The not very secret life of A7’s front companies

The US Treasury last week decided to hit A7, the Kremlin-backed payment service money laundering network, with a wave of new sanctions. This includes designation as a Transnational Criminal Organisation — a status that gives them a few new tools to go after it.

The designation press release set out something that FT readers already knew:

The A7 Network exploits the international financial system by leveraging Sub-Agents, falsified trade documents, falsified import-export records, and misleading goods descriptions to make sanctioned or illicit payments appear to be ordinary commercial activity.

The Treasury also published a proposed set of new regulations from FinCen, plus an alert which set out some useful advice on how to spot A7 front companies.

As it happens, we had revealed week before how $6.9bn was laundered through conventional correspondent banking. The US government’s analysis is, broadly, the same as ours. But there’s something in here that gives me pause.

We’ll get to it — but first, it is worth explaining the whole universe of A7 subagents / front companies.

To start at the beginning, at the start of 2025: at the core of the system, early on, a small number of fronts in the UAE were performing some critical functions for the network, whose purpose was to enable Russian importers to pay their suppliers abroad after Moscow’s banks were cut off from the world banking system.

First, these central accounts took hard currency from Russian exporters. Second, they used that float to make payments abroad on behalf of A7 customers. And finally, they would distribute this cash to other A7-linked entities, which needed reimbursement or topping-up.

But this place in the system — doing the FX work — puts them one hop from Russian exporters and traders, lots of whom are sanctioned. And they are directed by A7, which is also sanctioned. So they are intrinsically exposed.

We know from the leak A7 had rules for operating these big central treasuries: nothing attention-grabbing. No payments to Belarus, Russia or the US. Staff are cautioned against payments to Citi, JPMorgan Chase, HSBC and ICBC — banks whose AML seems to be on to them.

They were also compartmentalised so that if one of the exporters’ fronts got busted, they wouldn’t all get busted. One internal chat message notes:

Assign each dirham supplier [the Russian exporters] to one paying company; mixing dirham suppliers under one ultimate owner is forbidden.

These things were often huge, but were fundamentally just puppet entities that were discarded at will.

For example, here is a message that was sent out to A7 staff on their internal messenger about Favnir, one of their biggest UAE front entities, and which was handling millions of dollars every day in early 2025:

From 10 March Favnir stops working. Gimli will be used for crypto and receiving dirhams. Solara for buying dirhams. Xentra for client payments.

These are the names of other front companies — Gimli, Solara and Xentra. The staff who make payments on behalf of customers were told:

Effective March 10, 2025, Favnir is suspending operations; payments from the UAE will be processed through the new company XENTRA L.L.C-FZ

It might fair to suspect that, if you were an AML officer who was on to Favnir, you might spot Xentra. That switch was not subtle. The two companies had 225 beneficiaries in common. Both held accounts at First Abu Dhabi and Dubai Islamic Bank.

The Swift messages for Favnir give its name and address as:

FAVNIR L L C FZ MEYDAN 6TH GRANDSTAND FLOOR MEYDAN 118256 DUBAI AE

Xentra, meanwhile is:

XENTRA L L C FZ MEYDAN GRANDSTAND 6TH FLOOR MEYDAN ROAD NAD 340671 DUBAI AE

You see similar artlessness through the leak. Ring enthusiasts might have already spotted a pattern: Gimli LLC-FZ appears to be named after a dwarf from Tolkien, while Favnir LLC-FZ seems to take its name from a Norse character popularised by Wagner.

There’s more Tolkien: you also get a Galadriel Trading FZCO and Boromir Trading FZCO. The successors of Favnir include Sigizmund FZCO and Zigfrid LLC-FZ, which might be how a Russian transliterated Siegmund and Siegfried, other characters from Wagner.

The FinCen notice also points out that a lot of the puppet entities have a “blank or minimally active website” operating on a fixed IP range. Again, it’s even less subtle than that.

The leak shows there were 71 email domains hosted on A7 infrastructure. Of these, 54 of these are held through the same registrar. And the records for the web registrations show A7 prepared these names in batches, with as many as nine being processed at once.

Some content could not load. Check your internet connection or browser settings.

I don’t wish to labour the point, but there were other clues that these big entities in the UAE were not quite what they seemed, and had been created to serve A7.

For example, someone might have pondered these supposed Emirati companies seemed to have time off on Russia Day and Victory Day, and why their Christmas-New Year break followed a Russian calendar.

A7 also had a distinctive payment ledger-numbering system, which sometimes even showed up in the description fields of their Swift messages.

So it starts with a big, fairly unsubtle collection of fronts, which it is setting up and shutting down. By the end of the period covered by the leak, however, something else is starting to happen.

First, the sheer number of entities was starting to rise. There were probably about 200 such entities in operation during the period of the leak, which ran to August 2025. And, based on the leak, we could see and identify about half of those in operation and match them to specific flows.

Some content could not load. Check your internet connection or browser settings.

The problem for FinCen’s rules is that, as A7 matured, the crude puppets were being joined by other companies with more convincing back stories. Some were older entities which A7 seemed to have taken some measure of control over. So the patterns of payment change.

But there was something else going on: according to A7’s payment ledger, two related entities in the UAE called “Celestial Bazaar” and “Zenith Global Mercantile”, for example, took in $445mn of internal payments.

In the central ledger, these things are treated much like the other paying bodies: they were assigned a code inside the A7 system as a “payer”. But, an internal A7 note written in late May 2025 notes:

These are “rented” treasuries. DBO in the UAE. No invoice replacement. Payment restrictions due to licenses. Amount limit of no more than $1 million USD per payment.

The implication of that word “rented” in the document seems to be that they may be controlled by a third party who is just doing some local payment processing for them. And these things are not empty companies. They have fully working websites and real businesses.

Here is a sample of some other bodies described in the leaks as “rented”.

(We’ve written to each of these companies at their publicised addresses, but had no replies other than some email bounces.)

We should be clear, too: they may also not know they are working for a transnational criminal organisation. And this brings me back to the FinCen release.

Here’s a line in there that jumps out. The proposed new rules would state:

transactions involving any company operating outside of the United States that is controlled by the A7 Network . . . are a class of transactions of primary money laundering concern in connection with Russian illicit finance

The interesting word there, to me, is controlled. Later on, it also says:

Although on paper, these companies are typically represented to be owned or managed by non-Russian third-country nationals, they are ultimately controlled by with [sic] the A7 Network.

It’s that word controlled that I suspect might need a tweak. Increasingly, I suspect, we will find these payments flowing through a broader range of payment agents, for whom the payments are only part of their work. In this sort of situation, I am not sure the proposed regulation covers them.

But there is, in any case, a second problem here: these new types of payers are much harder to spot. The payments are buried inside a real business.

Maybe the designation and rule changes will help, precisely because A7 is making this move.

Zach Tvarozna, a former US government banking analyst who wrote a report on A7, said: “Making A7 a TCO is a huge step. It puts the network in the same category as a drug cartel, and alongside the FinCen rule it gives the US a much wider set of tools.”

Tvarozna (who has an excellent Substack on transnational financial shenanigans) added: “You need a lot of those powers, especially if the entity gets cleverer and starts infiltrating legitimate businesses who may not realise what they’re actually getting themselves involved with. These are the types of networks that sanctions alone can’t stop.”

All quite daunting.

But there is a real upside for people fighting money laundering: it will be much pricier to move cash this way. Trying to get the millions-of-dollars-a-day flows that moved through Favnir or Gimli through real companies is going to be very hard without the cost base shooting up.

The test of financial and trade sanctions effectiveness is not whether they stop Russia doing something. Things always get through. You measure effectiveness in the price they can be forced to pay for doing it.

Further reading:
— Kremlin-backed forgery scheme moved $6.9bn through global banks (FT)
— Rosneft billions fed Kremlin-backed money laundering network (FT)
— UK businessman given senior role at group linked to Kremlin money-laundering operation (FT)