Table of Contents
The A7 sanctions evasion network is a Russia-linked shadow banking system that routed billions of dollars through global financial institutions using front companies, sub-agents, and falsified trade documents to evade sanctions imposed on Russia and Iran. A Financial Times investigation traced approximately $6.9 billion in payments through A7-associated entities over nine months from late 2024 through August 2025. Separately, U.S. authorities estimate that A7’s sub-agents processed more than $17 billion in USD-denominated transactions between January 2025 and June 2026.
These are not equivalent figures. The $6.9 billion reflects a specific sample of bank transfers identified in leaked internal A7 documents. The $17 billion is a broader U.S. government assessment covering a longer timeframe and additional types of flows, including trade-based laundering and settlement through digital assets.
For AML and sanctions professionals, the A7 case exposes critical blind spots: cross-border correspondent banking exposure, risk from intermediary companies in third country jurisdictions, the limits of name-based sanctions screening, and the difficulty of distinguishing ordinary commercial activity from illicit finance when trade documents are deliberately falsified. This article examines the network’s structure, financial mechanisms, regulatory response, and practical lessons for compliance teams.
What Is the A7 Network? Definitions, Timeline, and Core Allegations
The A7 Network is a purpose-built payment-settlement infrastructure founded in 2024 by Promsvyazbank (PSB), a state-owned Russian bank with close ties to the defence sector, and Ilan Mironovich Shor, a Moldovan oligarch sanctioned by the U.S., UK, and European Union. The core consists of three Russia-based entities-A7 LLC, A71 LLC, and A7 Agent LLC-which operate through a global web of shell companies and financial entities across at least 83 countries.
On October 1, 2026, OFAC designated the A7 Network as a significant transnational criminal organization under Executive Order 13581. The Treasury’s Office of Foreign Assets Control described the network as infrastructure explicitly used for sanctions evasion, money laundering, and support for the IRGC, Iran-backed groups, cybercriminals, and actors linked to North Korea. The A7 network helps facilitate Russian and Iranian financial activities on an industrial scale, with the network claiming to process over 2,000 transactions daily. According to U.S. government filings, A7 Network’s total transaction volume exceeds 7.5 trillion rubles-approximately $91.5 billion.
Key timeline:
Late 2024: A7 founded by PSB and Shor; sub-agent model begins in Kyrgyz Republic
2025: Rapid expansion of sub-agents into Central Asia, Middle East, Africa, Hong Kong, and UAE
Late 2024–August 2025: FT-identified $6.9 billion in flows through global banks
January 2025–June 2026: FinCEN estimates A7 sub-agents processed over $17 billion
August 2026: UK National Crime Agency issues industry alert
October 1, 2026: OFAC designation as transnational criminal organization; FinCEN publishes proposed rule and alert under Operation Economic Outcast
A7 has publicly claimed to support legitimate imports and exports and ordinary trade. These are A7’s statements in response to U.S. allegations-not independent findings of fact. No judicial determination has yet covered every transaction processed through the network.
How the A7 Sanctions-Evasion Network Reportedly Moved Funds Through the Financial System
The Financial Times traced approximately $6.9 billion in payments routed through A7-associated entities by analysing leaked internal documents. These flows moved through bank accounts held by foreign companies-A7’s sub agents-at major financial institutions including Standard Chartered ($1.1 billion via Hong Kong), First Abu Dhabi Bank (over $1.8 billion through 17 entities), DBS ($273 million), Citigroup ($74 million), and Deutsche Bank ($18 million).
The payment layering model worked as follows: payments initiated by Russian entities or Iranian counterparties flowed to sub-agents in third-country jurisdictions such as the UAE, Hong Kong, and Kyrgyzstan. These sub-agents held bank accounts at correspondent banks and used them to remit payments across borders for underlying counterparties, clearing transactions involving dollars and other hard currencies. Invoices referenced ordinary trade-consumer goods, equipment, and commodity shipments, making the flows appear as routine import/export settlement.
The A7 Network processed over $17 billion from January 2025 to June 2026, according to FinCEN’s assessment, including transactions involving Iranian oil sales and weapons procurement. This broader figure covers flows beyond the FT sample, including trade-based laundering and potentially digital asset channels. The network uses ruble-backed stablecoins like A7A5, issued by the sister company Old Vector LLC, to facilitate payments alongside traditional banking rails.
A single front company in Kyrgyzstan accounted for approximately $2.4 billion of the identified flows. Rosneft-linked export earnings-over $2 billion through at least sixteen trading companies-were channelled through the network to finance imports for the Russian market and support supply chains tied to sanctioned sectors.
From a compliance lens, the difficulty is stark: transaction size, product descriptions, and counterparties were superficially plausible. Payments appeared as standard trade flows-mid-to-high six-figure amounts within normal bands for wholesale trade-making them hard to isolate within high-volume transaction monitoring queues and increasing sanctions risk for banks reviewing seemingly routine trade payments.
Front Companies, Sub Agents, and Falsified Trade Documentation
The network employs front and sub-agent companies in third-country jurisdictions with looser transparency requirements. Russia uses third-country companies to disguise sanctioned payments, while Russia’s military procurement relies on proxy companies incorporated in the UAE, Hong Kong, Kyrgyzstan, Indonesia, and other jurisdictions. These offshore companies and shell companies are structured with complex shareholding that obscures ultimate Russian or Iranian beneficial ownership.
Falsified trade documents are central to how A7 defeats screening. The FT investigation found that military-related purchases-such as night-vision equipment and electronic components-were described as “hardened glass” on export documents. A7 maintained a library of counterfeit corporate stamps, seals, and document templates used to fabricate invoices and customs paperwork. HS codes were deliberately mismatched: sanctioned customs codes replaced with unrestricted ones, and generic commodity descriptions masked dual use goods and electronic integrated circuits destined for the Russian military.
Some A7 sub agents reportedly helped move proceeds from Iranian oil sales and defence-related procurement by describing shipments as unrelated commodities. These were sometimes linked to Iran’s shadow fleet tankers, connecting Iranian sanctions evasion to trade sanctions circumvention through the same infrastructure.
These techniques defeat basic screening because trade documents mention non-sanctioned goods and counterparties. Banks see plausible commercial context. There are no direct references to sanctioned entities or embargoed sectors in the paperwork. Document-level scrutiny-cross-checking invoices against bills of lading, shipping data, and declared counterparties-becomes essential, especially for higher-risk geographies. Tools like adverse media screening and entity risk assessment can help identify patterns inconsistent with a claimed business profile, though they require investigator judgement to act upon.
Why Conventional AML and Sanctions Screening Often Miss Network-Level Risk
Most institutions’ sanctions and AML controls follow a familiar architecture: name screening at onboarding, periodic KYC refreshes, rule-based transaction monitoring, and payment screening focused on direct name and address matches to sanctions lists. These controls work well against straightforward cases. They are structurally inadequate against a networked sanctions evasion system like A7.
Key blind spots the A7 case exposes:
Individual vs. network focus: Screening checks individual counterparties, not the A7 network as an integrated ecosystem spanning hundreds of entities across 83 countries and approximately 435 financial institutions
Clean-name sub agents: Dozens of differently named sub agents and affiliates have no obvious connection to designated parties; newly formed foreign companies with no sanctions history pass onboarding checks
Incomplete beneficial ownership: Corporate structures in certain countries make UBO identification difficult; sanctioned Russians or Iranians operate through nominees below the 50 percent rule threshold
Siloed data: Export controls data, shipping intelligence, and financial transaction data sit in separate systems with no integration
Transaction-monitoring challenges compound the problem. Payments appear as standard trade flows. Values and frequencies fall within normal bands for wholesale trade. There is no simple typology like structuring around a fixed threshold; instead, persistent use of specific corridors and counterparties emerges only through network-level analysis linking common directors, shared addresses, overlapping IPs, and mirrored trade patterns.
Due diligence and transaction monitoring are critical for compliance with networks like A7, but they must work together, not in isolation. RegTech platforms that integrate screening, monitoring, and entity risk assessment aim to help institutions see these connections at scale.
Regulatory Response: Operation Economic Outcast and A7-Related Measures
A7’s operations have prompted aggressive regulatory responses from global authorities. International bodies are coordinating crackdowns on the A7 Network to strengthen sanctions enforcement across jurisdictions. Effective trade sanctions implementation depends on coordination between agencies, alerts, designations, and banking-sector controls.
OFAC Actions
OFAC designated the A7 Network as a significant transnational criminal organization on October 1, 2026. All property of the A7 Network in the U.S. is blocked under the authority of the Office of Foreign Assets Control OFAC and must be reported to OFAC. The designation covers A7 LLC, A7 Agent LLC, Old Vector LLC, Garantex, Grinex, and key individuals including Sergey Mendeleev and Ilan Shor. The 50 Percent Rule applies: entities majority-owned by designated A7 actors are also blocked, raising indirect risk exposure for banks and corporates.
FinCEN Actions
The Financial Crimes Enforcement Network published a Notice of Proposed Rulemaking proposing to prohibit U.S. financial institutions from processing fund transmittals involving A7 sub agents-covering both fiat and convertible virtual currency. This NPRM is a proposed rule, not final; institutions must track when and if it becomes effective through the Federal Register. FinCEN also issued an alert with key indicators of A7 network activity, urging financial institutions to file SARs referencing specific terms. Violations of U.S. sanctions can lead to civil or criminal penalties.
UK and Allied Actions
The UK National Crime Agency issued an industry alert on August 31, 2026, warning the private sector about A7’s methods. The UK has sanctioned over £20 billion of trade with Russia since February 2022. EU and G7 partners issued parallel advisories focused on front companies, high-risk goods lists, and export controls circumvention to enforce sanctions more effectively. These measures represent unprecedented action in the capital markets union and beyond.
Critical distinction for compliance readers: OFAC designations create legal prohibitions and asset freezes. The FinCEN NPRM is a proposed special measure shaping how U.S. banks manage correspondent and payable-through accounts. Alerts and advisories are non-binding but highly influential-they shape what regulators expect from risk-based AML programs. Even before a rule is finalised, a TCO designation plus detailed guidance raises examiners’ expectations for monitoring, SAR reporting, and sanctions due diligence.
U.S. sanctions threaten Russia’s financial channels supporting its economy, and sanctions against the A7 Network increase funding stress for Russia’s economy by targeting the infrastructure used to circumvent sanctions on Western technology, energy exports, and financial stability mechanisms.
Sanctions-Evasion Red Flags and Lessons for Financial Institutions
Indicators linked to A7 and similar sanctions evasion networks do not in themselves prove wrongdoing. They are risk factors that require contextual assessment, escalation, and potentially an internal investigation or SAR filing. Sanctions against the A7 Network raise compliance risks for financial institutions that fail to identify and act on these patterns.
High-level patterns relevant to A7-type activity include:
Trade finance flows involving newly formed companies in jurisdictions associated with re-exports to sanctioned countries
Customers or counterparties whose trade volumes spike rapidly following new sanctions packages
Repeated use of the same small set of freight forwarders or agents in higher-risk hubs
Payments routed through entities involved in regulatory alerts or adverse media, even where not formally designated
The practical red-flag table in the next section provides specific indicators tied to these patterns.
Network and pattern detection is essential-not just one-off alert handling. Trade-finance and payments teams must coordinate with sanctions and export controls specialists. Institutions need structured processes for integrating new governmental alerts from FinCEN, NCA, and EU rapidly into their risk models. Adverse media monitoring and entity risk scoring help move beyond strict list-based screening to dynamic detection of A7-like networks, while recognising that investigator expertise remains crucial.
How RegTech and Enhanced Analytics Can Strengthen A7-Type Sanctions and AML Investigations
The A7 case illustrates convergence across trade finance, payments, cryptocurrency exchanges, and export controls, making manual, siloed approaches insufficient. Regulatory bodies are focused on preventing sanctions evasion through digital assets as well as traditional channels.
Key capability areas where RegTech assists:
Name and sanctions screening beyond simple list checks, incorporating fuzzy matching, ownership data, and network relationships-capabilities offered by platforms like ZIGRAM’s PreScreening.io
Transaction monitoring and payment screening adapted to cross-border trade and high-risk corridors, linking payments to trade documents and customer profiles
Entity risk assessment combining corporate registries, beneficial ownership data, PEP/sanctions lists, and adverse media to score potential sub agents
Adverse media monitoring capturing early signals when a counterparty appears in investigations around sanctions evasion or illicit finance
Integrated workflows matter: screening alerts, TM alerts, and KYC events feeding into a single case-management view, with the ability to pivot from a payment to its counterparty network, document set, and historical behaviour. ZIGRAM’s approach to integrated AML risk management combines screening, monitoring, risk assessment, and due diligence reporting to enable this joined-up detection.
RegTech supports but does not replace human investigators. Nuanced judgement about export controls, dual-use goods, and geopolitical context cannot be fully automated. As regulators increase expectations for spotting sophisticated schemes, boards and senior management must invest in both technology and specialist investigative capacity.
Practical Red-Flag Table for A7-Type Sanctions Evasion
The following indicators are drawn from observed A7 behaviour and regulatory alerts. They are not proof of wrongdoing-they are triggers for increased scrutiny, deeper review, documentation, and potentially SAR filings.
Potential Red Flag | Why It Matters | Recommended Compliance Response |
|---|---|---|
Newly incorporated trading company linked to a third country suddenly processing high-volume trade with Russia or Iran-linked sectors | May indicate a sub-agent role in a sanctions-evasion network; A7 used recently formed entities to process billions | Enhanced due diligence on company history, site verification, and relationship review |
Invoices describing generic "consumer goods" or "equipment" with no detailed specifications for high-value shipments | A7 used vague descriptions to mask dual use goods and electronic components; misalignment with risk profile of exported goods | Document verification, cross-check against shipping data, HS code validation, and potential SAR |
Counterparties overlapping with entities mentioned in OFAC/FinCEN or UK NCA alerts but not yet formally designated | A7 sub agents operated for months before formal designation; early media or alert references signal emerging risk | Adverse media monitoring, escalation to sanctions team, relationship risk assessment |
Payment chains transiting multiple obscure intermediaries before reaching high risk jurisdictions | Layered routing obscures the final destination and sanctioned entities; A7 shifted flows across jurisdictions when detected | Pattern analysis, corridor-level monitoring, cross-customer linkage checks |
Crypto-linked settlement (e.g., ruble-backed tokens) used alongside traditional trade finance instruments | A7 issued the A7A5 token and used stablecoins; multi-rail settlement bypasses traditional oversight | Monitor for mixed fiat-crypto settlement, flag unusual token references, coordinate with crypto compliance |
Mismatches between shipping data (ports, routes, tonnage) and declared cargo value or type | A7 front companies declared shipments inconsistent with actual goods; shadow fleet vessels carried Iranian oil under false documentation | Cross-reference shipping intelligence with trade documents and customer profile |
Rapid shift of payment routes following bank action or regulatory pressure | When Standard Chartered closed accounts, A7 rerouted through UAE-based banks; adaptive behaviour signals awareness of controls | Track account closures and monitor for re-routing to alternate institutions or jurisdictions |
Multiple entities sharing addresses, directors, or document templates with overlapping corporate structures | A7 maintained shared seals, stamps, and counterfeit document libraries across front companies | Network analysis on shared attributes, consolidated entity review, beneficial ownership verification |
Payments co-mingling energy export earnings with unrelated trade settlement through same front companies | Rosneft hard-currency flows mixed with other trade flows through A7's network, complicating audit trails | Sector-specific monitoring for energy and commodities; flag co-mingled flows through single intermediaries |
Entity's own research or public disclosures contradict its stated business purpose or volume | A7 claimed legitimate consumer trade, but transaction volumes and counterparty profiles were inconsistent | Compare stated business model against actual transaction patterns and public information |
FAQs: A7 Network, $6.9 Billion Flows, and Compliance Obligations
What is the A7 sanctions-evasion network, in practical terms?
The A7 Network is a Russia-linked shadow banking network founded in 2024 to route cross-border payments for Russian and Iranian sanctioned actors through front companies and sub agents in third-country jurisdictions. OFAC designated it as a significant transnational criminal organization in October 2026 under Operation Economic Outcast. The network is used for Iranian oil sales, weapons procurement, and to circumvent sanctions on Western technology and sanctioned sectors.
How does the Financial Times’ $6.9 billion figure differ from the $17 billion cited by U.S. authorities?
The $6.9 billion reflects a nine-month sample (late 2024 to August 2025) of bank transfers identified in leaked internal A7 documents by the FT. The $17 billion is FinCEN’s broader estimate of total transaction volume processed by A7 sub agents from January 2025 to June 2026-a longer period covering additional flow types. They are not equivalent and should not be combined.
Are banks and fintechs liable if they unknowingly processed A7-related transactions?
Under U.S. sanctions law, liability for transactions involving sanctioned entities can be strict. Regulators assess willfulness, the adequacy of compliance systems, and responsiveness to alerts and advisories. FinCEN proposed rules to block U.S. financial institutions from A7 transactions, and criminal penalties apply to knowing violations. Institutions that demonstrate robust risk-based controls and timely SAR filing are in a stronger position.
What kinds of controls are most relevant to spotting A7-type activity?
Integrated sanctions screening, trade finance due diligence, transaction monitoring for high-risk corridors, and adverse media and network analysis. Name screening alone is insufficient when sub agents use clean names and newly formed entities. The A7 Network utilizes falsified trade documents for sanctions evasion, so document-level scrutiny is essential.
Does crypto change the risk profile in the A7 case?
Crypto is one channel among many. The real challenge is multi-rail settlement that mixes fiat currencies, ruble-backed tokens like A7A5, and commodity-backed value flows to bypass traditional oversight. A7 has been utilized by Russia to bypass international sanctions through both banking and digital asset channels simultaneously.
Conclusion: Implications and Key Takeaways for Financial Institutions
The A7 case reveals what modern sanctions evasion looks like: network-based design spanning dozens of jurisdictions, use of sub agents and front companies to break the chain between sanctioned entities and the international financial system, trade misrepresentation through falsified trade documents, and multi-rail settlement combining banking, crypto, and commodities. The A7 Network processes illicit financial transactions on a massive scale-the network operates through a global web of shell companies, foreign companies, and financial entities that adapt when individual channels are shut down.
Even sophisticated sanctions evasion networks leave footprints across the financial system-in beneficial ownership records, shipping data, invoice anomalies, and repeated corridor patterns. These can be detected with the right combination of human expertise and analytics.
Key takeaways for compliance leaders:
Do not rely on name screening alone; integrate ownership, network, and adverse media intelligence to detect entities involved in sanctions evasion before formal designation
Prioritise trade finance and export-controls risk within sanctions programs, especially for jurisdictions linked to re-exports to Russia and Iran and for trade flows in sanctioned sectors
Build escalation pathways so front-line alerts linked to new government advisories from FinCEN, NCA, and EU are rapidly triaged and acted upon
Invest in RegTech that can correlate payments, customers, and documents at scale while empowering investigators with explainable outputs
Recognise that shutting down one A7-type network does not end sanctions evasion; programs must be adaptive and intelligence-led
Effective sanctions compliance now requires contextual entity intelligence, document scrutiny, payment analysis, and risk-based investigations working together. This is precisely the type of integrated capability that modern RegTech platforms-including ZIGRAM’s combined screening, monitoring, and due diligence workflow-are built to support.
