The US Treasury moved to cut off a shadow-banking network it says Iran has used to slip sanctioned money through ordinary-looking trade payments. The package is called Operation Economic Outcast. It has three parts, all aimed at the A7 Network: a FinCEN proposal to prohibit US fund transfers involving the network’s Sub-Agents, a FinCEN alert telling banks what to look for, and an OFAC designation of the network as a significant transnational criminal organization.
Secretary Scott Bessent said the point is to dismantle the infrastructure that lets Iran and other adversaries move illicit funds and that anyone who facilitates that finance loses access to the US system.
The release is sb0644. It builds on the August 14, 2025 designation of A7 LLC and Old Vector LLC. Those firms were already sanctioned. Today’s step is the wider network.
Who Runs the A7 Network
OFAC says the network is led by Ilan Mironovich Shor, a US-sanctioned convicted fraudster. Sub-Agents are companies in third countries, built to take and send payments for the network. Treasury says their websites and bank accounts are controlled by A7 staff, who reach those accounts through custom VPNs that hide location and let payments move quickly.
The public case is that this is not a loose set of traders. It is a purpose-built layer for disguising sanctioned payments as commercial activity, using falsified trade documents, falsified import-export records, and misleading goods descriptions.
FinCEN’s alert describes the network’s backbone as three Russia-based companies, all sanctioned by OFAC.
Iran is the stated user, including the Islamic Revolutionary Guard Corps (IRGC), the Central Bank of Iran, and what Treasury calls Iran-backed terrorist organizations, naming Hamas. The same Sub-Agents, FinCEN says, also served cybercriminals, including ransomware actors and buyers of restricted goods.
What Treasury Did on October 1
FinCEN’s notice of proposed rulemaking, under section 9714(a) of the Combating Russian Money Laundering Act, would prohibit transmittals of funds in transactions involving A7 Sub-Agents. The comment period closes 30 days after the notice is published in the Federal Register. The NPRM PDF is up. The rule is not in force today.
The FinCEN alert is in force as guidance. It lists red flags and describes the use of foreign companies to reach international payment systems. It does not itself freeze accounts.
OFAC’s designation does freeze. Property and interests of the A7 Network, including transactions by Sub-Agents acting for it that are in the United States or held by US persons, are blocked and must be reported. Entities owned 50% or more by blocked persons are blocked too. US persons generally cannot deal in that property unless OFAC licenses it. OFAC can fine on a strict-liability basis. Non-US persons can still be exposed if they cause a US person to violate sanctions.
The UK National Crime Agency put out its own A7 alert on August 31, 2026. Treasury cites that as the prior step.
How Large Treasury Says the Flows Are
By its own account, as of January 2026, the network claimed more than 2,000 transactions a day and more than 7.5 trillion rubles of volume. Treasury puts that at about $91.5 billion, or roughly 13% of Russia’s 2025 foreign trade. That is the network’s claim, repeated by Treasury, not an audited ledger.
FinCEN’s own investigation says Sub-Agents processed more than $17 billion between January 2025 and June 2026, aggregated globally.
A separate measurement exists for the token itself. Chainalysis reported that A7A5 processed $93.3 billion in under 10 months, describing it as a purpose-built settlement rail for sanctioned actors seeking access to the international financial system.
On Iran specifically, the release gives two examples. One Sub-Agent dealt with entities in Iran’s shadow fleet, the tankers and front companies used to move Iranian oil, and that Sub-Agent and a sister company received nearly $140 million from Iranian sanctions-evasion entities. A separate Sub-Agent sent about $1.6 million to a company linked to Iranian sanctions evasion and weapons procurement.
Where Crypto Sits in the Designation
Two crypto links are in the OFAC section.
The network “has been linked to Nobitex, Iran’s largest digital asset exchange,” which OFAC designated, alongside the Iranian exchanges Wallex, Bitpin, and Ramzinex. The release does not spell out the transaction path.
It also says the network “has also facilitated transactions related to North Korean hacks of cryptocurrency exchanges and other illicit actors.” No exchange, no date, and no amount are named in this release.
The token line is concrete. A7A5 is a ruble-backed token issued by Old Vector LLC, designated on 14 August 2025 and described as part of the A7 Network. Treasury says the token was created so members could transact internationally while sanctioned infrastructure providers earned on circulation. FinCEN’s alert says each token is advertised as backed by ruble deposits held at Promsvyazbank, the Russian state bank already under OFAC sanctions.
How the Token Actually Reaches the Banking System
This is the part that matters for banks and exchanges, and FinCEN states it plainly: financial institutions are unlikely to see A7A5 transactions directly, because the token is typically converted into other digital assets such as Tether’s USDT, which may then be converted into fiat currency.
So the compliance exposure is rarely a wallet holding A7A5. It is the stablecoin and fiat leg downstream of it, which looks like ordinary activity unless an institution is screening for the pattern.
What Is Blocked, and Who Must Report
As of this designation, A7A5 is blocked property. US persons cannot buy, sell, or hold it, and any A7A5 in US jurisdiction or in a US person’s control must be reported to OFAC—a filing obligation, not merely a prohibition on trading.
That is a token ban tied to the issuer’s existing designation, extended by today’s network-wide block. It is not a new finding that every ruble stablecoin is illicit.
The US is also the third jurisdiction to reach the token rather than the first. The European Union banned A7A5 in its 19th sanctions package, prohibiting any transaction involving it, and its 20th package extended the approach to the exchanges and payment agents that distribute such tokens, adding RUBx and the Belarusian digital ruble to the same prohibited list. The UK acted on A7A5-linked entities earlier still.
What Banks and Exchanges Are Supposed to Do Now
US financial institutions are expected to use the alert’s red flags and file suspicious-activity reports where the pattern matches. The proposed Sub-Agent ban, once final, would go further: a prohibition on fund transfers involving those agents, not only a reporting duty.
Crypto firms that are US persons, or that move funds through the US, inherit the same block. A transfer involving A7, a Sub-Agent acting for it, or A7A5 is prohibited unless OFAC licenses it. Treasury points firms with information toward FinCEN’s whistleblower program if a tip leads to a penalty above $1 million.
No new SDN list excerpt was pasted into the press release. Compliance teams will need the actual designation entries, the NPRM, and the alert, not the press summary, before they block names.
Also Read: U.S. Treasury Sanctions 10 TdA-Linked Targets Over ATM Jackpotting
