US Targets Russia-Linked Payment Network Behind $17B in Transactions

The US has sanctioned the A7 Network, a Russia-linked payment network used by the Iranian regime to evade sanctions, along with property and interests linked to its sub-agents. The action targets the network itself, not Tether or USDT.

OFAC’s designation extends earlier restrictions on A7 LLC and Old Vector LLC. It blocks all property and interests in property belonging to A7 and its sub-agents, plus entities owned at least 50 percent by blocked persons.

The order is broad, but the evidence available to the public is mostly aggregated. No individual A7 wallet addresses or complete sub-agent list were published in the sources reviewed.

A Payment Network Built Around Sub-Agents

A7 was launched in September 2024. Its core consists of A7 LLC, A71 LLC and A7 Agent LLC, which are jointly owned by Ilan Mironovich Shor and Russia’s state-owned Promsvyazbank, or PSB. Treasury describes Shor as a sanctioned and convicted fraudster.

The network relied on a large collection of sub-agents. According to TRM Labs’ analysis of FinCEN findings, A7 had created or acquired hundreds of sub-agents with bank accounts at roughly 435 financial institutions in at least 83 countries as of June 2026.

FinCEN’s investigation found that those sub-agents processed more than $17 billion in dollar-denominated transactions between January 2025 and June 2026. A7 itself claimed a much larger operation, reporting more than 2,000 daily transactions and more than 7.5 trillion rubles in volume as of January 2026. Treasury converted that claimed figure to $91.5 billion, about 13 percent of Russia’s foreign trade transactions in 2025.

Those numbers describe different measurements. FinCEN’s $17 billion covers dollar-denominated transactions found during its investigation. A7’s $91.5 billion was a network claim covering a broader volume period and metric.

How A7A5 Connects Rubles to USDT

A7A5 is the clearest piece of the system. It is a blocked, ruble-backed token issued by Old Vector LLC and built on Tron and Ethereum.

The token serves as an internal accounting and settlement asset. It is backed by ruble deposits held at PSB, a sanctioned Russian bank. A7 then converts A7A5 into more widely accepted digital assets, including USDT, which can be exchanged for fiat.

TRM says A7 most often used A7A5 as a non-freezable bridge into USDT and then into fiat. Over-the-counter brokers supplied liquidity from jurisdictions of concern.

That makes USDT a conversion asset within the network, not the target of the US action. Tether was not designated as part of this sanctions package. The blocked component is A7A5 and the financial activity connected to designated A7 entities.

More than 180 entities reportedly processed A7A5 transactions worth at least $179.1 billion between February 2025 and June 2026. Historically, the activity went almost entirely through sanctioned venues such as Garantex and Grinex.

The Blockchain Trail Shows Wider Exposure

TRM’s on-chain analysis found more than $166 billion in volume connected to A7. It also identified $176.6 million of exposure to sanctioned actors, including the Islamic Revolutionary Guard Corps, Hamas and the Houthis.

The identified flows included:

• More than $65 million from an IRGC-attributed address to one A7 address.
• About $5 million linked to Hamas.
• More than $590,000 from the proceeds of North Korean hacks of BTCTurk and Woo X.

Treasury also reported that one A7 sub-agent and a sister company received nearly $140 million from entities involved in Iranian sanctions evasion. A separate sub-agent transferred about $1.6 million to a company linked to Iranian sanctions evasion and weapons procurement.

These figures have not been independently verified beyond TRM’s blockchain analysis. They are still useful because they show that A7’s activity was not limited to ordinary trade settlement. The network touched funds and counterparties connected to several sanctioned groups.

A Separate Proposal Would Reach Both Cash and Crypto

OFAC’s sanctions are already in force. FinCEN has proposed a separate rule that would expand the pressure on banks and crypto businesses linked to A7’s sub-agents.

The proposal could cover roughly 348,000 Bank Secrecy Act financial institutions, including banks, broker-dealers and crypto exchanges registered as money services businesses. It would prohibit transmittances of funds to or from a listed sub-agent, or to any bank account or convertible virtual currency address administered for one.

FinCEN would share the confidential sub-agent list with covered institutions through its secure Financial Intelligence Portal. Public publication could give A7 time to replace the exposed companies. Institutions would be required to block transactions only when an entity appears on that list.

The proposal targets payment channels rather than correspondent accounts because A7A5 transactions move outside the correspondent banking system. A rule covering both cash and crypto is meant to close that gap.

The proposed rule remains open for public comment for 30 days after publication in the Federal Register. It does not delay the OFAC sanctions.

Where Pressure Could Shift Next

A7’s network is broad, but US restrictions do not automatically close every route. TRM identified TokenSpot, an unsanctioned exchange in Kyrgyzstan, as a possible pressure point. It processed $6.7 billion in volume, which TRM considered unusually high for an exchange of its size and location. A7, Grinex and Garantex together accounted for 28 percent of its outgoing volume.

TRM also traced initial USDT payments and other activity from A7-controlled wallets back to OTC desks and payment services in the US, UAE and UK.

The new OFAC designation blocks identified A7 entities and sub-agents, while the proposed FinCEN rule would reach financial institutions that transact with listed sub-agents. The practical gap now sits with the exchanges, brokers and payment services that may still connect the network to dollars, stablecoins and fiat.