U.S. Treasury Targets A7 Network Over Sanctions Evasion and Shadow Banking

The U.S. Treasury has moved against the A7 Network, a Russian shadow banking operation it says Iran and the Islamic Revolutionary Guard Corps have used to evade sanctions, with a proposed rule that would cut its front companies off from American finance, including in crypto.

The Office of Foreign Assets Control designated the network a significant transnational criminal organization on Thursday, listing it with addresses in Russia, Kyrgyzstan, Nigeria and Zimbabwe. The Financial Crimes Enforcement Network separately proposed prohibiting transfers involving what it calls the network's Sub-Agents, the companies it uses to make sanctioned payments look like ordinary trade.

FinCEN is acting under section 9714 of the Combating Russian Money Laundering Act, which offers six special measures, and picked the sixth, a transmittal-of-funds prohibition. The fifth, which restricts correspondent accounts, would have left a hole, blockchain intelligence firm TRM Labs noted, based on its research into the network: A7A5 transactions move outside correspondent banking entirely, and FinCEN considers them integral to the business model. The sixth measure reaches fiat and crypto alike, and the proposed rule would bind roughly 348,000 institutions, crypto exchanges among them.

The A7 Network and A7A5

A7A5 is a ruble-backed token issued by Kyrgyz-registered Old Vector, live on Tron and Ethereum, with deposits held at Promsvyazbank, Russia's state-owned defense bank. FinCEN describes a mirror system: tokens move between addresses inside Russia to represent payments abroad while Sub-Agents make the matching fiat transfers in dollars, yuan, dirhams and euros, leaving the two sides firewalled from each other.

More than 180 entities processed at least $179.1 billion in A7A5 between February 2025 and June 2026, FinCEN found, historically almost all of it through the sanctioned exchanges Garantex and Grinex. The token is most often used as a non-freezable bridge into USDT and then fiat. Since a reported hack at Grinex in April, supply has consolidated into unhosted wallets, which the agency reads as a possible move away from sanctioned venues.

On the fiat side, A7 has created or acquired hundreds of Sub-Agents holding accounts at about 435 financial institutions across at least 83 countries, processing more than $17 billion between January 2025 and June 2026. Staff run those accounts from Moscow over custom VPNs that make the activity appear to originate in Dubai, Hong Kong or Bishkek.

One Sub-Agent dealt directly with entities tied to Iran's shadow fleet of tankers, and together with a sister company received close to $140 million from firms involved in Iranian sanctions evasion, Treasury said. Another sent about $1.6 million to a company linked to weapons procurement, while Treasury also ties the network to Nobitex, the Iranian exchange it designated in June, and to the laundering of proceeds from North Korean exchange hacks.

The network was launched in September 2024 by the fugitive Moldovan oligarch Ilan Shor and Promsvyazbank, and by January claimed to handle more than 2,000 transactions a day. Its stated historical volume of 7.5 trillion rubles, about $91.5 billion, would equal roughly an eighth of Russia's foreign trade last year. The EU sanctioned parts of the network previously, and the UK's National Crime Agency issued its own alert in August.