Four years of sanctions were meant to cut Russia off from the global banking system. Instead, a state-backed network rebuilt a way back in — using front companies, forged invoices, cryptocurrency and ordinary Western banks.
THE SHORT VERSION
A Russian company under sanctions doesn't need to wire dollars from Moscow to pay for restricted imports. The dollars can already be waiting abroad.
- A Moscow-based network called A7 — run by a convicted fraudster and part-owned by Russia's military bank — matches roubles owed inside Russia against hard currency held outside it.
- Foreign front companies make what look like ordinary trade payments, carrying forged invoices that relabel the goods and strip out any Russian trace.
- Leaked records reported by the Financial Times trace more than $6.9 billion through global banks. Just over half ended up in China.
- No bank has been accused of knowingly helping. The system works precisely because each payment looks mundane.
The core trick. A rouble debt inside Russia is matched against hard currency already held abroad, so no payment has to cross the border. A forged invoice makes the offshore payment look like ordinary third-country trade. Graphic: Valdrans.
Two separate Citi stories
In short: one is a regulatory fine for control failures in 2022; the other is A7-linked money reaching Citi clients in 2024–25. They are not the same thing.
Citi appears twice in this story, and the two must not be blurred together. In September 2026 the UK fined Citibank N.A., London Branch about £4.7 million over roughly 970 payments worth some £19.7 million, processed mostly in 2022, that breached Russia sanctions.[^1] The payments touched sanctioned Alfa-Bank, Gazprombank, Credit Bank of Moscow and the shipping firm Sovcomflot. Crucially, the regulator found no intent to breach sanctions: it blamed alert backlogs, manual processes and human error, and cut the penalty because Citi self-reported most of the breaches.[^2]
Separately, the leaked A7 files show around $74 million reaching Citigroup clients between late 2024 and August 2025.[^8] That is a different matter, and the reporting does not show that Citi — or any other bank named later — knowingly processed sanctions-evading payments. Keep the two apart, because the difference is the whole point: the 2022 case was sanctioned names slipping through imperfect filters; the 2024–25 network was built so the sanctioned name never appears in the payment at all.
A7: a sanctions-evasion service
In short: a Moscow settlement company, launched with state money and run by a convicted Moldovan fraudster, that sells sanctions evasion as a service.
A7 is a cross-border settlement operation launched in October 2024 by Promsvyazbank (PSB) — the state bank that finances Russia's defence sector — with money from the state development corporation VEB.RF.1 It is led and majority-owned by Ilan Shor, a Moldovan former banker convicted over the theft of about $1 billion from Moldovan banks, who has since relocated to Russia.1 The UK, US and EU have all sanctioned A7 and its affiliates.2
The scale A7 claims for itself is enormous. Shor has said the network handled more than 7 trillion roubles — about $86 billion — in under a year, and PSB's chairman Petr Fradkov later put the A7A5 token's cumulative turnover near $140 billion.3 Those are the operators' own figures, not audited numbers, and should be read as boasts. But even discounted heavily, they describe something built at industrial scale, with Vladimir Putin personally attending the opening of an A7 office.1
How the machine works
In short: it never replaced SWIFT — it borrowed access to it through front companies, then forged the paperwork to get payments past bank compliance teams.
The mechanics, as described by the NCA, the Open Source Centre, the FT and the New York Times, follow one loop:
1. The rouble leg stays inside Russia. A Russian importer buys an A7 promissory note — a veksel — in roubles, covering the foreign payment it needs to make. When the note is redeemed, no bank transfer leaves Russia.2
2. Hard currency is paid from an offshore pool. A7 draws on pools of foreign currency it already holds abroad, historically routed through Kyrgyzstan, the UAE and Hong Kong. A foreign "sub-agent" company with an ordinary local bank account pays the supplier.2
3. A forged invoice makes it look routine. The FT found a library of thousands of corporate stamps, some fake and some lifted from genuine companies. Staff were instructed to swap customs codes for sanctioned goods, and to strip Cyrillic text so payments carried no "Russian trace."4 The New York Times reported that A7's in-house invoicing software used a commercial AI model to read real trade documents and generate falsified versions — in one case rewriting measurement equipment as LED light boxes.5
4. Digital cover hides the operators. A7 built websites and email addresses for its shells and ran VPNs so staff inside Russia appeared to be in the country whose banks they were approaching.2 Payments were also kept small and split into pieces to stay beneath scrutiny.4
Where the money came from
In short: much of the hard currency was Russian oil money that never had to return home — it paid for imports while still sitting abroad.
A payment network that takes roubles in Moscow but pays suppliers in dollars, dirhams and yuan needs pools of hard currency already outside Russia. The FT's second investigation showed where a large share came from: 16 companies linked to Rosneft, internally nicknamed the "Coral" network, supplied more than $2 billion of foreign currency into A7. In June 2025 alone, that group reportedly provided around two-thirds of the hard currency A7 acquired.6
The mechanism is a netting trick: a Russian exporter's dollars, earned abroad from an oil cargo, are handed to A7 outside Russia, while the exporter is settled in roubles inside Russia. The same dollar never has to travel back to Moscow and out again.
The offshore loop. Export earnings that never repatriate become the reserve that pays foreign suppliers, closing the circle when goods are delivered back into Russia. Graphic: Valdrans.
The money map
In short: leaked records trace more than $6.9 billion through global banks, with just over half ending in China. No bank is accused of knowing.
The FT's leak traces more than $6.9 billion of A7 bank-rail payments. The New York Times found A7 shells paying through banks in more than 80 countries.5 The chart below shows the largest reported flows by institution — amounts received by, or sent from, accounts and clients tied to A7.
Reported flows, late 2024 – August 2025. Figures are journalistic estimates from leaked A7 records, not court-established totals. Being named here is not a finding that a bank did anything wrong. Graphic: Valdrans; data via Financial Times.
| Bank | Where | Reported A7-linked flow | Bank's response |
|---|
| First Abu Dhabi Bank | UAE | 17 A7 entities; $1.8bn+ outbound | Says accounts identified and closed |
| Standard Chartered | Hong Kong | ~$1.1bn received by accounts | Declined to comment |
| DBS | Hong Kong | ~$273m sent to accounts | Acted on one account |
| Citigroup | various | ~$74m received by clients | Declined to comment |
| Deutsche Bank | Europe | ~$18m sent to clients | Declined to comment |
| JPMorgan Chase | various | accounts used; sum not published | Declined to comment |
The companies and banks named
In short: the network runs on shell companies in the UAE, Hong Kong and Kyrgyzstan, plus a handful of Central Asian banks and crypto firms.
| Entity | Where | Role reported | Status |
|---|
| A7 LLC & subsidiaries | Russia | Core settlement company; issues and routes the veksels | Sanctioned UK/US/EU2 |
| Trading Company of the Kyrgyz Republic (TKKR) | Kyrgyzstan | Largest single A7 payment vehicle | Named in leak; dissolved Feb 20263 |
| Keremet Bank | Kyrgyzstan | Cross-border payments for PSB | Sanctioned US/UK7 |
| Old Vector LLC | Kyrgyzstan | Issuer of the A7A5 stablecoin | Sanctioned US/UK8 |
| Grinex | Kyrgyzstan / Russia | Garantex successor exchange; A7A5 trading hub | Sanctioned US/UK8 |
| Gimli Trade LLC-FZ | UAE (Dubai) | Payment vehicle in the oil-money chain | Sanctioned UK6 |
| Pilot Finance Limited | Nigeria | Payment provider partnered with A7 | Sanctioned UK2 |
| UAE / HK front cluster | UAE, Hong Kong | Suspected payment fronts (Galadriel, Sigizmund, Power Sphere, Desert Bridge, Jinghang Way and others) | Assessed by CIR9 |
The Centre for Information Resilience warns it cannot establish the exact operational role of every company in its high-confidence cluster — a distinction worth preserving rather than labelling every name a "laundering company."9
The people running it
In short: the named figures are all sanctioned or indicted by governments — not anonymous. Each entry below reflects that public status.
| Person | Role reported | Status |
|---|
| Ilan Shor | Founder, leader and majority owner of A7 | Convicted in Moldova; UK/EU sanctioned1 |
| Petr Fradkov | Chairman & CEO of Promsvyazbank, A7's co-owner | US/UK sanctioned since 20223 |
| Aleksandr Mira Serda | Garantex co-founder & commercial chief | US-indicted; State Dept reward10 |
| Aleksej Besciokov | Garantex technical administrator | US-indicted; arrested March 202511 |
| Ekaterina Zhdanova | Runs the "Smart" laundering network | US-sanctioned; detained in France7 |
| George Rossi | Heads the "TGR" laundering network | US-sanctioned7 |
The crypto and cyber layer
In short: A7's token plugs into the same exchange ecosystem that ransomware gangs used to cash out — a documented overlap, not a claim that A7 is a hacking group.
A7's crypto arm connects to Garantex, a Moscow-run exchange that US prosecutors say processed vast sums of criminal proceeds and served as an off-ramp for ransomware crews including Conti and LockBit.11 US, German and Finnish authorities seized its servers in March 2025. Its operators promptly relaunched as Grinex and migrated balances into A7's rouble-backed A7A5 token.12 The overlap matters: the same infrastructure that settles Russian cross-border trade also touches the world of ransomware cash-out. The UK's Operation Destabilise mapped two further Russian-speaking networks, Smart and TGR, that convert street cash into crypto while also serving sanctioned Russian clients.7
Not one organisation. A7, the Garantex/Grinex crypto world and the Smart/TGR cash networks are separate operations that intersect through shared banks, exchanges and people. The dashed lines are the documented connections between them. Graphic: Valdrans.
How it feeds back to Moscow
In short: the chain runs from the Russian state, through its defence bank, to the suppliers that keep its industry and war effort stocked.
A7 is co-owned by PSB, the bank Fradkov turned into the financier of Russia's defence industry, and funded by the state corporation VEB.RF.1 Western agencies say Shor runs the operation under the direction of the Russian presidential administration.5 The value returns to Russia not as cash wired home, but as imported goods — electronics, machinery and components — delivered through the front-company layer. The FT found payments for military equipment and purchases by Russia's security services among the flows.4
WHAT IS PROVEN, AND WHAT IS ALLEGED
- Officially established: the OFSI fine on Citi; the US, UK and EU designations; the Garantex indictments; the NCA's published findings.
- Reported from leaks: the $6.9 billion figure, the bank-by-bank flows, the forgery library and the AI invoice tool. These are journalistic analyses of leaked A7 data, not court-established facts.
- Self-reported by A7: the $86 billion and $140 billion turnover claims. Treat them as boasts.
- The banks: none is accused of knowingly processing evasion payments.
Sources
Every figure and claim above is drawn from the following regulator notices, court records and published investigations. Original FT, NYT and Reuters reports are paywalled or access-restricted; where used, they are cited through the outlets that reproduced their findings.