UK issues A7 sanctions alert and plans to double OFSI penalty cap

The UK’s National Crime Agency and the government issued their first nationwide alert on the A7 network on Monday, August 31, 2026. The alert, reference 0808-NECC, comes from the NCA’s National Economic Crime Centre (NECC) and was prepared with the Office of Financial Sanctions Implementation (OFSI). The same day, Chancellor of the Exchequer John Healey announced that OFSI’s maximum civil penalty would double, from 50% to 100% of the value of a sanctions breach.

A7 routes Russian trade settlements through shell companies and banks in third countries, and claims to have settled more than $86 billion in its first year. “We are ramping up the economic pressure on Putin and leaving those aiding his illegal war with nowhere to hide,” Healey said. The press release names neither the legislation that will carry the higher cap nor a date for it to take effect.

A7 offers Russian firms a way to settle trade under sanctions

Established in 2024, A7 is a commercial enterprise backed by Promsvyazbank (PSB), a sanctioned Russian state-backed bank, and VEB.RF, a state-owned development corporation. According to the alert, Ilan Shor, the Russian-Moldovan oligarch and convicted fraudster, set up A7 with PSB, and its structures are hosted between Kyrgyzstan and Russia. PSB describes A7 as a “unique mechanism” for completing trade settlements “in the face of anti-Russian sanctions pressure.” The UK, the US, and the EU have all sanctioned the network.

Liquidity outside Russia, paid out through sub-agents

A7 builds pools of liquidity outside Russia and draws on them to settle its clients’ transactions. That liquidity entered the international financial system from Kyrgyzstan, mainly through the Trading Company of the Republic of Kyrgyzstan (TKKR), which was liquidated in February 2026. Once introduced, the money no longer carries any trace of its Russian origin. It is linked instead to shell companies that the alert calls “sub-agents.”

• The sub-agents are registered abroad but controlled from inside Russia.
• A7 creates websites and email addresses for them, and VPNs make its staff appear to be in the target country.
• Transfers between sub-agent accounts pay the suppliers of Russian or sanctioned clients.
• False invoices dress up these transactions, following well-known trade-based money laundering practices.

The network’s credit instrument is the veksel, a Russian-law promissory note. Clients buy it in Russia, and its value covers the transactions executed abroad, so no correspondent bank transfer ever leaves Russia. Instead, a shell company elsewhere completes a seemingly separate transaction. The alert also flags an expansion into payment service providers, citing Pilot Finance Limited, a Nigerian PSP that had connections to British financial entities and has since been sanctioned by the UK. OFSI says it has identified transactions between A7 shell companies and UK-incorporated beneficiaries, routed through banks in several intermediary jurisdictions.

The red flags compliance teams are asked to watch

• Companies with a short history completing large volumes of transactions with entities in a different industry
• Invoices for goods or services that differ from the supplier’s usual products
• Limited information on owners, directors, or beneficiaries
• Online banking over a VPN that exits in the target jurisdiction but does not match the customer’s profile

A 100% cap bites on breaches above £1 million

OFSI’s penalty power rests on section 146 of the Policing and Crime Act 2017. The Treasury can impose a penalty if it is satisfied, on the balance of probabilities, that a person has breached financial sanctions legislation. Since June 15, 2022, the Economic Crime (Transparency and Enforcement) Act 2022 has removed any requirement to show knowledge or suspicion, so civil liability is strict.

The statutory maximum follows a two-part rule. Where the value of the funds involved can be estimated, it is the greater of £1 million and 50% of that value; otherwise, it is £1 million. The percentage test therefore only matters above £2 million. Raising it to 100% would lower that threshold to £1 million.

The cap does not set the fine. OFSI fixes a baseline penalty within the statutory maximum, at least 75% of it for Level 4 cases, the most serious. It then applies discounts that can be combined, including up to 30% for voluntary disclosure and cooperation.

OFSI published 20 enforcement decisions between January 2019 and August 31, 2026. The largest is the £20.47 million penalty on Standard Chartered Bank in February 2020. The four penalties issued in 2026 before the alert ranged from £160,000 for Bank of Scotland to £1,000,920.59 for Sabre Global Technologies. Payments companies have appeared on the list since 2019, including Travelex, Clear Junction, and TransferGo.