In partnership with
Remote hiring has created a new kind of exposure: the person on payroll may not be who you think they are. In this week's feature, find out where the sanctions risk actually begins, which warning signs are worth taking seriously, and what a smaller company can realistically check before the first paycheck goes out.
| In this issue | ||||||
|
Small businesses that adopted generative AI hired 7% more in their first year with it than firms that had not started, per Gusto, and the roles they added were mostly hands-on and customer-facing. On that pattern, adoption moves payroll toward the people who deliver what you sell.
Connecticut makes your salary range public Oct. 1
Starting Oct. 1, Connecticut employers have to put the wage range and a general description of benefits in every internal and external job posting. The rule comes from H.B. 5003, signed in May, and applies regardless of company size (Foley & Lardner, National Law Review).
Remote jobs can count too. If the position is outside Connecticut but reports directly to a Connecticut-based supervisor or worksite, the posting falls under the law. Benefits include health insurance, retirement, fringe benefits, paid leave and other compensation beyond wages.
You have to mean the range you post
Connecticut also changed what qualifies as a wage range. Instead of what an employer expects to rely on when setting pay, the law now uses the range the employer sets in good faith for the position. Applicants and employees can sue over violations, with a two-year window to bring a claim.
At 100 employees, there's another disclosure
Employers with 100 or more workers must create an employee guide covering at least 10 commonly used pay codes and explaining how those differentials work. It has to be available in English, Spanish and the most common language spoken by the workforce.
California, Colorado and New York already require wage ranges in job postings. Connecticut joins them Oct. 1.
Founder read: Your exposure may sit with the roles already filled. One new posting can reveal that market pay moved faster than your last compensation cycle, forcing managers to explain gaps they did not create and may not have authority to fix.
OpenAI makes every minute of a voice call billable
GPT-Live 1 reached general availability Sept. 10 at $0.05 per minute, billed by the second. That covers the live voice layer; backend models and tool calls used during the conversation are charged separately (OpenAI API changelog). Founder read: Watch the tail of the usage curve. A small group of users with long, tool-heavy sessions can change the economics of the feature long before overall usage looks alarming.
Microsoft can reject an AI ad after your export strips the evidence
Microsoft Advertising says advertisers are responsible for clearly disclosing AI-generated or materially altered content when required, placing the disclosure near the content and preserving watermarks, metadata and other provenance information. Ads can be rejected, restricted or removed for missing required disclosures or interfering with machine-readable provenance (Search Engine Land). Founder read: This is the kind of rule that exposes handoff risk. Design, agencies, ad ops and automated tooling can each touch the same file, and the metadata can drop at any of the four handoffs.
Some VCs now want departed founders below 2.5%
David Siegel, a partner at Grellas Shah, writes that many venture investors now insist that a departed founder own no more than 2.5% of the company. Standard four-year vesting can leave someone who departs with a much larger permanent stake, and Siegel says fights over getting that equity back can lead to six-figure litigation (Crunchbase News). Founder read: Founder departures are often treated like personnel events, but the cap-table consequences can sit dormant for years. They usually become expensive at the exact moment the company has the least time to negotiate them.
Some teams never seem to stop moving. They're on Attio, the agentic CRM.
Every customer signal is captured in one shared context layer, always current and compounding. Agents and workflows build pipeline, chase every buying signal, and move deals forward, an always-on revenue engine running alongside your team.
With Attio, you’ll get:
Leads automatically prioritised and routed to the right rep
Expansion and risk signals caught the moment they land
Follow-ups written in your voice, already there when you arrive
Teams like Parallel, Turbopuffer, and Wordsmith build on Attio. Are you one of them?
When a fake hire reaches payroll
A fake candidate can make it through your hiring process without creating a sanctions violation. The real problem begins when you start paying them.
Kraken had been warned.
Industry partners told the crypto company that North Korean hackers were applying for jobs across the sector. Then Kraken received a list of email addresses linked to the group. One of them matched an application already in its hiring system.
Kraken kept the candidate in the process.
On the recruiter call, the candidate joined under a name that wasn't on the resume, then changed it. Their primary ID appeared to have been altered, apparently using information stolen in an identity theft case two years earlier.
By the final round, Kraken wasn't conducting an ordinary interview anymore. Chief security officer Nick Percoco and several employees held what the company described as a casual chemistry interview. They asked the candidate to verify their location, hold up a government-issued ID and recommend some local restaurants.
Kraken later said it kept going "to learn more about their tactics at every stage of the process."
That worked because Kraken knew what it was looking at before anyone got hired.
For an employer that doesn't, the legal problem can begin with something far more routine: payroll.
The first paycheck changes the equation
Under 31 CFR 510.701(a), the civil penalty is tied to the transaction that forms the basis of the violation. The maximum is the greater of $377,700 or twice the amount of that transaction.
An interview creates no payment. Payroll does.
That leaves an important unanswered question for employers. Neither the regulation nor any source I found says whether repeated salary payments to the same worker would count as one violation or several.
There is at least one useful analogue. In its 2024 Vietnam Beverage action, OFAC treated 43 separate payments as 43 apparent violations. That wasn't an employment case, so it doesn't answer the payroll question. But it shows that OFAC can count repeated payments separately rather than treating an ongoing relationship as a single violation.
For a non-egregious case that a company voluntarily self-discloses, the base penalty is half the transaction value, capped at $188,850 per violation.
The civil provision also doesn't require the company to know it was dealing with a prohibited person.
A March 2024 compliance note from Commerce, Treasury and Justice says a person subject to U.S. jurisdiction "may be held civilly liable even if such person did not know or have reason to know" that a transaction was prohibited. Jenner & Block applied that same standard to an employer that unknowingly hired one of these workers in an Aug. 13, 2026 alert.
Criminal liability has a different threshold. The statute covers anyone who "willfully" commits, attempts, conspires or aids and abets a violation. The maximum penalty is $1 million, and a natural person can also face up to 20 years in prison.
A company can't go to prison. A founder or officer who acts willfully can.
The enforcement gap
That sounds severe. The enforcement record is more complicated.
Skadden wrote on June 8, 2026 that neither DOJ nor OFAC had brought an enforcement action against a company for inadvertently hiring one of these workers.
That doesn't amount to a safe harbor.
OFAC has repeatedly enforced the North Korea Sanctions Regulations in other settings. Vietnam Beverage Company Limited agreed to pay $860,000 in October 2024 after subsidiaries accepted U.S.-bank payments "for the sale of alcoholic beverages to North Korea." OFAC treated 43 payments as 43 apparent violations. Mondo TV settled for $538,000 four months earlier.
What OFAC hasn't published is a case penalizing an employer for hiring a North Korean IT worker.
The enforcement guidelines still matter. OFAC considers "the existence, nature and adequacy" of a company's risk-based compliance program, where relevant, along with factors such as willfulness and recklessness.
The appendix provides no safe harbor for employers that ran a hiring process and missed the fraud.
The hire that made it through
KnowBe4 did hire one.
At 9:55 p.m. EST on July 15, 2024, the company detected suspicious activity on the new employee's device. About 25 minutes later, it had contained the machine.
That tells us how quickly KnowBe4 responded after detection. It tells us less about how long the person could have remained inside the company without that alert.
KnowBe4 later published some of the warning signs it found: Voice over Internet Protocol numbers paired with little or no digital footprint for the contact information; mismatched addresses and dates of birth across sources; and conflicting personal details, including marital status and repeated "family emergencies" used to explain unavailability.
None of those proves fraud by itself.
Together, they give an employer something more useful than a stereotype: facts that can be checked.
Nobody knows the real odds
Kraken had an industry warning, a list of suspect email addresses, a chief security officer and enough staff to turn the interview into an investigation.
A 30-person company has the interview.
What it doesn't have is a reliable number telling it how likely this is to happen.
Fortune reported on Sept. 1 that hiring vendor Endorsed found North Korean patterns in 47% of U.S. remote IT applications it analyzed. But Fortune's description of the sample leaves a problem: read plainly, the 175,000 applications appear to be the flagged set pulled from a much larger corpus, rather than a neutral sample of remote IT applicants.
Endorsed hasn't published a methodology. It also sells the product that the number helps create demand for.
GetReal Security has reported a 41% figure, but that comes from a survey of 668 leaders at organizations with at least 1,000 employees.
Neither number tells a smaller employer its odds.
I couldn't find published data showing what share of victim companies are small or mid-sized, how long these workers typically remain undetected at companies that size, or what the financial loss looks like when one gets through.
What a smaller company can actually control
The guidance gets more concrete when it reaches the laptop.
Google's Mandiant team recommends verifying that a corporate laptop is "shipped to and subsequently geolocated where the individual reports to reside during onboarding." Skadden sends equipment only to the address on the worker's identity documents. Holland & Knight recommends verified addresses that require photo identification or in-person pickup.
Those steps check where the laptop goes first.
The FBI says the people supporting these schemes also offer "[r]eshipment of U.S. company laptops to North Korean IT workers overseas." The address on the shipping label can't tell you what happens to the machine after delivery.
Candidate screening creates another problem if the company starts using nationality, accent, surname or perceived ethnicity as a shortcut.
Holland & Knight's Aug. 26, 2026 employment alert recommends using "objective, articulable indicators of fraud or misconduct," including inconsistent location data, mismatched identity documents, suspicious remote-access tools, anomalous login activity, payroll-routing irregularities or refusal to appear on camera.
That distinction matters because Title VII covers employment decisions based on national origin and race, while the Immigration and Nationality Act includes protections involving citizenship status under 8 U.S.C. section 1324b.
The same alert recommends using "'soft' questions about claimed location and work history that are difficult to script." Kraken asked about local restaurants.
That can expose a bad story. It can also trip up someone who moved three weeks ago and doesn't yet know about the cool Thai place down the street.
Holland & Knight's more useful rule is procedural: apply the same screening to similarly situated roles based on legitimate security and access risks, then document the legitimate reason behind each decision.
A smaller company can't reproduce Kraken's operation. It can decide what evidence it checks before the laptop ships, which inconsistencies trigger a second look, who reviews them and what has to be resolved before payroll starts.
That's the part you still control before the candidate becomes a transaction.
Start at 22 minutes for the quota math. Reina set each rep's quota at 20 times base pay, which puts a rep on $100,000 at a $2 million target. Divide one of your reps' quotas by that rep's salary and see where you land. The ratio comes from a company selling enterprise deals, so it breaks at small contract sizes.
CJ Gustafson names the five files to pull before anyone models a number: current and open headcount rosters, this September's P&L, historical rep attainment, and the last 12 months of costs. A role you open in November and fill in January lands in both years' budgets, which is the trap he spends longest on. He writes from a CFO's chair, so scale it down.
Rob Litterst sorts AI features by what each call costs to run: bundle the near-free calls, meter the ones with real per-call cost, cap spend on expensive work, and price anything that replaces a person like headcount. If you are pricing an AI feature this quarter, this gives you a useful way to sort the problem. His examples are all large vendors.
The brief 330K+ marketers actually read
TLDR Marketing is the free daily brief that 330K+ growth marketers, performance marketers, and CMOs actually read. The most interesting stories in marketing, curated and summarized in 5 minutes.
I run The Pricing Reset, a six-week engagement for founders of sales-led B2B SaaS companies whose product has outgrown the pricing they set a few years ago. I rebuild the packaging, price points and discount rules, then help put the new pricing live on new deals so the team can run it without every exception landing on the founder.
The work continues through a 90-day measurement window, with check-ins at days 30, 60 and 90 and a final readout against the company's own starting numbers.
If your pricing has not kept pace with the product, book a 20-minute call at redwoodridge.net/book, or reply with your current pricing page. I'll tell you whether The Pricing Reset applies and, if it doesn't, what I'd look at instead.
Thanks for reading. See you next Wednesday.
— Jason
P.S. Hit reply and tell me: how much of your team have you met in person?
