A7A5 and the A7 Network: What Crypto Exchanges Should Screen For Now

On October 1, 2026, the U.S. Treasury took coordinated action against the A7 Network, a Russia-linked shadow banking network that Treasury says Iran uses to evade sanctions. OFAC sanctioned the network as a significant transnational criminal organization. FinCEN proposed a rule that would prohibit transmittals of funds involving the network's sub-agents, and issued an alert (FIN-2026-Alert007) describing how the network moves value, including through the ruble-backed A7A5 token.

For exchange compliance teams, the alert is unusually specific about digital assets. This article summarizes what Treasury and FinCEN published and the screening and monitoring questions it raises for crypto exchanges and VASPs.

What Treasury and FinCEN announced

Treasury's press release describes A7A5 as "a blocked, ruble-backed token issued by Old Vector LLC." Old Vector was designated on August 14, 2025, in an earlier OFAC action that also targeted Grinex, the exchange that TRM Labs and others describe as the successor to the sanctioned Garantex exchange.

The scale is significant. According to the FinCEN alert, more than 180 entities processed A7A5 transactions totaling at least $179.1 billion between February 2025 and June 2026. FinCEN's announcement states that the proposed rule is issued under section 9714(a) of the Combating Russian Money Laundering Act.

According to Decrypt, A7A5 circulates on Tron and Ethereum.

How A7A5 moves, according to the alert

The FinCEN alert sets out several typologies that matter directly to exchanges:

• An internal ledger. A7A5 acts as a "mirror system" for the network's international fiat payments, moving between internal addresses to keep balances in line.

• A bridge into mainstream stablecoins. A7A5 is often converted into other digital assets, such as USDT, which can then be converted into the customer's chosen fiat currency.

• OTC liquidity providers. The network relies on sub-agents and intermediaries, including OTC brokers outside Russia. FinCEN flags newly created firms, and firms rapidly expanding stablecoin operations, as a particular concern.

• Wrapped tokens. U.S. institutions may encounter wrapped or pegged A7A5 derivatives, often accessed through decentralized finance applications.

• Kyrgyzstan. Kyrgyz-registered entities serve as cross-border settlement vehicles. The alert names Grinex and Old Vector as Kyrgyz-linked digital asset actors.

Decrypt also reports that after a reported hack of Grinex in April, A7A5 supply has shifted toward unhosted wallets. If that is accurate, exposure is now less likely to arrive from a single, easily identified exchange cluster.

The red flags to map to your controls

The alert's digital-asset red flags include a customer that:

• offers, has traded in, or has "historic direct or indirect exposure" to trades denominated in A7A5;

• provides digital assets, especially stablecoins, to identified or suspected A7 Network sub-agents;

• is engaged in international trade, import/export or shipping and uses stablecoins for large purchases, especially of commodities not usually paid for in digital assets, including military or dual-use goods;

• operates a digital asset firm, including one presenting itself as an OTC desk, that sees sudden, unexplained growth in jurisdictions with known links to A7 Network operations, especially with a minimal online presence or limited operating history.

The alert also lists transactions with suspected Kyrgyz shell companies, and account access from VPN infrastructure or servers in jurisdictions it identifies as hosting A7 Network digital infrastructure.

Practical questions for your screening and monitoring program

The alert does not prescribe specific controls, and what is required of a given firm depends on its business and legal position. The questions below are the ones we would expect a compliance lead, a bank partner or an examiner to ask.

1. Does your blockchain analytics coverage identify A7A5 and its wrapped variants on both chains? Confirm with your vendor which token contracts are labeled, on which networks, and whether wrapped or pegged derivatives are covered.

2. Have you scoped a lookback? The red flag explicitly covers historic exposure. One reasonable starting point is early 2025, when FinCEN's data window begins. Decide the period, the customer population and the exposure threshold, and write the rationale down.

3. Are your indirect-exposure settings fit for this pattern? Because A7A5 is often swapped into USDT before it reaches a regulated venue, exposure may appear one or more hops away. Check whether your alert thresholds would surface a deposit of USDT that recently passed through an A7A5 conversion.

4. Are your OTC and payment-agent customers re-risked? Newly formed OTC firms, rapid growth in stablecoin volume, thin online presence, Kyrgyz counterparties and trade-related stablecoin payments are all named in the alert. These map naturally to enhanced due diligence triggers and periodic review.

5. Is address screening the only control? Treasury's press release does not list digital currency addresses. Check the SDN entries themselves rather than assuming address screening will catch exposure, and pair list screening with token-level and counterparty-level detection.

6. Are device and network signals in scope? The VPN and hosting indicators are only useful if your onboarding and login data feed your monitoring.

Whatever you decide, document the scope, results and escalation decisions. A short, dated memo is what lets you show your work to a bank partner or examiner later.

The broader point

The A7 action follows a pattern seen in earlier Garantex and Grinex actions: sanctioned infrastructure rebuilds itself, and stablecoins are the connective tissue. A screening program that depends on a static list of exchange addresses will miss much of that movement. Programs that treat token exposure, counterparty behavior and customer profile together are better placed to identify it.

How we can help

ComplyChain works with crypto exchanges and VASPs on sanctions and wallet-screening reviews, lookback scoping, and transaction monitoring tuning. Learn more about our work with crypto exchanges and VASPs and our AML and KYC compliance solutions, or email info@complychainsolutions.com to talk through how the A7 alert applies to your program.

This article is general information, not legal advice. Speak to your counsel about the requirements that apply to your business.