Treasury Designates the A7 Criminal Network

On 1 October 2026 the United States Treasury moved against a network it says has been moving value outside the banking system. Treasury A7 Network sanctions October 2026 is the action. Under Operation Economic Outcast, the Office of Foreign Assets Control designated the A7 Network a significant transnational criminal organization. The Financial Crimes Enforcement Network proposed a rule to prohibit fund transfers involving A7 sub-agents and issued an alert to help banks spot the activity. The designation, the proposal, and the alert are three instruments. Only the designation is already a designation.

What happened

Treasury describes A7 as a Russia-tied shadow bank used by Iran. In that description, a shadow bank shifts value the way a bank does without sitting inside the regulated perimeter those flows would normally cross. The network is led by Ilan Mironovich Shor. Treasury says it has used falsified trade documents and custom virtual private networks. False trade paper can make a payment look like settlement of goods. This article reports those methods as Treasury's description. It does not reconstruct them.

Property of the network and its sub-agents that U.S. persons hold or control is blocked. In this kind of sanctions action, blocked property is not free for those persons to transfer or deal in. Two limits stay in the sentence. The property is that of the network and its sub-agents. And it is property U.S. persons hold or control. The accounts used here do not turn that into a wallet list.

The A7A5 token is a blocked ruble-backed token issued by Old Vector LLC. OFAC designated Old Vector on 14 August 2025, more than a year before the 1 October 2026 designation of the network. The token was already blocked through its issuer. October is the network designation, not the first time the issuer appeared on an OFAC list. A ruble-backed token uses the ruble as its stated reference. "Blocked" is a legal status, not a view about whether any peg holds.

A7 is also linked to Nobitex and to transactions tied to North Korean crypto hacks. "Linked" means the connection the accounts report. It is not a trace this newsroom performed, and it is not a description of how any hack was carried out. The North Korea point concerns transactions tied to crypto hacks. It is not a new hack announced on 1 October.

FinCEN's proposal and FinCEN's alert do different work. The proposed rule would prohibit fund transfers involving A7 sub-agents. A proposal is not a final rule, so this article will not describe that prohibition as already in force. The alert was issued to help banks spot the activity. An alert is a recognition tool. It does not, by itself, freeze a customer, and it is not the designation. Folding the proposal, the alert, and the OFAC list into one ban hides which instrument does which job.

The volume figures are claims the pages cite, not counts this newsroom made. Both accounts cite about 7.5 trillion rubles, or about $91.5 billion. Treasury dates the ruble claim to A7's own account as of January 2026. Both accounts also cite more than $17 billion processed globally. Treasury attributes that figure to FinCEN for January 2025 through June 2026. The ruble line is the network's own account, as Treasury presents it. The processing line is FinCEN's, for that window. Neither number is repeated here as an independent measurement.

Why it matters

The policy bet in a designation like this is that U.S. persons and banks that touch the U.S. system stop being usable pipes. Blocking property that U.S. persons hold or control is the direct legal effect. The alert tries to make the network recognizable in ordinary monitoring, where a transfer may not arrive under the network's name. The proposed ban on transfers involving sub-agents would, if finalized, reach beyond the listed organization to transfers those sub-agents touch. Until final, it remains a proposal.

Treasury is treating the operation as a national-security problem, not only as a loss to customers. A shadow bank described as Russia-tied and used by Iran is, in that telling, a channel for a state and for a criminal organization at once. Shor is named as the leader. Falsified trade documents matter because a payment dressed as commerce is harder to see. If the documents are false, the payment is not the settlement it pretends to be. This article does not grade individual invoices.

A7A5 should not be read as a neutral ruble product sitting near a sanctioned network. The token is blocked, and Old Vector LLC was designated on 14 August 2025. The October action then puts the wider network, not only the issuer, on the list.

What's next

The OFAC designation stands. Property of the network and its sub-agents that U.S. persons hold or control is blocked. FinCEN's rule is still a proposal, so the prohibition on fund transfers involving A7 sub-agents is not described here as finished. The alert can be used now by banks trying to recognize the activity. Designation now, alert now, rule not yet final: that is the operational picture.

Figures beyond the two attributed totals are left out. Any retelling should keep the attribution. The ruble claim is A7's own account as of January 2026, via Treasury. The figure of more than $17 billion is FinCEN's for January 2025 through June 2026. For related enforcement context, see Fundsz judgment and reverse solicitation.

Treasury's release is here. A second account is here.