On October 1, 2026, the U.S. Treasury acted against the A7 Network, which it describes as a shadow banking network with ties to Russia used by the Iranian regime to evade sanctions. OFAC sanctioned the network under Executive Order 13581, as amended by Executive Order 13863, for what OFAC determined to be a significant transnational criminal organization. FinCEN issued Alert FIN-2026-Alert007 on October 1, 2026. FinCEN issued the Alert concurrently with a finding and notice of proposed rulemaking under section 9714(a) of the Combating Russian Money Laundering Act. The comment period closes 30 days after the proposal is published in the Federal Register.
What OFAC blocked, and why a list will not find it
The blocking covers all property and interests in property of the A7 Network, including transactions involving Sub-Agents acting for or on behalf of the network, that are in the United States or in the possession or control of U.S. persons, and that property must be reported to OFAC. The difficulty for a compliance team is what a Sub-Agent looks like. FinCEN describes Sub-Agents as companies the network forms, acquires or partners with in third countries such as Hong Kong, Indonesia, the Kyrgyz Republic, the Seychelles, Türkiye and the United Arab Emirates. As of June 2026, according to FinCEN, the network operated hundreds of companies with bank accounts at approximately 435 financial institutions in at least 83 countries.
A screening tool matches names. Hundreds of third-country trading companies, each presented as locally owned, are unlikely to appear on any list by name. In our reading, that is the point of this action: the designation names a network, not a list, and the compliance burden moves from name screening to typology detection. The penalty framework does not soften to match. OFAC may impose civil penalties for sanctions violations on a strict liability basis.
How the money moves
In a typical transaction, as FinCEN describes it, the A7 Network satisfies its customer’s payment obligation through network-controlled settlement mechanisms, including bills of exchange or promissory notes, and a Sub-Agent then appears as the contracting or paying party on invoices, sales agreements and payment instructions. FinCEN characterizes the structure as a form of trade-based money laundering built on falsified trade documents, false import-export records and misleading goods descriptions. From the receiving bank’s side, the payment appears to be an ordinary commercial transfer from a company with no visible link to Russia or Iran.
The infrastructure is the tell. According to FinCEN, network staff reach Sub-Agent accounts through VPNs that have operated on the domains muzpan.com and sodkamus.com and often appear to have IP addresses in Dubai, Hong Kong or the Kyrgyz Republic. For an exchange or custodian, login telemetry may therefore be a better detection layer than counterparty screening.
The designation names a network, not a list, and the compliance burden moves from name screening to typology detection.
The digital asset side matters for this audience. Treasury states that A7A5 is a blocked, ruble-backed token issued by Old Vector LLC, which OFAC designated on August 14, 2025. FinCEN found that more than 180 entities processed A7A5 transactions totaling at least $179.1 billion between February 2025 and June 2026. FinCEN’s analysis indicates that U.S. financial institutions may encounter derivative or wrapped tokens pegged to A7A5, often accessed through decentralized finance applications. A platform that lists or custodies tokens bridged from other chains could carry indirect exposure without ever touching the native token.
What the section 9714 proposal would add
FinCEN finds that transactions involving any company operating outside of the United States that is controlled by the A7 Network are a class of transactions of primary money laundering concern. It proposes a prohibition on certain transmittals of funds, by any covered financial institution, involving that class of transactions. According to FinCEN’s investigation, Sub-Agents processed more than $17 billion between January 2025 and June 2026, aggregated globally.
The proposal, if finalized, would likely sit alongside the OFAC blocking as a separate Bank Secrecy Act obligation with its own examination trail. The questions we expect to matter most in comments are which firms count as covered financial institutions, and what level of diligence a firm must perform to identify a company as A7-controlled when nothing in the payment chain says so. Firms with cross-border transmittal volume should read the proposal with those two questions in mind and consider commenting.
What still applies
The proposal is a proposal. Nothing in it is in force until a final rule is published. The OFAC blocking, by contrast, is not a proposal, and the ordinary rules around it are unchanged. Entities owned 50 percent or more, directly or indirectly, individually or in the aggregate, by one or more blocked persons are also blocked. Suspicious activity reporting continues under existing rules. FinCEN requests that filers include the key term “FIN-2026-A7NETWORK” in SAR field 2 and in the narrative. FinCEN’s whistleblower program may pay awards where information leads to a successful enforcement action with monetary penalties exceeding $1,000,000. Firms should expect that their own staff, and their counterparties’ staff, know that.
What firms should do
First, stop treating this as a list update. Add the A7 Network and its known entities to screening, but brief your monitoring team that the designation extends to Sub-Agents that the list will not name. Document that decision and the controls that respond to it.
Second, build the typologies into transaction monitoring. The Alert gives you the indicators: recently formed companies with sudden high volumes, goods descriptions that do not fit the supplier’s business, payments routed through several shell companies, altered documents, and out-of-place Cyrillic characters in otherwise English language documents. FinCEN also lists a trade, import-export or shipping customer using stablecoins for large purchases of commodities not usually traded using digital assets, including military or dual-use goods or oil and petroleum products.
Third, use your device and network data. FinCEN flags customer websites whose serving IP ranges fall within 159.100.19.150/152 and 159.100.19.203/214. Add those ranges and the muzpan.com and sodkamus.com domains to login and onboarding checks, and route hits to a sanctions analyst rather than the general alerts queue.
Fourth, trace token exposure. Run your listed assets, custody holdings and bridged tokens for any direct or indirect link to A7A5 or wrapped versions of it, including through DeFi integrations. Where you find exposure, treat it as a potential blocking question and take legal advice; Taft does not give it.
Fifth, decide whether to comment on the section 9714 proposal within the 30-day window, and start the gap analysis now so you are not building a transmittal control after the rule is final.
Taft reviews sanctions and AML programs against actions like this one, from screening logic to monitoring rules to governance, and reports where the gaps are. A compliance review from Taft is the place to start if you want an independent look before the proposal becomes a rule. For the wider control set this sector needs, see our guide to crypto compliance for digital asset firms.
Sources
- Operation Economic Outcast Takes Unprecedented Action Against Sanctions Evasion Network Used by Iran, U.S. Department of the Treasury
- This document has been submitted to the Office of the Federal Register (FR) for publication, doc
- 1. See 31 U.S.C. 5312(a)(2); 31 C.F.R. 1010.100(t)., doc
Taft does not provide legal advice. Content is for informational purposes only and subject to regulatory guidance.