The Multilateral Sanctions Monitoring Team (MSMT) is a coalition mechanism created in October 2024 by 11 like‑minded UN member states (Australia, Canada, France, Germany, Italy, Japan, Netherlands, New Zealand, Republic of Korea, United Kingdom, United States) after the UN’s DPRK sanctions Panel of Experts was disbanded. It is not a UN body. Its role is to monitor and report on violations and evasions of UN Security Council sanctions on North Korea, including by collecting and consolidating information from participating governments and private‑sector entities, analyzing patterns of sanctions evasion (such as cyber operations and overseas IT work), and publishing thematic reports that are then used by states and international bodies to improve enforcement and policy responses.
The MSMT differs from the former UN 1718 Committee Panel of Experts in three main ways: • Institutional status: the 1718 Panel was an official UN Security Council expert body supporting the DPRK sanctions committee; the MSMT is an ad‑hoc multilateral mechanism created by 11 states outside the UN after Russia vetoed renewal of the Panel’s mandate in 2024. • Mandate and authority: the 1718 Panel had a Security Council mandate to investigate and report on implementation of DPRK sanctions to the Council and its 1718 Committee; the MSMT has only the authority its member governments give it, and issues public reports rather than formal UN documents. • Membership and scope: the 1718 Panel’s work served all UN member states and was overseen by the Council; the MSMT is run by a self‑selected group of states, and so far has focused on specific themes (DPRK–Russia military cooperation and, in its second report, cyber and IT‑worker sanctions evasion) to help fill the “monitoring gap” left by the Panel’s disbandment.
According to public summaries of the October 22, 2025 MSMT report, North Korea uses several types of cyber and IT‑worker activity to evade UN sanctions, including: • Cryptocurrency theft and other cyber‑enabled financial theft by DPRK state‑linked hackers, with stolen funds used to support its weapons of mass destruction and ballistic‑missile programs. • Fraudulent overseas IT work, where DPRK IT workers hide their nationality, use false or stolen identities, and work through foreign front companies or intermediaries to earn hard currency, often via online freelance platforms. • Cyber espionage and other malicious cyber operations conducted by UN‑designated DPRK entities (such as the Reconnaissance General Bureau), which also help them evade the UN asset freeze. These activities generate and launder billions of dollars in violation of UN sanctions.
The MSMT itself has no independent legal or enforcement authority: it cannot impose sanctions, order asset freezes, or bring criminal cases. Its function is to monitor, analyze, and publicly report on violations and evasions of UN sanctions on the DPRK. Enforcement actions—such as adopting new UN measures, imposing national sanctions designations, or prosecuting individuals and entities—must be taken by states or by UN bodies acting within their own legal frameworks, often using MSMT findings as supporting information.
Public statements about the October 22, 2025 MSMT report indicate that it relies mainly on: • Information supplied by the 11 participating states (government intelligence, law‑enforcement, and sanctions‑implementation data) on DPRK cyber operations and IT‑worker schemes. • Information from private‑sector organizations, such as cybersecurity firms, financial institutions, and affected businesses, describing incidents of DPRK cyber theft, IT‑worker fraud, and related money‑laundering. • Consolidation and analysis of these inputs to map links between UN‑designated DPRK entities (for example, the Reconnaissance General Bureau) and specific cyber, cryptocurrency, and IT‑worker activities. Detailed internal methodologies beyond this consolidation of state and private‑sector reporting have not been publicly described.
The public can access both the full MSMT report and the January 12 briefing recording online: • MSMT report: The October 22, 2025 report, titled “The DPRK’s Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker Activities,” is available in multiple UN languages on the official MSMT website (msmt.info); governments’ joint statements link directly to it. • January 12, 2026 briefing recording: The U.S. State Department notes that a recording of the UN side‑event briefing on the second MSMT report is available online; the event is hosted on UN Web TV under the title “Multilateral Sanctions Monitoring Team (MSMT) 2nd Report…” and can be streamed publicly.