
US Designates Russia's A7 Network as Transnational Criminal Organization
OFAC designated Russia's A7 Network a transnational criminal organization and FinCEN proposed a rule under the Combating Russian Money Laundering Act (section 9714) barring US institutions, including crypto exchanges, from transfers tied to its "Sub-Agent" front companies. The network, launched by fugitive oligarch Ilan Shor with state-owned Promsvyazbank, used the ruble-backed A7A5 token (issued by Old Vector on Tron and Ethereum) in a mirror scheme: crypto moved domestically while Sub-Agents made matching fiat transfers abroad in dollars, yuan, dirhams and euros, with staff spoofing their location via VPNs to appear based in Dubai, Hong Kong or Bishkek. FinCEN found over 180 entities moved at least $179.1 billion in A7A5 (mostly via sanctioned exchanges Garantex and Grinex) and ties the network to Iranian sanctions evasion, Nobitex, and laundering of North Korean exchange-hack proceeds.
What it is
FinCEN's proposed rule under section 9714 of the Combating Russian Money Laundering Act targets the A7 Network by invoking the sixth of six available "special measures" — a transmittal-of-funds prohibition — rather than the fifth (correspondent account restrictions). This choice is the substantive detail the page adds: OFAC's designation and the rule's existence are already in the summary, but why FinCEN picked this specific measure is not.
How it works
Blockchain intelligence firm TRM Labs noted that the fifth special measure, which restricts correspondent banking relationships, "would have left a hole": A7A5 token transactions move outside correspondent banking entirely, so a correspondent-account-based restriction wouldn't touch the token side of the network's mirror scheme. The sixth measure instead prohibits transmittals of funds — reaching fiat and crypto alike — which is why FinCEN selected it as the only option that closes both halves of the mirror system (ruble-token moves domestically, fiat moves abroad).
Preconditions / Affected
The proposed rule would bind roughly 348,000 US institutions, including crypto exchanges. On the fiat side, A7 has built or acquired Sub-Agents holding accounts at about 435 financial institutions across at least 83 countries. Since a reported hack at Grinex in April 2026, A7A5 token supply has consolidated into unhosted wallets — FinCEN reads this as a possible shift away from the sanctioned exchanges (Garantex, Grinex) that historically carried almost all A7A5 volume.
What to do
The rule is still a proposal: the public comment period closes 30 days after it appears in the Federal Register. There is no compliance deadline yet — institutions should watch for the Federal Register publication date to calculate the comment window, and crypto exchanges in particular should note the rule explicitly covers convertible virtual currency, not just fiat.
Caveats
The $179.1 billion A7A5 volume figure and the "unhosted wallet consolidation" trend are FinCEN's own findings/interpretation, not independently verified. The rule's current status is proposed, not final — its scope could change before or after the comment period closes.
Organisations named here
- Combating Russian Money Laundering Act
- FinCEN
- Garantex
- Grinex
- IRGC
- OFAC
- Operation Economic Outcast
Technologies named here
- A7A5 token
- TRM Labs
- Custom VPNs
- Old Vector
- Promsvyazbank
- TRON
- Ethereum
- USDT
- VPN
- A7A5
Techniques named here
- Shadow banking / mirror transaction system
- Non-freezable token bridging
- Location spoofing via VPN
- Trade-disguised sanctioned payments
- Wallet consolidation to evade sanctioned venues
Threat actors named here
- A7 Network
- Ilan Shor
- Islamic Revolutionary Guard Corps
- Garantex
- Grinex
- Nobitex
- North Korean exchange hackers
Related in Threat Intel
Reverse Engineering the Six Stages of MacSync Stealer and RAT
AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
