The U.S. Treasury on October 1 designated the A7 Network a significant transnational criminal organization under Operation Economic Outcast — the first time a crypto-native shadow banking system has received that classification. FinCEN simultaneously issued Alert FIN-2026-Alert007 and proposed a ...
"Treasury is dismantling the financial infrastructure that allows Iran and other adversaries to evade sanctions, move illicit funds, and undermine the integrity of the global financial system." — Scott Bessent, U.S. Secretary of the Treasury
The U.S. Treasury on October 1 designated the A7 Network a significant transnational criminal organization under Operation Economic Outcast — the first time a crypto-native shadow banking system has received that classification. FinCEN simultaneously issued Alert FIN-2026-Alert007 and proposed a rule under Section 9714(a) of the Combating Russian Money Laundering Act to bar all 348,000 U.S. BSA-covered financial institutions from processing any transaction linked to A7 sub-agents, in fiat or convertible virtual currency.
The numbers are large. FinCEN estimates A7 sub-agents moved more than $17 billion in dollar-denominated transfers between January 2025 and June 2026. The network's ruble-pegged stablecoin, A7A5, processed $179.1 billion across 180-plus entities in the same period, according to Treasury filings. At peak, blockchain analytics firm Elliptic tracked $1 billion per day flowing through A7A5. That volume has since collapsed 96%, to roughly $24.3 million daily as of June 2026, after coordinated sanctions from the U.S., EU, and UK and the shutdown of primary exchange Grinex.
The action represents the most comprehensive U.S. enforcement operation against a crypto-based sanctions evasion network to date. It spans three agencies — OFAC, FinCEN, and the State Department — and targets entities across Russia, Kyrgyzstan, Nigeria, and Zimbabwe. The implications extend to every stablecoin issuer, exchange, and compliance team operating in cross-border payments.
The A7 Network was launched in September 2024 by two principals: Ilan Shor, a fugitive Moldovan oligarch previously sanctioned by OFAC for election interference on behalf of Russia, and Promsvyazbank (PSB), Russia's state-owned defense bank. The corporate structure consists of three Russia-based entities — A7 LLC, A71 LLC, and A7 Agent LLC — jointly owned by Shor and PSB.
The network functioned as a parallel financial system. Sub-agents — front companies operating across at least 83 countries — maintained accounts at approximately 435 financial institutions, according to FinCEN's proposed rule published in the Federal Register on October 5. These sub-agents used intermediary companies and falsified trade documentation to disguise payment flows, routing value through Russia, Iran, and intermediary jurisdictions.
Treasury identified specific users: the Islamic Revolutionary Guard Corps (IRGC) and Hamas used the network to move funds outside conventional banking channels. According to RFE/RL reporting, Vladimir Putin attended the virtual opening of an A7 office in Vladivostok, and reported users include Roman Abramovich, Nikolai Patrushev, and Arkady Rotenberg.
The network's operational footprint, as documented by TRM Labs' on-chain analysis, included connections to the sanctioned Garantex exchange and its successor platform Grinex, along with Kyrgyz-based enablers including Old Vector LLC, InDeFi Bank, and ExVed. Garantex co-founder Sergey Mendeleev was identified as a key facilitator.
The A7A5 token is a ruble-backed stablecoin issued by Old Vector LLC on the Tron and Ethereum blockchains. OFAC sanctioned Old Vector on August 14, 2025. The token was backed by deposits held at PSB Bank and launched in January 2025.
The operational model was straightforward: A7A5 served as an internal settlement layer. Value transferred inside Russia via A7A5 corresponded to fiat payments executed internationally by A7 sub-agents in dollars, euros, yuan, or dirhams. FinCEN described it as a "mirror" mechanism — a blockchain-based hawala system running at industrial scale.
The volumes were substantial. According to FinCEN filings, more than 180 entities processed at least $179.1 billion in A7A5 transactions between February 2025 and June 2026. By January 2026, the network claimed a historical volume exceeding 7.5 trillion rubles (approximately $91.5 billion), or close to one in eight dollars of Russia's 2025 foreign trade, according to RFE/RL.
Elliptic's research documented the token's rapid ascent: market capitalization tripled in less than two weeks to $521 million during mid-2025, and aggregate A7A5 transfers reached $41.2 billion at the time of their analysis. Daily transfer volume peaked at $1 billion per day, making A7A5 the largest non-dollar stablecoin by transaction volume.
The token also played a specific role in exchange migration. After international law enforcement action against Garantex, A7A5 served as the primary vehicle for moving high-value Garantex account holders to Grinex, the successor platform, according to TRM Labs.
The October 1 action was coordinated across three agencies:
OFAC designated the A7 Network as a significant transnational criminal organization (TCO). This is a higher designation than standard sanctions and carries additional penalties. OFAC also added specific individuals, companies, and cryptocurrency wallet addresses to the Specially Designated Nationals (SDN) list.
FinCEN issued Alert FIN-2026-Alert007, providing red-flag indicators for financial institutions to identify A7-linked activity. Separately, FinCEN proposed a rule (31 CFR 1010.668) under Section 9714(a) of the Combating Russian Money Laundering Act that would prohibit every BSA-covered financial institution — approximately 348,000 entities including banks, broker-dealers, money services businesses, and crypto exchanges — from transmitting funds involving A7 Network sub-agents in any currency, including convertible virtual currency. The proposed rule opened a 30-day public comment period.
The State Department took concurrent action targeting network facilitators.
Treasury Secretary Bessent stated the action "sends a clear message that if you facilitate illicit finance for America's adversaries, you will lose access to the U.S. financial system."
The enforcement campaign did not begin on October 1. A7A5's operational decline predates the TCO designation by months.
According to Elliptic's tracking, average daily transaction volumes fell to $24.3 million by June 2026 — a 96% decline from the July 2025 peak. No new A7A5 tokens have been minted since July 2025, indicating weak demand.
The collapse followed a sequence of enforcement actions:
Analysts at Elliptic further noted that approximately 34% of remaining observed A7A5 volume consisted of circular fund movements that inflate totals — meaning actual economic throughput was even lower than headline figures suggest. Crystal Intelligence reported that A7A5 contracts still run on Tron and Ethereum but the token is effectively "parked, not gone" — dormant infrastructure that could theoretically be reactivated.
The October 1 TCO designation and FinCEN proposed rule aim to close remaining channels. By targeting the 435 financial institutions in 83 countries where sub-agents hold accounts, Treasury is attacking the fiat on-ramp and off-ramp infrastructure that gives the token residual utility.
The proposed FinCEN rule has direct implications for crypto-native businesses. The definition of "covered financial institution" under the BSA includes money services businesses, which encompasses cryptocurrency exchanges registered with FinCEN. If finalized, the rule would require these entities to screen for and block any transaction involving identified A7 sub-agents — a technically non-trivial task given that sub-agents operate through hundreds of front companies.
The rule also applies to convertible virtual currency explicitly, not just fiat. This marks one of the clearest regulatory statements that crypto-to-crypto transactions fall within FinCEN's enforcement perimeter when connected to designated entities.
For compliance teams, the operational burden is significant. A7 sub-agents used falsified trade documentation and layered corporate structures specifically designed to evade detection. FinCEN's alert provides red-flag indicators, but identifying shell companies across 83 jurisdictions requires sophisticated transaction monitoring and entity resolution capabilities.
The action also intersects with the concurrent Senate investigation into Tether. A September 28 report by Democratic investigators on the Senate Permanent Subcommittee on Investigations found that 84% of more than 800 Iran-linked sanctioned crypto wallets used USDT. Tether stated it had frozen approximately $550 million in Iran-linked assets during 2026.
The A7 Network's reliance on stablecoin infrastructure raises questions about issuer obligations. A7A5 was purpose-built for sanctions evasion, but the network also used USDT as a bridge currency in certain operations. The Senate report's finding that 84% of Iran-linked sanctioned wallets held USDT does not prove direct Tether complicity — USDT is the most widely held stablecoin globally — but it does place pressure on issuers to demonstrate that compliance programs can detect and prevent state-level evasion schemes.
Tether's response — pointing to $550 million in frozen Iran-linked assets — indicates reactive enforcement capacity. The policy question is whether the GENIUS Act's $10 billion threshold and associated compliance requirements, currently working through Congress, would have prevented or detected A7-scale operations earlier.
The economic logic is clear: sanctions evasion networks gravitate toward the most liquid, most widely accepted settlement instruments. For now, that means dollar-denominated stablecoins. The A7 Network's construction of a purpose-built ruble stablecoin was itself an acknowledgment that existing stablecoin infrastructure, while useful, was insufficient for the scale of evasion required.
Scale: The A7 Network processed $17 billion in fiat and $179.1 billion in A7A5 transactions across 180+ entities in 18 months. Sub-agents maintained accounts at 435 financial institutions in 83 countries.
Enforcement reach: The TCO designation and proposed FinCEN rule cover all 348,000 BSA-registered financial institutions, including crypto exchanges. The rule explicitly covers convertible virtual currency transactions.
Sanctions effectiveness: A7A5 daily volumes fell 96% from peak before the October 1 designation, suggesting that earlier targeted sanctions against enablers (Old Vector, Grinex) were effective at degrading operational capacity.
Stablecoin policy implications: The A7 case strengthens the regulatory argument for mandatory compliance infrastructure at the stablecoin issuer level, not just at the exchange level.
Precedent: This is the first time a crypto-native shadow banking network has received TCO designation, establishing a template for future actions against similar structures.
The A7 Network action demonstrates that blockchain-based sanctions evasion operates under the same economic constraints as traditional hawala networks: it requires fiat on-ramps, off-ramps, and counterparties willing to accept the legal risk. When those access points are systematically targeted — as occurred through the August 2025 OFAC designations, the Grinex shutdown, and now the TCO classification — transaction volumes collapse.
The $179.1 billion figure is significant not because it represents a new kind of threat, but because it quantifies an old one: state-sponsored sanctions evasion conducted through crypto infrastructure at a scale previously associated with correspondent banking networks. The enforcement response — spanning OFAC, FinCEN, and State across three concurrent actions — matches that scale.
The 30-day comment period on the proposed FinCEN rule closes in early November 2026. If finalized, it would establish the most comprehensive prohibition on crypto-linked sanctions evasion transactions in U.S. regulatory history.