The Big Shor

How A7 Works

Domestically, A7 would market and sell securities to Russian entities using a ‘bill of exchange’, effectively providing a form of credit. In return, A7 promised to settle payments to suppliers around the world, reconnecting Russian businesses to foreign markets.

In order to execute these payments, the A7 Network relies on a web of front companies in Asia, the Middle East and Europe. These companies are designed to have no discernable links to Russia, although their websites and bank accounts are controlled by A7 staff.

The A7 Network is able to access these front company accounts using custom-built Virtual Private Networks (VPN) that mask their true location and permit the rapid execution of payments.

The invoices and trade documents underpinning these payments are also falsified. Using custom built code, the A7 Network inputs real invoices issued by foreign suppliers to Russian customers and generates new copies. While the invoice value stays the same, the A7's "Invoicer" application swaps the list of real goods being ordered by Russian customers with a fake one, using mundane items such as LED lights, shelving units and garbage bins. The newly-generated documents are void of any reference to Russia and any Russian text.

This complex scheme is designed to avoid triggering red flags at international financial institutions, thereby circumventing due diligence and compliance software. Together, they ensure that Russia-origin money flows freely to suppliers across the world.

Correspondent Banking

For all of the attention devoted to digital assets and blockchain technology, the A7 Network depends heavily on conventional correspondent banking infrastructure. To move such large volumes of money to global exporters, accessing the international banking system is critically important.

By July 2025, internal ledgers showed that approximately RUB 2.1 trillion, or around $25 billion, in bills of exchange had passed through the A7 system. As of April 2026, key A7 personnel claim that figure is now over RUB 6.1 trillion. However, processing such volumes requires more than isolated shell companies or ad hoc payment routes.

OSC discovered that a series of entities located across Kyrgyzstan, the United Arab Emirates, Hong Kong, Hungary and Mongolia act as payment vehicles and external treasuries, maintaining funds outside Russia and settling transactions on behalf of A7’s Russian customers. Internal records and leaked SWIFT messages show payments moving through correspondent banking relationships and reaching suppliers in more than 80 jurisdictions.

The concentration of flows within the network is striking. One organisation stands apart from the rest. The Trading Company of the Kyrgyz Republic (TKKR), a state-owned company established by the Kyrgyzstani government, emerged as the single largest A7 payment vehicle identified by OSC.

Kyrgyzstan: Captured State

While over a dozen A7-linked front companies were operating in Kyrgyzstan, TKKR was different. The entity – shut down in February 2026 – was wholly owned by the Kyrgyzstani Ministry of Economy and Commerce.

An internal presentation produced by A7 and PSB, identifies TKKR as a core part of the network’s international infrastructure, highlighting billions generated in turnover. The presentation also charted a range of TKKR’s foreign branches, opened to gain access to foreign bank accounts and currencies. Thousands of invoices, bank transaction records and documents contained within the leaks reveal TKKR’s integral role as an A7 payment vehicle – dubbed internally as PKG001 – during its lifespan.

The company is present on thousands of invoices and SWIFT messages showing the execution of payments to suppliers through international banks, ultimately on behalf of Russian customers.

An internal A7 ledger identifies TKKR as having participated in approximately 1,400 bills of exchange up to July 2025. Some of these were on behalf of sanctioned Russian companies and military suppliers.

Rustakt LLC (ООО “Рустакт”) is one such example. Registered days after the February 2022 invasion, Rustakt is one of the primary suppliers of FPV drones to Russia’s elite military units and is reportedly funded by Russian military intelligence. Despite Rustakt being designated by the EU on 17 December 2024, TKKR processed 21 bills of exchange– valued at RUB 1.3 billion or $13.1 million – after the sanctions were imposed.

Sanctioned and Military Customers of A7

Rustakt is but one of 75 sanctioned Russian companies named in the A7 ledger and on additional A7 customer lists contained within the leaks. Others, for example, operate within Russia’s nuclear industry, military vehicle manufacturing and military logistics. This includes MG-Flot, the owner and operator of multiple sanctioned military logistics vessels that have shipped millions of artillery rounds and other munitions from North Korea and Iran.

However, A7 also worked on behalf of a wide array of non-military companies covering various sectors of the Russian economy. One of its most significant customers is Wildberries, Russia’s largest online retailer, while others are Russian importers of chemicals and household goods. Another is a UAE company sanctioned by the United Kingdom as part of Russia’s Shadow Fleet.

The Role of Cryptocurrency

A7A5, the company’s ruble-pegged stablecoin, has garnered global attention and invited a raft of sanctions. Yet, while cryptocurrency is employed by the network, senior A7 staff have claimed publicly that it is only one of many mechanisms the company uses.

The files analysed by OSC show that A7 appears to be a fiat-first payment system, designed to move hard currency into the international banking system to settle payments for Russian imports.

Forensic analysis by TRM Labs suggests that the reported on-chain volume of $166 billion is substantially inflated – approximately $35 billion of this figure likely stems from circular transfers between A7 and other Russian sanction evasion-related actors. Part of this circular movement of funds appears to be a book-settling mechanism designed to maintain liquidity across the network’s own addresses, functioning as a digital mirror of A7’s internal debt ledger rather than a medium for customer settlements.

However, the ability to make crypto payments remains important for settlements outside the international financial system. Analysis by TRM Labs, for example, shows that a number of A7-associated wallets have links to a range of illicit and nation-state actors, including Iran’s Islamic Revolutionary Guard Corps (IRGC), Venezuelan money launderers, North Korean hackers and Hamas.

Expansion

Even as sanctions pressure on Russia intensified, A7’s ambitions continued to expand.

On 17 September 2025, for example, A7 announced an expansion of its global network with the opening of its first African representative offices in Harare, Zimbabwe and Lagos, Nigeria. The expansion was supported by the state finance ministries from both African countries and the Russian Ministry of Finance.

Speaking at the Russia-Africa Partnership Forum in Cairo on 20 December 2025, Russian Foreign Minister Sergey Lavrov stated that Nigeria and Zimbabwe had already joined the platform and invited other “African partners” to follow their example.

Conclusion

The A7 Network emerged during one of the most acute periods of financial pressure faced by the Russian state since the collapse of the Soviet Union. As sanctions tightened, correspondent banking relationships deteriorated, and cross-border payments for Russian companies became increasingly unreliable, the Kremlin faced a mounting strategic problem: how to sustain the flow of goods, capital and technology required for both the war in Ukraine and the functioning of the wider Russian economy.

The system that emerged is sprawling in both scale and ambition. Built around Russia’s state-owned defence bank, supported by state development institutions and operated through a latticework of front companies abroad, A7 sought to re- construct Russia’s access to the international financial system from the outside in.