1. Washington strikes
On 1 October, the US Treasury launched a three-pronged action against A7, a Russia-linked payments network, under what it called Operation Economic Outcast. Its sanctions office, OFAC, designated A7 a significant transnational criminal organisation, listing addresses in Russia, Kyrgyzstan, Nigeria and Zimbabwe; that designation took effect immediately. Its financial intelligence unit, FinCEN, proposed a rule that would bar US banks from handling transfers involving A7's foreign "sub-agents", and issued an alert listing red flags for banks. The proposed ban is not yet final.
"Treasury is dismantling the financial infrastructure that allows Iran and other adversaries to evade sanctions, move illicit funds, and undermine the integrity of the global financial system," the department said.
2. Who is behind A7
A7 was set up in Moscow in late 2024. It is 51% owned by Ilan Shor, a Moldovan businessman convicted in 2017 over the theft of about $1 billion from three Moldovan banks in 2014, and sanctioned by the US, the UK and the EU, notably for interfering in Moldova's elections on Russia's behalf. The other 49% belongs to Promsvyazbank (PSB), a state-owned Russian bank that serves the defence sector and has been under Western sanctions since 2022.
Its purpose, according to Western governments, is simple: to keep Russian trade flowing after the main Russian banks were cut off from the SWIFT messaging network in 2022. In January 2025, A7 also launched A7A5, a stablecoin pegged to the ruble and backed by deposits at PSB.
3. How the money moves
The Treasury describes an architecture built on "hundreds" of apparently independent companies in third countries, which it calls sub-agents. A Russian client pays A7 in rubles; a sub-agent abroad, with an account at a local bank still connected to SWIFT, pays the foreign supplier in dollars, euros, yuan or dirhams. A7 staff ran these accounts from Moscow, using custom virtual private networks that made the activity appear to come from Dubai, Hong Kong or Bishkek, according to the Treasury.
FinCEN's alert, published the same day, adds two details. Inside Russia, A7 records what it owes its clients with bills of exchange and promissory notes, known as veksels. And the VPNs ran on infrastructure provided by IT companies controlled by Ilan Shor, on the domains muzpan.com and sodkamus.com. FinCEN describes the whole scheme as a form of trade-based money laundering: shell companies, falsified trade documents, false import-export records and misleading descriptions of goods.
The leaked files obtained by the Financial Times add the human detail. They mention at least a hundred front companies actively making payments, and at least a hundred more, including at least 87 in Hong Kong, 61 in the United Arab Emirates, 16 in Kyrgyzstan and 14 in Indonesia. A7 staff discuss how to remove what they call the "Russian trace" from documents.
4. The banks in the paper trail
According to the FT's analysis, A7-linked entities moved about $6.9 billion through the international banking system between late 2024 and August 2025. Seventeen A7-linked entities with accounts at First Abu Dhabi Bank, the UAE's largest lender, made more than $1.8 billion of outbound payments. Accounts at Standard Chartered in Hong Kong received about $1.1 billion.
The documents also show that banks, including First Abu Dhabi Bank, sent anti-money laundering queries to A7's front companies. Several banks named in the reporting said they take their sanctions and anti-money laundering obligations seriously.
5. How big is A7?
Three figures circulate, and they measure different things.
6. The Iran connection
What turned A7 from a Russian sanctions-evasion tool into a US criminal target is Iran. The Treasury says A7 sub-agents were involved in Iranian oil sales and weapons procurement, and its press release cites the network's financial support for the Islamic Revolutionary Guard Corps and for Iranian proxies such as Hamas. FinCEN goes further: its analysis of bank reporting data indicates that Iranian actors, including the Central Bank of Iran and the IRGC, are using the network. It also lists North Korea, Iran-backed terrorist groups, cybercriminals and ransomware actors among those that have used it. One sub-agent and a sister company received close to $140 million from firms involved in Iranian sanctions evasion, according to the Treasury. The case echoes the channels we described in our analysis of Iran's use of stablecoins: when one route closes, sanctioned states look for another.
The crypto leg: A7A5
A7A5 was designed without a freeze function, unlike the dollar stablecoins that issuers can block. It traded first on Garantex, a Russian exchange seized by US authorities in March 2025, then on its Kyrgyz successor, Grinex. Western sanctions on Grinex and the token's issuer, and an EU ban on A7A5 transactions from November 2025, cut its volumes sharply. After an alleged hack of Grinex in April 2026, the tokens were consolidated into wallets held outside any exchange, according to FinCEN. The agency also says A7A5 is mostly used as a non-freezable bridge: converted into other assets such as Tether's USDT, then into the currency the client wants. The token runs on the Tron and Ethereum blockchains.
7. Four years of cat and mouse
