Skip to content

Back to the catalog

US Designates Russia's A7 Network as Transnational Criminal Organization
decrypt.coarticle

US Designates Russia's A7 Network as Transnational Criminal Organization

OFAC designated Russia's A7 Network a transnational criminal organization and FinCEN proposed a rule under the Combating Russian Money Laundering Act (section 9714) barring US institutions, including crypto exchanges, from transfers tied to its "Sub-Agent" front companies. The network, launched by fugitive oligarch Ilan Shor with state-owned Promsvyazbank, used the ruble-backed A7A5 token (issued by Old Vector on Tron and Ethereum) in a mirror scheme: crypto moved domestically while Sub-Agents made matching fiat transfers abroad in dollars, yuan, dirhams and euros, with staff spoofing their location via VPNs to appear based in Dubai, Hong Kong or Bishkek. FinCEN found over 180 entities moved at least $179.1 billion in A7A5 (mostly via sanctioned exchanges Garantex and Grinex) and ties the network to Iranian sanctions evasion, Nobitex, and laundering of North Korean exchange-hack proceeds.

TL;DR US Treasury designated Russia's A7 Network and proposed cutting off its crypto/fiat Sub-Agent front companies, exposing a $179B+ ruble-stablecoin laundering and sanctions-evasion scheme tied to Iran and Promsvyazbank.
Document

What it is

FinCEN's proposed rule under section 9714 of the Combating Russian Money Laundering Act targets the A7 Network by invoking the sixth of six available "special measures" — a transmittal-of-funds prohibition — rather than the fifth (correspondent account restrictions). This choice is the substantive detail the page adds: OFAC's designation and the rule's existence are already in the summary, but why FinCEN picked this specific measure is not.

How it works

Blockchain intelligence firm TRM Labs noted that the fifth special measure, which restricts correspondent banking relationships, "would have left a hole": A7A5 token transactions move outside correspondent banking entirely, so a correspondent-account-based restriction wouldn't touch the token side of the network's mirror scheme. The sixth measure instead prohibits transmittals of funds — reaching fiat and crypto alike — which is why FinCEN selected it as the only option that closes both halves of the mirror system (ruble-token moves domestically, fiat moves abroad).

Preconditions / Affected

The proposed rule would bind roughly 348,000 US institutions, including crypto exchanges. On the fiat side, A7 has built or acquired Sub-Agents holding accounts at about 435 financial institutions across at least 83 countries. Since a reported hack at Grinex in April 2026, A7A5 token supply has consolidated into unhosted wallets — FinCEN reads this as a possible shift away from the sanctioned exchanges (Garantex, Grinex) that historically carried almost all A7A5 volume.

What to do

The rule is still a proposal: the public comment period closes 30 days after it appears in the Federal Register. There is no compliance deadline yet — institutions should watch for the Federal Register publication date to calculate the comment window, and crypto exchanges in particular should note the rule explicitly covers convertible virtual currency, not just fiat.

Caveats

The $179.1 billion A7A5 volume figure and the "unhosted wallet consolidation" trend are FinCEN's own findings/interpretation, not independently verified. The rule's current status is proposed, not final — its scope could change before or after the comment period closes.

Organisations named here

  • Combating Russian Money Laundering Act
  • FinCEN
  • Garantex
  • Grinex
  • IRGC
  • OFAC
  • Operation Economic Outcast

Technologies named here

  • A7A5 token
  • TRM Labs
  • Custom VPNs
  • Old Vector
  • Promsvyazbank
  • TRON
  • Ethereum
  • USDT
  • VPN
  • A7A5

Techniques named here

  • Shadow banking / mirror transaction system
  • Non-freezable token bridging
  • Location spoofing via VPN
  • Trade-disguised sanctioned payments
  • Wallet consolidation to evade sanctioned venues

Threat actors named here

  • A7 Network
  • Ilan Shor
  • Islamic Revolutionary Guard Corps
  • Garantex
  • Grinex
  • Nobitex
  • North Korean exchange hackers