The agency says A7 was used to help Iran evade sanctions, and the network was also used by Iran’s Islamic Revolutionary Guard Corps. U.S. Treasury Secretary Scott Bessent said these measures continue efforts to isolate Iran and its financial enablers and send a signal to those who help finance the illegal activities of U.S. adversaries.
According to FinCEN, A7 subagents are shell foreign companies through which the payment network moved money and disguised transactions linked to sanctioned sectors and individuals as ordinary commercial activity. In particular, suppliers for the military-industrial complex used such companies to purchase foreign components.
The operation of A7 subagents was previously described by the Financial Times: when purchasing sanctioned components, the company drew up fake contracts in which thermal imaging sights were listed as “tempered glass”. According to the publication, A7 was created in 2024 by fugitive Moldovan businessman Ilan Shor and Promsvyazbank, which specializes in financing and servicing enterprises in the defense-industrial complex.
A7 also launched the first ruble stablecoin, A7A5. The company was initially registered in Kyrgyzstan, and later the republic’s authorities shut it down under pressure from foreign states, although the network continued operating.
According to FinCEN, by June 2026 A7 had hundreds of subagents in Hong Kong, Indonesia, Kyrgyzstan, the Seychelles, Turkey, and the UAE. These companies were registered to foreign nationals but were managed by executives from Russia, and they were used to make payments to companies serviced by major U.S. and European banks.
FinCEN estimates the network’s turnover in January 2026 at more than 2,000 transactions per day and over 7.5 trillion rubles, which the agency compared to roughly 13% of Russia’s foreign trade operations. According to Promsvyazbank’s estimate, in the first half of 2025 nearly 12% of Russian business foreign trade passed through A7; at the same time, FinCEN did not publish a full list of subagents and sent banks an alert to help identify suspicious activity linked to the network.
Sources
