- Trending
- Comments
- Latest
A Kremlin-backed payment network called A7 moved more than $6.9 billion through the international banking system despite Western sanctions on Russia, according to a Financial Times investigation of leaked internal files.
The network used front companies, forged invoices and accounts at major global banks, including Standard Chartered and JPMorgan, to disguise the transactions.
Western governments sought to isolate many Russian banks from the international financial system following Russia’s full-scale invasion of Ukraine in 2022. A7 emerged as part of Russia’s effort to build alternative channels for international payments, and its public positioning suggested a technologically sophisticated system combining alternative payment infrastructure and cryptocurrency.
But the FT’s investigation, based on hundreds of thousands of leaked files, paints a more conventional picture. According to the records, A7 established or worked through a large network of front companies in jurisdictions including the United Arab Emirates, Hong Kong, Kyrgyzstan and Indonesia.
Those entities held accounts with banks participating in the international financial system, allowing money to be deposited and transferred internationally on behalf of Russian businesses.
When banks requested documentation explaining the transactions, A7’s network allegedly supplied invoices and other documents designed to make the payments appear legitimate.
The investigation found evidence of an industrial-scale operation producing counterfeit invoices and manipulating payment information, in some cases, descriptions were altered and Cyrillic characters removed, apparently to make transactions less likely to trigger sanctions-related scrutiny.
The FT identified more than $6.9 billion that moved through the international banking system via A7-linked entities during the period examined, routed through approximately 100 A7 front companies.
The documents also referenced at least another 100 groups, including companies based in the UAE, Hong Kong, Kyrgyzstan and Indonesia. More than half of the money eventually flowed toward Chinese accounts, according to the investigation.
The scale may be even larger than the confirmed figure. The leaked records contained details of another 17,500 payments whose values the FT could not establish, along with A7-issued promissory notes carrying a combined face value exceeding $20 billion. The $6.9 billion figure represents transactions the investigation was able to identify and quantify, not necessarily the full extent of A7’s activity.
The investigation identified transactions involving customers and accounts at several major international financial institutions. Accounts at Standard Chartered’s Hong Kong operation received approximately $1.1 billion from A7-linked entities between late 2024 and August 2025.
A7-linked activity also sent roughly $273 million to DBS in Hong Kong, $74 million to Citigroup clients and around $18 million to Deutsche Bank clients. A7 also established accounts for 17 different entities at First Abu Dhabi Bank, which made more than $1.8 billion in outbound payments combined, and the network additionally had access to accounts at JPMorgan Chase and DBS.
The involvement of these institutions does not, by itself, establish that the banks knowingly participated in sanctions evasion. The FT reported that several banks detected suspicious activity and took action against customers or accounts tied to the network, a distinction that matters, since the investigation describes an alleged effort by A7 to exploit weaknesses in banks’ screening systems rather than evidence that any named bank intentionally facilitated the scheme.
The leaked records show how A7 adapted once banks began flagging suspicious transactions. In early 2025, A7 routed significant volumes through banks in Kyrgyzstan, including Eldik, Aiyl and Eurasian Savings Bank.
Standard Chartered subsequently raised concerns about money flowing from Kyrgyzstan into accounts held by its customers, and in February 2025 the bank placed a hold on payments involving a series of connected accounts. The records indicate some payments had been divided into smaller amounts, potentially to avoid triggering reporting thresholds.
After that scrutiny, A7 shifted more of its activity toward the UAE, and First Abu Dhabi Bank became one of the network’s important channels. The episode illustrates what the FT described as a cat-and-mouse dynamic: once a route attracted scrutiny, A7 could change jurisdictions, counterparties or payment channels rather than abandon the operation.
The leaked documents allowed investigators to identify A7 accounts from which billions of dollars worth of Tether’s dollar-pegged stablecoin, USDT, were sold to Russian buyers.
That matters because USDT has become one of the most important digital assets for moving dollar-denominated value across borders, unlike conventional bank transfers, stablecoin transactions can occur on public blockchains without two parties maintaining a conventional correspondent-banking relationship.
But the A7 case shows crypto and traditional banking working together rather than as competing systems: traditional banks provided access to international currencies and the SWIFT-connected financial system, while cryptocurrency offered another mechanism for transferring or converting value.
That hybrid model complicates sanctions enforcement, since investigators must follow money across both conventional financial institutions and blockchain-based infrastructure.
A7 was established with backing from Promsvyazbank, a Russian state-owned bank with close ties to Russia’s defence sector that has itself been sanctioned by Western governments. Moldovan businessman Ilan Shor, the figure associated with founding A7, has also been sanctioned by Western governments.
The UK government and National Crime Agency have previously identified A7 as a major Russian sanctions-evasion network, and in August 2026 the UK announced what it described as its first nationwide alert focused on A7, warning financial institutions and other businesses about the network’s methods. The FT investigation adds new evidence about how the network allegedly operated and the scale of the financial flows involved.
Rather than moving money directly from sanctioned Russian institutions into Western financial institutions, the network reportedly used companies and accounts in third countries, with the UAE and Hong Kong becoming particularly important.
This structure creates several layers between the original Russian source of funds and the final recipient, leaving compliance teams to determine whether an apparently ordinary transaction involving a UAE or Hong Kong company is actually connected to a sanctioned Russian business.
The investigation found that A7 could change the jurisdictions through which payments were routed once banks began raising questions, meaning that blocking individual accounts did not necessarily eliminate the wider network.
The central question the investigation raises is whether sanctions can remain effective when sophisticated financial networks combine shell companies, third-country banks, forged trade documents, cryptocurrency and alternative payment infrastructure all at once.
Russia’s exclusion from large parts of the Western financial system was intended to make international transactions harder for sanctioned entities; A7’s reported activity demonstrates one way a determined network can attempt to reconnect to the global financial system indirectly.
It also illustrates why sanctions enforcement increasingly involves more than identifying sanctioned names, compliance systems must trace networks, beneficial ownership, transaction patterns, counterparties and the economic purpose behind payments.
For the crypto industry, the investigation is significant because it challenges the idea that sanctions-evasion networks operate exclusively through crypto. A7 reportedly used cryptocurrency alongside conventional banking infrastructure, crypto can provide speed, liquidity and cross-border transfer capability, but large international financial operations still depend heavily on banks for fiat conversion, access to foreign currencies and settlement.
Stablecoins sit directly in the middle of that increasingly interconnected system, and Tether’s involvement puts renewed attention on USDT’s role in cross-border payments involving sanctioned or high-risk jurisdictions.
The presence of USDT transactions in the A7 records does not establish that Tether itself knowingly participated in the alleged scheme, rather, it shows the stablecoin was part of the financial environment through which A7-linked entities and Russian buyers moved value.
Tether has previously faced scrutiny over USDT’s use in illicit finance, while blockchain transactions can also be traced and frozen when issuers or law-enforcement agencies identify sanctioned addresses.
A7’s broader cryptocurrency infrastructure has also attracted scrutiny. The Centre for Information Resilience reported on A7A5, a ruble-pegged cryptocurrency built as part of A7’s sanctions-evasion infrastructure, describing it as a stablecoin operated through Kyrgyzstan and noting that A7 and affiliated entities have been sanctioned by the US, UK and EU.
The organisation also warned that third-party companies connected to Kyrgyzstan’s emerging crypto sector could provide infrastructure through which sanctions-evasion networks become embedded in local financial systems, while cautioning that connections identified in its report don’t by themselves establish illegal conduct by every company or individual named.
Separate analysis by blockchain intelligence firm Elliptic similarly described A7A5 as a ruble stablecoin designed to give Russian businesses an alternative to dollar-based stablecoins such as USDT.
Sanctions can restrict specific banks, companies, individuals and wallets, but they don’t automatically eliminate demand for international payments. When one route closes, businesses seeking to move money can attempt another route through a different jurisdiction, institution or asset.
The leaked A7 records show how such a system can combine several methods at once: a payment might begin with a Russian company, pass through a front company in another country, enter a bank connected to SWIFT, move through another institution and eventually reach a Chinese counterparty, with cryptocurrency providing another layer for moving or converting value along the way.
For banks, the case raises questions about whether existing customer due-diligence and transaction-monitoring systems can identify networks that deliberately distribute activity across jurisdictions.
For stablecoin issuers, it raises a related question: how should digital-dollar infrastructure respond when sanctioned or high-risk networks attempt to use stablecoins alongside conventional financial institutions? The issue is likely to grow more pressing as stablecoins become more deeply woven into international payments, and as governments increasingly treat issuers and ecosystem participants as part of the broader sanctions-enforcement framework.
The A7 investigation reveals a sanctions-evasion network that allegedly moved more than $6.9 billion through global banking channels despite ties to sanctioned Russian interests. Its reported methods were strikingly conventional, shell companies, third-country accounts, forged invoices and manipulated transaction information ,but the network also intersected with the crypto ecosystem, including Tether’s USDT and A7’s own stablecoin infrastructure.
The case shows how sanctioned networks can attempt to combine on-chain and traditional finance rather than choosing one over the other, and why regulators, banks, stablecoin issuers and blockchain analytics firms will increasingly need to monitor the entire financial chain rather than treating crypto and traditional finance as separate worlds.
This story is based The Financial Times investigation on leaked internal A7 files.
Copyright © 2025 - The Bit Gazette.
