How A7 Allegedly Used Shell Companies and Forged Trade Documents to Move $6.9 Billion

The central allegation is straightforward: A7 reportedly made Russian-linked cross-border payments appear to be routine trade conducted by non-sanctioned companies in other jurisdictions. Leaked internal files reviewed in reporting on the network indicate that more than $6.9 billion passed through international banks from late 2024 to August 2025. Those reports are evidence of an alleged sanctions-evasion system, not a finding that every bank involved knowingly broke sanctions law. 16

The alleged payment-routing model

A7 was established in late 2024 with backing from Promsvyazbank, a Russian state-owned lender with defence-sector ties, and Ilan Shor, according to reporting on the leaked files. It was presented as a way to sustain Russian cross-border commerce after post-invasion sanctions and financial restrictions made conventional routes more difficult. 615

The reported method used a network of more than 100 front companies and existing businesses in jurisdictions including the United Arab Emirates, Hong Kong and Kyrgyzstan. These companies could open accounts and appear, on paper, to be legitimate buyers or sellers in an international transaction. 1012

The critical alleged step was the documentation. Invoices, shipping records and other trade paperwork were reportedly falsified or altered to obscure the real party to a transaction, the goods involved, or the Russian connection. Some reporting says documents were adjusted to remove Cyrillic text and erase the visible “Russian trace.” 1015

That structure turns one Russian-linked payment into several seemingly ordinary steps:

1. A third-country company is presented as the buyer, seller or intermediary.
2. Trade documents supply a plausible commercial purpose for the transfer.
3. Funds enter accounts held at international banks under the intermediary’s name.
4. The payment can then be forwarded to suppliers or counterparties while the underlying Russian beneficiary is harder to identify.

Which banks processed the payments?

The leaked files reportedly identify flows involving Standard Chartered, First Abu Dhabi Bank, DBS, Citigroup, Deutsche Bank and JPMorgan, among others. They show payment activity through accounts at those institutions, including roughly $1.1 billion deposited into Standard Chartered accounts in Hong Kong and about $273 million into DBS accounts, according to one account of the records. 18

But handling a payment is not, by itself, proof that a bank knew the real origin, beneficiary or purpose of the funds. A finding of knowledge, intent or a sanctions-law violation would require evidence beyond the existence of transactions in a bank’s systems—such as a regulatory determination or court ruling. The available reporting instead describes how disguised counterparties and fabricated documents could frustrate ordinary controls. 115

Why false trade documents are so effective

Sanctions screening is strongest when a payment clearly names a sanctioned person, bank or company. Trade-based schemes seek to defeat that clarity. If the sender and recipient are companies that appear non-sanctioned, and the transaction is backed by seemingly credible invoices, the most important risk information may sit outside the payment message itself.

That makes several controls especially important:

• verifying the beneficial owners behind counterparties;
• checking whether trade documents are authentic and consistent with shipping activity;
• identifying implausible routes, repeated intermediaries or circular payments; and
• examining correspondent-banking relationships in higher-risk trade corridors.

The A7 reporting therefore points to a broader weakness: name-list screening alone cannot reliably detect concealed ownership, fictitious trade, or payments whose true economic purpose has been disguised.

Where did the money ultimately go?

The reporting indicates that the network was designed to support Russian foreign trade, including payments to overseas suppliers and counterparties. Some transactions were reportedly connected to goods with military or security relevance. 913

However, the available material does not provide a complete, independently verified account of every ultimate recipient across the reported $6.9 billion. With layered companies and allegedly false documents, it would be too definite to claim that all funds reached any one sector, organisation or end user.

Crypto, Tether and alleged militant-network links

The core leaked-file reporting described here centers on bank transfers, front companies and forged trade paperwork. It does not, on the supplied evidence, establish that Tether knowingly facilitated A7 payments, or that A7 itself funded Iran’s IRGC, North Korean hacking groups or Hamas.

Those claims require a higher evidentiary standard than evidence of overlapping crypto intermediaries or wallet exposure. The appropriate distinction is between a demonstrated direct transfer, indirect exposure through a shared service provider, and knowing material support. The supplied reporting does not establish the first or third proposition for A7.

What the case suggests about Russia sanctions

Post-2022 restrictions made Russian trade finance more costly and complex, but the reported A7 operation suggests that access to international payment infrastructure can persist when intermediaries conceal the real parties and purpose of a transaction. 16

The practical lesson is not that sanctions are irrelevant. It is that enforcement needs to focus as much on the facilitators and records surrounding a payment as on the payment itself: company ownership, trade-document integrity, high-risk corridors, and intelligence sharing between banks and authorities. When those checks fail, a payment may look legitimate at each individual step while serving a concealed sanctions-evasion network overall.