Risky business

A System-Level Analysis of the North Korean Proliferation Financing System


Risky business

A System-Level Analysis of the North Korean Proliferation Financing System

Executive Summary

In this report, we conduct a system-level examination of the North Korean overseas financing and procurement system. We find that this system is centralized, limited, and vulnerable, and that its disruption should greatly increase the pressure on the Kim regime to return to the negotiating table.

North Korea employs a global array of overseas networks to circumvent international sanctions and continue its pursuit of nuclear weapons. These networks are engaged in schemes as diverse as cybercrime , military equipment sales , currency counterfeiting , narcotics , and even wildlife trafficking . They make up a complex overseas financing and procurement system designed to raise the funds and materials North Korea needs for its regime security and weapons programs. As sanctions have tightened, these networks have grown increasingly important to the regime. Moreover, they illustrate how North Korean officials have gained a deep understanding of international trade, finance, and transportation and how to nest their illicit activities within them.

In this report, we conduct a system-level examination of the North Korean overseas financing and procurement system. Our paper finds that this system is centralized, limited, and vulnerable, and that its disruption should greatly increase the pressure on the Kim regime to return to the negotiating table.

  • In Centralized, we examine key individuals and companies that connect networks from around the world. We discuss case studies of both regime “tactical controllers,” who conduct the operational tasks needed to move illicit goods, as well as “strategic chokepoints” through which these goods and their regime financing must flow.
  • In Limited, we explore trends within China-North Korea trade, the largest market exploited by North Korean overseas networks. Our data shows only 5,233 Chinese companies to have traded with North Korea from 2013 to 2016. Our analysis shows a small number of interconnected firms annually account for vast proportions of the trade, limiting the number of avenues in which North Korea can nest its illicit activity.
  • In Vulnerable, we analyze corporate structures and risk indicators that can be used to filter this data to identify potential dual-use transactions and networks of possible concern. Our priority lay in linking previously unidentified entities with known North Korean illicit actors to showcase the possibility of causing systemic disruption using targeted enforcement.

There is a need for immediate action. The North Korean regime is unpredictable and dangerous. Pyongyang is willing to sell conventional weapons to war torn countries around the world, employ chemical weapons to murder potential rivals, push for further development of nuclear weapons, proliferate nuclear technology to the Syrian regime, engage in cyber terrorism, and threaten both Washington, DC and Seoul with destruction. Chinese Foreign Minister Wang Yi recently characterized the atmosphere in the region as, “with swords drawn and bows bent,” (剑拔弩张). Devising effective strategies to disrupt and dismantle North Korean overseas networks that provide critical support to its weapons of mass destruction (WMD) and ballistic missile programs requires identification of key personnel and an understanding of organization, operations and methods of evading and adapting to sanctions. We intend for this report to be a first step in that direction.

Risky Business

Risky Business


Using public information, our study finds that the North Korean overseas regime financing and procurement system is centralized, limited, and vulnerable, and thus ripe for disruption.
+ Acknowledgments



David Thompson is a Senior Analyst with C4ADS covering East Asia and proliferation issues. He was the primary researcher and author of C4ADS’ September 2016 report In China’s Shadow and previously worked as a member of C4ADS’ Environmental Crimes Fusion Cell, investigating the role of transnational criminal organizations in environmental crime. David received his undergraduate degree in political science and Chinese language and literature from the George Washington University. He speaks Mandarin and has lived in China, studying at Peking University.


C4ADS would like to thank Bill Newcomb, a C4ADS fellow and former member of the UN Panel of Experts Sanctions Committee 1718; John Park of the Harvard Kennedy School; Catherine Dill of the James Martin Center for Nonproliferation Studies; Marcus Noland and Kent Boydston of the Peterson Institute for International Economics; Joshua Stanton, an attorney in Washington D.C.; Anthony Ruggiero of the Foundation for Defense of Democracies; and the many other individuals who generously provided advice and insight.

This research was funded by grants from an anonymous foundation and the Sejong Institute. Additionally, this report would not have been possible without C4ADS technology partners, whose software and systems were integral to the project’s success.



The mention of any individual, company, organization, or other entity in this report does not imply the violation of any law or international agreement, and should not be construed as such.

+ Foreword - William J. Newcomb, Former Finance Expert, UN Panel of Experts

It is tempting to many who write about North Korea to equate the striking Night Lights photo, which contrasts the bright lights of the South and nearby China with the darkness of the North, with an absence of information about the secretive country—calling it a “black hole.” To be sure North Korea is a ranking member of the short list of countries the Intelligence Community calls “Hard Targets.” There are few, and not very reliable, sources of data provided by North Korea itself, and for years useful knowledge about the North was hard won, especially on its nuclear, other WMD, and ballistic missile programs.

North Korea is not self-sufficient in supporting weapons programs development. It remains highly dependent on foreign sourcing of both sophisticated technology and mundane items like switches and relays. The DPRK’s procurement efforts, in large part, appear to be embedded in its overseas trade networks and to depend crucially on cooperative sources of supply and trusted intermediaries who help conceal North Korea’s involvement from unwitting suppliers and banks.

These overseas trade networks and their activities are knowable. Operating in business space, they leave tracks in the form of records, such as registration forms; lists of owners, directors and employees; purchases and sale of assets; leasing and mortgage documents; and quantities, amounts, and types of goods bought and sold. The very kind of information collected in a number of B-to-B databases.

When I worked on the United Nation’s Panel of Experts, we used data on North Korean-linked ships to construct and connect networks of its agents and collaborators embedded in the West. Hong Kong’s business registry was of significant help in this task, as shown in the reports provided by the Panel to the Security Council and available on the 1718 Committee website.

C4ADS launched its first investigation of DPRK overseas networks by building upon the Panel’s initial work on shipping and expanding it through exploitation of ownership and directorship records and identification of common links, such as street addresses, phone and fax numbers, and email addresses. Using recently developed network analysis tools, C4ADS broke new ground and in its first report on DPRK overseas connections, In China’s Shadow. It convincingly demonstrated how open-source research could not only be used to identify DPRK networks and their global footprint but also could provide evidence to materially assisted in bringing sanctions violators to justice.

The following report by C4ADS, its second on the DPRK’s overseas links, uses the same proven method to extend its research and identify other major networks, some of which may play a critical role in North Korea’s sanctions evasion efforts. Moreover, this new report provides a macro as well as a micro view of how these networks are organized and operate and, most importantly, locates their points of vulnerability. It should be of great assistance to international banks’ compliance efforts as well as to judicial authorities that have the legal tools to disrupt and dismantle networks and prosecute those involved who are providing internationally prohibited support to the DPRK’s WMD and ballistic missile programs.

This report is being released at a critical time. North Korea is speeding up the pace of its WMD and ballistic missile development programs. It is vital to take steps now to disrupt the North’s foreign sources of supply of technology and components. While information developed from classified sources and methods is crucial to understanding how the DPRK operates, it often cannot be utilized in legal proceedings to break up networks and prosecute participants. This report shows how open source research, carefully done and meticulously documented, can provide the needed leverage to put them out of business. I encourage its use to do so.

—William Newcomb, Former Member of the United Nations Panel of Experts on DPRK Sanctions

+ Methodology

This report reflects a three-month follow up investigation to C4ADS’ August 2016 report, In China’s Shadow. It aims to demonstrate the effectiveness of using open data to continue to map and expose North Korean overseas networks. Throughout this research, we have prioritized using official documentation whose source and credibility can be clearly established.

We began the investigation by building a baseline understanding of the roles and modus operandi of North Korean overseas networks based on case studies of some of the most significant enforcement actions in the past few years. These include of the seizure of the Jie Shun, the sanctioning of Dandong Hongxiang Industrial Development Co. Ltd., and the court case of Chinpo Shipping,. Throughout this process, we relied heavily on existing reporting, court documents, and public records to inform our findings on the nature and structure of the activity of these networks.

Next, we focused on the totality of reported trade with China, North Korea’s largest trading partner. We sought to identify companies that matched patterns we had previously identified during the course of our research. For key companies within this dataset, we used a wide range of global corporate, tax, property, maritime, and trade databases to map out their corporate holdings and activities. Where necessary, our findings were supplemented by native-language media, academic reporting, and expert interviews. Data from this expanded sample was structured within our Palantir Gotham network analysis platform.

Finally, key entities for focused investigations were identified based on patterns and trends found within the Palantir structured data. To expand the emerging networks, public records in East Asian countries, including corporate registries, court filings, and customs and trade data were primarily but not exclusively used. Wherever possible, the research priority lay in the identification of unsanctioned companies associated with North Korean sanctioned entities, which could represent indicators of ongoing proliferation activities and financing for North Korea.

There are some limitations in the report’s methodology. In many cases, there is no transaction-level financial data to confirm suspected illicit activity. In addition, a large portion of North Korean trade is not prohibited. As such, unless explicitly stated, the mention of any individual, company, organization, or other entity in this report does not necessarily imply the violation of any law or international agreement, and should not be construed as such.

+ Introduction

Sanctions levied against North Korea for its development and testing of nuclear weapons and ballistic missiles have failed to prevent the Kim regime from their continued development. In 2016 alone, the Kim regime tested a record two nuclear devices and 26 ballistic missiles or other systems using ballistic missile technology. While the international community has attempted to coerce the regime with “swift and tough” sanctions in 2006,“unprecedented” sanctions that had “teeth that will bite” in 2009, sanctions in which “the screws are beginning to turn” in 2013, and the “toughest and most comprehensive sanctions regime ever imposed by the [United Nations] security council” in 2016, it is likely that North Korea will soon flight test an intercontinental ballistic missile.

While the international response to date has not proven to be an effective deterrent against North Korean nuclear development, it is not for a lack of consensus. The destabilizing effect of North Korean progress in its weapons of mass destruction program has caused the international community to repeatedly voice its concern. While the resolve of the United States, South Korea, and Japan to denuclearize the Korean peninsula was never in doubt, recent North Korean weapons tests have further strengthened their coordinated trilateral alliance. Additionally, Russia called North Korea’s January 6, 2016 test of a hydrogen bomb a “flagrant violation of international law and UN Security Council resolutions.” China, North Korea’s only remaining ally, has clearly and repeatedly stated its desire for a denuclearized Korean peninsula proclaiming, “China is steadfast in its position that the Korean Peninsula should be denuclearized and nuclear proliferation should be prevented to maintain peace and stability in Northeast Asia.”

In the face of continued pressure and growing political will, the international community has struggled to understand how the Kim regime has remained steadfast in its development of WMD’s. The answer lies in large part with North Korea’s overseas networks, that have grown into a complex overseas financing and procurement system over the past decade, earning hard currency through reported schemes as diversified as sales of military equipment, cybercrime, printing of counterfeit currency, rhino horn smuggling, and narcotics trafficking. These networks have shown a deep understanding of how the systems of international trade, finance, and transportation work and, thus, how to nest their illicit activities within them. They have increasingly evolved into large-scale operations. C4ADS’ previous report, In China’s Shadow, profiled the Liaoning Hongxiang Group and identified how its parent company, Dandong Hongxiang Industrial Development Co. Ltd. had transacted over $500 million in trade with North Korea. Yet, the regime’s global reach is closely intertwined with the work of its intelligence services, North Korean agents in Malaysia recently murdered the half-brother of Kim Jong Un using chemical weapons, where a large-scale military equipment network, violating sanctions to raise hard currency for the regime, was discovered weeks earlier. These networks even extend as far as the United States. In 2015, a North Korean agent was convicted for attempting to buy night vision goggles from a federal agent in Hawaii. The man in question, Kim Song Il, had businesses in Hong Kong, China, and Russia, with at least two different Cambodian passports. His network was also reportedly instrumental in the shipment of military equipment from North Korea, through China, to the Angolan Navy—a potential violation of international sanctions.

That sanctions have not prevented the regime from reconsidering its position on its nuclear program is obvious. This study seeks to examine sanctions through the North Korean lens, looking to investigate the steps that the Kim regime is employing to nullify sanctions’ effects. The continuing misperceptions of North Korea as the “Hermit Kingdom” or “the most sanctioned country in the world,” are fueling the narrative behind the narrowing of non-military options on the Korean peninsula. In truth, the North Korean regime, far from being isolated, is globally active through its overseas networks. The impact of these misperceptions is considerable, most notably in the false belief that sanctions cannot succeed on a “closed” country like North Korea.

Many companies have been unwittingly exposed to North Korean proliferation activity because of the broad misunderstanding of North Korean infiltration of the licit commercial system of trade, allowing regime agents to thrive in an environment of obfuscation and uncertainty.

A concerted effort by the international community to target specific sanctions violating entities is needed to curb the North Korean WMD program. We intend to spearhead this effort. Using open source research and data, this report aims to provide system-level analysis to map how these networks operate today. In an increasingly constrained environment, North Korea’s options are limited, and although the system of North Korean sanctions evasion is adaptive, it is not necessarily flexible enough to overcome certain principles in the system’s design. Using public information, our study finds that the North Korean overseas regime financing and procurement system is centralized, limited, and vulnerable, and thus ripe for disruption.



North Korean overseas networks are centralized around key commercial facilitators who act as control nodes across multiple networks. As their role in illicit activity is uncovered, they often create new webs of shell and front companies to continue operations.
+ Tactical Controllers: Fan Mintian 范民田 and the Jie Shun

North Korean overseas networks have helped the regime circumvent sanctions for the past decade. However, they are comprised of a limited number of commercial facilitators and regime agents, who freely conduct business within the licit global commercial system. Because of the layers of shell and front companies they employ to hide their actual purpose, everything from procuring proliferation material, to selling sanctioned conventional weapons, to purchasing Hennessey, enough obscurity exists for them to operate mostly unaffected by international sanctions. This creates a situation where a centralized group of regime linked individuals can repeatedly conduct illicit behavior abroad on behalf of North Korea. This can be seen in no better example than that of the seizure of the ship the Jie Shun.

Intercepted on August 11, 2016 on route to the Suez Canal, the Jie Shun was seized with 30,000 PG-7 rocket propelled grenades and subcomponents hidden under a cargo of 2,300 tons of iron ore.

According to Egyptian authorities, the cargo, 132 tons of weapons in total, was entirely manufactured in North Korea. Ship tracking software available to C4ADS shows the ship leaving the North Korean port of Nampo on June 16, 2016 and making no additional port calls before being intercepted. According to the UN Panel of Experts, there was no indication of the ultimate destination of the cargo, however, North Korean rocket propelled grenades have been identified in Syria and Lebanon.

Figure 1: Voyage of the Jie Shun

(Top) One of the RPG’s seized from the Jie Shun. (Bottom Left) The ship made no additional port calls before being seized in Egypt. (Bottom Right) Details of the Jie Shun.

What is perhaps more striking than the shipment itself are the members of the network that sent it. The 2017 United Nations Panel of Experts report states that the holder of the document of compliance for the Jie Shun was a Chinese national named Fan Mintian 范民田. Mr. Fan, a veteran North Korean commercial facilitator, has played a role in multiple overseas networks, gaining his first mention in a United Nations Panel of Experts report in 2014 as an owner of Dalian Sea Glory Shipping.

In 2011, the company in question reportedly operated the ship MV Light, which was interdicted by the United States Navy, suspected of carrying missile components to Myanmar.

Another of Mr. Fan’s companies, V-Star Ships Ltd., was later referenced in the April 2016 court case of Chinpo Shipping in Singapore.

Chinpo Shipping provided financial assistance to the ship Chong Chon Gang, which was seized while transiting the Panama Canal transporting weapons from Cuba to North Korea. The company was charged with transferring “financial assets or resources that may reasonably be used to contribute to the [North Korean] nuclear related programs,” as well as carrying out unlicensed remittances. Court transcripts included emails sent by employees of Chinpo Shipping regarding an attempted payment to V-Star Ships Ltd. of US$41,560, cancelled for “compliance considerations” by Wells Fargo on July 9, 2013, six days before the Chong Chon Gang was seized.

Emails sent on July 11, 2013 in response to the cancellation state, “Please do not send us any instructions for outward and inward remittances to and from V-Star Ships Limited and Cuba so as to avoid being blacklisted.”

Figure 2: Fan Mintian Network Activity

Fan Mintian was active in networks surrounding some of the largest weapons seizures in North Korean sanctions history, including the Jie Shun and Chong Chon Gang, as well as the interdiction of the MV Light.

Mr. Fan is not an anomaly. The repeated use of the same commercial facilitator across multiple major weapons shipments is indicative of the limited nature of North Korean overseas networks and thus their potential vulnerability to large-scale disruption through the removal of specific tactical nodes within these networks. Unfortunately, to date, the ability of individuals involved in multiple instances of illicit North Korean weapons proliferation to openly move from network to network, even after repeated seizures, is telling of the lack of effective implementation and rigorous enforcement of UN Security Council sanctions measures. The case of the Jie Shun should be especially reprehensible given its implications. Repeated sales of weapons by North Korean overseas agents, potentially headed into some of the most conflict-ridden areas in the world, whose proceeds could be used to fund the development of the North Korean nuclear weapons, should be unacceptable to the international community.

+ Strategic Chokepoints: Dandong Hongxiang Industrial Development Co. Ltd.

While complex webs of shell and front companies can be used to obscure North Korean assets, the purchases they conduct on behalf of the regime require a centralized financing system. This financing must work outside the traditional North Korean banking system, which is now under significant scrutiny and pressure. To achieve this, North Korea has begun to increasingly rely on a small number of “gateway firms” based in foreign countries. Positioned overseas to avoid the restrictions of sanctions, these firms are vital to allowing North Korea to both monitor the funds being deployed for procurement, as well as to access the international financial system. The clearest example to date is that of the Liaoning Hongxiang Group 辽宁鸿祥集团 and its parent company, Dandong Hongxiang Industrial Development Co. Ltd (DHID) 丹东鸿祥实业发展 有限公司. DHID, now sanctioned by the US Treasury for acting on behalf of a sanctioned North Korean financial entity, had conducted over US$500 million in North Korea trade over the past five years and had nearly four dozen companies under the control of its Chairwoman, Ma Xiaohong 马晓红. These included companies specializing in trading and logistics, information technology, restaurants, hotels, shares in financial institutions, and Chinese-North Korean joint ventures.

Figure 3: Licit Business Model

It is important to first understand the unique role that Dandong Hongxiang Industrial Development, and the Liaoning Hongxiang Group, played in the broader system of China-North Korea trade. According to documents released by the Department of Justice in light of the action taken against the network, DHID described itself as, “an enterprise that conducts Sino-North Korea import and export,” that “accounted for more than 20% of market share.” It was able to satisfy procurement orders for North Korean government organizations and purchase hundreds of millions of dollars of North Korean commodities that it moved through domestic Chinese distribution channels.

In addition to its position as a large-scale trade firm on the border of North Korea, DHID played an additional, and likely much more valuable role for North Korea, as a means for the sanctioned North Korean financial institution Korea Kwangson Banking Corp. (KKBC) to access the global financial system. Designated since 2009 for its role in allegedly facilitating transactions for some of North Korea’s most notorious weapons proliferators, as part of North Korean banking’s foreign exchange infrastructure,

KKBC needed to maintain access to the international financial system, especially the US dollar, to pay its various counterparties around the world. Department of Justice documents state, “DHID Entities served as financial intermediaries for US dollar transactions between North Korea based entities who were financed by KKBC and suppliers in other countries to evade the restrictions on US dollar transactions.” The documents further state “that over two separate time periods...a total of US$11,127,580.60 was remitted to DHID through this KKBC account. Of which approximately $8,324,067.00 were cash withdrawals for DHID, and $2,803,513.60 were designated as wire transfers to DHID.”

To maintain records of KKBC in the broader set of DHID’s own financial documents, Department of Justice documents allege that DHID employed a “ledger system” to record transactions. This system, a parallel set of matching financial records held at DHID and KKBC, would likely allow for KKBC to settle the accounts of its various customers within North Korea without having to actually transfer money out of DHID host accounts. Court documents from the Chinpo Shipping court case in Singapore state that Chinpo was running a similar scheme, acting as a means by which North Korean entities could make payments to other parties. The documents reference a separate excel spreadsheet among the company’s financial documents in which Chinpo “kept track of [North Korean] deposits and payments.” In its ledger, Chinpo held sums varying from $3.6 million to almost $6.8 million between 2008 and 2012 on behalf of North Korean entities.

To complicate the trail leading back to KKBC, DHID maintained a number of front companies in countries around the world. All in all, the network consisted of 43 total business entities and was present in six business jurisdictions on four continents. Department of Justice documents state that DHID used at least 22 companies to engage in US dollar transactions, moving nearly US$75 million through the United States financial system. Far from being isolated, the scope of the network allowed sanctioned North Korean entities to conduct financial transactions that would appear to US and European correspondent banks as coming from companies based in the British Virgin Islands, Seychelles, England, Wales, or Hong Kong.

In spite of the steps taken to obfuscate transactions made on behalf of KKBC and the various levels of front companies employed, the system relied on DHID as its cornerstone. Its licit trading activities allowed for large transfers of value, via commodity sales, to come from North Korea, likely replenishing its DHID host accounts, and gave the regime a fleet of foreign flagged ships with which to send goods back. Since 2013, DHID imported over US$250 million in North Korean coal alone, and in that same time period sent nearly US$210 million of goods to the Kim regime. In addition, the ledger system allowed the Kim regime to monitor and control flows of money in and out of its accounts, maintaining its ability for centralized management of these funds.

Figure 4: Illicit Business Model

Targeted international action against entities like DHID strike at where the North Korean overseas financing system is most vulnerable, at key “chokepoints,” where licit and illicit activities converge. Firms playing a similar role to DHID should not be characterized as Chinese companies acting on behalf of the Kim regime, but rather as what they really are, North Korean regime assets assisting in the violation of international sanctions. Using loopholes and countermeasures, North Korea has been able to insert itself into border trade firms that act as proxies and enter the commercial system undisturbed. By targeting action against these host companies, as the US and China did in the case of DHID in September, 2016, the international community is doing more than simply freezing the assets of a single host. They are preventing the regime from accessing to the global financial system.

Figure 5: Dandong Hongxiang Global Network



China, the largest market exploited by North Korean overseas networks, represents about 85% of total North Korean trade. Yet, this entire trading system has consisted of only 5,233 companies from 2013 to 2016. Top firms by revenue in this dataset not only play a disproportionately large role, they also have begun to consolidate among themselves.
+ Macro - the trade system

North Korean overseas networks have been extremely adaptive to the combined pressures of international sanctions, in large part due to their ability to nest and disguise their illicit business within the licit trade. Like the cover material of iron ore over the RPG’s aboard the Jie Shun, or the dual role played by Dandong Hongxiang, the problem is particularly acute in the North Korean context where the state controls major aspects of the international trading economy. As early as 2006, former Undersecretary for Terrorism and Financial Intelligence Stuart Levey noted that, “the line between North Korea’s licit and illicit money is nearly invisible.” As North Korea has become ever more isolated internationally, it has had to confine nearly all of its trade to China. Data from 2016 shows that around 85% of total North Korean trade was conducted with China. According to Harvard-based North Korea specialist John Park, “what we are seeing now is the operation of sophisticated North Korean-run networks based in China.” In this relationship, North Korea has repeatedly taken advantage of the system of trade to conduct illicit activity nested within the licit system.

North Korea has repeatedly exploited the Chinese market to disguise its illicit activity. In the past, North Korean networks in China have reportedly shipped missile components to North Korea, used Chinese dual-use technologies in UAV’s, used Chinese vehicles for mobile missile launchers, and counterfeited Chinese currency. Using a variety of large-scale commodity exports, the regime found a receptive market in the growing Chinese economy, particularly the trade in anthracite coal, which made up over 46% of total exports in 2016 alone. While the ban on North Korean coal imports levied by China on February 18, 2017 has ostensibly halted Chinese imports of coal from North Korea, the regime’s nested trading infrastructure remains largely in place. “There are lucrative recurring business opportunities with elite North Korean state trading companies,” according to Park, “But the catalyst for the further development of sophisticated North Korean-directed networks is the private Chinese company.” These relationships are partly responsible for the development of black markets within North Korea, giving North Korean traders access to an expanding portfolio of foreign goods. Leveraging their unique position, many China-based, commercial facilitators branch heavily into other illicit networks. It should be noted that DHID-linked front companies were transacting heavily with the businesses of a formerly sanctioned Burmese regime crony, who was known to be a weapons facilitator for the junta.

Although the regime has seen a boom in the sale of natural resources in recent years, the increased sale of fewer and fewer commodities to a single country has left its system of trade progressively more vulnerable. Analysis reveals that the scope of licit trade, in which North Korea nests its illicit networks, is surprisingly small. According to trade records, from 2013 to 2016, there were only 5,233 companies within China that either imported goods from or exported goods to North Korea. To put that number in perspective, as of 2016, 67,163 Chinese companies exported to South Korea. Additionally, these 5,233 businesses are not all unique actors: many of them have subsidiary relationships with companies within the dataset. For example, the network surrounding the DHID, the Liaoning Hongxiang Group, was made up of 18 companies in China alone, many of which appear within the dataset as unique entities.

Figure 6: Total Reported North Korea-China Trade
Note: Trade relationships are from the perspective of Chinese companies

Figure 7: Number of Chinese Firms Trading with North Korea

Companies within this discreet dataset that are seeking to conduct illicit activities are likely to be subject to similar market forces as the Liaoning Hongxiang Group, and are likely to manifest those forces in similar network structures. By analyzing trade flows to isolate these networks, it may be possible to significantly increase the tempo of investigations and enforcement actions.

+ Micro: Corporate Oligopolies

While the number of firms doing business with North Korea is limited, a disproportionate share of that trade is centralized among an even smaller number of large-scale trading firms. This centralization is best seen in the trade data. According to trade records, the top ten importers of North Korean goods in China in 2016 controlled just shy of 30% of the market. Many of these companies have retained their market position for years. In 2016, five of the top ten Chinese exporters had been in the top ten for at least three of four years since 2013. For its part, Dandong Hongxiang Industrial Development Co. Ltd. appears on both the list of top importers and top exporters from 2013 to 2016, a position only shared by one other company, Dandong Qiancang Trading Co. Ltd. 丹东乾仓贸易有限公司. The limited number of companies dealing with North Korea on this scale annually suggests that these central companies have created a system in which dealing with the Kim regime carries high barriers of entry. This is an idea that has been explored in more detail by John Park:

“The primary driver for the development of North Korean-run networks is the monetization of political relationships. The head of the private Chinese company, acting as the node of a network, has become adept at clearing a pathway of potential obstacles by buying the services of local law enforcement officers and politically connected officials. In a short period of time, these actors have become full-fledged partners in the network.”

Figure 8: Chinese Companies Trading with North Korea by Trade Revenue
Points on the graph represent the trade revenue of the 5233 Chinese companies trading with North Korea.

Market Centralization: Dandong Zhicheng Metallic Material Co. Ltd. 丹东至诚金属材料有限公司** **

In 2016, a single company, Dandong Zhicheng Metallic Material Co. Ltd. 丹东至诚金属材料有限公司, reportedly accounted for 9.19% of total North Korean exports to China. Established in July 2005, just as North Korean coal exports began to increase as a percentage of total exports,

Dandong Zhicheng Metallic Material Co. Ltd. is a commodity company based in Dandong, China. The company’s archived website states that, as of April 6, 2016, it was recording annual sales of US$250 million, mainly of North Korean coal. This fact is recorded in trade data: 97% of the company’s imports were of North Korean coal. The company’s rapid growth and subsequent market position today is best described by a 2013 statement by one of the company’s traders, “The golden time for high profit has ended. It is now difficult to expand the market share further, and small players are out of the game.”

Since 2014, Dandong Zhicheng Metallic Material Co. Ltd. has reportedly been the top overall importer from North Korea in China.

While Dandong Zhicheng Metallic Material Co. Ltd. is the clearest example of centralization of China-North Korea trade, it is hardly the only one. Even discounting the fact that many of the firms contained within the dataset are subsidiaries of larger firms, top firms hold a unique position—regardless of the presence of illicit activity, international business at this volume with North Korea is unlikely to occur without interacting with the regime. Court transcripts from the Chinpo Shipping case repeatedly state as much, “there are no private companies in DPRK. All companies are state-owned.”

Figure 9: Centralization of Revenue within Chinese Companies Trading with North Korea
The graphs do not illustrate subsidiary relationships between companies in the dataset. The lower portion of each graph represents ~99% of companies by revenue trading between China and North Korea.

  Figure 10: DHID-Dandong Kehua Economic Trade Co. Ltd. Joint Venture  The Chinese business registry filing for Dandong Hongri Diandang Co. Ltd. clearly shows its status as a joint venture between DHID and Dandong Kehua Economic Trade Co. Ltd.

Figure 10: DHID-Dandong Kehua Economic Trade Co. Ltd. Joint Venture
The Chinese business registry filing for Dandong Hongri Diandang Co. Ltd. clearly shows its status as a joint venture between DHID and Dandong Kehua Economic Trade Co. Ltd.

While statistical analysis of the dataset shows the influence of top firms on China-North Korea trade, the internal structure of their business networks reveals how truly limited these networks are. Once charted, not only do links between top firms become more apparent, but it becomes much more apparent that a very small number of key executives control a disproportionate share of the trade.

Many of the top importers and exporters have relationships with other top firms via joint ventures, shared directors, shareholders, or common identifiers (office addresses, phone numbers, email addresses, etc.). For example, the company Dandong Hongri Diandang Co. Ltd. 丹东鸿日典当有限公司 was formed via a joint venture between DHID and Dandong Kehua Economic Trade Co. Ltd. Both companies were additionally part of the “Northeast Asia Economic Trade Development Summit,” an event including five leading China- North Korea trade companies. These relationships, both formal and informal, are marks of an increasingly consolidating China-North Korea trade.

The extent of inter-connectedness among these firms is perhaps best seen in the network surrounding executives linked to Dandong Tianfu Trade Co. Ltd. 丹东天富贸易有限公司. Together they link seven firms that appear on top ten importer or exporter revenue lists between 2013 to 2016, including the previously mentioned Dandong Qiancang Trading Co., into a loose network via shared directors, shareholders, and business identifiers. The combined exports of these seven companies to North Korea from 2013 to 2016 was US$737,302,913, or 5.6% of total Chinese exports to North Korea over that period. Centered around the CEO of Dandong Tianfu Trade Co. Ltd., Zhang Ling 张玲, a Chinese Communist Party member, the group holds a commanding position. Much like DHID, the network encompasses a full suite of commodity, logistics, trade, and hospitality companies. As John Park observed, “While on the surface we may see shrubs, below are roots that are remarkably deep and interconnected with other root systems.”

Figure 11: Extended Tianfu Network
Entities on the graph are solely linked by management or shareholding relationships sourced from Chinese business registry filings.

Figure 12: Extended Tianfu Network by Shared Identifiers
Entities on the graph are connected by management and shareholding relationships, as well as through shared identifiers.



Centralized illicit networks nested within a limited number of firms means that targeting specific key nodes can have a disproportionate impact. Moreover, due to these nodes requiring the licit systems of trade, transportation, and finance to conduct core business operations, they are also visible and vulnerable to law enforcement action.
+ Avenues for Proliferation Procurement: High Risk Signals

The main objective of the North Korean sanctions program is to deny the proliferation of WMD and dual- use materials that could benefit the regime’s nuclear and missile programs. Although sanctions have greatly restricted avenues for North Korea-related trade, it is clear from repeated weapons testing that proliferation materials are circumventing these measures. This is, in large part, likely because of the ability of North Korean overseas networks to disguise these transactions within their much larger trade flows. By monitoring the specific trade flows that these companies conduct, in addition to analyzing the network structures of firms playing a central role in China-North Korea trade, it may be possible to identify signals of illicit activity. It should be noted that analysis of DHID flagged a potential shipment of aluminum oxide, a component used in uranium enrichment, among the company’s exports to North Korea as recently as September 2015.

The following Harmonized System (HS) codes, used to classify and define internationally traded goods, were provided by Catherine Dill, Senior Research Associate at the James Martin Center for Nonproliferation Studies, as goods that had a high potential for dual-use application in ballistic missile programs. While the list is not exhaustive, it does identify key dual-use components North Korea could use within its missile program. Further investigation is required to confirm the presence of any illicit activity.

  • 9306.90 – Bombs, grenades, torpedoes, mines, missiles and similar munitions of war and parts thereof
  • 9014.20 – Instruments and appliances for aeronautical or space navigation (other than compasses)
  • 8802.60 – Spacecraft (including satellites) and suborbital and spacecraft launch vehicles
  • 8803.90 – Parts for 8802.60
  • 8526.10 – Radar
  • 8412.10 – Reaction engines other than turbo-jets
  • 8411.11 – Turbo-jets: Of a thrust not exceeding 25 kN
  • 8526.91 – Radio navigational aid apparatus
  • 8463.90 – Other machine-tools for working metal or cermet’s, without removing material
  • 6815.10 – Non-electrical articles of graphite or other carbon
  • 2825.10 – Hydrazine and hydroxylamine and their inorganic salts
  • 3801.10 – Artificial graphite
  • 3801.90 – Preparations based on graphite or other carbon in the form of blocks, plates or other semi- manufactures

Searches for these HS codes within trade data of Chinese firms exporting to North Korea produced a rangeof interesting results:

  • In April 2014, Dandong Qiancang Trading Co. Ltd. was responsible for a shipment worth US$17,600 of HS code 8463.90. According to the James Martin Center for Nonproliferation Studies, items might include machine-tools for working metal or cermet, without removing material. These machines might be used in the production of specialized, precise components for military hardware, including items utilized in nuclear and ballistic missile development.
  • Similarly, in July 2015, DHID was responsible for a shipment worth US $2,529 of HS code 8463.90.
  • In April 2014, Dandong Stokers Trading was responsible for a shipment worth US $10,500 of HS code 8526.91. According to the James Martin Center for Nonproliferation Studies, types of items within this code might include navigation systems used in vehicles. It is possible that this category might contain guidance devices for ballistic missiles.

Trade data suggests that there are additional types of goods, including potential dual-use weapons components, being exported to North Korea. By isolating firms that have sent potential dual-use weapons technology to the regime, it may be possible to identify sanctions violators and the North Korean overseas networks that surround them.

+ High-Risk Networks: The Sun Sidong Network

The largest exporter of potential dual-use equipment in our sample, Dandong Dongyuan Industrial Co. Ltd. 丹东东源实业有限公司, sent North Korea a shipment of US$790,000 of radio navigational aid apparatus (8526.91) in June 2016. Experts at the James Martin Center for Nonproliferation Studies state that this type of equipment, “might include navigation systems used in vehicles. It is possible that this category might contain guidance devices for ballistic missiles.”

While the shipment itself may warrant deeper investigation and scrutiny from law enforcement, it is again the network around the company in question that is of greatest interest for the purposes of this investigation.

Chinese business records for the company state that Dandong Dongyuan Industrial Co. Ltd. is a general- purpose trading firm whose business scope includes the sale of automobiles, machinery, natural resources, and general household products. Its trade records indicate that it has exported to three countries: North Korea, the Democratic Republic of the Congo, and the United States. From 2013 to 2016, the company sent US$28,543,792 worth of material to North Korea. According to Chinese business registry filings, the majority shareholder, controlling a 97% stake, is a Chinese national named Sun Sidong 孙嗣东.

Figure 14: Sun Sidong Hong Kong Director Search
Hong Kong business registry director search results for Sun Sidong.

According to the Hong Kong business registry, Mr. Sun is also the owner of Jieshun Shipping Limited, a company that, according to Equasis shipping records, was the sole owner of the previously mentioned Jie Shun from April 14, 2012 to August 10, 2014.

On August 11, 2016, when the Jie Shun was seized carrying RPGs, the ship was owned by a Hong Kong-based company named Vast Win Trading Limited. Hong Kong business registry documents reveal that Vast Win Trading Limited is owned by a Chinese national named Sun Sihong 孙嗣红, a business partner of Mr. Sun’s. Sun Sihong additionally lists a residential address on her Hong Kong annual return of an apartment in the same complex as Mr. Sun. Further investigation is required to confirm familial ties between Sun Sidong 孙嗣东 and Sun Sihong 孙嗣红.

  Figure 15: Dongyuan Network  Network chart of business holdings of Sun Sidong and associates, including links to the  Jie Shun .

Figure 15: Dongyuan Network
Network chart of business holdings of Sun Sidong and associates, including links to the Jie Shun.

Exploitation of trading networks based out of Northeast China, as previously discussed, is common practice for North Korean overseas networks. What is more illustrative of the success of the North Korean regime’s sanctions countermeasures is their ability to penetrate other less familiar business jurisdictions around the world. In addition to companies in China and Hong Kong, Mr. Sun is also listed as the president of of a company based within the United States. This entity would allow Mr. Sun to transact with businesses around the world without any obvious ties to his China-based North Korea centric businesses. In principle, it would also provide him the ability to register for business services within the United States, including sending or receiving shipments, establishing bank accounts, or applying for employment visa’s.

Figure 16: Shared Identifiers Dongyuan to Zhicheng
Excerpts from Chinese business registry annual return filings showing shared email address used by Dandong Dongyuan Industrial Co. Ltd. and Dandong Zhicheng Metallic Material Co. Ltd.

Further investigation into the companies associated with Mr. Sun yielded much more than just a network of front and shell companies—it provided linkages via shared identifiers between his network and the largest Chinese importer of North Korean coal over the past three years, Dandong Zhicheng Metallic Material Co. Ltd. Included within the company’s business registry annual return information was an email address, This email address is linked to only four companies within the Chinese business registry, two owned by Mr. Sun and two, including Dandong Zhicheng Metallic Material Co. Ltd., owned by Chinese national Chi Yupeng 迟玉鹏. The fact that Dandong Zhicheng Metallic Material Co. Ltd. and Dandong Dongyuan Industrial Ltd., a company with linkages to the Jie Shun seizure, share common identifiers on their business registry information does not necessarily prove collusion or the existence of illicit activity. However, it demonstrates again what has been consistently apparent; that the limited North Korean trading system is much more inter-connected than it at first appears, and that, because of links to illicit actors, it may be vulnerable to systemic disruption in the face of targeted enforcement action.

  Figure 17: Dongyuan to Zhicheng  Network chart displaying links between Fan Mintian, the  Jie Shun , Sun Sidong and Dandong Zhicheng Metallic Material Co. Ltd.

Figure 17: Dongyuan to Zhicheng
Network chart displaying links between Fan Mintian, the Jie Shun, Sun Sidong and Dandong Zhicheng Metallic Material Co. Ltd.



Dismantling North Korea’s overseas illicit financing and procurement system is the most compelling means to coerce the regime to the negotiating table. The time for action is now.

International pressure and sanctions enforcement levied against North Korea have stumbled because of two key misconceptions. First, the system of North Korean financing and procurement is practically invisible, making it nearly impossible to expose. And second, the information needed to pressure the regime is unobtainable from the open source; therefore, unavailable to key stakeholders, such as banks, transportation companies, and much of law enforcement. Our study finds the opposite to be true. By being centralized, limited and ultimately vulnerable North Korean overseas networks are, by their nature, ripe for disruption.

The cases studies in this paper, while not comprehensive, were intended to highlight key trends and patterns which can help to guide decision-makers in understanding the operational capabilities of these networks and to hopefully design more effective global enforcement strategies. Cases such as Fan Mintian’s role in weapons trafficking highlight the extent to which the system is centralized around key entities and individuals, while the activities of entities such as Dandong Hongxiang reveal the extent to which the entire system relies on key logistical ‘chokepoints’ for its global centralized system of illicit finance. Moreover, as can be seen in its trading relationships with the Tianfu Group and Dandong Zhicheng Metallic Material Co. Ltd., the system is closely interconnected, and through connections to companies such as Dandong Dongyuan Co. Ltd., potentially exposed to, and facilitating, illicit activity. However, the entire system remains extremely vulnerable. The fact that a vast majority of North Korea’s trade activity, both licit and illicit, may be concentrated within just 5,233 companies makes the investigative work to map and expose these networks manageable. Additionally, these networks’ reliance on the licit systems of finance, trade, and transportation means they leave behind a digital trail within public records, and other data sources, and are acutely vulnerable to targeted sanctions.

Although to date economic coercion has been ineffective in persuading North Korea to abandon its pursuit of nuclear weapons, this does not mean it cannot work. On the contrary, targeted enforcement actions against key nodes within the system can have the effect of impacting multiple networks across multiple countries simultaneously, removing key functions, such as individuals or entities specialized in illicit finance and procurement, who cannot be easily replaced. Each action can individually increase the cost and complexity of sanctions evasion for North Korea, but if applied against a number of these key nodes simultaneously, they could, in theory, cause the entire overseas system to collapse. The 2016 indictment and forfeiture action against Dandong Hongxiang in September 2016 is an ideal example of such action. The action not only disrupted a major source of revenue for the North Korean government, but also an important gateway through which the broader regime banking sector was accessing the international financial system. For the U.S. government, it closed down a network moving known dual-use materials that could be used in North Korea’s uranium enrichment program, but for the Chinese government, it had the additional benefit of closing down an entity that was exposing the Chinese banking sector to significant reputational and material risk.

Dismantling North Korea’s overseas illicit financing and procurement system is the most compelling means to coerce the regime to the negotiating table. The time for action is now.