FinCEN Targets A7 Network Sub-Agents in Major AML Action
On 3 October 2026, the US Treasury's Financial Crimes Enforcement Network issued a formal finding and notice of proposed rulemaking that would prohibit every covered US financial institution from sending or receiving funds — including convertible virtual currency — involving any non-US company controlled by the A7 Network, a class of entities FinCEN calls "Sub-Agents." The proposal arrived the same day OFAC designated the A7 Network as a significant Transnational Criminal Organization under Executive Order 13581, as part of what Treasury is calling Operation Economic Outcast. For accounting firms, auditors, and CFOs managing clients with cross-border trade or digital asset exposure, this is one of the most consequential AML actions of 2026, and it demands an immediate compliance review.
What the A7 Network Is and Why FinCEN Acted Now
The A7 Network was formally launched in September 2024 by two parties already sanctioned by the United States, the EU, and the UK: fugitive Moldovan oligarch Ilan Shor and Promsvyazbank (PSB), Russia's state-owned defense bank. Its operational core sits in three Russia-based entities — A7 LLC, A71 LLC, and A7 Agent LLC — jointly owned by Shor and PSB.
PSB described the service at launch as a mechanism to "support Russian foreign trade participants and their trading partners amid anti-Russian sanctions pressure." That framing is blunt. As of January 2026, the network claimed a cumulative volume exceeding 7.5 trillion rubles, roughly equivalent to USD 91.5 billion, which FinCEN notes is close to one in every eight dollars of Russia's 2025 foreign trade.
Key Enablers Named in the Finding
FinCEN's finding identifies a ring of operational enablers working with or through the A7 core: Old Vector LLC (a Kyrgyz entity), the exchanges Garantex and Grinex, InDeFi Bank, ExVed, and Garantex co-founder Sergey Mendeleev. Vladimir Putin attended the virtual opening of an A7 office in Vladivostok. Reported users cited in the finding include Roman Abramovich, Nikolai Patrushev, and Arkady Rotenberg.
The finding draws extensively on research published by TRM Labs in June 2026 with the Open Source Centre, which traced the network's links to North Korea, Iran-backed groups, ransomware actors, and the Islamic Revolutionary Guard Corps.
The Sub-Agent Structure: How Sanctions Evasion Works at Scale
With roughly 80 percent of Russian banks sanctioned since 2022 and many cut off from SWIFT, A7 fills the gap through a layered sub-agent model. It forms, acquires, or partners with companies in third countries — including Hong Kong, Indonesia, the Kyrgyz Republic, the Seychelles, Türkiye, and the UAE. These entities appear on paper to be owned and managed by non-Russians. In practice, A7 controls them remotely, running their bank accounts from Moscow over VPNs that make activity appear to originate in Dubai, Hong Kong, or Bishkek.
As of June 2026, A7 had created or acquired hundreds of Sub-Agents holding accounts at approximately 435 financial institutions across at least 83 countries. FinCEN assesses those Sub-Agents processed more than USD 17 billion in dollar-denominated transactions between January 2025 and June 2026.
Trade-Based Money Laundering Mechanics
The scheme is a textbook example of trade-based money laundering. A Russian customer settles its obligation inside A7's internal ledger, typically by purchasing bills of exchange known as veksels. Between September 2024 and July 2025 alone, A7 clients bought more than 3,200 veksels worth over USD 25 billion. A7 then assigns an industry-matched foreign Sub-Agent to appear as the paying counterparty, generates trade documents with any reference to Russia removed, and routes payment through the Sub-Agent's bank account.
Six Named UAE Sub-Agents
The NPRM names six UAE-based Sub-Agents with specific transaction volumes:
| Sub-Agent | Reported Volume / Notes |
|---|---|
| Power Sphere LLC-FZ | USD 61 million — Russian trade-based money laundering and energy-sector procurement (Sep 2023 – Jul 2025) |
| Hydrofusion Resources FZ-LLC | USD 3.6 million |
| Gimli Trade LLC-FZ | USD 1.5 million; UK-sanctioned December 2025 |
| Galadriel Trading FZCO | Over USD 946,000 tied to export-control evasion |
| Sigizmund FZCO | USD 41,000, including dual-use goods |
| Pearl Bridge | Approximately USD 30,000 |
The Iran dimension runs through the same Sub-Agent layer. One Sub-Agent transacted with entities linked to Iran's shadow fleet; that Sub-Agent and a sister entity received nearly USD 140 million from parties involved in Iranian sanctions evasion between July 2023 and October 2025. A separate Sub-Agent sent approximately USD 1.6 million to a company linked to Iranian weapons procurement.
The A7A5 Stablecoin: Where Crypto Accounting Enters the Picture
Alongside the fiat sub-agent network operates the A7A5 stablecoin, a ruble-backed token issued by Old Vector, registered in the Kyrgyz Republic, and live on both Tron and Ethereum. Each token is backed by ruble deposits held at PSB. FinCEN describes it as part of a deliberate mirror system: tokens move between internal addresses inside Russia to represent foreign payment obligations, while Sub-Agents execute the matching fiat transfers abroad in dollars, yuan, dirhams, or euros. The two sides balance on A7's internal ledger, and the counterparties on either side remain firewalled from each other.
The scale is striking. FinCEN found that more than 180 entities processed A7A5 transactions worth at least USD 179.1 billion between February 2025 and June 2026. That volume, flowing through Tron and Ethereum infrastructure, is precisely why FinCEN determined that special measures one through five — which include recordkeeping, reporting, and correspondent account restrictions — would be insufficient. A7A5 transactions move entirely outside the correspondent banking system, so only a transmittal-of-funds prohibition, the sixth and broadest measure, could reach them.
TRM Labs has also flagged TokenSpot, an unsanctioned Kyrgyz exchange that shares infrastructure with Grinex, as a likely next point of disruption in this network.
For teams using crypto bookkeeping software or digital asset accounting software to reconcile client wallets on Tron or Ethereum, any token identified as A7A5 on-chain now carries a primary money laundering concern designation. That changes both the accounting treatment and the suspicious activity reporting obligation immediately upon the rule taking effect.
The Legal Authority: Section 9714 and the Sixth Special Measure
FinCEN is acting under section 9714 of the Combating Russian Money Laundering Act, as amended by the FY2022 National Defense Authorization Act. Section 9714 permits Treasury to apply the five special measures available under section 311 of the USA PATRIOT Act to classes of transactions connected to Russian illicit finance, and it adds a sixth measure allowing Treasury to prohibit or condition certain transmittals of funds.
FinCEN selected that sixth measure deliberately. The agency concluded that recordkeeping and reporting requirements (special measures one through four) would permit illicit transfers to continue. It also determined that restricting correspondent and payable-through accounts (special measure five) would leave a gap precisely because A7A5 transactions bypass the correspondent banking system entirely. A transmittal-of-funds prohibition is the only instrument that covers both fiat and crypto in one sweep.
This builds on two precedents: FinCEN's 2024 section 9714 order against Russia-linked exchange PM2BTC, and its 2025 section 311 action against Huione Group, both of which applied special measures authority against hybrid fiat-crypto money laundering infrastructure. The A7 NPRM extends that playbook to a network operating at a scale several orders of magnitude larger. For additional context on how Treasury coordinates crypto-linked sanctions, see our coverage of how Treasury's Hamas crypto fundraising sanctions affect client screening.
Compliance Implications for Accounting Firms and CFOs
The NPRM is a proposal, not a final rule — the public comment period is now open. But the accompanying OFAC designation is effective immediately, and the combination creates a compliance posture that cannot wait for the rule to be finalized.
Counterparty and Transaction Screening
Any covered US financial institution — and any accounting firm or CFO advising one — must treat the named Sub-Agents as prohibited counterparties from the moment an OFAC designation is live. That means screening existing client relationships, trade finance mandates, correspondent banking arrangements, and digital asset transaction histories against the named entities. The 435 financial institutions cited as holding Sub-Agent accounts span 83 countries, which means the exposure is not limited to obvious jurisdictions.
Firms running crypto accounting software or digital asset accounting software should run chain-analysis checks on any Tron or Ethereum addresses associated with A7A5 tokens. On-chain tracing tools can identify whether client wallets have received or sent A7A5, even indirectly through intermediary hops. If they have, a suspicious activity report (SAR) may be required, and the accounting treatment of those assets needs legal review before they appear in audited financial statements.
Trade Finance and Documentary Review
The Sub-Agent model is designed to strip Russian origin from trade documents. That makes standard documentary due diligence insufficient on its own. Accounting teams reviewing trade payables or receivables with counterparties in the UAE, Kyrgyzstan, Hong Kong, Indonesia, the Seychelles, or Türkiye should apply enhanced due diligence to verify that the beneficial owner of the counterparty is not A7-controlled. The NPRM's description of VPN-masked account management from Moscow is a reminder that appearance of local control is not evidence of it.
For context on how compliance teams are approaching blockchain-based red flags in related enforcement contexts, our analysis of AML red flags compliance teams must know from crypto bridge hacks covers transferable detection frameworks.
Audit and Financial Reporting Considerations
From a financial reporting standpoint, any asset or liability with a nexus to a designated entity is subject to potential freezing or seizure. Auditors reviewing client balance sheets that include trade receivables, stablecoin holdings, or deposits at financial institutions in the named jurisdictions will need to assess whether those assets remain recoverable and whether disclosure obligations under ASC 450 or IAS 37 contingency frameworks are triggered. The sheer volume of the A7A5 network — over USD 179 billion in a 16-month window — means the probability of inadvertent exposure across a large client portfolio is not negligible.
Frequently Asked Questions
What is the A7 Network and who controls it?
The A7 Network is a sanctions-evasion infrastructure launched in September 2024, jointly controlled by sanctioned Moldovan oligarch Ilan Shor and Promsvyazbank, Russia's state-owned defense bank. It uses a global web of non-Russian shell companies, called Sub-Agents, to move funds on behalf of Russian foreign trade participants who cannot access the conventional banking system.
What does FinCEN's proposed rule actually prohibit?
If finalized, the rule would bar all covered US financial institutions from sending or receiving any funds — including convertible virtual currency — involving a Sub-Agent. It uses the sixth special measure under section 9714 of the Combating Russian Money Laundering Act, which reaches both fiat transmittals and crypto transfers in a single prohibition.
What is the A7A5 stablecoin and why does it matter for digital asset accounting?
A7A5 is a ruble-backed stablecoin issued by Old Vector LLC, a Kyrgyz entity, and deployed on Tron and Ethereum. Each token is backed by ruble deposits at Promsvyazbank. FinCEN found that more than 180 entities processed at least USD 179.1 billion in A7A5 transactions between February 2025 and June 2026. Because these flows bypass the correspondent banking system, any A7A5 token appearing in a client's digital asset holdings requires immediate legal and accounting review, and potentially triggers SAR obligations.
Does the OFAC designation have immediate effect even before the NPRM is finalized?
Yes. OFAC's Transnational Criminal Organization designation of the A7 Network under Executive Order 13581 is effective immediately. That means US persons are already prohibited from transacting with designated A7 entities. The FinCEN NPRM — which would extend the prohibition to Sub-Agent transactions more broadly — is subject to a public comment period before it becomes final, but firms should not treat that gap as permission to wait.
Which jurisdictions carry the highest Sub-Agent exposure risk?
FinCEN's finding specifically names Sub-Agents in the UAE, the Kyrgyz Republic, Hong Kong, Indonesia, the Seychelles, and Türkiye as jurisdictions where A7 has placed controlled entities. The NPRM names six UAE-based Sub-Agents by name and transaction volume. However, with accounts held at approximately 435 financial institutions across at least 83 countries, the geographic footprint is genuinely global, and firms should not limit screening to these jurisdictions alone.
Source: TRM Labs