The US Treasury on Thursday, October 1, 2026, designated the A7 Network, a Russia-linked payment network that it says Iran used to evade sanctions, as a significant transnational criminal organization. A7 is led by Ilan Shor, a fugitive Moldovan oligarch already under US sanctions. Treasury’s Financial Crimes Enforcement Network (FinCEN) proposed the same day to bar US financial institutions from sending or receiving funds, crypto included, in any transaction involving A7’s “Sub-Agents.” These are the companies A7 controls in third countries to receive and send its payments. FinCEN also issued an alert with red flags.
Treasury filed the move under Operation Economic Outcast, the banner it also used that day for new Iran-related designations. “Treasury is dismantling the financial infrastructure that allows Iran and other adversaries to evade sanctions, move illicit funds, and undermine the integrity of the global financial system,” Treasury Secretary Scott Bessent said. Treasury says the action follows the UK National Crime Agency’s August 31, 2026 alert on A7.
A ban on any transfer that touches a listed sub-agent
FinCEN used section 9714(a) of the Combating Russian Money Laundering Act, which lets Treasury act against a class of transactions of “primary money laundering concern in connection with Russian illicit finance.” Beyond the five special measures of section 311 of the USA PATRIOT Act, it allows a sixth: prohibiting or conditioning certain transmittals of funds. FinCEN chose that one, arguing that a curb on correspondent accounts would miss A7A5, the network’s ruble-backed token, whose transactions do not rely on correspondent banking.
The proposed 31 CFR 1010.668 would bar banks, broker-dealers, money services businesses, and other covered financial institutions from any transmittal of funds “from or to an A7 Network Sub-Agent, or from or to any account or CVC address administered by or on behalf of” one. An institution that knows or has reason to believe a transfer is prohibited would have to notify the affected parties with which it has a direct commercial relationship. Each institution would also take a risk-based approach to deciding what further due diligence, if any, it needs to avoid processing prohibited transfers; FinCEN says the screening software already used for sanctions compliance could serve. FinCEN counts 347,926 potentially affected institutions, about 35,000 of them likely to bear more than a minimal burden, and puts their recordkeeping and disclosure costs at up to about $18 million a year in total.
| Sub-agent | Base | Amount | Period |
|---|---|---|---|
| Power Sphere LLC-FZ | Dubai | $61M | Sept. 2023 to July 2025 |
| Hydrofusion Resources FZ-LLC | UAE | $3.6M | May to June 2025 |
| Gimli Trade LLC-FZ | Dubai | $1.5M | May to June 2025 |
| Galadriel Trading FZCO | Dubai | More than $946,000 | May to July 2025 |
| Sigizmund FZCO | Dubai | $41,000 | July to Sept. 2025 |
| Pearl Bridge | Dubai | About $30,000 | April 2025 |
Comments are due 30 days after the proposal appears in the Federal Register, under docket FINCEN-2026-0265. FinCEN says that window balances public notice against the national security risk of letting illicit transfers continue.
Shell companies, false invoices, and VPNs run from Moscow
In a typical A7 transaction, the customer settles inside the network, using instruments such as veksels, the Russian term for bills of exchange or promissory notes, while a sub-agent appears as the payer on the invoice and sends the money through correspondent banks and SWIFT. By June 2026, A7 had created or acquired hundreds of sub-agents, in places such as Hong Kong, Indonesia, the Kyrgyz Republic, the Seychelles, Türkiye, and the UAE. Moscow-based staff run their accounts over VPNs that make them appear to be abroad, FinCEN says.
FinCEN ties some sub-agents to Iran. One dealt directly with entities in Iran’s oil-smuggling “shadow fleet” and, with a sister company, received nearly $140 million from entities involved in Iranian sanctions evasion between July 2023 and October 2025. Another sent about $1.6 million to a company linked to Iranian weapons procurement. Treasury also cites financial support for Iran’s Islamic Revolutionary Guard Corps and Hamas, and links A7 to Nobitex, Iran’s largest digital asset exchange, sanctioned on June 2, 2026.
OFAC blocks the network, and its ruble token with it
The designation by Treasury’s Office of Foreign Assets Control (OFAC) blocks all property and interests in property of the A7 Network in the US or held by US persons, including transactions involving sub-agents acting on its behalf. It extends the August 14, 2025 designations of A7 LLC and Old Vector LLC, the Kyrgyz issuer of A7A5; OFAC treats the token itself as blocked property. Each A7A5 is advertised as backed by ruble deposits at Promsvyazbank (PSB), the sanctioned Russian state defense bank that set up A7 with Shor. FinCEN says the token serves mostly as a bridge into more widely accepted digital assets, such as Tether’s USDT.
The alert, FIN-2026-Alert007, asks institutions to cite the key term “FIN-2026-A7NETWORK” in suspicious activity reports. Its red flags include:
- A recently formed company suddenly running unusually high volumes of large transactions
- Account access from IP addresses tied to A7’s VPN infrastructure, such as the domains muzpan[.]com and sodkamus[.]com
- Invoices with out-of-place Cyrillic characters, an analog company stamp on an otherwise digital document, or signs of AI alteration
- Direct or indirect exposure to A7A5 or to “wrapped” tokens based on it
A7 categorically rejected any accusation that it had worked with Iran or terrorist organizations, Reuters reported on October 2. The company said it serves legitimate import and export operations in consumer goods and raw materials.