On October 1, the US Treasury's Financial Crimes Enforcement Network (FinCEN) published a finding and a notice of proposed rulemaking (NPRM) that designate transactions involving any company outside the United States controlled by the A7 network as a class of transactions of primary money laundering concern in connection with Russian illicit finance. FinCEN proposes to prohibit covered US financial institutions from sending or receiving funds, including convertible virtual currency, connected to these companies, which the agency calls «Sub-Agents».
The measure was taken at the same time as the decision by the US Treasury's Office of Foreign Assets Control (OFAC) to designate the A7 network as a significant transnational criminal organization under Executive Order 13581, as part of an operation the Treasury calls Economic Outcast. Taken together, the two decisions target both the network itself and the global system of shell companies that gives it access to the international financial system.
FinCEN's finding is based on an extensive analysis of A7's activities, including the findings of the study «The A7 Leaks: On-Chain Analysis of Russia's Cryptocurrency Connections», published in June 2026 together with the Open Source Centre. The NPRM uses these materials to substantiate the network's links to North Korea, Iran-backed terrorist groups, ransomware operators and the Islamic Revolutionary Guard Corps (IRGC).
The legal instrument
FinCEN is acting under section 9714 of the Combating Russian Money Laundering Act, as amended by the National Defense Authorization Act for Fiscal Year 2022. Section 9714 allows the Treasury to apply the five special measures provided for in section 311 of the USA PATRIOT Act to classes of transactions connected to illicit financial flows from Russia. It also provides for a sixth measure, which allows the Treasury to prohibit or restrict certain transmittals of funds.
This measure continues the line of action FinCEN began with its 2024 section 9714 order against the Russia-linked exchange PM2BTC and its 2025 section 311 action against Huione Group. In both cases, the special authorities were used against hybrid money laundering infrastructure combining fiat funds and cryptocurrency.
The A7 network
The A7 network was officially launched in September 2024 by two parties under US, EU and UK sanctions: the fugitive Moldovan oligarch Ilan Shor and the Russian state-owned defense bank PSB (Promsvyazbank). The core of the network consists of three Russia-registered companies, A7 LLC, A71 LLC and A7 Agent LLC, jointly owned by Shor and PSB. They work together with Russian and Kyrgyz infrastructure participants, including Old Vector LLC, the crypto exchanges Garantex and Grinex, InDeFi Bank, ExVed and Garantex co-founder Sergey Mendeleev.
At the launch, PSB described the service as a way to «support Russian participants in foreign economic activity and their trading partners amid sanctions pressure on Russia».
Vladimir Putin attended the virtual opening of A7's office in Vladivostok, and the network's users reportedly included Roman Abramovich, Nikolai Patrushev and Arkady Rotenberg.
The collapse of the A7 empire: how the ruble-pegged stablecoin A7A5 lost its liquidityJul 31, 2026Read more
The Sub-Agents
The Sub-Agent structure is at the center of FinCEN's finding. Roughly 80% of Russian banks have been under sanctions since 2022, and many of them have lost access to SWIFT. A7 fills this gap by creating, acquiring or recruiting companies in third countries, including Hong Kong, Indonesia, Kyrgyzstan, the Seychelles, Turkey and the UAE. On paper, these companies are owned and run by non-Russians. In practice, they are controlled by A7.
The mechanism follows the classic trade-based money laundering scheme. A Russian client settles its obligation inside the A7 system, often by buying promissory notes. Between September 2024 and July 2025, A7 clients bought more than 3,200 such notes with a total value of over $25 billion. A7 then assigns a foreign Sub-Agent matching a particular industry to act formally as the paying party, generates trade documents with no mention of Russia and manages the Sub-Agent's bank accounts from Moscow via VPN, creating the impression that the transactions are carried out from Dubai, Hong Kong or Bishkek.
The NPRM names six Sub-Agents registered in the UAE. The largest of them, Power Sphere LLC-FZ, processed $61M connected to trade-based money laundering and procurement for Russia's energy sector between September 2023 and July 2025. The other companies are:
- Hydrofusion Resources FZ-LLC ($3.6M);
- Gimli Trade LLC-FZ ($1.5M; the company was sanctioned by the UK in December 2025);
- Galadriel Trading FZCO (more than $946K connected to export control evasion);
- Sigizmund FZCO ($41K, including dual-use goods);
- Pearl Bridge (around $30K).
The Iranian segment also runs through this structure. One of the Sub-Agents transacted directly with entities linked to Iran's shadow fleet. This Sub-Agent and an associated company received nearly $140M from entities involved in evading Iranian sanctions between July 2023 and October 2025. Another Sub-Agent sent around $1.6M to a company linked to weapons procurement for Iran.
A7A5 and the crypto layer
The A7A5 stablecoin runs in parallel with the fiat system. It is a Russian ruble-backed token issued by the Kyrgyzstan-registered company Old Vector and operating on the Tron and Ethereum networks. Each token is backed by ruble deposits at PSB. FinCEN describes this system as a kind of mirror infrastructure. The tokens move between internal addresses inside Russia and represent foreign payments, while the Sub-Agents make the corresponding fiat transfers abroad in dollars, yuan, dirhams and euros. The two sides are reconciled in A7's accounting system, while the settlement participants remain isolated from one another.
Historically, these transactions ran almost entirely through sanctioned platforms such as Garantex and Grinex. After the reported hack of Grinex in April 2026, A7A5 supply consolidated in non-custodial wallets, which FinCEN sees as a possible shift away from sanctioned exchanges. A7 most often uses A7A5 as an unfreezable bridge into USDT and then into fiat currencies, with liquidity provided by OTC brokers from jurisdictions of concern to regulators. FinCEN also notes the existence of wrapped A7A5 tokens on other blockchains.
These findings largely match the results of earlier on-chain analysis. Research into A7's infrastructure identified more than $166 billion in on-chain turnover linked to the network and $176.6M in transactions with sanctioned parties, including the IRGC, Hamas and the Houthis. In particular, more than $65M was transferred from an IRGC-linked address to a single A7 address, around $5M was linked to Hamas, and more than $590K came from the proceeds of North Korea's hacks of BTCTurk and Woo X. The research also found that roughly a third of the A7A5 volume of $110 billion claimed at the time consisted of circular transfers between A7-controlled addresses, that is, the internal accounting operations that FinCEN now describes. An earlier study of Garantex, Grinex and A7A5 showed how A7A5 was used to move Garantex clients to Grinex after Garantex was shut down in March 2025. FinCEN also refers to this migration.
The Kyrgyz exchange TokenSpot could become a point for disrupting the A7 network
Grinex, A7A5 and Meer were set up in Kyrgyzstan as parts of A7's broader cryptocurrency ecosystem. Another entity, also based in Kyrgyzstan, has been identified as well: TokenSpot, which runs on the same infrastructure as Grinex, including shared collection addresses. With a transaction volume of $6.7 billion, TokenSpot shows abnormally high turnover for a company of its size and jurisdiction. A7, Grinex and Garantex together account for 28% of TokenSpot's outgoing volume.
Leaks of A7's internal chats contained a large amount of data on cryptocurrency transactions. Among them were initial USDT transfers sent to A7 substructures that presumably operated in other jurisdictions. Most of these and other transactions from the same A7-controlled wallets around the summer of 2025 can be linked to OTC desks and payment services based in the US, the UAE and the UK. According to the researchers, large crypto exchanges were also used to carry out these multimillion-dollar transactions, after which A7-linked individuals made further transfers through various VASPs to conceal the original source of the funds.
What the proposed rule provides for
The proposed rule, 31 CFR 1010.668, applies to all financial institutions subject to the Bank Secrecy Act (BSA), roughly 348,000 entities, including banks, broker-dealers and money transmitters, among them crypto exchanges. It would prohibit any transmittal of funds to or from a Sub-Agent, as well as to any convertible virtual currency (CVC) account or address controlled by a Sub-Agent or administered on its behalf.
FinCEN explains that publishing the full list would allow A7 to set up replacement companies faster. Financial institutions are required to block only transfers connected to entities on this list.
On cryptocurrency, FinCEN acknowledges that financial institutions usually cannot reject an incoming on-chain transfer before it is received. An institution that receives CVC from a listed Sub-Agent's address is considered compliant if it blocks the funds where other authorities require it, or rejects the transaction, denying the recipient access to the funds and returning them to the originating address. Where OFAC asset-blocking requirements apply, the blocking itself satisfies this rule.
Financial institutions must notify affected persons with whom they have a direct business relationship and document that notification, and must also apply a risk-based approach to additional due diligence, which FinCEN believes can be carried out using existing sanctions screening tools. Listed entities will be able to petition FinCEN for removal. Comments on the proposal will be accepted for 30 days after its publication in the Federal Register under docket FINCEN-2026-0265.
What compliance teams should do now
The fiat transaction typologies described by FinCEN give banks a fairly clear screening profile.
Teams should be ready to integrate the FI Portal list into their wallet screening systems as soon as the final rule is adopted, since blockchain analytics will be the tool that allows financial institutions to link a listed Sub-Agent to the cryptocurrency addresses it controls.
A7 built the network so that Russian money would look like ordinary trading activity in Dubai. FinCEN's proposal makes the companies that provide this cover toxic to the US financial system and lays the groundwork for other countries and financial institutions around the world to follow suit.
