US Treasury Moves to Block A7 Network and Its Global Sub-Agents

The U.S. Department of the Treasury has launched a coordinated regulatory offensive against the A7 Network, a massive shadow banking system designed to bypass international sanctions on behalf of Russia and Iran ¹. Under "Operation Economic Outcast," the Financial Crimes Enforcement Network (FinCEN) proposed a rule to prohibit U.S. financial institutions from sending or receiving funds or digital assets involving the network's global front companies, known as "Sub-Agents" [1, 2]. Simultaneously, the Office of Foreign Assets Control (OFAC) designated the A7 Network as a significant transnational criminal organization ¹.

This regulatory action targets a hybrid fiat-and-crypto infrastructure that has successfully operated outside traditional banking channels. According to FinCEN, the network has processed tens of billions of dollars for sanctioned entities, cybercriminals, and state-sponsored military groups ¹.

The Sub-Agent Architecture and Russian Trade

To bypass the global financial system after approximately 80% of Russian banks were sanctioned and stripped of SWIFT access, the A7 Network established a parallel financial architecture ². The network was launched in September 2024 by fugitive Moldovan oligarch Ilan Shor and Promsvyazbank (PSB), Russia's state-owned defense bank ².

At the core of this architecture are "Sub-Agents"—hundreds of companies created or acquired by A7 in third-country jurisdictions, including Hong Kong, Indonesia, the Kyrgyz Republic, the Seychelles, Türkiye, and the UAE ². While these entities appear on paper to be owned and operated by non-Russians, they are wholly controlled by A7 staff operating from Moscow [1, 2]. Staff execute payments through custom Virtual Private Networks (VPNs) to make transactions appear as though they originate in local hubs like Dubai or Hong Kong [1, 2].

Between January 2025 and June 2026, these Sub-Agents processed more than $17 billion in dollar-denominated transactions [1, 2]. The network operates through trade-based money laundering, utilizing falsified trade documents, misleading goods descriptions, and bills of exchange called "veksels" to disguise illicit payments as ordinary commercial activity [1, 2]. As of January 2026, the A7 Network claimed to process over 2,000 transactions daily, with a historical volume exceeding 7.5 trillion rubles ($91.5 billion), representing approximately 13% of Russia’s 2025 foreign trade ¹.

The Crypto Layer: A7A5 and the Mirror System

Running parallel to the fiat network is the A7A5 stablecoin, a ruble-backed token issued by Kyrgyz-registered Old Vector LLC and deployed on the Tron and Ethereum blockchains [1, 2]. Each token is backed by ruble deposits held at PSB ².

According to FinCEN, the A7A5 token serves as an internal mirror system ². Tokens are transferred between internal addresses within Russia to represent foreign payments, while the external Sub-Agents execute matching fiat transfers abroad in foreign currencies like U.S. dollars, yuan, dirhams, or euros ². This structure keeps counterparties firewalled from one another ².

Between February 2025 and June 2026, more than 180 entities processed at least $179.1 billion in A7A5 transactions ². While these transactions historically flowed through sanctioned Russian exchanges like Garantex and Grinex, a reported April 2026 hack of Grinex led to A7A5 supply consolidating into unhosted wallets ². FinCEN notes this indicates a shift toward unhosted infrastructure to avoid freeze risks, using the stablecoin as a non-freezable bridge into $USDT and subsequent fiat liquidity ².

On-chain analysis by TRM Labs identified over $166 billion in on-chain volume connected to the network, including $176.6 million in direct exposure to sanctioned actors ². This exposure includes $65 million from an address attributed to Iran's Islamic Revolutionary Guard Corps (IRGC), $5 million linked to Hamas, and over $590,000 in stolen cryptocurrency originating from North Korean hacks of the BTCTurk and Woo X exchanges ².

The Iran and Terrorist Financing Nexus

Beyond facilitating Russian trade, the A7 Network's Sub-Agents established critical financial pipelines for the Central Bank of Iran, the IRGC, and Iran-backed proxy groups ¹.

FinCEN's investigation revealed that one UAE-based Sub-Agent transacted directly with entities in Iran's "shadow fleet" of oil tankers ¹. This Sub-Agent and its sister company received nearly $140 million from entities involved in Iranian sanctions evasion between July 2023 and October 2025 ². Another Sub-Agent transferred approximately $1.6 million to an entity linked to Iranian weapons procurement [1, 2]. Furthermore, OFAC linked the network to Nobitex, Iran's largest digital asset exchange, which was designated by the U.S. in June 2026 ¹.

Implications for the Crypto Industry

FinCEN is utilizing its authority under Section 9714 of the Combating Russian Money Laundering Act to implement this ban ². The agency bypassed traditional recordkeeping or correspondent account restrictions because those measures would fail to stop A7A5 transactions, which move entirely outside the correspondent banking system ².

By implementing a transmittal-of-funds prohibition, the U.S. government is effectively blocking both fiat and cryptocurrency transfers associated with any A7 Sub-Agent ². This action follows similar hybrid fiat-crypto crackdowns, such as the 2024 action against PM2BTC and the 2025 action against Huione Group ².

For the broader digital asset market, this highlights the increasing focus of Western regulators on peer-to-peer, unhosted wallet transactions and stablecoins used in state-level sanctions evasion. At the time of writing, BTC is trading at $86,518 and ETH at $2,742, showing that the market has largely absorbed the regulatory news without immediate systemic panic.

What to Watch

The public comment period for FinCEN's notice of proposed rulemaking will close 30 days after its official publication in the Federal Register ¹. Following the comment period, FinCEN will move to finalize the rule, which will legally obligate all covered U.S. financial institutions to halt any transactions linked to the identified Sub-Agents [1, 2].

Additionally, compliance officers and on-chain investigators are monitoring TokenSpot, an unsanctioned Kyrgyz cryptocurrency exchange ². TRM Labs has identified TokenSpot as sharing infrastructure with the sanctioned Grinex exchange, marking it as a highly probable next target for international regulatory disruption ².