A7 Moved $17 Billion Through Front Companies With Accounts at 435 Institutions. Treasury's Rule Targets the Companies, Not the Token

What Happened

The United States Department of the Treasury moved against the A7 Network on Thursday, October 1, with 3 instruments at once. The Office of Foreign Assets Control (OFAC) designated the network a significant transnational criminal organization under Executive Order 13581. The Financial Crimes Enforcement Network (FinCEN) found that transactions involving any non-US company controlled by A7 are a class of transactions of primary money laundering concern tied to Russian illicit finance, and proposed a rule under section 9714(a) of the Combating Russian Money Laundering Act that would bar covered US financial institutions from any transmittal of funds, convertible virtual currency included, to or from those companies or any account or crypto address run on their behalf.

FinCEN also issued an alert, FIN-2026-Alert007, with red flags for banks. Treasury filed the package under Operation Economic Outcast, its economic campaign against Iran, and sanctioned Iran's auto and rail sectors the same day.

A7 was formed in 2024 by Ilan Shor, a fugitive Moldovan politician convicted of fraud at home and sanctioned by OFAC in 2022, with Promsvyazbank (PSB), the state-owned Russian bank tied to the military. OFAC had already sanctioned A7's 3 Russian companies, its Kyrgyz token issuer Old Vector, and the Grinex exchange on August 14, 2025.

FinCEN says A7 forms, acquires, or partners with companies in third countries, represented on paper as owned by non-Russian nationals, and uses them to make and receive payments for clients. It calls them Sub-Agents. As of June 2026 there were hundreds, with accounts at approximately 435 financial institutions in at least 83 countries, and they processed more than $17 billion between January 2025 and June 2026.

1 Sub-Agent dealt directly with Iran's shadow tanker fleet; it and a sister company took in nearly $140 million from entities involved in Iranian sanctions evasion. Treasury says the same pathways served ransomware operators, the Islamic Revolutionary Guard Corps (IRGC), and proxies including Hamas.

The ruble token was the part of A7 built to be seen. The rail was hundreds of companies with clean paperwork and accounts at 435 institutions, and the rule aimed at them will be applied to you by an exchange reading a list you cannot.

The Front Company Is the Product

The United Kingdom's National Crime Agency (NCA) got here a month earlier. Its flash alert of August 31, the first it has sent to the whole regulated sector, describes A7's instrument of choice as the veksel, a Russian promissory note a client buys that then stands as credit for a payment executed abroad through one of the network's companies.

The mechanism runs on bank rails: shell companies with local accounts, false invoices, staff on virtual private networks to appear located wherever they are seeking banking services. FinCEN's red flags are generic for the same reason: high volumes soon after an account opens, trade paperwork that does not match the goods, payment routes that cross several countries.

None of that is a signature. It is what any busy trading company looks like until someone pulls the ownership thread.

That is why the shape of the US response matters more than the designation. Section 9714 lets Treasury apply the special measures of section 311 of the USA PATRIOT Act to Russian illicit finance and adds a 6th: a prohibition on transmittals of funds. Its 2 prior uses on the public record, against Bitzlato in 2023 and PM2BTC in 2024, were orders against named exchanges.

This time FinCEN is proposing a rule against a class, any company A7 controls whether or not it has been named, with comments due 30 days after Federal Register publication. The scope is every institution the Bank Secrecy Act covers, roughly 348,000 by the estimate TRM Labs cites, including money services businesses such as crypto exchanges.

And the Sub-Agents' identities, by FinCEN's own account, will be distributed primarily through its secure portal for financial institutions. A designation puts a name on a public list; this puts the names in a channel only the institution screening you can see. The contrary case is that this is how a shell network has to be fought: publish the list and A7 re-registers the companies by Friday.

It still means the decision about your wire, or your withdrawal, will be made against a list you cannot read, by an institution penalized for a miss and not for a false positive.

The Token Was the Visible Part

A7A5, the network's ruble-backed stablecoin, has been the part of A7 the crypto press could see. Issued by Old Vector in the Kyrgyz Republic and backed by ruble deposits at PSB, it is blocked property under US sanctions because its issuer was designated in August 2025: for any US person, every unit carries the sanctioned bank's status.

FinCEN's finding counts more than 180 entities processing at least $179.1 billion in A7A5 transactions between February 2025 and June 2026, and PSB's chief executive, Pyotr Fradkov, claimed in August that cumulative turnover was nearing $140 billion. Against the $17 billion through the Sub-Agents, the token looks like the main event.

The analysts who watch the chain disagree. TRM Labs told CoinDesk in July that about 34% of A7A5's observed volume was circular transfers between related addresses, and put genuine daily volume nearer $75 million than the issuer's claimed $205 million; the issuer answers that data firms undercount its decentralized-finance activity.

Elliptic measured a decline of more than 90% from the token's peak. The reason is Grinex. The Kyrgyz exchange that was A7A5's main venue halted in mid-April after about $13.7 million in USDT left customer wallets in what it called an attack by the special services of unfriendly states; Chainalysis noted the stolen stablecoins were swapped at once for a token no issuer can freeze, a pattern also consistent with an inside job.

Either way, customers have been locked out since. The $17 billion FinCEN cares about did not move on a token. It moved through companies with accounts at 435 financial institutions, and the token's inflated volume, in TRM's reading, was there to build confidence in the rest.

What This Means for You

The practical change is at the checkpoints, not on the chain. Every US custodial venue you use is about to screen against a list it cannot show you, and it will be judged on misses. If you move money across borders, especially through Hong Kong, the UAE, Türkiye, Indonesia, or the Kyrgyz Republic, expect more due diligence requests, held wires, and closed accounts, and expect a share of them to land on legitimate businesses, which are the ones with accounts to freeze.

Keep your own provenance file: who paid you, from what account, for what invoice. Screen unfamiliar counterparties before you accept funds, because an inbound payment from a Sub-Agent's account becomes your problem at the next exchange. And size exchange balances so a compliance hold costs you time, not solvency.

The second lesson is about what a stablecoin is. A7A5 became blocked property the day its issuer was designated because the token is a claim on Old Vector's deposits at PSB, and a claim inherits the status of whoever owes it. That is the architecture that let Tether freeze $42 million before any warrant existed, covered here in September, pointed the other way.

Bitcoin on your own hardware wallet has no issuer to designate and no deposit to attach, which is precisely why Treasury's rule aims at the transmittal layer, where coins meet dollars, rather than at any asset. Private keys change who can move your coins. They do not change who decides whether an exchange will accept them.

Name the limit plainly. Holding your own keys removes the issuer from your position. It does not remove the checkpoint, because the checkpoint is every covered institution, and this proposal just handed them a roster only they can see. The Grinex lesson cuts the same way: a parallel rail with a custodian in the middle is a custodian, and it fails its users the way custodians fail, with sanctions as the trigger rather than the cause.

The case for self-custody was never that the state cannot find the edges of the system. It is that between the edges, nobody else holds the switch.

What to Watch

The Federal Register publication date starts the 30-day comment clock, and the final rule will show whether FinCEN keeps the portal-only list or publishes names. Whether the European Union and the UK follow with class-based measures of their own matters more than the US action alone, since most of the 435 institutions are not American, and the NCA's August alert suggests London is already moving.

Watch how quickly A7 re-registers Sub-Agents under new directors. On the Iran side, Tehran received Washington's reply to its 7-day Hormuz proposal through Qatar on September 30. If those talks fail, Operation Economic Outcast will keep producing actions like this one, and the institutions that held the 435 accounts are the obvious next layer.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.