NextFin News - A Kremlin-backed payments group funnelled more than $6.9 billion through some of the world's largest banks by relying not on cryptographic innovation but on an industrial-scale forgery operation that mass-produced fake invoices, according to an investigation built on hundreds of thousands of leaked internal files. The findings, published on 21 September 2026, expose a structural weakness at the heart of the sanctions regime: the global payments network did not need to be broken - only one bank inside it needed to be fooled.
Layer 1 — The situation
A7 was launched in October 2024 in Russia and Kyrgyzstan by Ilan Shor, a Moldovan fugitive convicted in absentia for his role in a billion-dollar bank heist in 2014, with backing from Promsvyazbank (PSB), the Russian state-owned lender that services Russia's military-industrial complex. After the 2022 full-scale invasion of Ukraine, Western governments cut major Russian banks off from Swift, and the Kremlin promoted A7 as the flagship alternative for paying Russian imports. Shor publicly described the system as
"immune to sanctions."
- Ilan Shor
The leaked files tell a different story. Rather than building a new payment rail, A7 leaned on the existing plumbing of international finance. Front companies deposited cash into ordinary bank accounts inside the Swift system, then used those accounts to pay overseas suppliers on behalf of Russian clients. To answer the question every compliance officer eventually asks - why is this account repeatedly sending money abroad? - A7 generated counterfeit invoices, altered transaction descriptions and swapped customs codes so restricted goods appeared to be ordinary commerce. Bank accounts in China were the ultimate destination for a little more than half of the flows.
The scale was large and the geography broad. The network extended across the United Arab Emirates, Hong Kong, Kyrgyzstan, Indonesia, the United Kingdom and Hungary, with roughly 100 active front companies on A7's roster and another 100 or more entities referenced in the files. Some of the payments appear connected to purchases by Russian security services and military-related entities.
The $6.9 billion figure covers the roughly ten months from A7's launch in late 2024 to August 2025. It is a measure of bank-rail flows derived from the leaked files - not a court judgment, not a regulatory penalty, and not an audited total of all A7 activity. A7 itself claims far larger volumes through other channels, including its ruble-backed stablecoin A7A5 and digital bills of exchange.
Layer 2 — The analysis
The mechanism: penetrating one bank beats breaking the network
The scheme worked because of a specific feature of how Swift is built. Swift is a messaging system between banks; it does not independently verify who is really behind a transaction. That job falls to the sending bank's own customer checks. Beat those checks at one member bank, and a payment can travel freely through the rest of the network.
Chris Cook, the enterprise editor who worked on the investigation, put it bluntly:
"if you can penetrate a bank that's inside Swift, you can go quite a long way and send quite a lot of money."
- Chris Cook, the enterprise editor who worked on the investigation
He added that when banks probed suspicious activity,
"A7 had an enormous forgery factory that was industrially producing fake paperwork, particularly invoices, to justify the payments."
- Chris Cook
And on A7's marketing as high-tech innovation:
"the reality is actually it's a bit more old-fashioned than that. It's money laundering."
- Chris Cook
The bank-by-bank footprint shows how the scheme spread risk rather than concentrating it. Between October 2024 and August 2025, accounts at Standard Chartered in Hong Kong alone received $1.1 billion from A7-linked entities. First Abu Dhabi Bank, the UAE's largest lender, hosted accounts for 17 separate A7-linked entities that together made more than $1.8 billion in outbound payments. DBS in Hong Kong was sent $273 million, clients of Citigroup received $74 million, and clients of Deutsche Bank in Europe were sent about $18 million. A7-linked entities also had access to accounts at JPMorgan Chase and DBS.
That dispersion is itself the point. No single bank saw enough of the flow to recognise the whole pattern; the leakage was only visible once the files were assembled and read as one network. A compliance officer sitting inside one institution sees a Hong Kong trading company paying a Chinese supplier - a plausible, ordinary transaction. It is only when an outsider stitches together Standard Chartered, First Abu Dhabi Bank, DBS, Citigroup and Deutsche Bank that the shape of the network appears.
The structural weakness: delegated trust is the vulnerability
This is not a story about a software bug in Swift. It is a story about delegated trust - the system's security is only as strong as the weakest bank's customer due diligence. That makes sanctions leakage a structural feature of the architecture, not a cyclical lapse that fixes itself. As long as verification responsibility sits with individual sending banks and no single node sees the full chain, a network with enough front companies and enough forged paperwork can find a path through.
The evidence that A7 adapted under pressure supports this reading. When Standard Chartered grew suspicious about money flowing into customer accounts from Kyrgyzstan, that scrutiny was enough to force A7 to shift more of its payment flow away from Kyrgyzstan and toward the United Arab Emirates. Controls pushed the network to a new route; they did not stop the network. This is the familiar pattern of sanctions enforcement as a game of whack-a-mole: close one door, and the network tests the next. The same pattern is visible in the wider A7 ecosystem: when Garantex, an exchange used by the network, came under pressure, liquidity migrated to the Kyrgyzstan-based Grinex platform.
Official authorities had already flagged the ecosystem. On 31 August 2026, the UK's National Crime Agency and government issued the first-ever nationwide industry alert against A7, warning that the network relies on third-country financial institutions to complete cross-border transactions and circumvent sanctions. The alert noted that within its first year of operation, A7 claims to have settled more than $86 billion of transactions - a figure far larger than the $6.9 billion traced through the banking files. The UK government also said it had acted on 26 May 2026 against third-country enablers linked to A7, with a focus on Central Asia and West Africa.
The broader picture is consistent. US Treasury materials describe A7 as a provider of cross-border settlement platforms used for sanctions evasion, and the UK's National Economic Crime Centre has said networks linked to A7 are likely designed to enable cross-border payments that circumvent sanctions. A7 and PSB are also behind A7A5, a ruble-backed stablecoin that blockchain analytics firm Elliptic says processed more than $100 billion in transactions in under a year, while TRM Labs put the reported on-chain figure at over $166 billion - though it found roughly $35 billion of that stemmed from circular transfers between A7 and other Russian sanctions-evasion actors, serving as an internal book-settling mechanism rather than genuine external settlement.
The coexistence of these channels matters. A7 did not choose between crypto and banks; it used both. The stablecoin handled the internal ledger and the ruble-to-dollar conversion; the forged-invoice banking channel handled the final leg into the real economy, where suppliers still want to be paid in usable currency through accounts they can actually receive. Each channel covers the other's weakness.
The second-order implication: the banks are exposed, but so is the regime
The immediate consequence is reputational and regulatory exposure for the banks named in the files. Standard Chartered, Citigroup, JPMorgan and Deutsche Bank each said they take anti-money laundering reporting seriously but declined to comment in detail; the banks said they had already identified the suspicious activity themselves and taken action against the customers involved. First Abu Dhabi Bank said it had identified and closed all of the A7-linked accounts and that it seeks to apply US, UK, EU and UN sanctions in its compliance processes.
But the second-order consequence runs deeper. The episode undercuts the central premise of financial sanctions after 2022 - that cutting Russian banks off from Swift would materially constrain Moscow's ability to pay for its war. Instead, a state-backed network staffed by a convicted fraudster and a sanctioned defence lender routed billions through the very system Russia was supposedly barred from, including payments tied to military procurement. The leakage does not require sophisticated crypto rails; it requires paperwork good enough to pass an overworked compliance desk.
There is also a cost to the cure. Once a leakage channel is exposed, banks tighten documentary checks across the board - more invoice verification, more questions on customs codes, more enhanced due diligence on third-country intermediaries. That raises the cost and slows the speed of legitimate trade finance for every importer, not just the sanctioned ones. The sanctioning power gets a cleaner system; the global trading system gets a friction tax.
The counter-thesis: the system did work, eventually
The strongest argument against a purely structural reading is that the controls did catch up. The named banks say they identified the suspicious activity and acted; First Abu Dhabi Bank closed the accounts; the UK issued an industry-wide alert; and Chancellor John Healey announced that the maximum fine available to the Office for Financial Sanctions Implementation would double from 50% to 100% of the value of a sanctions breach - a change that, as of the announcement, had no named commencement date or legislative instrument. The Russian Embassy in London dismissed the measures as a continuation of
"illegal unilateral sanctions"
- The Russian Embassy in London
that "would not influence Moscow's course."
On this view, the $6.9 billion is evidence not of a broken system but of a self-correcting one: the leakage was detected, the route was closed, and the penalty regime was tightened. The architecture survived contact with the adversary.
That argument has force but it is incomplete. Self-correction after $6.9 billion has flowed through - and after a network that claims more than $86 billion in first-year settled volume - is a slow and costly form of correction. Detection came from a leak analysed by journalists, not from a control that flagged the pattern in real time. The falsifying signal for the structural view is specific and observable: if, within 12 months of the 31 August 2026 UK alert, regulators can point to a measurable drop in A7-routed flows and to coordinated, cross-border customer-due-diligence standards that close the delegated-trust gap, then the leakage was cyclical and correctable. If instead the network simply migrates to another permissive jurisdiction with another batch of front companies - the Kyrgyzstan-to-UAE pattern repeating elsewhere - the weakness is structural and will persist.
Layer 3 — Conclusion and outlook
The near-term impact falls on the named banks: enhanced regulatory scrutiny, potential fines, and costly remediation of trade-finance and correspondent-banking controls. The medium-term impact falls on legitimate trade: tighter documentary checks mean slower, more expensive cross-border payments for ordinary importers. The long-term question is whether the architecture itself changes - whether verification responsibility moves up the chain, toward a node that can see more than its own customer.
Base case: A7's banking routes contract under pressure, but the model survives through other channels - crypto, bills of exchange, and new third-country hubs - because the underlying incentive (paying for a war economy under sanctions) remains. Upside case: the UK alert triggers coordinated G7 action on correspondent-banking due diligence, and the delegated-trust gap narrows meaningfully. Downside case: the network fragments into smaller, harder-to-detect channels, and the $6.9 billion proves to be only the visible slice of a much larger flow.
What to watch: the next industry alert from the NCA or the Office of Financial Sanctions Implementation; enforcement actions against any of the named banks; and whether A7's claimed volumes fall after the account closures. The single signal that would break the structural thesis is a sustained, verified reduction in routed flows across multiple jurisdictions within a year of the alert.
The uncomfortable lesson is that Russia did not need to reinvent the financial system to evade sanctions. It needed a forgery factory, a handful of front companies, and one bank that did not ask enough questions.
Explore more exclusive insights at nextfin.ai.
