Kremlin-Backed FinTech A7 Funneled $6.9 Billion Past Sanctions Using SWIFT and Counterfeit Invoices

A Kremlin-backed financial network known as A7 successfully moved more than $6.9 billion through the global banking system between late 2024 and August 2025, bypassing Western sanctions designed to isolate the Russian economy. The operation utilized a vast network of front companies and counterfeit trade documents to retain access to the SWIFT messaging system, masking the origin of the funds from international compliance monitors.[1][3]

Founded in late 2024 by sanctioned Moldovan oligarch Ilan Shor and the Russian state-owned Promsvyazbank, A7 was designed specifically as an alternative to Western-dominated payment infrastructure. To execute the transfers, the network established over 100 front companies registered in jurisdictions including the United Arab Emirates, Hong Kong, and Kyrgyzstan.[1][3]

When international banks flagged transactions for routine anti-money laundering checks, A7 employees produced forged invoices and altered customs codes to disguise the purpose of the funds. Staff systematically removed Cyrillic characters from documentation and utilized a library of counterfeit corporate stamps to clear compliance hurdles and present the transfers as legitimate global trade.[2][3]

The illicit flows passed through several of the world's largest financial institutions before the scheme was fully uncovered. Accounts linked to A7 at Standard Chartered's Hong Kong branch received $1.1 billion before the bank detected the suspicious activity—specifically noting transactions split into smaller tranches to avoid reporting thresholds—and closed the accounts in February 2025.[1][3]

During that same operational window, DBS Bank in Hong Kong processed $273 million, while Citigroup clients received $74 million. First Abu Dhabi Bank held accounts for 17 separate A7-linked entities that collectively processed more than $1.8 billion in outbound payments.[1][3]

Addressing the exposure, First Abu Dhabi Bank stated it does not comment on specific client matters but confirmed that the identified A7-linked accounts have been closed, adding that the institution "applies sanctions frameworks from the US, the UK, the EU, and the UN." The cited financial intelligence reports note that other involved institutions similarly reaffirmed their commitment to anti-money laundering regulations.[1][3]

Just over half of the identified financial flows ultimately reached accounts at Chinese banks. A portion of the transferred funds was reportedly used to settle invoices for highly sensitive war-related goods, including military equipment and purchases directed by Russian security services, demonstrating the strategic stakes of the compliance breach.[1][2]

The revelation of the $6.9 billion scheme has prompted renewed scrutiny of correspondent banking networks and the mechanisms that trigger sanctions alerts. While the involved banks maintain that they have since closed the identified accounts, the breach highlights the ongoing challenge of policing state-sponsored financial evasion within the millions of daily SWIFT transactions.[1][3]