

goods or services changing hands.50 A critical component of these methods is the utilization of the 

maritime sector to facilitate the illicit movement of proliferation-sensitive goods or natural resources 

trade in violation of UN or U.S. sanctions. 

Part Two describes cyber-enabled proliferation financing, the digital revenue-raising model that 

previous risk assessments have also documented but that we describe more prominently here. In 

these cases, networks affiliated with states of proliferation concern use cyber capabilities, such as 

cyber-enabled theft or ransomware attacks, to raise and move money by conducting attacks on 

financial institutions, including VASPs.51 In the case of the DPRK, these activities are complemented by 

information technology (IT) workers who use fraudulent means to conceal their identities and contract 

out their services on digital platforms, earning income that would otherwise be legitimate if it were not 

for the underlying fraud and violations of DPRK-related sanctions. 

49 Department of the Treasury, FinCEN, “FinCEN Proposes New Regulation to Enhance Transparency in Convertible Virtual Currency 

Mixing and Combat Terrorist Financing,” (October 19, 2023), https://www.fincen.gov/news/news-releases/fincen-proposes-newregulation-enhance-transparency-convertible-virtual-currency. 

50 For more information on open account transfers and their role in trade transactions see Appendix IV of The Wolfsberg Group, 

ICC and BAFT Trade Finance Principles, https://library.iccwbo.org/content/tfb/pdf/trade-finance-principles-2019-amendmentswolfsberg-icc-baft-final.pdf, p. 69. 

51 FinCEN, “READOUT: FinCEN Hosts Public-Private Dialogue on Countering the DPRK's Illicit Cyber Activities,” (August 31, 2023), 

https://www.fincen.gov/news/news-releases/readout-fincen-hosts-public-private-dialogue-countering-dprks-illicit-cyber. 
12 2024 ◆ National Proliferation Financing Risk Assessment 

Part One: The “traditional” procurement and revenue-raising model

This part presents case studies of the “traditional” procurement and revenue-raising model, which 

is characterized by efforts of PF networks to mimic legitimate commercial trade.52 The 2022 NPFRA 

presented this activity in a series of case studies on (1) misuse of legal entities and (2) exploitation of 

the maritime sector. Based on private sector feedback on the overlap of this activity in PF schemes, 

those two sections are combined in this assessment. 

To disguise their activity as legitimate commerce, proliferation networks leverage corporate entities to 

gain access to financial services, including correspondent banking. While specific typologies will vary 

across networks, PF networks often create multiple front or shell companies in the United States and 

third-country jurisdictions. Once they create that financial structure, these networks will also exploit 

the maritime sector to either transport goods needed for a state’s proliferation efforts or to move 

commodities that generate revenue for such a program (as in the cases of the DPRK, Iran, and Russia, 

especially considering the G7+ imposed price cap).53 

Recent U.S. guidance and alerts, with typologies, red flags, and case studies, have informed this 

assessment. In November 2023, FinCEN and the Department of Commerce’s Bureau of Industry and 

Security released a Joint Notice on the global evasion of U.S. export controls.54 The Joint Notice 

provided an overview of how financial institutions, including those involved in the maritime sector and 

other entities conducting business with U.S. persons or U.S.-origin goods, should exercise vigilance 

against the financing of illicit procurement. Additionally, in December 2023, the Departments of 

Commerce, the Treasury, Justice, State, and Homeland Security released a Quint-Seal Compliance 

Note on “Know Your Cargo” best practices in the maritime sector.55 The Compliance Note offers 

potential indicators of sanctions and export control evasion and encourages transportation 

companies, maintenance companies, insurance providers, financial institutions, and other entities 

involved in cargo transport to adopt appropriate compliance measures to guard against deceptive 

practices, including those mentioned in the case studies below. 

52 For additional context see p. 17 of the 2022 NPFRA. 

53 Department of the Treasury, “Treasury Tightens the Price Cap with New Sanctions and Updated Guidance,” (December 20, 2023), 

https://home.treasury.gov/news/press-releases/jy2008. 

54 FinCEN and BIS Joint Notice, “FinCEN and the U.S. Department of Commerce’s Bureau of Industry and Security Announce the New 

Reporting Key Term and Highlight Red Flags Relating to Global Evasion of U.S. Export Controls,” (November 6, 2023), https://www.

fincen.gov/sites/default/files/shared/FinCEN_Joint_Notice_US_Export_Controls_FINAL508.pdf. 

55 Department of Commerce, Department of the Treasury, Department of Justice, Department of State, and Department of 

Homeland Security, “Quint-Seal Compliance Note: Know Your Cargo: Reinforcing Best Practices to Ensure the Safe and 

Compliant Transport of Goods in Maritime and Other Forms of Transportation,” (December 11, 2023), https://ofac.treasury.gov/

media/932391/download?inline. 
2024 ◆ National Proliferation Financing Risk Assessment 13

Russian Federation

November 2023 Russian Illicit Procurement Scheme

Criminal Prosecution

In November 2023, the Department of Justice (DOJ) announced the unsealing of an indictment and 

criminal complaint outlining charges in two separate criminal conspiracies related to the unlawful 

export of dual-use technologies to Russia. 

According to court documents, a Brooklyn, New York resident and two Canadian nationals were 

charged in a sanctions evasion and export control scheme. The defendants used two corporate entities 

registered in Brooklyn to facilitate the scheme and unlawfully source, purchase, and ship millions 

of dollars’ worth of dual-use electronics from U.S. manufacturers to sanctioned end-users in Russia. 

Two of the defendants allegedly purchased electronic components from U.S. manufacturers and 

distributors under the auspices of the two companies and arranged for the items to be sent to various 

locations in Brooklyn. They then unlawfully shipped the items to a variety of intermediary corporations 

located in other countries, including Türkiye, Hong Kong, India, China, and the UAE, where they were 

rerouted to Russia.

Separately, two individuals from St. Petersburg, Russia; and one individual from Brooklyn were 

charged with conspiracy and other offenses related to an export control scheme to benefit companies 

affiliated with the Russian military, including SMT-iLogic, a sanctioned56 Russian entity that has been 

identified as part of the supply chain for producing Russian military drones used in Russia’s war 

against Ukraine. The defendants allegedly used a corporate entity to facilitate their illegal export 

control scheme. According to court documents, between October 22, 2021, and February 22, 2022, 

corporate accounts controlled by one of the individuals allegedly received wire transactions from 

iLogic totaling approximately $273,000. These funds were then allegedly used almost entirely to make 

payments to a Brooklyn-based electronics distributor or to pay that individual’s credit cards, which he 

used to buy goods from the Brooklyn-based company. 

December 2022 Russian Illicit Procurement Scheme

Criminal Prosecution 

In December 2022, DOJ unsealed a 16-count indictment charging two U.S. nationals and five Russian 

nationals—including a suspected Federal Security Service officer—with conspiracy and other charges 

related to a global procurement and money laundering scheme on behalf of the Russian government 

in which the defendants allegedly conspired to obtain military-grade and dual-use technologies 

from U.S. companies. According to the indictment, these items included ammunition and the 

transfer of highly sensitive and heavily regulated electronic components, some of which can be used 

in the development of nuclear and hypersonic weapons, quantum computing, and other military 

applications. At the center of the procurement network was Serniya Engineering, a Moscow-based firm 

56 Department of the Treasury, “With Wide-Ranging New Sanctions, Treasury Targets Russian Military-Linked Elites and Industrial 

Base,” (September 14, 2023), https://home.treasury.gov/news/press-releases/jy1731. 
14 2024 ◆ National Proliferation Financing Risk Assessment 

that was already subject to U.S. sanctions57 and placed on Commerce’s Entity List58 for acting on behalf 

of Russian defense and intelligence entities. 

According to the indictment, the five individuals allegedly unlawfully purchased and exported 

highly sensitive and heavily regulated electronic components to Russia. To execute the scheme, the 

co-defendants allegedly created shell companies and associated bank accounts in the New York 

City area to route shipments and layer financial transactions. The U.S.-based co-defendants would 

then allegedly fabricate shipping documents and invoices, repackaging and reshipping items to 

intermediate destinations around the world before their ultimate arrival in Russia. According to the 

indictment, common transshipment points included Estonia, among other jurisdictions. Payments 

were also layered, with money being transferred to accounts in the names of shell companies held at 

different banks in jurisdictions throughout the world.

May 2023 Russian Illicit Procurement Scheme

Criminal Prosecution 

In May 2023, the DOJ unsealed a criminal complaint charging a Greek national with wire fraud 

conspiracy and smuggling. The defendant was head of a collection of defense and technology 

companies in the Netherlands and Greece. According to the complaint, since 2017 this individual 

had allegedly been involved in smuggling U.S.-origin military and dual-use technologies to Russia in 

violation of U.S. law. These highly regulated and sensitive components allegedly included advanced 

electronics and sophisticated testing equipment used in military applications, including quantum 

cryptography and nuclear weapons testing, as well as tactical battlefield equipment. As described in 

the complaint, the Russian end-users allegedly included Russian intelligence and military research and 

development entities. 

As alleged, the defendant conspired with a network of companies orchestrated by the Russian 

intelligence services to fraudulently acquire and then smuggle U.S.-origin military and dual-use 

technologies to aid the Russian defense and security sectors, by procuring sensitive equipment 

meeting NATO specifications designed for tactical battlefield conditions as well as components with 

applications in space-based and cryptographic communications. 

To further this illicit procurement scheme, the defendant allegedly signed false end-use statements 

and provided them to U.S. companies, certifying that the individual’s company was the end user of 

the requested items, and that the goods would not be reexported elsewhere or used for weapons 

development. 

57 Department of the Treasury, “Treasury Targets Sanctions Evasion Network and Russian Technology Companies Enabling Putin’s 

War,” (March 31, 2022), https://home.treasury.gov/news/press-releases/jy0692. 

58 Department of Commerce, Bureau of Industry and Security, Final Rule, Further Imposition of Sanctions Against Russia with the 

Addition of Certain Entities to the Entity List, (March 9, 2022), https://www.federalregister.gov/documents/2022/03/09/2022-04925/

further-imposition-of-sanctions-against-russia-with-the-addition-of-certain-entities-to-the-entity. 
2024 ◆ National Proliferation Financing Risk Assessment 15

 Iran 

December 2023 Iranian UAV Procurement59

Criminal Prosecution

In December 2023, DOJ unsealed an indictment charging an Iranian national and a PRC national with 

a scheme to procure U.S.-manufactured dual-use microelectronics for the IRGC’s UAV program. OFAC 

also sanctioned the Iranian national, as well as related individuals and entities based in Iran, Malaysia, 

Hong Kong, and Indonesia for their participation in the procurement network.60 The PRC national had 

been designated in October 2023.61

According to the DOJ press release, the defendants allegedly used a web of foreign front companies 

to illegally purchase and export from the United States to Iran dual-use microelectronics that are 

commonly used in UAV production, including high electron mobility transistors, monolithic microwave 

integrated circuit power amplifiers, and analog-to-digital converters. To effect this scheme, the 

defendants allegedly used the foreign companies to obfuscate the end-destination for the goods. 

For example, between June and September 2015, they caused an unwitting French company to 

purchase from a U.S. company several pieces of analog-to-digital converters with applications in 

wireless and broadband communications, radar and satellite subsystems, multicarrier, multimodal 

cellular receivers, antenna array positioning and infrared imaging. The PRC national then caused a 

division of the French company to ship the analog-to-digital converters to Hong Kong, where they were 

reexported to Iran.

United States v. Behrouz Mokhtari 62

Criminal Prosecution 

In July 2023, Behrouz Mokhtari was sentenced to 41 months in prison followed by three years of 

supervised release after pleading guilty to violating U.S. sanctions against Iran. According to his 

plea, Mokhtari used his management positions and/or maintained ownership control over multiple 

businesses in Iran and the UAE. He used this network of businesses to illegally provide services to 

Iranian entities, such as the refinement and transport of petrochemical products. Mokhtari and his coconspirators used the network’s bank accounts in the UAE to process these U.S. dollar transactions.

In a separate conspiracy lasting from about February 2013 until at least June 2017, Mokhtari and a 

number of Iranian nationals agreed to conduct illicit shipments of petrochemical products to and from 

Iran, utilizing his front company, East & West Shipping Inc., in Panama to do so.

In furtherance of the scheme, Mokhtari created a Panama-based front company, East & West Shipping 

Inc., to purchase two liquid petroleum gas (LPG) tanker vessels to transport Iranian petrochemical 

59 DOJ, “Iranian National Charged with Unlawfully Procuring Microelectronics Used in Unmanned Aerial Vehicles on Behalf of the 

Iranian Government,” (December 19, 2023), https://www.justice.gov/opa/pr/iranian-national-charged-unlawfully-procuringmicroelectronics-used-unmanned-aerial-vehicles. 

60 Department of the Treasury, “Treasury Targets Procurement Network Across Middle East and East Asia Supporting Iran’s UAV 

Program,” (December 19, 2023), https://home.treasury.gov/news/press-releases/jy2004. 

61 Department of the Treasury, “Treasury Sanctions Actors Supporting Iran’s Missile and UAV Programs,” (October 18, 2023), https://

home.treasury.gov/news/press-releases/jy1820. 

62 Department of Justice, “Virginia Man Sentenced to Federal Prison for Conspiring to Violate Iranian Sanctions,” (July 25, 2023), 

https://www.justice.gov/opa/pr/virginia-man-sentenced-federal-prison-conspiring-violate-iranian-sanctions. 
16 2024 ◆ National Proliferation Financing Risk Assessment 

products in international commerce on behalf of, and to benefit, Iranian entities associated with the 

Government of Iran. Mokhtari arranged for the sale of one of the vessels to be scrapped, with the funds 

sent to two bank accounts controlled by Mokhtari. Mokhtari ultimately used some of the proceeds to 

purchase a home in California.63

Mokhtari was ordered to forfeit approximately $2,862,598 in proceeds derived from his criminal activity 

as well as a residence he purchased in Campbell, California, for over $1.5 million using such proceeds.64

United States vs. Saber Fakih65

Criminal Prosecution 

In January 2022, an individual who had been based in the United Kingdom, Saber Fakih, pleaded guilty 

to violations of IEEPA and the Iranian Transactions and Sanctions Regulations arising from a scheme 

to export an Industrial Microwave System (IMS) and counter-drone system to Iran without having 

obtained an OFAC license. 

According to Fakih’s Statement of Offense, he agreed to provide to an Iranian national with an IMS 

system from an unnamed U.S. company. Saber Fakih acted as an intermediary to mask the Iranian 

national’s role in the scheme. That individual then arranged for money to purchase the IMS to be 

deposited into an account in the UAE, which was then sent in three wires through the United States to 

an individual in Canada, and then ultimately to the U.S. manufacturer. Based on instructions from his 

co-conspirators, Fakih misrepresented to the manufacturer that the IMS was destined for an end-user 

in Dubai, UAE. 

May 2023 Iranian Ballistic Missile Procurement

Criminal Prosecution 

In May 2023, the United States announced the indictment of a PRC national associated with Li Fangwei 

(a.k.a. Karl Lee)66 charging the individual with sanctions evasion, money laundering, and bank fraud 

offenses based on his alleged participation in a scheme to use Sinotech Dalian Carbon and Graphite 

Manufacturing Corporation (Sinotech Dalian), an OFAC-designated entity, to provide materials used 

in the production of weapons of mass destruction, specifically ballistic missile components, for Iran’s 

program. 

According to charging documents, between at least March 2019 and September 2022, the individual 

allegedly participated in a scheme to use Sinotech Dalian, including through transactions involving the 

U.S. financial system, to supply isostatic graphite, which is used in the manufacture of rocket nozzles 

and reentry vehicle nose tips in ICBMs, to Iranian entities. To obfuscate Sinotech Dalian’s role in this 

alleged scheme, the defendant allegedly created a bank account in the name of a front company, 

which received two transfers from a U.S. bank totaling over $15,000. 

63 Plea agreement, p. 5. 

64 Department of Justice, “Virginia Man Pleads Guilty to Conspiring to Violate Iranian Sanctions,” (January 9, 2023), https://www.

justice.gov/opa/pr/virginia-man-pleads-guilty-conspiring-violate-iranian-sanctions

65 Department of Justice, “Indictment and Guilty Plea Entered in Iranian Export Case,” (January 27, 2022), https://www.justice.gov/

usao-dc/pr/indictment-and-guilty-plea-entered-iranian-export-case. The statement of offense can be found at https://www.

justice.gov/d9/press-releases/attachments/2022/01/27/fakih_saber_-_statement_of_offense_-_jan_2022_0.pdf. Case reference: 

District of Columbia, 1:18-CR-00134-DLF. 

66 For more information on Karl Lee, see the 2018 NPFRA, p. 21. 
2024 ◆ National Proliferation Financing Risk Assessment 17

 Multiple Jurisdictions 

Toll Holdings67

Enforcement Action

In April 2022, OFAC entered a settlement agreement with Toll Holdings, an Australia-headquartered 

international freight forwarding and logistics company for apparent violations of multiple sanctions 

programs, including processing transactions involving the DRPK, Iran, and Syria. Toll Holdings caused 

nearly 3,000 payments through itself, its affiliates, providers, or suppliers to be processed by U.S. financial 

institutions for the benefit of sanctioned individuals or entities, or for the benefit of individuals or entities 

located in sanctioned jurisdictions. Toll’s compliance function did not have policies and controls in 

place commensurate with the complexity of its operations, which included almost 600 invoicing, data, 

payment, and other system applications spread across its various business units. 

According to the enforcement action, after one of Toll’s banks raised concerns over Toll’s compliance 

with U.S. sanctions, Toll tried to mitigate their risk exposure by ceasing all business with U.S.-

sanctioned countries as of June 2016. However, Toll did not implement the compliance policies and 

procedures necessary to prevent payments involving sanctioned persons, nor did it test whether 

shipments involved persons located in U.S.-sanctioned countries. It was not until February 2017 that 

Toll introduced additional controls to finally prevent shipments to or from sanctioned countries. 

MidFirst Bank68

Enforcement Action

In July 2022, OFAC issued a finding of violation to MidFirst Bank for violations of the Weapons of Mass 

Destruction Proliferators Sanctions Regulations. MidFirst Bank maintained accounts and allowed 34 

payments involving two individuals to be processed for 14 days after they had been added to OFAC’s 

List of Specially Designated Nationals and Blocked Persons (the SDN List). 

According to the Finding of Violation, MidFirst Bank staff misunderstood how their third-party vendor 

software handled screening the entirety of their customer database against the SDN List. The thirdparty vendor would screen the customer database once a month, and only do daily screenings for new 

customers, or existing customers who made certain changes to their account information (e.g., change 

of address). 

67 Department of the Treasury, OFAC, “Settlement Agreement between the U.S. Department of the Treasury’s Office of Foreign Assets 

Control and Toll Holdings Limited,” (April 25, 2022), https://ofac.treasury.gov/recent-actions/20220425. 

68 Department of the Treasury, OFAC, “OFAC Issues a Finding of Violation to MidFirst Bank for Violations of the Weapons of Mass 

Destruction Proliferators Sanctions Regulations,” (July 21, 2022), https://ofac.treasury.gov/media/924506/download?inline. 
18 2024 ◆ National Proliferation Financing Risk Assessment 

Part Two: Cyber-Enabled Proliferation Financing: The “new” 

digital evasion model69

As described earlier in the NPFRA, the DPRK continues to advance its illicit exploitation of new financial 

technology, including virtual assets to raise and move money. The 2018 and 2022 NPFRAs noted how 

the DPRK used, stole, and laundered virtual assets to fund its illicit weapons programs, and that 

activity has accelerated during the review period.70 According to U.S. government-issued advisories, 

DPRK cyber actors target a variety of organizations in the blockchain technology and virtual asset 

industry, including virtual asset exchanges,71 decentralized finance (DeFi) protocols, blockchain bridge 

developers, virtual asset trading companies, venture capital funds investing in virtual assets, and 

individual holders of large amounts of virtual assets or non-fungible tokens (NFTs).72 They also seek to 

exploit CVC mixing activities.

The DPRK has also developed an additional revenue stream by deploying IT workers. According to 

May 2022 Treasury, State, and FBI-issued guidance,73 the DPRK has dispatched thousands of highly 

skilled IT workers around the world (located primarily in Russia and the PRC) to generate revenue 

that contributes to its WMD and ballistic missile programs. These IT workers take advantage of 

existing demands for specific IT skills, such as software and mobile application development, to 

obtain freelance employment contracts from clients around the world, including in North America, 

Europe, and East Asia. In many cases, DPRK IT workers represent themselves as U.S.-based and/or 

non-North Korean teleworkers. The workers may further obfuscate their identities and/or location by 

subcontracting work to non-North Koreans. 

69 For enforcement actions involving VASPs with significant compliance deficiencies Treasury can conclude that if ordinary residents 

of comprehensively sanctioned jurisdictions like DPRK and Iran can access these platforms, governmental entities in those 

countries can and, in some cases based on reporting from other sources, do use them to move assets. This is directly applicable 

in the virtual asset context, as cybercriminals associated with both governments have conducted ransomware attacks, almost 

certainly demanding virtual assets as payment, and DPRK cybercriminals have stolen hundreds of millions of dollars’ worth of 

virtual assets.

70 FinCEN, “READOUT: FinCEN Hosts Public-Private Dialogue on Countering the DPRK’s Illicit Cyber Activities,” (August 31, 2023), 

https://www.fincen.gov/news/news-releases/readout-fincen-hosts-public-private-dialogue-countering-dprks-illicit-cyber. 

71 The use of the term “exchange” in this assessment does not indicate registration as such or any legal status of any such platform. 

This definition is for the purpose of the risk assessment and should not be interpreted as a regulatory definition under the BSA or 

other relevant regulatory regimes.

72 Cybersecurity and Infrastructure Security Agency, “TraderTraitor: North Korean State-Sponsored APT Targets Blockchain 

Companies,” (April 20, 2022), https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a. 

73 Department of State, Department of the Treasury, and the FBI, “Guidance on the Democratic People’s Republic of Korea 

Information Technology Workers,” (May 16, 2022), https://ofac.treasury.gov/media/923126/download?inline&_gl=1*sl1zci*_gcl_

au*MTkzNDc0OTQwOS4xNjk3NzMxMzA1.
2024 ◆ National Proliferation Financing Risk Assessment 19

 DPRK 

Maui ransomware74

Civil asset forfeiture complaint 

In July 2022, based on victim reporting from a Kansas medical center that was the victim of a neverbefore-seen ransomware variant, the DOJ announced a complaint to forfeit seized virtual assets paid 

as ransom to DPRK hackers or otherwise used to launder such ransom payments. In May 2022, the 

FBI filed a sealed seizure warrant for virtual assets, which was then worth approximately $500,000 

and hosted in the exchange accounts of PRC-based money launderers. A portion of the seized funds 

included virtual assets paid by the Kansas medical center, another health care provider in Colorado, 

and other victims in the United States and abroad.

Also in July 2022, the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the 

Department of the Treasury released a joint Cybersecurity Advisory to provide technical details on 

the Maui ransomware and provided recommended mitigation measures for those entities likely to be 

targeted to protect their critical infrastructure.75

April 2023 DPRK Money Laundering

Criminal Prosecution

In April 2023, the DOJ unsealed two indictments charging a DPRK FTB representative for his role in 

money laundering conspiracies designed to generate revenue for the DPRK using virtual assets. The 

individual allegedly conspired with two over-the-counter traders to launder stolen virtual assets and 

used funds to purchase goods on behalf of the DPRK government in U.S. dollars via Hong Kong-based 

front companies.

The individual was separately charged with a conspiracy involving various North Korean IT workers 

to launder the proceeds of illegal IT development work. These IT workers used fake personas to get 

jobs, including jobs at U.S. blockchain development companies. The workers asked to be paid in 

virtual assets, such as stablecoins, like USD Tether and USD Coin, which are pegged to the U.S. dollar. 

After receiving payment, the workers funneled their earnings back to North Korea through the FTB 

representative.

DPRK IT Workers Seizure76

Civil asset forfeiture complaint 

In October 2023, under a court order issued in the Eastern District of Missouri, the DOJ seized 17 

website domains used by DPRK IT workers in a scheme to defraud U.S. and foreign businesses, evade 

sanctions, and fund the development of the DPRK government’s weapons program.

74 DOJ, “Justice Department Seizes and Forfeits Approximately $500,000 from North Korean Ransomware Actors and their 

Conspirators,” (July 19, 2022), https://www.justice.gov/opa/pr/justice-department-seizes-and-forfeits-approximately-500000-

north-korean-ransomware-actors. 

75 Cybersecurity and Infrastructure Security Agency, “North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target 

the Healthcare and Public Health Sector,” (July 7, 2022), https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-187a. 

76 DOJ, “Justice Department Announces Court-Authorized Action to Disrupt Illicit Revenue Generation Efforts of Democratic People’s 

Republic of Korea Information Technology Workers,” (October 18, 2023), https://www.justice.gov/opa/pr/justice-departmentannounces-court-authorized-action-disrupt-illicit-revenue-generation. 
20 2024 ◆ National Proliferation Financing Risk Assessment 

As alleged in court documents, the DPRK dispatched thousands of skilled IT workers to live abroad, 

primarily in China and Russia. Once established, they acted to deceive U.S. and other businesses 

worldwide into hiring them as freelance IT workers. These workers used pseudonymous email, social 

media, payment platform and online job site accounts, as well as false websites, proxy computers located 

in the United States and elsewhere, and witting and unwitting third parties to generate millions of dollars 

a year on behalf of designated entities directly involved in the DPRK’s UN-prohibited WMD programs.

Certain DPRK IT workers designed the 17 seized website domains to appear as domains of legitimate, 

U.S.-based IT services companies, thereby helping the IT workers hide their true identities and location 

when applying online to do remote work for U.S. and other businesses worldwide. In reality, this specific 

group of DPRK IT workers, who worked for the PRC-based Yanbian Silverstar Network Technology Co. Ltd. 

and the Russia-based Volasys Silver Star, had previously been sanctioned in 2018 by Treasury.77

Coinciding with the announced website seizures, the DOJ also announced: (i) the court-authorized seizure 

of approximately $1.5 million in revenue from the IT Workers’ criminal scheme; and (ii) a partnership 

with the Republic of Korea and U.S.-based online freelance work and payment service platforms, which 

resulted in the shutdown of thousands of the IT Workers’ fraudulent accounts on those platforms.

 Multiple Jurisdictions 

Sinbad.io Mixer

Designation78

In November 2023, OFAC designated Sinbad.io (Sinbad), a virtual asset mixer that served as a key 

money-laundering tool for the Lazarus Group, a DPRK-sponsored hacking group. According to the 

OFAC press release, Sinbad processed millions of dollars’ worth of virtual assets that the Lazarus Group 

had stolen, including through the high-profile heists from Horizon Bridge, Axie Infinity, and Atomic 

Wallet. As with illicit mixers like Blender.io, which some industry experts believe to be a predecessor 

mixer, Sinbad operated on the Bitcoin blockchain and indiscriminately facilitated illegal transactions 

by obfuscating their origin, destination, and counterparties. 

August 2023 Tornado Cash Mixer 

Criminal Prosecution

In August 2023, the DOJ unsealed an indictment charging a Russian national and a Washington man 

with creating, operating, and promoting Tornado Cash, a virtual asset mixer that allegedly facilitated 

more than $1 billion in money laundering transactions, and laundered hundreds of millions of dollars 

for the Lazarus Group, the sanctioned North Korean cybercrime organization. The Tornado Cash 

service allegedly advertised to customers that it provided untraceable and anonymous financial 

transactions, and the defendants allegedly chose not to implement know-your customer or AML 

programs as required by law. Even after Treasury designated Tornado Cash in August 2022, the two 

individuals allegedly helped the Lazarus Group to transfer criminal proceeds from a virtual asset wallet 

that had been designated by OFAC as blocked property. Each individual is charged with one count of 

77 Department of the Treasury, “Treasury Targets North Korea-Controlled Information Technology Companies in China and Russia,” 

(September 13, 2018), https://home.treasury.gov/news/press-releases/sm481. 

78 Department of the Treasury, “Treasury Sanctions Mixer Used by the DPRK to Launder Stolen Virtual Currency,” (November 29, 

2023), https://home.treasury.gov/news/press-releases/jy1933. 
2024 ◆ National Proliferation Financing Risk Assessment 21

conspiracy to commit money laundering, one count of conspiracy to operate an unlicensed money 

transmitting business, and one count of conspiracy to violate the International Economic Emergency 

Powers Act. 

Bittrex79

Enforcement Action

In October 2022, OFAC settled with Bittrex, Inc., a Washington-based online virtual asset exchange 

and hosted wallet service for over $24 million for apparent violations of multiple sanctions programs. 

FinCEN separately settled with Bittrex for $29 million for willful violations of the BSA’s AML and 

suspicious activity report (SAR) reporting requirements. This was the first joint enforcement action 

undertaken by OFAC and FinCEN against a VASP. 

According to the OFAC enforcement action,80 Bittrex did not maintain any internal controls that would 

have prevented customers resident in sanctioned jurisdictions including the Russian-occupied Crimea 

region of Ukraine, Cuba, Iran, Sudan, and Syria from accessing its platform. For example, Bittrex did 

not screen for Internet Protocol addresses, which would have shown customers transacting on its 

platform from these jurisdictions. Neither did it use information the customers themselves provided—

such as physical addresses or passport information—that would have confirmed their presence in a 

sanctioned jurisdiction. Finally, Bittrex retained a third-party vendor who screened transactions for 

hits against OFAC’s SDN list and other lists but did not scrutinize customers or transactions for a nexus 

to sanctioned jurisdictions.

According to the FinCEN consent order,81 in addition to Bittrex’s sanctions compliance deficiencies, the 

company failed to maintain an effective AML program. Despite a significantly high transaction volume, 

Bittrex assigned two employees to manually review transactions for suspicious activity. The result was 

that Bittrex did not file a single SAR between 2014 and May 2017. The hiring of additional employees 

generated only one SAR between May 2017 and November 2017. Among other types of suspicious 

activity, Bittrex failed to identify transactions with darknet marketplaces like AlphaBay, Agora, and Silk 

Road 2, and did not report transactions connected to ransomware attacks. Finally, Bittrex failed to fully 

address the risks from certain anonymity-enhanced virtual assets. 

Binance82

Criminal Prosecution; Enforcement Actions

In November 2023, Binance Holdings Limited pleaded guilty and agreed to pay more than $4 billion 

to resolve DOJ’s investigation into violations related to the BSA, failure to register as a money 

transmitting business, and violations of IEEPA. Binance’s founder and chief executive officer, 

Changpeng Zhao, pleaded guilty to failing to maintain an effective AML program, in violation of 

79 Department of the Treasury, “Treasury Announces Two Enforcement Actions for over $24M and $29M Against Virtual Currency 

Exchange Bittrex, Inc.,” (October 11, 2022), https://home.treasury.gov/news/press-releases/jy1006. 

80 Department of the Treasury, OFAC, “Settlement Agreement between the U.S. Department of the Treasury's Office of Foreign Assets 

Control and Bittrex, Inc.,” (October 11, 2022), https://ofac.treasury.gov/recent-actions/20221011. 

81 Department of the Treasury, FinCEN, “Consent Order Imposing Civil Monetary Penalty,” (October 11, 2022), https://www.fincen.

gov/sites/default/files/enforcement_action/2023-04-04/Bittrex_Consent_Order_10.11.2022.pdf. 

82 Readers should cross-reference the relevant sections on Binance in the NMLRA and NTFRA. DOJ, “Binance and CEO Plead Guilty to 

Federal Charges in $4B Resolution,” (November 21, 2023), https://www.justice.gov/opa/pr/binance-and-ceo-plead-guilty-federalcharges-4b-resolution. 
22 2024 ◆ National Proliferation Financing Risk Assessment 

the BSA. As part of the plea agreement, Zhao resigned as CEO. Binance’s guilty plea was part of 

coordinated resolutions with FinCEN,83 OFAC,84 and the CFTC85 (as of this writing the SEC has pending 

charges against Binance).86 As part of the agreement, in addition to the monetary penalties, Binance 

agreed to retain an independent compliance monitor for three years and remediate and enhance its 

AML and sanctions compliance programs. 

As noted in FinCEN’s consent order and other related documents, due in part to Binance’s failure to 

implement an effective AML program, illicit actors used Binance’s exchange in various ways, including 

conducting transactions that obfuscated the source and ownership of virtual assets; transferring illicit 

proceeds from ransomware variants; and moving proceeds of darknet market transactions, exchange 

hacks, and various internet-related scams. 

As also noted in FinCEN’s consent order and other related documents, Binance also knew that U.S. 

sanctions laws prohibited U.S. persons—including its U.S. customers—from trading with its customers 

subject to U.S. sanctions, including customers in comprehensively sanctioned jurisdictions, such 

as Iran. Binance knew that it had a significant number of users from comprehensively sanctioned 

jurisdictions and a substantial number of U.S. users and that its matching engine would necessarily 

cause U.S. users to transact with users in sanctioned jurisdictions in violation of U.S. law. Nonetheless, 

Binance did not implement controls that would prevent U.S. users from trading with users in 

sanctioned jurisdictions. Because of Binance’s internationally weak implementation of its controls, 

between January 2018 and May 2022, Binance willfully caused over $898 million in trades between U.S. 

users and users ordinarily resident in Iran.87

Additionally, as noted in FinCEN’s consent order and other related documents, Binance users effected 

transactions with Iranian virtual asset exchanges without filing SARs: Binance user wallets effected 

a significant volume of direct transactions with various Iranian virtual asset exchanges, each worth 

more than $2,000, and in the aggregate worth the equivalent of over half a billion dollars. This total 

also includes several transactions with virtual asset wallets associated with sanctioned entities and 

individuals. No SARs were filed with FinCEN.88

83 Department of the Treasury, FinCEN, “In the Matter of : Binance Holdings Limited, Binance (Services) Holdings Limited, 

Binance Holdings (IE) Limited, d/b/a Binance and Binance.com, Number 2023-04, Consent Order Imposing Civil Money 

Penalty,” (November 21, 2023), https://www.fincen.gov/sites/default/files/enforcement_action/2023-11-21/FinCEN_Consent_

Order_2023-04_FINAL508.pdf. 

84 Department of the Treasury, OFAC, “Settlement Agreement between the U.S. Department of the Treasury’s Office of Foreign Assets 

Control and Binance Holdings, Ltd.,” (November 21, 2023), https://ofac.treasury.gov/recent-actions/20231121 .

85 CFTC, “Binance and its CEO, Changpeng Zhao, Agree to Pay $2.85 Billion for Willfully Evading U.S. Law, Illegally Operating a Digital 

Asset Derivatives Exchange, and Other Violations,” (November 21, 2023), https://www.cftc.gov/PressRoom/PressReleases/8825-23 .

86 SEC, “SEC Files 13 Charges Against Binance Entities and Founder Changpeng Zhao,” (June 5, 2023), https://www.sec.gov/news/

press-release/2023-101. 

87 “Binance and CEO Plead Guilty to Federal Charges in $4B Resolution.”

88 “In the Matter of: Binance Holdings Limited, Binance (Services) Holdings Limited, Binance Holdings (IE) Limited, d/b/a Binance 

and Binance.com, Number 2023-04, Consent Order Imposing Civil Money Penalty,” pp. 48-49.
2024 ◆ National Proliferation Financing Risk Assessment 23

Emerging Trends 

The United States maintains a strong legislative and regulatory framework to counter PF in direct 

response to the complexity of the proliferation threats and vulnerabilities discussed in this and prior 

NPFRAs. WMD proliferators and their procurement networks will continue to target the U.S. for its 

dual-use technology and will use a mix of existing and emerging trends to purchase and export such 

technology and goods. WMD state actors will also continue to target U.S. companies and individuals to 

raise revenue illicitly to support their programs. Russia’s need for military components to support its 

war in Ukraine sets a new stage in its relationship with the DPRK, accelerating PF threats. Other trends 

referenced below include the search for alternatives to reliance on the U.S. dollar for global trade 

and new technologies that may pose a proliferation risk. The United States will continue to target PF 

sanctions evaders and procurement networks, seeking new tools and skills as necessary as will be 

described in our policy response in the Illicit Finance Strategy. 

Sanctions Evasion and State Complicity 

As documented in the 2022 NPFRA, a significant volume of evasion activity that PF networks engage in 

is enabled by countries ignoring their responsibilities under relevant UNSCRs, which undermines the 

tenets of global arms control through the lack of effective implementation of international sanctions 

and export control requirements, or the broader measures required to prevent proliferation to nonstate actors under UNSCR 1540). The United States has previously publicly stated that Russia and the 

PRC have failed to hold the DPRK accountable for its multiple violations of UNSCRs related to ballistic 

missile testing.89 The review period saw persistent efforts by the Russian Federation to engage in 

bilateral arms deals with Iran and DPRK, which the United States assesses are violations of UN and/or 

U.S. sanctions. In the case of the DPRK, where the arms embargo is a cornerstone of the UN sanctions 

regime, the unwillingness of a permanent member of the Security Council to enforce undermines the 

credibility of international measures to restrict the DPRK’s development of WMD.90

New & Alternative Payment Infrastructure

The Treasury and its interagency partners are studying the potential risks from new and alternative 

payment systems, as some countries seek to develop strategies to avoid U.S. jurisdiction and 

evade U.S. sanctions specifically. These systems include the growth of local currency settlement to 

avoid dollar-clearing, the growth of alternatives to the Society for Worldwide Interbank Financial 

Telecommunication (SWIFT) payment messaging system, or the development of a Central Bank Digital 

Currency (CBDC).91 In its report on the Future of Money and Payments, Treasury documented how bad 

actors could evade U.S. sanctions using foreign CBDCs or virtual assets, including stablecoins.

89 According to U.S. Representative to the United Nations Ambassador Linda Thomas-Greenfield, “[S]ince the beginning of 2022, 

this Council has failed to live up to its commitments because of China and Russia’s obstructionism,” U.S. Mission to the United 

Nations, Remarks by Ambassador Linda Thomas-Greenfield at a UN Security Council Briefing on Nonproliferation and the 

Democratic People’s Republic of Korea,” (August 25, 2023), https://usun.usmission.gov/remarks-by-ambassador-linda-thomasgreenfield-at-a-un-security-council-briefing-on-nonproliferation-and-the-democratic-peoples-republic-of-korea/. 

90 U.S. Mission to the United Nations, “Remarks at a UN Security Council Briefing Called by Russia on Threats to International Peace 

and Security,” (August 25, 2023), https://usun.usmission.gov/remarks-at-a-un-security-council-briefing-called-by-russia-onthreats-to-international-peace-and-security-4/. 

91 Department of the Treasury, The Future of Money and Payments: Report Pursuant to Section 4(b) of Executive Order 14067, (September 

2022), https://home.treasury.gov/system/files/136/Future-of-Money-and-Payments.pdf. 
24 2024 ◆ National Proliferation Financing Risk Assessment 

However, Treasury continues to assess that U.S. adversaries would find it difficult to translate those 

alternative payment systems into an at-scale replacement for U.S. global financial leadership and the 

strength of U.S. currency because these systems could not replicate the foundations of U.S. strength, 

including strong economic performance; sound macroeconomic policies and institutions; open, deep, 

and liquid financial markets; institutional transparency; commitment to a free-floating currency; and 

strong and predictable legal systems.92

Emerging Technologies

As described in the National Biodefense Strategy, advances in life sciences and biotechnology, while 

offering multiple benefits for public health, can also bring new security risks from potential intentional 

misuse that require mitigation.93 Big data, artificial intelligence, and genomic modification, to take 

some examples, represent potential new threats from state and non-state actors. Potential adversaries 

could also use the same biological and chemical science advancements created to develop lifesaving medical countermeasures to develop new or enhanced agents. Technologies intended to 

reduce testing and production inefficiencies, such as biofoundries and additive manufacturing, create 

opportunities to reduce the development footprint and increase the number of proliferation pathways 

available to malign actors.94 The United States will remain vigilant of such misuse and whether illicit 

actors could misuse the U.S. financial system to develop or deploy these capabilities. It will also 

support the efforts of multilateral and international organizations to advance work in this area. 

Conclusion

Over the review period, the United States faced evolving efforts from PF networks associated with 

previously acknowledged states of proliferation concern. Two states in particular, Russia and the 

DPRK, presented a significantly higher threat. Russia’s ongoing illegal war in Ukraine has accelerated 

that country’s illicit procurement, including components produced in the United States. The DPRK 

has leveraged its significant malicious cyber activity capabilities and its deployment of fraudulent IT 

workers to raise revenue. 

Some vulnerabilities persisted from the two prior NPFRAs, including the size of the U.S. financial system, 

the centrality of the U.S. dollar in global trade, and the role of U.S. manufacturers in the production of 

military and proliferation-related technology (including dual-use items) continue to make the United 

States a target of exploitation by PF networks. These structural vulnerabilities are mitigated to a 

significant extent by a strong culture of compliance with U.S. law by U.S. financial institutions and other 

private sector actors, though some gaps remain. Specifically, over the review period, the United States 

worked to finalize the implementation of the CTA. The full implementation of the CTA will help facilitate 

law enforcement investigations and make it more difficult for illicit actors to hide behind anonymous 

shell companies created in the United States or foreign entities registered to do business in the United 

States. The varying levels of AML/CFT/CPF controls for the virtual asset sector globally and some 

92 Ibid., p. 34. 

93 White House, National Biodefense Strategy and Implementation Plan, (October 2022), https://www.whitehouse.gov/wp-content/

uploads/2022/10/National-Biodefense-Strategy-and-Implementation-Plan-Final.pdf. 

94 DOD, 2023 Strategy for Countering Weapons of Mass Destruction, (September 28, 2023), https://media.defense.gov/2023/

Sep/28/2003310413/-1/-1/1/2023_STRATEGY_FOR_COUNTERING_WEAPONS_OF_MASS_DESTRUCTION.PDF, p. 5.
2024 ◆ National Proliferation Financing Risk Assessment 25

compliance deficiencies with U.S. VASPs made the United States vulnerable to PF networks. 

In response to these vulnerabilities, the United States will continue to explore avenues to improve its 

AML/CFT/CPF regime. As documented in this NFPRA, the U.S. government has made significant progress 

on closing loopholes in the collection of BOI information through implementing the CTA, working 

domestically and through the FATF to improve AML/CFT/CPF compliance within the virtual asset sector, 

and communicating red flags and typologies associated with illicit procurement efforts through alerts 

and advisories. 

Given the devastating consequences to international peace and security that would arise from the use of 

a WMD, the United States will continue to identify additional measures to strengthen the U.S. CPF regime. 
26 2024 ◆ National Proliferation Financing Risk Assessment 

Participants

In drafting this assessment, the Department of the Treasury’s Office of Terrorist Financing and 

Financial Crimes consulted with staff from the following U.S. government agencies, who also reviewed 

this report:

•	 Department of Commerce

 Bureau of Industry and Security (BIS)

•	 Department of Defense (DOD)

 Office of the Under Secretary of Defense for Policy

•	 Department of Energy 

 National Nuclear Security Administration

•	 Department of Homeland Security

 Countering Weapons of Mass Destruction/Strategy, Plans & Policy

 Homeland Security Investigations

•	 Department of Justice (DOJ)

 Criminal Division

 Federal Bureau of Investigation (FBI)

 National Security Division

•	 Department of State

 Bureau of Economic and Business Affairs 

 Bureau of International Security and Nonproliferation 

•	 Department of the Treasury

 Financial Crimes Enforcement Network (FinCEN)

 Office of Foreign Assets Control (OFAC)

 Office of Intelligence and Analysis (OIA)

 Office of Terrorist Financing and Financial Crimes 

•	 Staff of the Federal Functional Regulators95

95 This includes staff of the Commodity Futures Trading Commission (CFTC), the Federal Deposit Insurance Corporation, the Board 

of Governors of the Federal Reserve System, the National Credit Union Administration, the Office of the Comptroller of the 

Currency, and the Securities and Exchange Commission. 
2024 ◆ National Proliferation Financing Risk Assessment 27

Scope & Definition

The United States continues to scope the NPFRA based on the FATF’s definition from its 2021 guidance 

on conducting PF risk assessments, where proliferation finance is defined as:

raising, moving, or making available funds, other assets or economic resources, or financing, 

in whole or in part, to persons or entities for purposes of WMD proliferation, including the 

proliferation of their means of delivery or related material (including both dual-use technologies 

and dual-use goods for non-legitimate purposes).96

In U.S. law, a WMD is defined as:

(A) any destructive device as defined in section 921 of 18 U.S.C. § 921;

(B) any weapon that is designed or intended to cause death or serious bodily injury through the 

release, dissemination, or impact of toxic or poisonous chemicals, or their precursors;

(C) any weapon involving a biological agent, toxin, or vector (as those terms are defined in 

section 178 of 18 U.S.C. § 178); or

(D) any weapon that is designed to release radiation or radioactivity at a level dangerous to 

human life;

As described further in the Vulnerabilities section, the NPFRA focuses exclusively on how proliferation 

networks working on behalf of nation-states exploit the U.S. financial system. This definition scopes in 

activities that the United States considers:

(1) illicit procurement, meaning the attempt to directly acquire goods, technology, or know-how 

as an input into a WMD program; as well as

(2) more indirect types of PF, which can generally fall under the rubric of revenue generation 

activity where proliferation networks, often operating on behalf or at the direction of states 

under comprehensive United Nations and U.S. sanctions, engage in illicit financial activity 

that generates proceeds that, in turn, support, directly or indirectly,97 WMD activities. 

Consequently, proliferation networks may commit offenses implicating U.S. anti-money 

laundering, sanctions, or export controls. 

This assessment is not a global PF risk or threat assessment. U.S. financial institutions and other U.S. 

businesses and individuals operating in foreign jurisdictions should complement their consultation of 

this risk assessment with other resources those jurisdictions may provide (including the jurisdiction’s 

own risk or threat assessments, guidance, and all relevant law and regulations governing AML/CFT/CPF). 

96 FATF PF Risk Assessment Guidance, p.8, footnote 7. 

97 As described in the case studies, in some cases individuals and entities may operate a couple of steps removed from those who 

are designated.
28 2024 ◆ National Proliferation Financing Risk Assessment 

Methodology

The 2024 NFPRA follows the FATF methodology,98 where PF risk is a function of the following:

•	 Threat: A threat refers to individuals or entities, or activity undertaken by those individuals and 

entities, with the potential to cause harm. The threats, which may include nation-state authorities, 

those acting under their control or on their behalf, or those wittingly or unwittingly supporting either, 

are the ones who exploit the U.S. financial system to move funds, assets, or other economic resources 

that could be used to: (1) directly acquire WMDs, their delivery systems, or the goods, technology, 

or know-how to allow them to build WMDs or their delivery systems, or (2) support a WMD program 

through a variety of revenue-raising activities. 

•	 Vulnerability: To acquire or expand their WMD capabilities, a threat actor must exploit aspects of a 

jurisdiction or a private sector entity to obtain components or financial services it would otherwise be 

prohibited from acquiring. These vulnerabilities may arise from weaknesses or loopholes in national 

laws or regulations, effectiveness issues impeding the ability of national authorities to properly 

investigate or disrupt proliferation networks, or unique circumstances that make a particular 

jurisdiction especially vulnerable to this kind of activity.

•	 Consequence: A consequence derives directly from a threat capitalizing on a vulnerability. In the 

context of PF, the consequence would be funds, assets, or other economic resources being made 

available to a proliferation network such that it can be used to acquire or augment a specific WMD 

capability.

•	 Risk is a function of threat, vulnerability, and consequence. It represents a summary judgment, 

considering the effect of mitigating measures, including regulation, supervision, and enforcement. 

Further in line with the prior assessments, the NPFRA is based on a review of public and private sector 

publications, government datasets,99 and analyses. Data collected are current as of January 31, 2024.100

These sources include the following: 

•	 A review of relevant Bank Secrecy Act (BSA) data collected by FinCEN that was potentially indicative 

of proliferation or sanctions evasion activity as seen by U.S. financial institutions101 as well as alerts 

and advisories derived from that data (see Appendix); 

•	 U.S. sanctions designations and enforcement actions related to WMD activity (including evasion by 

proliferating entities or states); 

98 The United States takes a broader view of PF risk than what the FATF Standards require and what the 2021 FATF PF Guidance 

conveys. That guidance restricts a consideration of threat, vulnerability, and consequence in the context of UN-targeted financial 

sanctions. The United States has a view of PF risk which includes both United Nations targeted financial sanctions and sectoral 

sanctions, as well as sanctions imposed under U.S. law, and restrictions imposed through U.S. export control authorities. FATF, PF 

Risk Assessment Guidance, p. 7, paragraph 11. 

99 As with prior assessments, the authors consulted classified sources of information to verify conclusions reached through a 

consultation of information available in the public domain. 

100 With respect to information collected from pending law enforcement cases, the charges in an indictment or similar charging 

documents are merely allegations. A defendant is presumed innocent until proven guilty beyond a reasonable doubt in a court 

of law. A seizure warrant is based on allegations. The government bears the burden of proving forfeitability in a civil forfeiture 

proceeding. 

101 For more information on BSA data please see Department of the Treasury, FinCEN, “What is the BSA Data?,” https://www.fincen.

gov/what-bsa-data. 
2024 ◆ National Proliferation Financing Risk Assessment 29

•	 Export control violation cases, particularly where a financing element related to WMD was present or the 

item being procured was identified as being controlled for WMD or military end-use or end-user reasons;

•	 Publicly available law enforcement documentation relating to criminal cases arising from WMD 

procurement or sanctions evasion, including prosecutions of money laundering cases in which the 

specified unlawful activity violated the International Emergency Economic Powers Act (IEEPA) and 

related regulations or relevant export control laws; 

•	 Civil and criminal asset forfeiture complaints related to property that had an alleged connection to 

WMD procurement or sanctions evasion; and 

Reports and analyses prepared by international organizations, including the United Nations and the 

FATF, think tanks, academic and research organizations, and media reporting.
30 2024 ◆ National Proliferation Financing Risk Assessment 

List of Acronyms

BOI Beneficial Ownership Information 

CBDC Central Bank Digital Currency 

CISA Cybersecurity and Infrastructure Security Agency 

CTA Corporate Transparency Act of 2021

CVC Convertible Virtual Currency 

DNI Director of National Intelligence 

DOD Department of Defense 

DPRK Democratic People’s Republic of Korea 

FATF Financial Action Task Force 

IAEA International Atomic Energy Agency 

ICBM Intercontinental Ballistic Missile

IEEPA International Emergency Economic Powers Act 

IMS Industrial Microwave System 

IRGC Islamic Revolutionary Guard Corps

IT Information Technology 

NSM National Security Memorandum

OFAC Office of Foreign Assets Control 

PF Proliferation Finance 

PRC People’s Republic of China

RGB Reconnaissance General Bureau 

SAR Suspicious Activity Report 

SDN Specially Designated National

SWIFT Society for Worldwide Interbank Financial Telecommunication 

UAE United Arab Emirates 

UAVs Unmanned Aerial Vehicles

UNSCRs United Nations Security Council Resolutions 

VASPs Virtual Asset Service Providers 

WMD Weapon of Mass Destruction
2024 ◆ National Proliferation Financing Risk Assessment 31

Appendix: Recent Guidance/Alert/Advisory Documents

December 2023 – Guidance for Foreign Financial Institutions on OFAC Sanctions Authorities Targeting 

Support to Russia’s Military-Industrial Base https://ofac.treasury.gov/media/932436/download?inline

November 2023 – FinCEN and the U.S. Department of Commerce’s Bureau of Industry and Security 

Announce New Reporting Key Term and Highlight Red Flags Relating to Global Evasion of U.S. Export 

Controls https://www.fincen.gov/sites/default/files/shared/FinCEN_Joint_Notice_US_Export_

Controls_FINAL508.pdf

October 2023 -Iran Ballistic Missile Procurement Advisory https://www.justice.gov/d9/2023-10/2023_

iran_ballistic_missile_procurement_advisory_10-17_final.pdf

September 2023 - FinCEN Analysis Reveals Trends and Patterns in Suspicious Activity Potentially Tied 

to Evasion of Russia-Related Export Controls https://www.fincen.gov/news/news-releases/fincenanalysis-reveals-trends-and-patterns-suspicious-activity-potentially-tied

July 2023 – U.S. Departments of Justice, Commerce, and the Treasury: Publication of Tri-Seal 

Compliance Note: Voluntary Self-Disclosure of Potential Violations, https://ofac.treasury.gov/

media/932036/download?inline

June 2023 – U.S. Departments of Commerce, Justice, State, and the Treasury: Guidance to Industry 

on Iran’s UAV-Related Activities https://www.justice.gov/d9/press-releases/attachments/2023/06/09/

iran_uav_industry_advisory_0.pdf

May 2023 – FinCEN & BIS Joint Alert, Supplemental Alert: FinCEN and the U.S. Department of 

Commerce’s Bureau of Industry and Security Urge Continued Vigilance for Potential Russian Export 

Control Evasion Attempts https://www.fincen.gov/sites/default/files/shared/FinCEN%20and%20

BIS%20Joint%20Alert%20_FINAL_508C.pdf

March 2023 - Departments of Justice, Commerce and Treasury Issue Joint Compliance Note on RussiaRelated Sanctions Evasion and Export Controls https://www.justice.gov/opa/pr/departments-justicecommerce-and-treasury-issue-joint-compliance-note-russia-related .

February 2023 – OFAC Fact Sheet: Disrupting and Degrading—One Year of U.S. Sanctions on Russia and 

Its Enablers, https://home.treasury.gov/news/press-releases/jy1298. 

October 2022 – U.S. Departments of the Treasury, Commerce, and State: Impact of Sanctions and 

Export Controls on Russia’s Military-Industrial Complex, https://ofac.treasury.gov/media/928856/

download?inline. 

June 2022 – FinCEN and the U.S. Department of Commerce’s Bureau of Industry and Security Urge 

Increased Vigilance for Potential Russian and Belarusian Export Control Evasion Attempts, https://

www.fincen.gov/sites/default/files/2022-06/FinCEN%20and%20Bis%20Joint%20Alert%20FINAL.pdf

March 2022 – FinCEN Alert on Real Estate, Luxury Goods, and Other High-Value Assets Involving Russian 

Elites, Oligarchs, and their Family Members, https://www.fincen.gov/sites/default/files/2022-03/

FinCEN%20Alert%20Russian%20Elites%20High%20Value%20Assets_508%20FINAL.pdf
32 2024 ◆ National Proliferation Financing Risk Assessment 

March 2022 – FinCEN Advises Increased Vigilance for Potential Russian Sanctions Evasion Attempts 

https://www.fincen.gov/sites/default/files/2022-03/FinCEN%20Alert%20Russian%20Sanctions%20

Evasion%20FINAL%20508.pdf

January 2022 – FinCEN Alert on Potential U.S. Commercial Real Estate Investments by Sanctioned 

Russian Elites, Oligarchs, and Their Proxies, https://www.fincen.gov/sites/default/files/shared/

FinCEN%20Alert%20Real%20Estate%20FINAL%20508_1-25-23%20FINAL%20FINAL.pdf
2024 ◆ National Proliferation Financing Risk Assessment 33