FinCEN Moves to Cut the A7 Network's Sub-Agents Off From the US Financial System

Key Takeaways

• FinCEN issued a finding and NPRM today identifying transactions involving any non-US company controlled by the A7 Network, which the agency calls "Sub-Agents," as a class of transactions of primary money laundering concern. The proposed rule would prohibit every covered US financial institution from sending or receiving funds or crypto involving a Sub-Agent.
• The action accompanies OFAC's designation today of the A7 Network as a significant Transnational Criminal Organization under Operation Economic Outcast, and it draws extensively on TRM Labs' A7 Leaks research.
• A7 has created or acquired hundreds of Sub-Agents with accounts at roughly 435 financial institutions in at least 83 countries. FinCEN assesses they processed more than USD 17 billion in dollar-denominated transactions between January 2025 and June 2026, including nearly USD 140 million from entities involved in Iranian sanctions evasion.
• The A7A5 stablecoin runs alongside the fiat network, with more than 180 entities processing at least USD 179.1 billion in A7A5 transactions between February 2025 and June 2026. TRM has also identified TokenSpot, an unsanctioned Kyrgyz exchange that shares infrastructure with Grinex, as a clear next point of disruption.

Today the US Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) issued a finding and notice of proposed rulemaking (NPRM) that identifies transactions involving any company outside the United States controlled by the A7 Network as a class of transactions of primary money laundering concern in connection with Russian illicit finance. FinCEN proposes to prohibit covered US financial institutions from sending or receiving funds, including convertible virtual currency, involving those companies, which the agency calls "Sub-Agents."

The action arrives alongside OFAC's designation of the A7 Network today as a significant Transnational Criminal Organization under Executive Order 13581, part of what Treasury is calling Operation Economic Outcast. Together, the two actions target both the core of the network and the global web of front companies that gives it reach into the international financial system.

FinCEN's finding draws extensively on TRM Labs research, including "The A7 Leaks: TRM's On-Chain Analysis of Russia's Cryptocurrency Connections," published in June 2026 with the Open Source Centre. The NPRM cites that work for the network's links to North Korea, Iran-backed terrorist groups, ransomware actors, and the IRGC.

The legal tool

FinCEN is acting under section 9714 of the Combating Russian Money Laundering Act, as amended by the FY2022 National Defense Authorization Act. Section 9714 lets Treasury apply the five special measures available under section 311 of the USA PATRIOT Act to classes of transactions tied to Russian illicit finance, and it adds a sixth measure that allows Treasury to prohibit or condition certain transmittals of funds.

FinCEN chose that sixth measure. The agency concluded that recordkeeping and reporting requirements under special measures one through four would allow illicit transfers to continue. It also found that restricting correspondent and payable-through accounts under special measure five would leave a gap, because A7A5 transactions, which FinCEN describes as integral to the A7 business model, move outside the correspondent banking system entirely. A transmittal-of-funds prohibition reaches both fiat and crypto.

The action builds on FinCEN's 2024 section 9714 order against Russia-linked exchange PM2BTC and its 2025 section 311 action against Huione Group, both of which used special measures authority against hybrid fiat-crypto money laundering infrastructure.

The A7 Network

The A7 Network was formally launched in September 2024 by two parties sanctioned by the United States, the EU, and the UK. Those are fugitive Moldovan oligarch Ilan Shor and Promsvyazbank (PSB), Russia's state-owned defense bank. Its core consists of three Russia-based companies, A7 LLC, A71 LLC, and A7 Agent LLC, jointly owned by Shor and PSB. They operate with and through Kyrgyz and Russian enablers including Old Vector LLC, the exchanges Garantex and Grinex, InDeFi Bank, ExVed, and Garantex co-founder Sergey Mendeleev.

PSB described the service at launch as a way to "support Russian foreign trade participants and their trading partners amid anti-Russian sanctions pressure."

As of January 2026, the network claimed a historical volume of more than 7.5 trillion rubles, roughly USD 91.5 billion, or close to one in eight dollars of Russia's 2025 foreign trade. Vladimir Putin attended the virtual opening of an A7 office in Vladivostok, and reported users include Roman Abramovich, Nikolai Patrushev, and Arkady Rotenberg.

The Sub-Agents

The heart of FinCEN's finding is the Sub-Agent structure. Roughly 80 percent of Russian banks have been sanctioned since 2022 and many have lost SWIFT access. A7 fills that gap by forming, acquiring, or partnering with companies in third countries such as Hong Kong, Indonesia, the Kyrgyz Republic, the Seychelles, Türkiye, and the UAE. On paper these companies are owned and managed by non-Russians. In practice, A7 controls them.

As of June 2026, A7 had created or acquired hundreds of Sub-Agents with bank accounts at approximately 435 financial institutions in at least 83 countries. FinCEN assesses that these Sub-Agents processed more than USD 17 billion in dollar-denominated transactions between January 2025 and June 2026.

The mechanics are classic trade-based money laundering. A Russian customer settles its obligation inside A7's internal system, often by purchasing bills of exchange known as veksels. Between September 2024 and July 2025, A7 clients bought more than 3,200 of them worth more than USD 25 billion. A7 then assigns an industry-matched foreign Sub-Agent to appear as the paying party, generates trade documents with any reference to Russia stripped out, and runs the Sub-Agent's bank accounts from Moscow over VPNs that make the activity appear to originate in Dubai, Hong Kong, or Bishkek.

The NPRM names six UAE-based Sub-Agents. The largest, Power Sphere LLC-FZ, moved USD 61 million tied to Russian trade-based money laundering and energy-sector procurement between September 2023 and July 2025. The others are Hydrofusion Resources FZ-LLC (USD 3.6 million), Gimli Trade LLC-FZ (USD 1.5 million, and UK-sanctioned in December 2025), Galadriel Trading FZCO (more than USD 946,000 tied to export control evasion), Sigizmund FZCO (USD 41,000, including dual-use goods), and Pearl Bridge (about USD 30,000).

The Iran nexus runs through this structure as well. One Sub-Agent transacted directly with entities tied to Iran's shadow fleet, and that Sub-Agent and a sister company received nearly USD 140 million from entities involved in Iranian sanctions evasion between July 2023 and October 2025. Another Sub-Agent sent about USD 1.6 million to a company linked to Iranian weapons procurement.

A7A5 and the crypto layer

The A7A5 stablecoin runs alongside the fiat system. It is a ruble-backed token issued by Kyrgyz-registered Old Vector and live on Tron and Ethereum, with each token backed by ruble deposits at PSB. FinCEN describes it as part of a mirror system. Tokens move between internal addresses inside Russia to represent foreign payments, while Sub-Agents execute the matching fiat transfers abroad in dollars, yuan, dirhams, and euros. The two sides balance on A7's ledger and the counterparties stay firewalled from each other.

FinCEN found that more than 180 entities processed A7A5 transactions worth at least USD 179.1 billion between February 2025 and June 2026, historically almost entirely through sanctioned venues like Garantex and Grinex. Following the reported April 2026 Grinex hack, A7A5 supply has consolidated into unhosted wallets, which FinCEN reads as a possible shift away from sanctioned exchanges. A7 most often uses A7A5 as a non-freezable bridge into USDT and then fiat, with OTC brokers in jurisdictions of concern supplying liquidity. FinCEN also flags wrapped A7A5 tokens on non-native chains.

This tracks closely with TRM's on-chain findings. The A7 Leaks identified more than USD 166 billion in on-chain volume connected to the network and USD 176.6 million in exposure to sanctioned actors including the IRGC, Hamas, and the Houthis. That included more than USD 65 million from an IRGC-attributed address to a single A7 address, about USD 5 million linked to Hamas, and more than USD 590,000 in proceeds from North Korean hacks of BTCTurk and Woo X. TRM also found that roughly a third of A7A5's reported USD 110 billion in volume at the time came from circular transfers between A7-controlled addresses, the internal accounting function FinCEN now describes. Earlier TRM research on Garantex, Grinex, and A7A5 documented how A7A5 served as the vehicle for moving Garantex customers to Grinex after the March 2025 takedown, a migration FinCEN also cites.

Kyrgyz Exchange TokenSpot Presents Opportunity for A7 Network Disruption

Grinex, A7A5, and Meer were all set up in Kyrgyzstan as part of A7’s larger cryptocurrency ecosystem. TRM has identified one other entities also based in Kyrgyzstan, TokenSpot, that runs on the same infrastructure as Grinex, including shared collection addresses. At USD 6.7 billion, TokenSpot has an abnormally large volume for an entity of its size and location, and A7, Grinex, and Garantex combined make up 28% of TokenSpot’s outgoing volume. TokenSpot has continued to send funds to these entities, even after their designations by the US, UK, and EU. At the current moment, TokenSpot has not been sanctioned. 

‍

Fiat-to-crypto onramps used for initial A7 liquidity traced to OTC desks and payments services in US, UAE, among others

A7’s leaked internal chats presented a trove of cryptocurrency transactions. Among them were initial USDT disbursements sent to A7 subentities believed to be operating in other jurisdictions. The majority of these and other transactions from the same A7-controlled wallets around the summer of 2025 can be traced back to OTC desks and payments services that are based in the US, UAE, and UK. TRM assesses that major exchanges were also used to send these multi-million dollar transactions, and that these and other VASPs were layered by A7 associates to obfuscate the source of funds. 

What the proposed rule requires

Proposed 31 CFR 1010.668 applies to every BSA financial institution, roughly 348,000 entities including banks, broker-dealers, and MSBs such as crypto exchanges. It would prohibit any transmittal of funds to or from a Sub-Agent or any account or CVC address administered on a Sub-Agent's behalf.

The list of Sub-Agents is where this rule departs from a typical sanctions action. Beyond the six named companies, FinCEN will share a list of known Sub-Agents only with covered institutions through its secure FI Portal and will update it over time. FinCEN explains that publishing the list would let A7 stand up replacement companies faster. Institutions are only obligated to block transmittals involving entities on that list.

For crypto, FinCEN acknowledges that institutions generally cannot reject an incoming on-chain transfer before it arrives. An institution that receives CVC from a listed Sub-Agent address is deemed compliant if it blocks the funds where other authorities require it, or rejects the transaction by preventing the recipient's access and returning the funds to the originating address. Where OFAC blocking obligations apply, blocking satisfies the rule.

Institutions must notify and document notice to affected persons with whom they have a direct commercial relationship, and take a risk-based approach to additional due diligence that FinCEN expects can run through existing sanctions screening tools. Listed entities may petition FinCEN for removal. Comments are due 30 days after Federal Register publication under docket FINCEN-2026-0265.

What compliance teams should do now

The fiat typologies FinCEN lays out give banks a clear screening profile. That profile includes newly formed UAE, Hong Kong, Kyrgyz, Turkish, or Seychelles trading companies with sudden high volumes, goods descriptions that diverge from the supplier's business, routing through multiple related intermediaries, and invoices that show signs of AI alteration.

For crypto businesses, the priority is exposure to the A7A5 contracts on Ethereum and Tron, to wrapped A7A5 on other chains, to Garantex and Grinex successor infrastructure, and to OTC desks in jurisdictions of concern that have suddenly scaled their stablecoin trading. Teams should be prepared to integrate the FI Portal list into wallet screening as soon as a final rule issues, since blockchain intelligence will be the way institutions connect a listed Sub-Agent to the addresses it controls.

The broader point is that Treasury now treats Russian sanctions evasion as a single system spanning trade finance, correspondent banking, and stablecoins, and it is using every tool it has against that system at once. A7 built its network to make Russian money look like ordinary commerce in Dubai. FinCEN's proposal makes the companies that provide that cover radioactive to the US financial system, and it invites other jurisdictions and institutions worldwide to follow.

Frequently Asked Questions

What did FinCEN announce today?

FinCEN issued a finding that transactions involving A7 Network Sub-Agents are a class of transactions of primary money laundering concern in connection with Russian illicit finance. It also proposed a rule, 31 CFR 1010.668, that would prohibit covered US financial institutions from engaging in any transmittal of funds to or from a Sub-Agent or any account or crypto address administered on a Sub-Agent's behalf. Comments are due 30 days after Federal Register publication under docket FINCEN-2026-0265.

What is the A7 Network?

The A7 Network is a Russia-based cross-border payments and sanctions evasion system launched in September 2024 by fugitive Moldovan oligarch Ilan Shor and Promsvyazbank (PSB), Russia's state-owned defense bank. Its core companies, A7 LLC, A71 LLC, and A7 Agent LLC, operate with Kyrgyz and Russian enablers including Old Vector, Garantex, Grinex, InDeFi Bank, ExVed, and Sergey Mendeleev. The network claims a historical volume of more than USD 91.5 billion, close to one in eight dollars of Russia's 2025 foreign trade.

What is a Sub-Agent?

A Sub-Agent is a company outside the United States that A7 controls and uses to make and receive payments on behalf of its clients. Sub-Agents are typically registered in places like the UAE, Hong Kong, the Kyrgyz Republic, Türkiye, Indonesia, and the Seychelles, with non-Russian owners and directors on paper. A7 staff in Moscow operate their bank accounts over VPNs, so payments appear to come from an ordinary trading company in Dubai or Hong Kong. The NPRM names six UAE-based Sub-Agents, and FinCEN will share its full list only with covered institutions through the secure FI Portal.

What role does the A7A5 stablecoin play?

A7A5 is a ruble-backed stablecoin issued by Kyrgyz-registered Old Vector on Tron and Ethereum, with reserves held at PSB. FinCEN describes it as one half of a mirror system, in which tokens move between internal addresses inside Russia while Sub-Agents execute matching fiat payments abroad. A7 also uses A7A5 as a bridge into USDT and then fiat. TRM found that roughly a third of A7A5's reported volume at the time of the A7 Leaks came from circular transfers between A7-controlled addresses.

Why did FinCEN use section 9714 instead of a standard section 311 action?

Section 9714 of the Combating Russian Money Laundering Act gives Treasury the five section 311 special measures for classes of transactions tied to Russian illicit finance, plus a sixth measure allowing it to prohibit or condition transmittals of funds. FinCEN concluded that recordkeeping requirements and correspondent account restrictions would leave A7A5 flows untouched, since those transactions move outside the correspondent banking system. A transmittal-of-funds prohibition covers both fiat and crypto.

‍