FinCEN Wants to Cut Off a Shadow Banking Network's Sub-Agents. Its Ruble Stablecoin Moved $179 Billion.

The Financial Crimes Enforcement Network took three actions at once on October 1, under the banner of Operation Economic Outcast. It issued an alert to financial institutions, FIN-2026-Alert007. It proposed a rule that would prohibit transmittals of funds involving what it calls the A7 Network's sub-agents. And the Treasury's Office of Foreign Assets Control sanctioned the network as a significant transnational criminal organisation.

FinCEN describes the A7 Network as a shadow banking network with ties to Russia, used by the Iranian regime to evade sanctions.

The scale described

• Hundreds of shell companies operating across more than 83 countries
• Accounts at approximately 435 financial institutions
• More than 180 entities processing transactions in A7A5, a ruble-backed stablecoin
• At least $179.1 billion in A7A5 transaction volume between February 2025 and June 2026

The three typologies

The alert sets out how the network is said to operate, and the structure matters more than the sanctions listing for a compliance officer trying to find it.

Sub-agent infrastructure

Rather than banking in its own name, the network works through a layer of sub-agents — companies incorporated in many jurisdictions whose ownership records are falsified to obscure the Russian connection. From the account-opening bank's perspective, the customer looks like an ordinary foreign trading company.

Trade-based money laundering

The alert describes fake invoices, altered trade documents and misleading descriptions of goods, used to dress illicit value transfer as ordinary commerce. This is the oldest technique in the category and the hardest to screen for, because the paperwork is internally consistent — it is the relationship between the paperwork and the physical goods that is false.

Mirrored on-chain transfers

A7A5, a stablecoin pegged to the ruble, is described as carrying internal value transfers that mirror the fiat transactions, letting the network move value between its own entities without those movements passing through correspondent banking channels.

What the proposed rule would do

The proposed rule, published as a notice of proposed rulemaking, would prohibit transmittals of funds regarding transactions involving the network's sub-agents. A prohibition of that kind operates differently from a sanctions designation: rather than freezing identified parties' assets, it bars a category of payment from passing through US financial institutions, which forces banks to screen for the relationship rather than only for names on a list.

What banks are being asked to do

The alert is addressed to all US financial institutions, with particular emphasis on those handling international trade finance, digital assets and correspondent banking. Institutions that identify related activity are asked to reference the key term FIN-2026-A7NETWORK in field 2 of the suspicious activity report and in the narrative. Key-term tagging is how FinCEN aggregates filings on a single typology; the agency has used the same mechanism for scam-centre and health-care-fraud reporting this year.

The action follows a sequence of related Treasury steps: a whistleblower bulletin on Iran-related illicit finance on September 10, and an exchange with global financial institutions convened on September 16 to support the same operation.

This article describes a regulatory action and is for general information. It is not legal or compliance advice; institutions should work from the alert and the Federal Register notice themselves.