On October 1, 2026, FinCEN issued an Alert to urge financial institutions to be vigilant in detecting, identifying, and reporting suspicious activity, involving the A7 Network. The A7 Network is a global wholesale sanctions evasion and money laundering service with ties to Russia, leveraged by a wide range of illicit actors, including Iran and its terrorist proxies.
The A7 Network facilitates cross-border payments for customers in Russia and other heavily sanctioned jurisdictions by using intermediary companies, misleading trade documents, and complex payment routes to obscure the involvement of sanctioned parties. It moves value through traditional banking channels and digital assets, including its ruble-backed A7A5 stablecoin, allowing funds to pass through international financial institutions while masking their connection to sanctioned entities.
To help detect, prevent, and report potential suspicious activity related to sanctions evasion and other illicit activities using the A7 Network, FinCEN has identified the following red flag indicators:
Use of “Sub-Agents”
A customer conducts transactions with suspected or previously identified A7 Network Sub-Agents.
A customer conducts transactions with suspected shell companies44 located in Kyrgyz Republic or other jurisdictions of concern for A7 Network activity.
A customer routes payments through several potential shell companies in multiple jurisdictions for no clear economic purpose before the funds arrive at their final destination.
A customer’s recently-formed company begins engaging in unusually high volumes of large transactions that occur over a short period of time and do not appear to be indicative of consistent business relationships with recurring counterparties.
A customer conducts a large volume of transactions with entities in disparate lines of business, or documentation related to a customer’s business transactions reveals inconsistencies between the descriptions of goods or services and the supplier’s business profile.
A customer accesses a financial account or conducts transactions from an IP address that resolves to identified VPN infrastructure known to be affiliated Ilan Shor and the A7 Network, such as the domains muzpan[.]com or sodkamus[.]com, and runs on servers based in jurisdictions known to host A7 Network digital infrastructure, such as Dubai, Hong Kong, or Kyrgyz Republic.
A customer provides an email address to register an account or communicate with their financial institution with a domain that resolves to mail servers affiliated with the domains muzpan.com or sodkamus.com.
A customer’s purported business website has a blank or minimally active website whose serving IP ranges fall within 159.100.19.150/152 and 159.100.19.203/214.
Mis-invoicing and Invoice Falsification
Documentation associated with a customer’s transactions include shipping invoices that use templates that differ from previously observed standards.
Documentation associated with a customer’s transactions contain overly simplified or vague product details, financially unlikely total dollar value prices for listed trade goods, or dates that do not make sense based on type of goods and/or services purportedly being purchased.
Shipping invoices and other documentation associated with a customer’s activities exhibit an analog “company stamp” affixed to an otherwise seemingly entirely digitally produced document.
Shipping invoices or other documentation for a customer’s transactions contain out-of-place Cyrillic characters in otherwise English language documents.
Documentation associated with a customer’s transactions appears to have been modified or wholly created using AI, for example displaying incorrectly formed letters, garbled wording, and malformed seals or other iconography.
Digital Asset Abuse
A customer offers, has traded in, or has historic direct or indirect exposure to trades denominated in the A7A5 token or in derivative, or “wrapped,” tokens based on the A7A5 token.
A customer provides digital assets, especially stablecoins, to identified or suspected A7 Network Sub-Agents.
A customer engaged in international trade, import/export, or shipping using stablecoins to make large purchases or engage in a high volume of transactions, especially to pay for commodities not usually traded using digital assets, including military or dual-use goods or oil and petroleum products.
A customer operating a digital asset firm—including a firm that purports to be engaged in “over the counter,” “OTC,” or “block trading” services with a primary focus on stablecoin/ fiat trading pairs—or suspected to be engaged in unregistered MSB activity involving digital assets sees a sudden, unexplainable growth in activity in jurisdictions with known touchpoints to A7 Network operations, especially if they have a minimal online presence or limited operating history.
The Alert can be found here.