A7 Sanctions Evasion Network: FinCEN Findings and Rule

The Financial Crimes Enforcement Network (FinCEN) found that overseas sub-agents of the A7 sanctions evasion network processed more than $17 billion between January 2025 and June 2026, and proposed on October 1 to bar US funds transfers involving them.

Press investigations published earlier allege that A7, a Russia-linked payment network, moved $6.9 billion through global banks using front companies and forged trade documents. The FinCEN findings describe a larger operation than that figure suggests, and they put a public account of its structure in front of every bank and payment firm that handles cross-border flows.

For compliance teams, the case turns on one question: how far does due diligence reach into the agents and intermediaries that sit behind a customer? The proposed rule would require screening for named sub-agents, and FinCEN’s alert lists red flags that transaction monitoring and trade-document checks can test against. Comments on the proposal are due November 4, 2026.

What FinCEN found on the A7 sanctions evasion network

FinCEN said that as of June 2026 the network held bank accounts at about 435 financial institutions in at least 83 countries. Its sub-agents are third-country companies that receive and remit payments on behalf of the network. They gave A7 access to correspondent banking relationships, SWIFT messaging and foreign-currency liquidity, according to the proposal.

The proposal also covers digital assets. FinCEN found that more than 180 entities processed transactions in A7A5, a ruble-backed token, worth at least $179.1 billion from February 2025 to June 2026. It said transfers within Russia in that token mirror fiat movements through the sub-agents, which keeps counterparties separated from one another.

The two headline numbers measure different things. The $6.9 billion in press reports concerns funds the investigations traced through banks. The $17 billion is the volume FinCEN found at the sub-agents.

The Treasury Department announced the action on October 1 under what it calls Operation Economic Outcast. “Treasury is dismantling the financial infrastructure that allows Iran and other adversaries to evade sanctions,” said Scott Bessent, Secretary of the Treasury, in the Treasury announcement. Treasury said the network, led by Ilan Shor, was also used by Iran to evade sanctions.

The proposed rule and OFAC designation

FinCEN’s notice of proposed rulemaking, published in the Federal Register on October 5 (docket FINCEN-2026-0265), relies on section 9714(a) of the Combating Russian Money Laundering Act. That law, Public Law 116-283 as amended in 2021, lets Treasury prohibit transmittals of funds tied to a Russian money laundering concern. The proposal would add a new section, 31 CFR 1010.668.

It would bar covered financial institutions from sending or receiving funds to or from any sub-agent, or any account or virtual currency address administered for one. Six sub-agents are named:

Galadriel Trading FZCO
Gimli Trade LLC-FZ
Hydrofusion Resources FZ-LLC
Pearl Bridge
Power Sphere LLC-FZ
Sigizmund FZCO

FinCEN said the definition is not limited to those six. It will share the full list with covered institutions through its secure FI-Portal and update it. Listed entities can petition FinCEN for removal.

The Office of Foreign Assets Control (OFAC) separately sanctioned the A7 network as a significant transnational criminal organization. Its property in US jurisdiction is blocked, as are entities 50% or more owned by blocked persons. OFAC had designated A7 LLC and Old Vector LLC, the issuer of A7A5, on August 14, 2025.

UK and EU measures tied to A7

FinCEN’s notice states that A7 LLC, A71 LLC and A7 Agent LLC are sanctioned by the US, the EU and the UK. It says Shor and Promsvyazbank are designated by all three. The UK sanctioned Gimli Trade LLC-FZ, one of the named sub-agents, on December 18, 2025.

Treasury said its action follows an alert on A7 issued by the UK National Crime Agency on August 31, 2026. Firms that operate across jurisdictions therefore face overlapping designations, each with its own screening list.

What A7 means for sub-agent due diligence

Under the proposal, institutions would take a risk-based approach and use screening able to detect a sub-agent as originator, beneficiary or a referenced party. FinCEN cites commercially available OFAC-style screening software as an example. An institution that knows or has reason to believe a prohibited transmittal is involved must notify affected parties with whom it has a direct commercial relationship, and document that it did so.

FinCEN’s red flags go beyond list matching. They include:

unusually high transaction volumes soon after a company is formed
goods descriptions that do not match the supplier’s business profile
payment routing through companies controlled by the network
falsified or AI-altered invoices
sub-agent activity that appears to come from VPN-linked IP addresses in Dubai, Hong Kong or the Kyrgyz Republic

Those indicators sit across trade finance, payments and onboarding. They also bear on third-party risk programs, because the exposure arrives through an agent rather than the account holder. Teams that keep screening, document review and customer files in separate systems will find the pattern harder to see, a problem covered in how AML tech stacks are being rewired around shared data feeds.

FinCEN estimates the rule would give 128 institutions with foreign correspondent accounts expanded obligations and 34,665 others limited ones. It puts the annual cost at about $17.7 million.

A practitioner view on A7 sanctions evasion risk

Becki LaPorte, Principal for AML Strategy and Innovation at screening vendor FinScan and a former chief AML officer at a large US broker-dealer, said capital-markets firms often keep product review and financial-crime review apart. Product due-diligence teams, she said, consulted her when something looked unusual. “They would bring me in if something was funky,” she said. “But they wouldn’t bring me in on a regular basis.”

LaPorte said the same distance appears with intermediaries. Advisers who place trades for clients, omnibus accounts that combine underlying customers, and the split between clearing and introducing brokers can each leave a firm with limited sight of ultimate beneficial ownership. Each party may assume the other has done the check, she said.

She also recalled colleagues at her former firm saying they did not work with Russia or China, and said a domestic customer base does not set the reach of the securities a firm offers. These are her examples of potential exposure. They are not findings that any product breached sanctions, and neither FinCEN nor OFAC has said so.

LaPorte argued that public enforcement actions would help peers if they described control failures in more detail. “There’s so little information that’s given publicly,” she said. “It’s really hard to make that correction.” FinCEN’s notice is unusually specific on ownership links, entity names and typologies, which addresses part of that complaint for this case.

Who else is exposed to the A7 network

FinCEN’s text points to correspondent banks, payment firms and digital asset providers. Over-the-counter digital asset brokers outside Russia may act as liquidity providers, it said, and US institutions may meet wrapped A7A5 tokens through decentralized finance applications. FinCEN noted there are few ready ways to reject incoming virtual currency before it is received.

Teams are also testing AI agents for AML and risk monitoring against patterns such as newly formed counterparties and mismatched goods descriptions, which FinCEN lists as indicators. Onboarding teams working across borders will also want to compare these indicators with their KYC requirements for agents and intermediaries.

The comment period on the proposed rule closes November 4, 2026. FinCEN has not issued a final rule, and the full sub-agent list will remain available only through the FI-Portal.