A7 network moved $6.9 billion through global banks using forged trade documents

What happened

A7, a payment network founded in late 2024 by Moldovan oligarch Ilan Shor, moved $6.9 billion through the global banking system between late 2024 and August 2025, according to a Financial Times investigation reported by the Irish Times. The FT investigation, based on hundreds of thousands of files obtained from inside A7, also identified a further $20 billion in promissory notes linked to the network.

A7 was established in Russia and Kyrgyzstan with backing from Promsvyazbank (PSB), a Russian state owned bank tied to the country’s defense industry. The investigation documented at least 200 shell entities across multiple jurisdictions: 61 in the United Arab Emirates, 87 in Hong Kong, 16 in Kyrgyzstan, 14 in Indonesia, three in the UK, and one in Hungary, which the report describes as a critical conduit into the EU.

According to the investigation, the network ran an industrial scale document forgery operation. It used a library of thousands of corporate stamps, both harvested from genuine documents and fabricated, to produce counterfeit invoices. Staff replaced sanctioned goods codes with unsanctioned alternatives and stripped Cyrillic text and other Russian traces from paperwork. Night vision scopes were labeled as thermal scopes; other goods were mislabeled as toughened glass, the FT found.

Banks reported to have processed A7 linked payments include Standard Chartered ($1.1 billion in Hong Kong alone), First Abu Dhabi Bank ($1.8 billion outbound and $1.3 billion from a dozen accounts), DBS Hong Kong ($273 million received and $207 million sent), Citigroup clients ($74 million), Deutsche Bank (roughly $18 million), and JPMorgan Chase, among others. None of these banks are alleged to have known they were processing A7 linked funds, and the source material contains no finding of wrongdoing against them. The UK placed A7 under sanctions in May 2025.

Why it matters

This is a screening and detection story, not a bank misconduct story. The mechanism the FT describes, forged invoices, altered goods codes, and stripped Cyrillic markers, is designed specifically to defeat document based sanctions screening and trade finance red flag checks rather than to bypass the banking system itself. That distinction matters for how a compliance team reads this.

The Kremlin has promoted A7 as a flagship cross border payment alternative since Russia’s disconnection from SWIFT in 2022. The investigation suggests the network’s actual value to its operators was not building a SWIFT alternative but retaining access to SWIFT connected correspondent banking through disguised trade documentation. The likely effect is that document forgery, not new payment rails, remains the primary tool for sustaining sanctions evasion at scale.

The spread across six jurisdictions, with Hungary flagged as a critical EU entry point, indicates the network deliberately distributed shell entities to avoid concentration risk in any single regulator’s field of view. A concentration of 87 Hong Kong entities and 61 UAE entities also points to where correspondent banks and their compliance teams should expect layered trade documentation to originate.

Practitioner angle

• Review trade finance and correspondent banking screening for reliance on invoice stated goods codes and product descriptions without independent verification against shipping or customs data. The FT’s findings show goods codes and descriptions were deliberately altered to defeat this exact check.
• Flag documentation that has had Cyrillic text or other country of origin markers removed as a standalone red flag, not just an absence of information. Deliberate stripping of national traces from trade paperwork is itself a signal.
• Check exposure to correspondent relationships and trade flows touching Hong Kong, the UAE, Kyrgyzstan, Indonesia, and Hungary, the jurisdictions named as shell entity hubs in this investigation, and assess whether current due diligence would catch a shell network of this structure.
• Reassess stamp and document authentication controls in trade finance workflows. A forgery operation built on a library of thousands of corporate stamps defeats visual or manual authenticity checks; verification needs to rely on issuer confirmation, not document appearance.
• Given the UK’s May 2025 sanctions designation of A7, confirm the entity and any known aliases or shell affiliates are loaded into current sanctions screening lists and that historical transaction records have been rescreened.

The single most important action: treat this as a prompt to test whether your institution’s trade finance screening can detect altered goods codes and stripped origin markers, since document based evasion, not exotic payment rails, is the demonstrated method here.