To unmask Moscow’s network of A7 front companies helping Russia and Iran move illicit billions through the global financial system, the U.S. Treasury Department is arming banks with a cheat sheet of red flags.
And it’s counting on them to follow it.
The network’s so-called “Sub-Agents,” the department warns, are registered in places such as Hong Kong, Indonesia, Kyrgyzstan, the Seychelles, Türkiye, and the UAE, but they are controlled from Moscow by A7, which uses them to send and receive payments that Russian and Iranian actors couldn’t undertake themselves. According to Treasury, such front companies processed more than $17 billion in transactions over the 18-month period that ended in June.
What financial institutions now have to do:
What Kharon’s research mapped: numerous additional companies — not named by authorities — that fit Treasury’s profile for A7 Sub-Agents.
A7’s VPNs typically depend on infrastructure provided by companies controlled by Ilan Shor, one of A7’s sanctioned founders and owners, and they commonly show IP addresses in Dubai, Hong Kong, or Kyrgyzstan, FinCEN said. That helps create “the illusion,” it said, “that these individuals are located outside of Russia — obscuring the connection between Russia and the Sub-Agents.”
Kharon identified additional companies, including Kyrgyzstan-based Silk Road Kommoditiz OsOO and UAE-listed Dynamix Energy LLC-FZ, that formerly used that IP address for their websites, according to domain records.
And it’s counting on them to follow it.
The network’s so-called “Sub-Agents,” the department warns, are registered in places such as Hong Kong, Indonesia, Kyrgyzstan, the Seychelles, Türkiye, and the UAE, but they are controlled from Moscow by A7, which uses them to send and receive payments that Russian and Iranian actors couldn’t undertake themselves. According to Treasury, such front companies processed more than $17 billion in transactions over the 18-month period that ended in June.
What financial institutions now have to do:
- Reject transfers involving Sub-Agents that Treasury identifies, under a proposed rule.
- Block any transactions conducted for A7, which Treasury designated as a transnational criminal organization.
- Report suspected Sub-Agents based on alerts detailing red flags.
What Kharon’s research mapped: numerous additional companies — not named by authorities — that fit Treasury’s profile for A7 Sub-Agents.
Shared digital infrastructure
One sign that Treasury’s Financial Crimes Enforcement Network, or FinCEN, warns banks to watch for is the internet architecture that A7 uses to house its network of payment platforms and shell companies.A7’s VPNs typically depend on infrastructure provided by companies controlled by Ilan Shor, one of A7’s sanctioned founders and owners, and they commonly show IP addresses in Dubai, Hong Kong, or Kyrgyzstan, FinCEN said. That helps create “the illusion,” it said, “that these individuals are located outside of Russia — obscuring the connection between Russia and the Sub-Agents.”
- (A7 rejected Treasury’s Iran allegations but said it serves the Russian market hit by sanctions.)
Kharon identified additional companies, including Kyrgyzstan-based Silk Road Kommoditiz OsOO and UAE-listed Dynamix Energy LLC-FZ, that formerly used that IP address for their websites, according to domain records.
Silk Road Kommoditiz was previously listed in leaked A7 documents reviewed by Kharon as part of an “A7 Group internal settlements scheme”; the Centre for Information Resilience, an open-source investigation group based in London, identified both companies’ domains as “associated with companies which appear to be linked to A7’s operations.”
Neither company responded to a request for comment.
“In order to maintain the necessary liquidity to operate,” FinCEN said, the A7 network relies not only on sub-agents but also on “other trusted intermediary entities.” Those can include digital asset brokers operating in “jurisdictions of concern for A7 Network activity—especially firms that are newly created or dramatically expanding their stablecoin trading operations.”
Kharon research identified one apparent cluster of such companies, in Kyrgyzstan’s capital.
In practice: The U.K. last week sanctioned Tsunami Payments LLC, a Bishkek-registered payment platform that services the A7A5 digital wallet; the company has not been designated or otherwise publicly identified by the U.S.
Corporate records show that Tsunami’s former manager, Kuvat Shabdanaliev, now manages three Kyrgyz companies all formed over the past year: Orakl Pey OsOO, Prizma Konnekt OsOO, and Prizma Finans OsOO, which was incorporated just last month.
Corporate records show an ongoing physical overlap with sanctioned Tsunami, too: Both Prizma companies list addresses at its same Bishkek office tower. Another operator the U.K. sanctioned last week is listed there as well.
And the Prizma network, Kharon’s research shows, connects to the apparatus behind the KGST stablecoin, pegged to Kyrgyzstan’s currency. Corporate and domain records show that Prizma Konnect’s owner — another new Kyrgyz company — shares an address at a Bishkek building with KGSToken, which launched the stablecoin in December.
Neither company responded to a request for comment.
Same manager, same tower, and A7 crypto ties
Several other companies that Kharon identified exhibit characteristics that cut across several different FinCEN indicators for A7 activity, including the use of shell companies, shared business ties, and a cryptocurrency channel, which can obfuscate the origin of Russian-linked payments.“In order to maintain the necessary liquidity to operate,” FinCEN said, the A7 network relies not only on sub-agents but also on “other trusted intermediary entities.” Those can include digital asset brokers operating in “jurisdictions of concern for A7 Network activity—especially firms that are newly created or dramatically expanding their stablecoin trading operations.”
Kharon research identified one apparent cluster of such companies, in Kyrgyzstan’s capital.
In practice: The U.K. last week sanctioned Tsunami Payments LLC, a Bishkek-registered payment platform that services the A7A5 digital wallet; the company has not been designated or otherwise publicly identified by the U.S.
Corporate records show that Tsunami’s former manager, Kuvat Shabdanaliev, now manages three Kyrgyz companies all formed over the past year: Orakl Pey OsOO, Prizma Konnekt OsOO, and Prizma Finans OsOO, which was incorporated just last month.
Corporate records show an ongoing physical overlap with sanctioned Tsunami, too: Both Prizma companies list addresses at its same Bishkek office tower. Another operator the U.K. sanctioned last week is listed there as well.
And the Prizma network, Kharon’s research shows, connects to the apparatus behind the KGST stablecoin, pegged to Kyrgyzstan’s currency. Corporate and domain records show that Prizma Konnect’s owner — another new Kyrgyz company — shares an address at a Bishkek building with KGSToken, which launched the stablecoin in December.
- Why that matters: According to public data and KGSToken’s website, KGST can be swapped instantly for dollar-pegged Tether, granting traders access to Western financial channels.
KGSToken, whose internet records list a Russian-domain email address, did not respond to requests for comment. The other companies could not be reached.
“Following the stablecoin’s listing on the global crypto exchange Binance, trading activity for the token has increased sharply and is already trading on the spot platform in the KGST/USDT pair,” KGSToken wrote on Instagram last December, soon after KGST’s launch.
Binance, which the U.S. in 2023 penalized more than $4 billion for offenses that included violating anti-money-laundering laws and U.S. sanctions, lists KGST with a current market capitalization of just over $9 million.
Read more from The Brief:
“Following the stablecoin’s listing on the global crypto exchange Binance, trading activity for the token has increased sharply and is already trading on the spot platform in the KGST/USDT pair,” KGSToken wrote on Instagram last December, soon after KGST’s launch.
Binance, which the U.S. in 2023 penalized more than $4 billion for offenses that included violating anti-money-laundering laws and U.S. sanctions, lists KGST with a current market capitalization of just over $9 million.
Read more from The Brief:
