A7 Network sanctions: FinCEN proposes a ban on payments to its Sub-Agents

The A7 Network sanctions of 1 October 2026 put a Russia-linked payment network on the SDN List and, through a FinCEN proposal, would bar US financial institutions from moving funds for its Sub-Agents. The Sub-Agents are third-country front companies. FinCEN would identify most of them only on a list shared privately with institutions.

• OFAC designated the A7 Network as a significant transnational criminal organisation on 1 October 2026; its blocking obligations apply now.
• FinCEN proposed, under section 9714(a) of the Combating Russian Money Laundering Act, a ban on transmittals of funds involving A7 Network Sub-Agents. Comments run for 30 days after Federal Register publication.
• FinCEN says the Sub-Agents processed more than 17 billion dollars between January 2025 and June 2026, and banked at about 435 institutions in at least 83 countries.
• Only six Sub-Agents are named in the proposed rule text. The rest would sit on a list FinCEN shares through its secure FI-Portal, not in public.
• A FinCEN Alert asks for SARs tagged "FIN-2026-A7NETWORK" and lists red flags, from VPN domains to AI-altered invoices.

What did Treasury announce about the A7 Network?

Treasury took three linked actions on 1 October 2026 under Operation Economic Outcast, its campaign against Iran's financial channels. OFAC designated the A7 Network itself. FinCEN published a finding and proposed rule against the network's Sub-Agents. FinCEN also issued an Alert, FIN-2026-Alert007, with red flags and a SAR filing request.

The Treasury press release describes A7 as a shadow banking network with ties to Russia, used by the Iranian regime, the Islamic Revolutionary Guard Corps (IRGC) and Iran-backed groups to move money. According to the FinCEN proposed rule, the network was created by sanctioned Moldovan businessman Ilan Shor and Russia's state defence bank Promsvyazbank (PSB), and formally launched in September 2024. Treasury had already designated core A7 companies, including A7 LLC and the stablecoin issuer Old Vector LLC, in August 2025.

The new step is the designation of the network as a whole. In the OFAC recent actions notice, the network appears as one SDN entry, "A7 NETWORK", tagged as a criminal organisation, with addresses in Russia, Kyrgyzstan, Nigeria and Zimbabwe. None of the six Sub-Agents named in FinCEN's draft appears as its own entry.

Treasury also links the network to Hamas, to Nobitex, the Iranian exchange OFAC designated on 2 June 2026, and to North Korean hacks of crypto exchanges.

The 91.5 billion dollar figure is the A7 Network's own claim; the 17 billion and 179.1 billion dollar figures come from FinCEN's analysis of financial data.

How do A7 Network Sub-Agents hide the money trail?

Sub-Agents are companies in third countries that the A7 Network forms, buys or partners with, then controls. They sign the invoices and send the payments, so a Russian or Iranian customer never appears in the payment chain. FinCEN calls the result trade-based money laundering.

The FinCEN Alert sets out the sequence. A customer gives the A7 Network its supplier details and trade paperwork. The network settles the obligation internally, partly through bills of exchange called veksels, then assigns a Sub-Agent to appear as the paying party and wire the funds through correspondent banking and SWIFT. In FinCEN's words, the payments "appear to financial institutions as ordinary commercial activity."

The Sub-Agents are typically presented as owned or managed by non-Russian nationals in places such as Hong Kong, Indonesia, the Kyrgyz Republic, the Seychelles, Türkiye and the United Arab Emirates. FinCEN says Moscow-based staff run their bank accounts through custom VPNs that make logins appear to come from Dubai, Hong Kong or the Kyrgyz Republic.

FinCEN publicly names six Sub-Agents, all based in the UAE, and gives the illicit flows it attributes to each.

According to the proposed rule, the UK sanctioned Gimli Trade LLC-FZ on 18 December 2025. The small sums at the bottom of the table suggest value thresholds alone may miss Sub-Agent activity.

A parallel digital asset rail runs on A7A5, a ruble-backed stablecoin on Tron and Ethereum. Treasury says the token is blocked property because of Old Vector's interest. FinCEN says US institutions are unlikely to see A7A5 directly. A7 has most often used it as a bridge into USDT, and the Alert flags new or fast-growing over-the-counter brokers and "wrapped" versions of the token as likely points of contact.

How does this compare with earlier section 9714 actions?

The earlier section 9714 actions on FinCEN's special measures list, Bitzlato and PM2BTC, each targeted one named crypto exchange and took effect by order. The A7 proposal targets a class of transactions covering an undisclosed number of front companies, and comes as a proposed rule, not an order.

FinCEN described the Bitzlato order as the first issued under section 9714(a). The PM2BTC order followed the same template: a prohibition on transmittals to or from one exchanger and any account or CVC address it administers. The A7 draft reuses that wording but applies it to every entity FinCEN identifies as a Sub-Agent, which moves the identification problem from the institution to FinCEN's list.

What do the A7 Network sanctions change for your obligations?

The OFAC designation binds US persons today: block and report A7 Network property, including transactions involving Sub-Agents acting for the network. The FinCEN ban is not yet law. The Alert asks for SAR tagging now. Each layer touches a different control: sanctions screening, KYB ownership checks, SAR filing and record-keeping.

Sanctions blocking and reporting. Treasury states that property of the A7 Network, "including transactions involving Sub-Agents acting for or on behalf of the A7 Network", is blocked and must be reported to OFAC. OFAC applies strict liability for civil penalties, and its 50 percent rule blocks entities owned 50 percent or more, directly or indirectly, individually or in the aggregate, by blocked persons. One network entry gives name matching little to work with, so sanctions screening has to reach control and payment-chain data, not only names.

The proposed transmittal ban. The draft defines Sub-Agents by a short named list plus "any other entity identified by FinCEN as a Sub-Agent of the A7 Network." If finalised, proposed 31 CFR 1010.668 would prohibit any covered financial institution from sending or receiving funds, including convertible virtual currency, involving a Sub-Agent. Institutions that know or have reason to believe a transfer is prohibited would have to notify affected customers with whom they have a direct commercial relationship, and document that notice. Where an OFAC blocking duty and the ban overlap, the draft says blocking prevails and satisfies the ban. Wilful violations of a final rule could carry criminal penalties under 31 U.S.C. 5322.

Special due diligence and KYB. The draft requires risk-based procedures to identify transactions involving Sub-Agents, using screening tools institutions already run. Because Sub-Agents use nominee owners, the stronger control is KYB that tests who controls a company, not only who is registered as its ultimate beneficial owner.

SAR filing. FinCEN asks filers to put "FIN-2026-A7NETWORK" in SAR field 2 and the narrative. The red flags turn onboarding data into evidence: account access from IP addresses tied to the VPN domains muzpan[.]com or sodkamus[.]com, and emails on those mail servers. A suspicious activity report built on those signals depends on having captured them at onboarding.

What is still uncertain about FinCEN's Sub-Agent rule?

The largest open question is the private list. FinCEN would share it with covered financial institutions only through its FI-Portal, arguing that "a broader public distribution of the list would undermine the purposes of the proposed rule". The draft does not say how hundreds of thousands of money services businesses would get access, or how fast updates would reach them.

A listed company could petition FinCEN for reconsideration and receive a written decision.

FinCEN estimates that 347,926 institutions fall within the rule's scope, of which about 35,000 would bear more than a minimal burden, at an aggregate cost of up to about 18 million dollars a year. Money services businesses make up 332,068 of the total, and a small remitter may never see the trade invoice behind a payment it relays.

Digital assets add a mechanical gap. FinCEN itself concedes there are few ways to reject an incoming crypto transfer before it lands, so the draft lets institutions act on the funds after receipt. That shifts the burden to fast detection and to records of what the institution did next.

Network displacement is another risk to the A7 rule. FinCEN reports that A7A5 has moved into unhosted wallets since an alleged hack of the Grinex exchange in April 2026, and Shor said in June 2026 that "A7 plans to operate everywhere". A periodic list will lag a network built to spin up new companies.

Non-US firms face indirect exposure. Treasury's release warns that non-US persons may not cause US persons to violate sanctions. UK and EU sanctions already cover A7's core companies, and the UK National Crime Agency issued its own A7 flash alert in August 2026.

Which firms are most exposed to A7 Network Sub-Agents?

Banks with trade finance and correspondent books carry the most direct risk, because Sub-Agents need dollar, euro, yuan and dirham clearing. Payment firms and money services businesses that onboard small import-export companies follow closely. Crypto platforms with OTC desks or stablecoin settlement in the named jurisdictions face the digital asset side, a pattern Zyphe also traced in Tether's Iran exposure.

FinCEN's red flags read like an onboarding checklist. A recently formed company that suddenly runs high volumes with unrelated counterparties fits the pattern. So do invoices with out-of-place Cyrillic characters, an analog company stamp on a digital document, or signs of AI alteration.

How should compliance teams respond?

Act on the designation now and prepare for the rule. Confirm the A7 Network entry is loaded in every screening engine, including payment and crypto address screening. Then review existing customers against the Alert's red flags, starting with recently formed trading companies in the named jurisdictions.

Next, check whether your institution can access FinCEN's FI-Portal, and who would receive and load the Sub-Agent list. Draft the customer notice the rule would require. Add the VPN domains and IP ranges from the Alert to device and login analytics, and re-screen trade documents for the invoice anomalies FinCEN lists.

Finally, consider commenting. As of 2 October 2026 the proposal was still pending publication in the Federal Register, so the 30-day comment clock had not started. FinCEN has asked for views on the notice, the due diligence scope and its choice of a transmittal ban over other special measures. Comments go to regulations.gov under docket FINCEN-2026-0265.

Zyphe runs KYB with recursive ownership resolution across 240+ corporate registries, and AML screening, while verified identity documents stay encrypted in the user's own vault, so a business sees verification results and audit trails without building a central store of customer PII. To see how it handles front-company risk, book a demo.

The bottom line

A7 is a sanctions target that is a network, not a name. With one SDN entry and a mostly private list of front companies, the burden moves to ownership and control checks, onboarding signals and payment-chain analysis. Teams that capture those signals will be better placed for the final rule; name matching alone cannot catch Sub-Agents FinCEN has not published.

Cited sources

• US Treasury press release, Operation Economic Outcast takes action against the A7 Network, 1 October 2026
• FinCEN notice of proposed rulemaking, special measure on transactions involving the A7 Network's Sub-Agents (RIN 1506-AB77)
• FinCEN Alert on the A7 Network, FIN-2026-Alert007
• OFAC recent actions, SDN List updates of 1 October 2026
• FinCEN, Bitzlato identified as a primary money laundering concern, first section 9714 order
• FinCEN order imposing a special measure on PM2BTC, September 2024
• FinCEN, section 311 and section 9714 special measures list
• UK National Crime Agency, flash alert on the A7 sanctions evasion mechanism, August 2026