A payment can involve a plausible company, a recognized bank and tidy commercial documents while the customer behind it stays out of sight. The A7 Network uses that gap to move money for sanctioned actors. For institutions receiving those payments, the challenge is connecting what screening, due diligence and monitoring each reveal. 

On October 1, 2026, the U.S. Treasury Department took coordinated action against A7, a Russia-linked shadow banking operation that helped Iran evade sanctions using a blend of conventional finance and cryptocurrency. The action is part of a broader campaign called Operation Economic Outcast, and it arrives from two directions at once. 

The action involves two U.S. authorities: 

• Office of Foreign Assets Control (OFAC): designated the A7 Network a significant transnational criminal organization. Its property and property interests must be blocked and reported to OFAC when they are in the U.S. or held or controlled by U.S. persons. 

• Financial Crimes Enforcement Network (FinCEN): issued Alert FIN-2026-Alert007 with indicators of A7-related suspicious activity. It also proposed restricting covered U.S. financial institutions from sending or receiving funds, including convertible virtual currency, in transactions involving Sub-Agents identified by FinCEN. That proposal is still an Notice of Proposed Rulemaking (NPRM), not a final rule, but banks would be unwise to treat it as distant. 
  
  How does the A7 Network operate? A bank that doesn’t look like a bank
  
  A7 was launched in September 2024 by Ilan Shor, the fugitive Moldovan oligarch, together with Promsvyazbank.  
   By its own account, the network was processing more than 2,000 transactions a day as of January 2026, with a historical total volume of over 7.5 trillion rubles, or roughly $91.5 billion. Treasury cites that claim as equivalent to about 13 percent of Russia’s 2025 foreign trade transactions. 

  A7 works through hundreds of apparently independent companies in third countries, known as Sub-Agents. Its use of ordinary companies, accounts and payment channels is part of the concealment.  
   Put enough respectable-looking intermediaries between the people who need to move money and the banks that must screen it, and the sanctioned party can disappear from view. 

  Here is how a payment can be disguised. A customer gives A7 the supplier details and supporting documents. A7 records value through its internal settlement arrangements and assigns a Sub-Agent to appear as the contracting or paying party. The outward payment can then travel from a non-Russian account through correspondent banking and SWIFT channels. The institution sees the intermediary while the underlying customer can remain concealed. 

  Digital assets provide a parallel route. A7A5 and related conversion paths can move value between network-linked parties, with Sub-Agents helping settle the corresponding payments in fiat currency. 
  
  
  

  

  
  
  Why this is more than a watchlist problem 

  FinCEN’s alert, dated October 1, 2026, speaks to banks, correspondent banking providers, payment institutions, digital asset service providers and other financial institutions. Its central message is blunt. Sanctions exposure may no longer be visible in the names appearing on a payment. 

  That matters at every stage of the compliance lifecycle: 

  • Screening. Checking the named sender and beneficiary can miss the sanctioned party actually directing the payment. 

  • Beneficial ownership. Companies that appear to be owned by third-country nationals may in practice be controlled by A7. 

  • Correspondent banking. Legitimate international channels can carry transactions whose sanctioned origin has been carefully concealed. 

  • Transaction monitoring. The tells are in the pattern: layered payments, newly established companies, volumes that don’t match the business. 

  • Trade finance. Invoices, supplier descriptions and shipping documents can be manipulated to disguise what a payment is really for. 

  • Digital assets. A7A5, wrapped tokens, USDT conversions and over-the-counter intermediaries can create links between digital asset activity and fiat settlement that aren’t apparent from the payment instruction. 

  • Geography. Kyrgyzstan and several other jurisdictions feature in the network, but location alone proves nothing. 

  FinCEN identifies 17 red flags across three categories: the use of Sub-Agents, mis-invoicing and invoice falsification, and digital asset abuse. And it adds a caveat worth underlining. No single red flag establishes suspicious activity. What counts is the full picture: the customer’s history, their expected business practices, and whether several indicators appear together.  

  
  

  What financial institutions should review 

  Think of the response as a set of questions your institution should be able to answer, with evidence. 

  Can we see past the name?
  Review the core A7 entities, identified Sub-Agents and related designated persons, including relevant ownership and control relationships. Test whether screening data and investigations can surface indirect connections, not just direct matches. Consider a targeted look back at relevant customers and transactions as more of the network comes to light. 

  Does the customer’s activity make sense?
  Compare higher-risk customers’ payment volumes, counterparties and commercial purposes with the business you were told about. Assess whether monitoring can identify unusual velocity and layering across jurisdictions, including indirect transfers through correspondent banks. Judge combinations of indicators rather than isolated ones. 

  Does the supporting evidence hold up?
  Check invoices, supplier profiles and trade descriptions against the payment activity. Investigate inconsistencies, including signs of AI-altered documents. Use relevant IP addresses, VPN infrastructure, email domains and websites to support the assessment. Where digital assets are involved, examine links to A7A5, wrapped tokens, USDT conversions and over-the-counter intermediaries that may connect to fiat settlement. 

  Are we ready to report and escalate?
  Make sure investigators know the 17 red flags. For institutions subject to U.S. SAR requirements, FinCEN requests the term FIN-2026-A7NETWORK in field 2 and the narrative of relevant filings. Apply any relevant OFAC blocking and reporting obligations independently of the proposed FinCEN rule, and set clear escalation paths for identified or suspected A7 links. 

  Could we implement the proposed rule?
  Covered U.S. financial institutions should assess the proposed prohibition, notification, due diligence and recordkeeping provisions. Consider how to identify the Sub-Agents specified by FinCEN and detect relevant indirect transactions, including those involving convertible virtual currency. A proposal isn’t a final rule, but financial institutions would be unwise to treat it as distant. 

  Finally, document risk assessments, monitoring decisions, investigations, escalation outcomes and control testing. If a regulator asks how a suspicious relationship was found and judged, the answer should be on paper. 

  
  

  The lesson beyond A7 

  The A7 case is a reminder that a payment instruction is only a sliver of the story. A transaction can involve a plausible company, a recognized bank and tidy commercial documents while its true purpose and its real controllers stay out of sight. 

  No single control closes that gap. Screening finds designated parties. Due diligence explains who owns what, and what activity to expect. Monitoring catches behavior that looks wrong. Trade documents and digital asset intelligence add evidence about what a transaction really is. Each does its job. The real test is whether an institution can connect what they each know, at the moment an investigator needs it. 

  Sanctions risk increasingly lives in relationships. The institutions that do well will be the ones that learn to read them.