Finance · sanctions · infrastructure
A7: how Russia rebuilt payment routes under sanctions
A7 gives Russian companies two ways to send money abroad. One uses foreign payment companies with bank access. The other uses A7A5 and dollar stablecoins. After sanctions and law-enforcement operations, operators shifted activity to replacement services.
Records from 31 August–5 October 2026 · read on 6 November
Sanctions now target the broader network
On 31 August, the NCA and UK government published an industry alert about A7. On 1 October, OFAC sanctioned A7 Network as a significant transnational criminal organization, extending action from the entities designated in August 2025 to the broader network.
Separately, FinCEN proposed prohibiting certain transfers by covered US financial institutions involving A7-controlled companies outside the United States, called Sub-Agents. The document published on 5 October is a proposed rule, with comments due on 4 November; expiry of the comment period does not establish adoption of a final rule.
US Treasury alleges that Iranian actors also used the network. A7 denied links to Iran and terrorist organizations in a statement reported by Reuters on 2 October; that article is accessible in AOL’s republication.
More than $17 billion: value of transactions processed by Sub-Agents from January 2025 to June 2026, according to FinCEN’s investigation. These transfers do not measure A7A5 token turnover and are not added to the $119.7 billion or approximately $140 billion above.
NCA / GOV.UK · U.S. Treasury · Federal Register · 5 Oct 2026 · Reuters / AOL · 2 Oct 2026
Inside A7
The main route runs through banks.
The Open Source Centre investigation from June 2026 analyses more than 30,000 documents and internal messages. It describes foreign payment companies and correspondent banks linking Russian-company payments to international financial infrastructure.
A7 can send a Russian company's payment through a foreign company before the money enters international banking.
The investigation includes ledgers, invoices, contracts, SWIFT messages and code. The documents describe foreign payment companies, altered invoices and remote bank access. A7A5 appears in liquidity, internal accounting and some payments involving counterparties that struggle to access banks.
Read the OSC investigation ↗
Follow one invoice
One bill, two payment routes.
A Russian importer needs to pay a supplier abroad. Follow how A7 can move that payment through two documented routes. Choose a route to see the steps.
JavaScript is off. Both routes are visible.
The bank route runs through foreign accounts
OSC describes the main route in three steps. A financial instrument in Russia, a payment company abroad, then correspondent banking.
Russian importer
Owes money to an overseas supplier. Sanctions make a direct cross-border payment harder.
A7 / PSB
A7 takes the roubles and undertakes to settle the supplier's bill using a bill of exchange. Sanctioned defence-sector bank PSB co-owns A7.
Foreign payment company
A Moscow-controlled company holds accounts and liquidity outside Russia and presents itself as local. The OSC investigation identifies nodes in Kyrgyzstan, the UAE, Hong Kong, Hungary and Mongolia.
Correspondent banks
Altered trade documents and remote account access can hide Russian links. The payment then passes through international banks in major currencies.
Overseas supplier
Receives money from the foreign payment company. OSC found supplier payments reaching more than 80 jurisdictions.
The crypto route moves roubles into dollar stablecoins
A7A5 is a blockchain token that carries rouble-denominated value. Abroad, it can be exchanged for widely used dollar stablecoins.
Roubles and A7 infrastructure
The client begins inside a rouble-denominated ecosystem tied to sanctioned PSB.
Old Vector issues A7A5
Kyrgyzstan-based Old Vector issues A7A5. The issuer says each token is backed 1:1 by rouble deposits. Reuters identifies PSB as the reserve bank.
Exchange
Grinex became a main early trading venue after Garantex was disrupted. Later sanctions widened to other exchanges and service providers.
Instant Swapper
Chainalysis says the service exchanges A7A5 into widely used dollar stablecoins. KYC checks appear minimal, and more than $2.2bn has passed through the service.
Overseas counterparty
Receives a dollar stablecoin that is easier to transfer or trade internationally than A7A5.
Test the network
If you cut a node, what still works?
Sanctions history shows that activity can move after a service is lost. Choose interventions. Observed cases and analytical scenarios carry different labels.
Choose interventions
You can combine interventions. The pressure meter is qualitative and does not predict how A7 would adapt.
What changes
Historical cases carry the "observed" label. The other effects are cautious inferences from the documented network.
No intervention selected. The network remains open across both routes.
The highest meter level appears when several hard-to-replace dependencies come under pressure at once. It does not show that the network will collapse. Costs, spillovers and adaptation remain uncertain.
Garantex
Treasury says that, after the 6 March 2025 action, Garantex operators created Grinex infrastructure and moved customer deposits. They used A7A5 to restore equivalent balances.
A7A5 + issuer
US and UK designations and the EU transaction ban raised pressure. The wider A7 network continued operating.
Correspondent banking
OSC describes these relationships as central to the bank route. Losing them would constrain large-scale supplier payments more directly than losing a single blockchain address.
Compare the values
The $140bn sum needs context.
These values cover different dates and scopes. $93.3bn and $119.7bn refer to A7A5. TRM's >$166bn covers a broader A7-linked cluster. PSB itself declares the ≈$140bn sum.
Volume landmarks
$9.3bnJune 2025 · FT
A7A5 movements to/from Grinex-linked wallets in the first four months.
A7A5 movements to/from Grinex-linked wallets in the first four months.
$93.3bn2025 · Chainalysis
A7A5 volume in roughly ten months.
A7A5 volume in roughly ten months.
$119.7bn24 Apr 2026 · Chainalysis
updated estimate of A7A5 volume to that date.
updated estimate of A7A5 volume to that date.
>$166bn12 Jun 2026 · TRM
A7-associated on-chain volume. This measure covers a broader group than A7A5 alone. OSC says ≈$35bn appears to be circular transfers.
A7-associated on-chain volume. This measure covers a broader group than A7A5 alone. OSC says ≈$35bn appears to be circular transfers.
≈$140bn10 Aug 2026 · PSB
declared A7A5 turnover. Company-reported value without a public independent audit.
declared A7A5 turnover. Company-reported value without a public independent audit.
Timeline
After sanctions, new nodes appear and volume rises.
The sequence links enforcement actions to the infrastructure that appeared after them and the volume estimates published later.
A7A5 launches. The rouble-denominated token enters the A7 ecosystem.
infrastructureGarantex is disrupted by an international operation. Treasury later says employees created Grinex and moved customer deposits. A7A5 was used to restore equivalent balances.
enforcementFT already measures $9.3bn of Grinex-linked A7A5 movement in four months.
measurementUS sanctions A7, Grinex and Old Vector. OFAC explicitly describes A7 as a cross-border settlement platform used for sanctions evasion.
USUK targets Grinex, Meer and Old Vector. The British government describes A7A5 as circumvention infrastructure.
UKEU prohibits transactions involving A7A5. Key entities around the token are also targeted.
EUChainalysis: $119.7bn A7A5. In parallel, enforcement moves toward third-country crypto service providers.
measurementUK broadens sanctions to more exchanges and providers. The measures add services tied to A7's liquidity and exchange infrastructure.
UKOSC and TRM publish "The Big Shor". The investigation documents foreign payment companies, altered invoices and dependence on correspondent banks.
investigationWSJ reports shell companies, fabricated trade documents and international expansion. These are journalistic findings. They remain separate from government sanctions findings.
pressPSB claims ≈$140bn A7A5 turnover. The same claim puts A7 at 15,000 regular business customers and up to 2,000 payments a day. All three values come from PSB.
PSB claimOn 31 August, the NCA and UK government published an industry alert about A7.
record / statementOFAC sanctions the A7 Network; FinCEN announces the Sub-Agent proposal.
record / statementUS Treasury alleges that Iranian actors also used the network. A7 denied links to Iran and terrorist organizations in a statement reported by Reuters on 2 October; that article is accessible in AOL’s republication.
record / statementSeparately, FinCEN proposed prohibiting certain transfers by covered US financial institutions involving A7-controlled companies outside the United States, called Sub-Agents. The document published on 5 October is a proposed rule, with comments due on 4 November; expiry of the comment period does not establish adoption of a final rule.
record / statementThe Moldova connection
Ilan Shor co-owns A7 with PSB.
Treasury places a sanctioned Moldovan oligarch among the owners of infrastructure used for Russian cross-border payments.
Ownership and state backing
U.S. Treasury says A7 and its subsidiaries are owned by sanctioned Moldovan oligarch Ilan Shor and Promsvyazbank (PSB), the sanctioned Russian bank serving the defence sector. OSC documents Russian state backing and participation in the project.
OSC found A7 supplier payments reaching more than 80 jurisdictions. Treasury identifies Shor as one of A7's owners.
Source discipline
Every claim says where it comes from.
Official sanctions findings, independent blockchain estimates, company statements and editorial inferences have different statuses.
The US, UK and EU have sanctioned A7 infrastructure
Treasury, the UK and the EU have designated network entities and described A7/A7A5's role in sanctions evasion.
Chainalysis and TRM measure large volumes in different scopes
They use different scopes and methods. Both find volumes in the tens or hundreds of billions.
PSB says ≈$140bn, 15,000 customers and 2,000 payments a day
PSB's CEO made all three statements. No public independent audit is available. Turnover can count the same value repeatedly.
The investigation points to two pressure points
The move from Garantex to Grinex and the OSC investigation point to replacement exchanges, foreign payment companies and correspondent-bank access.
Sources
Evidence behind each claim.
Each source identifies the claim it supports. PSB and A7 data are labelled as operator statements.
Reuters
Rouble-backed A7A5 stablecoin turnover nears $140 billion ↗PSB statements on turnover, customers, payments per day and geographic distribution.
Wall Street Journal
Russia's Hottest Startup Is a State-Backed Sanctions Evasion Network ↗Shell companies, AI-assisted fake invoices, expansion and A7 scale claims. These are journalistic findings.
Open Source Centre
The Big Shor: A7 and the Illusion of Russian Financial Innovation ↗Documents on the bank route, front companies, invoices, SWIFT, TKKR, more than 80 jurisdictions and circular transfers.
TRM Labs
The A7 Leaks: On-Chain Analysis ↗A7-associated on-chain volume and crypto's distinct roles in liquidity and internal accounting.
UK FCDO
UK cracks down on backdoor Russian sanctions evasion ↗Expansion of sanctions toward exchanges and financial infrastructure around A7.
Chainalysis
EU's 20th Russia Sanctions Package ↗Updated $119.7bn A7A5 estimate and measures aimed at third-country virtual-asset service providers.
Chainalysis
Crypto Crime in 2025 ↗$93.3bn in 2025, weekday and weekend pattern, more than $2.2bn through Instant Swapper and continuity from Garantex to Grinex.
Council of the EU
19th package of sanctions against Russia ↗A7A5 transaction prohibition and sanctions on key entities.
UK FCDO
UK targets sanctions circumvention and crypto networks ↗Designations of Grinex, Meer and Old Vector.
U.S. Treasury
Treasury sanctions cryptocurrency exchange and network ↗A7 ownership, A7A5 issuer, the move from Garantex to Grinex and use of A7A5 after disruption.
Financial Times
Crypto coin for Russian shadow payments moves $9bn ↗Early independent measurement and description of the A7A5 to USDT exchange.
A7A5 / Old Vector
A7A5 documentation ↗Used only to describe the token's stated design and 1:1 backing, not as independent validation.
NCA / HM Treasury
Industry alert on A7 ↗Official alert; no inference of complete network removal.
U.S. Treasury
A7 Network designation and Sub-Agent transactions ↗Official action and attributed findings; distinct metrics.
FinCEN
Operation Economic Outcast ↗Proposed measure and alert; separate from OFAC sanctions.
Reuters / AOL
A7 denies links to Iran ↗Reported company response; Reuters original was inaccessible, republication read.
Federal Register / GPO
2026-20371 · proposed rule ↗Official PDF; comments due 4 November, not proof of a final rule.
Method and limits. The sources include official sanctions documents, investigations based on leaked records, blockchain analysis, journalism and operator statements. Wallet addresses, access routes and practical usage steps are omitted. Turnover stays separate from trade value. Simulator outcomes are labelled as observed or analytical. Volumes and investigations retain their 10 August 2026 reference. Records from 31 August–5 October were read on 6 November 2026; next FinCEN procedure check: 7 November.