US alleges Russia’s A7 payment network moves funds for Iran and sanctioned groups

銳報SHARPPOST

World Finance · Analysis

SharpPost Editorial Team | October 5, 2026

The US Financial Crimes Enforcement Network (FinCEN) published a proposed rule in the Federal Register on October 5 that would prohibit covered financial institutions from processing funds transfers involving overseas subagents of Russia’s A7 network. FinCEN alleges that companies, accounts and settlement arrangements established to help Russia evade sanctions have also been used by Iran’s central bank, the Islamic Revolutionary Guard Corps (IRGC) and other participants in sanctioned activities. The agency has designated transactions involving these subagents as a class of transactions of primary money laundering concern linked to Russian illicit finance.

According to FinCEN, Russia’s state-owned defense bank Promsvyazbank (PSB) and Ilan Shor jointly own A7 LLC, established in 2024. Both are under US, EU and UK sanctions. By June 2026, A7 had formed or acquired hundreds of subagent companies with accounts at about 435 financial institutions in at least 83 countries. Some banks may not have realized that their account holders were making payments on behalf of sanctioned clients, FinCEN says.

A7’s press office told Russian news outlet RBC on October 2 that the company did not handle transactions for Iran, terrorist organizations or related entities. It said clients underwent multiple compliance checks and that A7 provided settlement services for lawful imports and exports by Russian and third-country businesses. The company said the new sanctions would not affect its operations.

Third-country companies pay suppliers

FinCEN describes a process in which clients submit supplier details, goods descriptions and payment amounts to A7, then obtain an internal settlement balance through instruments such as bills of exchange. An overseas subagent signs contracts, issues invoices and sends payment instructions in its own name. The supplier’s payment records identify the third-country company rather than the original client.

The Open Source Centre’s (OSC) investigation, The Big Shor, reported that A7 employees controlled third-country companies’ bank accounts and used custom software to alter invoices. They retained payment amounts but replaced goods descriptions with ordinary consumer products and removed references to Russia, the investigators said. OSC based its findings on leaked communications, ledgers, contracts and SWIFT messages it had verified.

Overseas payments move through subagents’ bank accounts and correspondent banks. SWIFT carries the messages between banks. OSC describes A7 as a predominantly fiat-payment network, with digital assets handling only part of its settlement and accounting.

FinCEN’s October 1 alert identifies related companies registered in Kyrgyzstan. They hold local accounts and have business connections to PSB. One of them, Old Vector, issues the ruble-backed stablecoin A7A5.

A7A5 circulates on Tron and Ethereum. In FinCEN’s account, tokens and account entries on the Russian side record internal claims, while overseas subagents pay suppliers in dollars, yuan, dirhams or euros. The records are reconciled against those payments; suppliers do not need to accept A7A5. The alert also describes conversions from A7A5 into assets such as USDT and then into fiat currency.

TRM Labs’ blockchain analysis identified circular transfers and internal bookkeeping. The same value moving between addresses can be counted repeatedly. FinCEN’s $179.1 billion in cumulative A7A5 transactions cannot all be treated as new cross-border payments.

Under the fiat-settlement arrangement FinCEN describes, subagents still have to transfer foreign currency from bank accounts to suppliers. Frozen accounts, a shortage of foreign currency or a bank’s refusal to process a transaction can interrupt delivery of the money. Completing an internal token transfer does not complete that overseas bank payment.

Payments linked to Iranian oil trade and weapons procurement

FinCEN connects the nearly $140 million in receipts to Iran’s shadow fleet, saying the receiving subagent dealt directly with associated entities. The fleet consists of oil tankers, shipping companies and front companies used to transport and sell Iranian oil. The separate transfers of about $1.6 million allegedly went to a company linked to Iranian sanctions evasion and weapons procurement. As of publication, the filing had not named either subagent or provided complete transaction records and evidence of the funds’ ultimate use.

In its October 1 announcement of Operation Economic Outcast, the US Treasury alleged that the subagents also moved money for Iran’s central bank, the IRGC and affiliated organizations. Under that account, Iranian participants used companies, accounts and payment relationships originally serving Russian clients rather than setting up separate cross-border settlement channels. The UK government and National Crime Agency had already identified connections between A7 and Iranian state-linked actors in an August 31 industry-alert announcement.

FinCEN says A7 personnel control the subagents processing these payments, although some companies’ registration documents identify third-country owners or managers. A7 employees in Moscow remotely operate overseas accounts and use VPNs to conceal their location, according to the filing. Account-opening documents, payer names and login locations may therefore fail to reveal Russian connections. US authorities allege that Iranian participants also use these companies and accounts to move funds.

TRM says one A7 address received more than $65 million directly from an address it attributed to the IRGC, while another received the equivalent of $5 million from Hamas. It also identified transactions with Sa’id al-Jamal’s network. Al-Jamal was sanctioned for allegedly moving IRGC Quds Force funds for the Houthis. TRM identified the Houthi connection through his network, not by classifying the two earlier transfers as Houthi funds.

TRM also says at least $590,000 stolen in the BTCTurk and Woo X exchange hacks, attributed to North Korean state hackers, reached A7-controlled addresses through intermediaries. Those paths and address attributions are TRM’s findings; they do not establish that every intermediary knew where the funds originated.

FinCEN says its alert draws on Bank Secrecy Act data, law-enforcement information and public reporting. The proposed rule cites OSC and TRM in relevant sections and incorporates some of their findings. The nonpublic material has not been disclosed in full, and the filing does not include court rulings establishing the reported transaction links.

Proposed restrictions on overseas subagents

The Office of Foreign Assets Control (OFAC) designated “A7 NETWORK” as a transnational criminal organization on October 1. According to Treasury, the network’s property and interests in property in the United States, or held or controlled by US persons, must be blocked. Transactions by subagents acting on its behalf also fall within the sanctions’ scope. The FinCEN draft published on October 5 proposes additional funds-transfer restrictions that are not yet in force.

FinCEN plans to supply covered institutions with a list of subagents through secure channels and update it as necessary. The agency says it is withholding the full list from the public to prevent A7 from replacing companies to evade restrictions. The draft would allow listed companies to submit evidence and request reconsideration. The proposed transfer prohibition includes convertible virtual currency, while existing OFAC blocking requirements continue to apply.

Under the draft, institutions’ obligation to reject funds transfers would apply to subagents on FinCEN’s list, which could change as the investigation proceeds. Banks would have to use it to identify payments made in third-country companies’ names. Public material does not identify which banks have already blocked A7-related transactions. A7 says its platform remains unaffected.

The public-comment period closes on November 4. FinCEN is seeking views on the scope of the prohibition, how institutions should be notified and their due-diligence obligations.

Information current as of October 5, 2026.