Russia’s A7 was sold to the world as a crypto-powered, sanctions-proof payments network. Two leaks, investigated by the Financial Times and The New York Times, tell a much older story: forged invoices, an AI-powered forgery app, and shell companies strung from Bishkek to Bahrain to Lagos. If you run a bank or payments business anywhere from Africa to Asia to the Pacific, this is your problem too.
In February 2025, a Russian client wanted 500 night-vision scopes, worth roughly half a million dollars. That’s awkward when you’re under sanctions, and night-vision optics are exactly the kind of thing the West would rather Russia didn’t buy.
So the paperwork said toughened glass.
According to internal files leaked to the Financial Times, staff at A7, the Kremlin-backed payments firm handling the deal, then got a compliance query from a bank and debated re-labelling the scopes as footwear. They decided against it. The recipient’s earlier invoices had all been for optical goods, and a sudden pivot to shoes might look odd. Glass it stayed.
That one invoice tells you most of what you need to know about Moscow’s much-hyped sanctions superweapon. It isn’t blockchain wizardry, and it isn’t a sovereign alternative to SWIFT. It’s a rubber stamp, a thesaurus, and a bank somewhere that didn’t ask the second question.
The pitch: immune to sanctions#
A7 launched in late 2024, backed by Promsvyazbank (PSB), the Russian state bank that finances the defence industry. Moscow presents it as the flagship fix for a problem it has had since 2022, when Russian banks were cut off from SWIFT: how do you pay for imports when the West has locked the front door?
The branding was pure start-up. There was a ruble-backed stablecoin, A7A5, that blockchain analysts say moved over $100 billion in its first year. There were promissory notes, crypto wallets, talk of a new settlement architecture for the non-Western world. This month Vladimir Putin and Narendra Modi discussed a Russian-Indian payment system with PSB’s chair in the room.
The man running it, Moldovan oligarch Ilan Shor, told Russian state media in July that his system was immune to sanctions. The company claims it handles a fifth of Russia’s foreign trade. Shor knows a thing or two about moving money quietly: he was convicted over the 2014 theft of roughly a billion dollars from Moldova’s banking system. Three Western intelligence officials told the NYT he now reports to a senior figure in Putin’s administration.
Then the crypto side hit a wall. After coordinated US, UK and EU sanctions, A7A5’s daily volume fell by about 96% from its mid-2025 peak, according to blockchain analytics firm Elliptic. The exits to more liquid stablecoins closed, one by one.
But the crypto was only ever the shop window. The leak shows what was going on out the back.
The reality: stamps, shells and SWIFT#
Hundreds of thousands of internal A7 files, obtained by the Financial Times, show more than $6.9 billion moving through the ordinary international banking system between late 2024 and August 2025. A separate New York Times investigation, drawing on leaked chats, accounting records and A7’s own source code, found more than $500 million in prohibited transactions in just the first four months of 2025, with over $130 million of it for goods useful to Russia’s military industry. The FT calls it old-fashioned money laundering. That’s generous. Some of it is closer to arts and crafts.
The mechanics are simple. A7 set up front companies outside Russia, got them bank accounts inside the SWIFT system, and had them pay Russian importers’ bills abroad. Just over half the money ended up in Chinese bank accounts. The FT found around 100 fronts actively paying, with the documents naming at least 100 more across the UAE, Hong Kong, Kyrgyzstan and Indonesia.
The biggest single payer wasn’t a shell at all. It was a state body, the now-closed Trading Company of the Kyrgyz Republic, set up in 2024 with the stated aim of reducing sanctions evasion. According to the NYT, it was used for the opposite. In one early-2025 deal, it paid $1 million for what the paperwork called car floor mats, body polish, safety glasses and rope. The money was actually for drone parts.
To keep banks comfortable, A7 ran what amounts to a forgery department, and gave it a software upgrade. The NYT reconstructed the firm’s in-house invoicing app from its source code. Staff uploaded a genuine invoice, and the app used ChatGPT to read it and generate a fake one for the same amount and date. Then they picked a company stamp from a database of more than 6,000 and dropped it on.
One March 2025 order for signal measurement sensors, among the most sensitive electronics the US tries to keep out of Russia, went in to the app. Out came an invoice for LED advertising light boxes, bought by the Kyrgyz state trading company. The seller’s bank raised no questions. (OpenAI says the credentials in the app are no longer active and that it doesn’t allow access from Russia.)
The rest of the toolkit:
- A library of corporate stamps, some faked, some lifted from real paperwork belonging to companies that had no idea.
- Invoices written in advance, building a paper trail before any bank asked for one.
- Customs codes swapped for the nearest non-sanctioned equivalent.
- The “Russian trace” scrubbed out, down to software that caught stray Cyrillic characters.
- Staff in Russia using VPNs to appear to be wherever the shell company was registered (Fintech Garden).
The banks on the other end are household names. Standard Chartered accounts in Hong Kong received $1.1 billion. First Abu Dhabi hosted 17 A7-linked entities that sent out more than $1.8 billion. DBS, Citigroup, JPMorgan Chase and Deutsche Bank also appear in the files. First Abu Dhabi says the accounts have been closed; the others either declined to comment or pointed to their controls.
Where does the hard currency come from? Partly from Russia’s own energy exports. The NYT traced roughly $100 million in Emirati dirhams, apparently skimmed from Gazprom sales proceeds, deposited in instalments into A7 shell accounts at First Abu Dhabi in early 2025. Within weeks, more than half had been converted into dollars, euros and Tether. From there, A7 could pay suppliers in more than 80 countries.
One detail sums it up. The leak also points to A7 promissory notes with a face value of more than $20 billion. The future of money, apparently, is an IOU.
Why the checks didn’t catch it (and why, once, they did)#
SWIFT is a messaging network built on trust. Each bank is responsible for knowing its own customers, and everyone downstream assumes the bank upstream did its job. So you don’t need to fool the whole system. You need to fool one member bank, once, and your payment is inside.
Here’s the part worth sitting with. The system did work, briefly. In February 2025, Standard Chartered noticed a burst of payments from a small Kyrgyz bank, many chopped into slices. One company received exactly 20 million renminbi in 12 pieces. Classic structuring. Standard Chartered put holds on the payments and the recipient accounts were closed.
A7’s response? It moved. Flows shifted from Kyrgyz banks to the UAE, where First Abu Dhabi became the main channel. When Emirati banks sent their own anti-money laundering queries in the months that followed, the forgery department answered them with fresh invoices.
That’s the real lesson. Each bank saw one payment, one customer, one plausible invoice. Nobody saw the network. And a red flag at one institution didn’t make the network go away; it just made it change address.
A former US government banking analyst who studied A7 for the Open Source Centre told the FT the leak should make us rethink how hard it is to keep correspondent banking clean. We’d go further. If your controls only ever look at one transaction at a time, it’s close to impossible.
A7 knows this, and has built its business around it. According to the NYT, the firm has a team whose job is to spin up replacement shell companies when old ones get burned: an industrial machinery trader in Qatar, a wholesaler in Kyrgyzstan, an oil-and-gas outfit in Bahrain. The company’s mascot is a nevalyashka, the Russian roly-poly doll with a weighted base that pops back up every time you knock it over. They told a Russian magazine that was the point.
“We’ve created a monster,” one economist at the Kyiv School of Economics told the Times.
There’s a practical sting for compliance teams here too. The NYT’s analysis of Treasury data found Washington has recently lifted more Russia-related sanctions than it has added (Treasury points to major new actions on Russian oil and on A7 itself). Whatever the politics, the effect on the ground is simple: fewer fresh names on the lists. Screening against a sanctions list only works if the shell companies are on it, and A7’s newest ones won’t be.
The map keeps getting bigger#
A7’s first beachhead was Kyrgyzstan, a country of seven million people whose banks suddenly got very rich. Kyrgyz bank profits rose from $42 million in 2021 to $354 million in 2024. Over the same years, shipments from China and Europe into Kyrgyzstan nearly tripled, to around $23 billion. Economists have long argued most of those goods were only passing through on their way to Russia.
When Western pressure pushed Kyrgyzstan to shut down the state trading company this year, A7 simply moved. The NYT identified 71 shell companies linked to the firm, with new ones in Bahrain, the UAE, Qatar, Mongolia and Nigeria. The FT’s files point to dozens more in Hong Kong and Indonesia. Just over half the money ended up in Chinese bank accounts. More than $2 million went to a single Maldives travel agency. And this month, Putin and Modi discussed a Russian-Indian payment system with the chair of A7’s state backer.
In Africa, A7 has gone further than shell companies. In September 2025 it opened public-facing offices in Lagos and Harare, with Russia’s deputy finance minister at the ribbon-cutting and Zimbabwe’s finance minister photographed at the Harare launch. Sergei Lavrov later declared that Nigeria and Zimbabwe had already joined the platform. There’s even a job ad for someone to build an A7 business in Togo from scratch.
Some honesty about scale. How much A7 actually moves through Africa is unclear, and the FT did not find that any of the $6.9 billion ran through Nigeria or Zimbabwe. Some of it may be Kremlin theatre. But theatre is how it starts. Kyrgyzstan didn’t look like a sanctions hub either, until it became one.
And the Pacific? Nothing in either leak places A7 there, and we’re not going to pretend otherwise. But look at what A7 goes hunting for: small, open economies with busy trade, tourism and remittance flows, few correspondent banks, and compliance teams stretched thin. That description fits a lot of places, from Central Asia to the Indian Ocean to the Pacific islands. The network has shown it will go wherever the door is least watched.
Who pays when the music stops#
Here’s the uncomfortable bit for anyone running a bank, a remittance firm or a payments business in a smaller financial centre, whether that’s in Africa, Central or Southeast Asia, or the Pacific. When a network like A7 gets exposed, the Kremlin doesn’t pay the bill. The local financial system does.
Look at Kyrgyzstan. Its banks were the early on-ramp. Within months, Standard Chartered was holding payments and closing accounts. Since then, Western governments have sanctioned a string of Kyrgyz banks over Russian flows, including state-owned Capital Bank, which the UK hit in August 2025 (the bank says it complies with international sanctions). Once a jurisdiction gets a reputation as a conduit, the big correspondent banks rarely sort the good actors from the bad. They de-risk. Accounts close, costs rise, and ordinary businesses find it harder to pay a supplier in Shanghai or Rotterdam.
Institutions across these regions know this story well. Pacific island banks have lost around 60% of their correspondent banking relationships since 2011, double the global rate, according to the World Bank, leaving some countries close to financial isolation. Several African countries have spent years clawing their way off the FATF grey list. Across Asia, smaller banks already pay a premium for access to dollar clearing. The last thing anyone needs is to discover, three years from now, that a sanctioned Russian payments network had been using their customer book as a front door.
This isn’t about choosing sides in someone else’s war. It’s about sovereignty in the most practical sense. If your institution can’t see who it’s really dealing with, then someone else gets to decide what risks you carry, and what your access to the global financial system is worth.
What to actually look for#
None of A7’s tricks are new. That’s the good news. The patterns are learnable, and most of them show up in data your institution already holds.
- Trading companies with no trade. A newly formed importer or exporter with no warehouse, no staff, no web presence and big volumes from day one deserves a closer look, whatever its invoices say.
- Goods that drift. When the same beneficiary is paid for cameras one month and glass the next, or the goods on the invoice don’t match what the counterparty is known to deal in, ask why.
- Payments cut into neat slices. Round sums split into near-identical tranches on the same day is exactly what tripped Standard Chartered’s alarm.
- Clusters, not customers. Several unrelated-looking companies sharing directors, addresses, IP ranges or the same small pool of counterparties is the signature of a front network. You only see it if you connect accounts, not just screen them one by one.
- Onboarding that goes stale. A7’s fronts opened accounts that looked clean at the start. Risk has to be re-scored as behaviour changes, not just at the next annual review.
- Crypto on-ramps next to trade flows. Large stablecoin conversions sitting alongside trade payments, especially through local OTC desks, is now a known A7 pattern.
And one new thing: if forgers are using AI to rewrite invoices in seconds, a document that looks perfect proves very little. The NYT confirmed A7’s fakes by doing something old-fashioned: contacting the real sellers and comparing paperwork. For high-risk trade payments, checking a document against its counterparty, the shipping data or the goods a supplier actually makes is worth more than checking the stamp.
None of this requires a Western-sized compliance department. It requires joined-up data: screening, customer risk and transaction monitoring talking to each other, so that a red flag in one place changes what you see everywhere else.
The lesson: check the pattern, not just the paperwork#
A7 was supposed to prove that the non-Western world could build its own financial plumbing, beyond the reach of Washington and Brussels. Maybe one day someone will. But this wasn’t it.
Strip away the stablecoin and the summit photo ops, and A7 is a parasite on the system it claims to replace. It needs SWIFT. It needs dollar and euro conversions from Gulf banks. It needs clean-looking companies in Hong Kong, Abu Dhabi and Manama. Above all, it needs compliance teams that check the invoice and not the pattern.
That last part is the one we can do something about. At Anqa, we build compliance tools for financial institutions across Africa, Asia and the Pacific that rarely get the attention of the global giants: KYC, sanctions screening, transaction monitoring and risk assessment in one place, so a warning sign in one corner of the business is visible in all of them. Not because the big banks have it figured out. The A7 files show they very clearly don’t.
The next network won’t be called A7, and it won’t necessarily be Russian. But it will still need a bank somewhere to believe that 500 night-vision scopes are a pallet of glass.
The question is whether that transaction implicates you.
Want to see how your own screening holds up? Anqa gives you 100 free screens a month, no strings attached. Try it free here.
Also try our free training resources.