How A7 Used Cross-Border Intermediaries to Move Funds
On October 1, 2026, the U.S. Department of the Treasury announced coordinated action against the A7 Network, describing it as a Russia-linked shadow banking network used by Iran to evade sanctions. The Office of Foreign Assets Control (OFAC) imposed sanctions on the network, while the Financial Crimes Enforcement Network (FinCEN) proposed a rule targeting certain fund transfers involving its sub-agents and issued an alert to help financial institutions identify suspicious activity.
According to the Treasury, the network used companies operating across multiple jurisdictions to receive and remit payments. It allegedly relied on falsified trade documents, misleading import and export records, and inaccurate descriptions of goods to make restricted financial activity appear to be ordinary commercial transactions. Such arrangements can make it harder for financial institutions to identify the origin of funds, the parties ultimately benefiting from a transaction, and its true purpose.
FinCEN stated that its investigation identified more than $17 billion in transactions processed by A7 Network sub-agents between January 2025 and June 2026. This figure represents the transaction volume disclosed by the regulator; it does not mean that every transaction was established to involve illicit proceeds.
The action illustrates how cross-border financial crime can extend beyond a single bank account or digital asset. Networks may distribute activity across corporate structures, intermediaries, and trade settlement arrangements, allowing individual payments to appear consistent with legitimate business activity.
Sanctions Evasion Risks Extend Beyond Digital Asset Transactions
For financial institutions, sanctions risks can be concealed within apparently routine corporate payments, trade finance, foreign exchange settlements, and cross-border transfers. Monitoring systems that focus only on individual customer names or transaction amounts may miss relationships between companies and indirect links to high-risk entities.
Sanctions screening should therefore be integrated with customer due diligence, beneficial ownership checks, transaction monitoring, and verification of the underlying commercial activity. Firms should assess the actual control relationships between payers and recipients, whether fund flows match a customer's stated business, and whether descriptions of goods, shipping routes, or transaction values contain material inconsistencies.
Digital asset exposure should also form part of the broader risk assessment. The Treasury's announcement referenced the A7 Network's connections to digital asset infrastructure and other sanctioned or high-risk activities. For crypto exchanges, custodians, and payment providers, this means traditional financial records may not be sufficient. Reviews may also need to consider on-chain address exposure, counterparty risk, and available sanctions intelligence.
However, an indirect connection to a high-risk entity does not automatically establish that every associated transaction violates sanctions. Compliance teams should evaluate the specific facts, applicable laws, ownership and control relationships, and official regulatory information before reaching a conclusion.
Strengthening AML and KYT Monitoring
The case highlights the importance of risk-monitoring systems that connect customers, companies, accounts, and transaction paths. AML teams should update sanctions lists and risk intelligence regularly, identify indirect transactions conducted through third-party companies or agents, and apply enhanced review procedures to higher-risk relationships.
KYT tools can complement traditional financial monitoring by tracing transfers between digital asset addresses, identifying exposure to known high-risk wallets, and detecting unusual transaction patterns. On-chain findings should be assessed alongside customer information, fiat payment records, trade documentation, and other investigative evidence rather than treated as independent proof of a violation.
When monitoring systems generate alerts, institutions should document the triggering indicators, analytical basis, investigation process, and final decision. They should also meet applicable reporting obligations. For complex cross-border networks, timely escalation, lawful information sharing with relevant institutions, and well-maintained audit trails can help reduce the risk that financial services are exploited for sanctions evasion or illicit fund transfers.