U.S. Treasury designates A7, the network behind ruble stablecoin A7A5, a criminal organization

The U.S. Treasury Department on Oct. 1 sanctioned the A7 Network, a Russia-linked cross-border payments network, as a significant transnational criminal organization. The network created A7A5, a stablecoin pegged to the Russian ruble. Treasury's Financial Crimes Enforcement Network (FinCEN) on the same day proposed a rule that would bar U.S. financial institutions from handling fund transfers involving the network's overseas Sub-Agents, and issued an alert to financial institutions.

FinCEN said more than 180 entities processed A7A5 transactions totaling at least $179.1 billion between February 2025 and June 2026. According to Treasury, the A7 Network claimed that as of January 2026 it processed more than 2,000 transactions a day, with total volume of more than 7.5 trillion rubles, or about $91.5 billion. That is roughly 13% of Russia's 2025 foreign trade transactions.

The payer on the invoice was a company in Hong Kong or Kyrgyzstan

Treasury described the A7 Network as a shadow banking network that offers sanctions evasion and money laundering as a service. It forms or acquires companies in places such as Hong Kong, Indonesia, the Kyrgyz Republic, the Seychelles, Türkiye and the United Arab Emirates, and uses them as Sub-Agents to make payments for Russian customers look like ordinary trade. According to FinCEN, as of June 2026 hundreds of these companies had opened accounts at about 435 financial institutions in at least 83 countries. Moscow-based staff used virtual private networks (VPNs) to appear to be in Dubai or Hong Kong while moving funds, and falsified or AI-altered invoices were also used.

Russia was not the only user. Treasury said the Central Bank of Iran, Iran's Islamic Revolutionary Guard Corps, Iran-backed terrorist organizations such as Hamas, and ransomware actors also used the channel. One Sub-Agent and its sister company received nearly $140 million from entities involved in Iranian sanctions evasion. Treasury added that the A7 Network has been linked to Nobitex, Iran's largest digital asset exchange, which the U.S. sanctioned on June 2, and has also facilitated transactions related to North Korean hacks of crypto exchanges. The network is led by Ilan Shor, a Moldovan businessman who is under U.S. sanctions and has been convicted of fraud.

"Today's action targeting A7 continues Treasury's unprecedented efforts to isolate Iran and its financial enablers and sends a clear message that if you facilitate illicit finance for America's adversaries, you will lose access to the U.S. financial system."

Scott Bessent, U.S. Treasury Secretary

An unfreezable ruble token, swapped into Tether

According to the FinCEN alert, A7A5 runs on the Tron and Ethereum blockchains. It is issued by Old Vector, a company registered in the Kyrgyz Republic, and each token has been advertised as backed by ruble deposits at Promsvyazbank (PSB), Russia's state defense bank. The A7 Network used the token as a bridge that the issuer cannot freeze: A7A5 was converted into more widely used stablecoins such as Tether (USDT), then into the fiat currency of the customer's choice to settle payments abroad. Tokens moved inside Russia, while Sub-Agents sent dollars, yuan, dirhams and euros outside it to balance the books.

The alert also listed red flags for financial institutions. They include a customer with a history of trading A7A5 or "wrapped" A7A5 tokens moved to other blockchains, a customer sending stablecoins to Sub-Agents, and an over-the-counter (OTC) firm swapping stablecoins for fiat that suddenly grows in regions tied to the network. The alert said A7A5 can be bought on only a small number of exchanges, most of them sanctioned by the U.S., the U.K. or the European Union, and that it also trades peer-to-peer and on decentralized exchanges.

A7A5 activity has already fallen sharply. Blockchain analytics firm Elliptic said in a July report that no new A7A5 had been issued since July 2025, and that average daily volume in June 2026 was $24.3 million, down 96% from its July 2025 peak. According to Elliptic, sanctioned exchange Grinex, which handled A7A5, announced around April 16 a security breach with losses of more than 1 billion rubles. FinCEN said that after the incident, A7A5 was consolidated into unhosted wallets rather than exchanges.

From a few companies to the whole network

The U.S. first sanctioned A7 LLC, A7A5 issuer Old Vector and the Grinex exchange, among others, on Aug. 14, 2025. This time it designated the entire network, including the Sub-Agents, as a criminal organization. As a result, all property and interests in property of the A7 Network in the United States or held by U.S. persons, including transactions involving Sub-Agents acting for the network, are blocked and must be reported to the Office of Foreign Assets Control (OFAC). Entities 50% or more owned by blocked persons are also blocked.

FinCEN's proposed rule is issued under section 9714(a) of the Combating Russian Money Laundering Act. The public comment period will close 30 days after it is published in the Federal Register. The U.K.'s National Crime Agency (NCA) issued its own alert on A7 on Aug. 31.

A7A5 is not listed on the Korean won markets of Upbit or Bithumb. Tether (USDT), the stablecoin A7A5 was swapped into, traded at 1,359 won on Upbit and 1,360 won on Bithumb at 3:30 p.m. KST on Oct. 3, while TRX, the native token of Tron, one of the blockchains A7A5 runs on, traded at 457 won on Upbit.