Inside A7: How Promsvyazbank Built a $6.9bn Sanctions-Evasion Service Through Western Banks

That architecture allowed a bank created to serve Russia’s defence sector to reach into the correspondent banking system it was supposed to have been cut off from.

The loophole was not outside the system

A7 was launched in October 2024 by Promsvyazbank, or PSB, which had been nationalised by the Russian state in 2017 and designated the following year as a bank serving the defence sector and military contracts. It was subjected to full Western sanctions after Russia’s full-scale invasion of Ukraine.

The apparent contradiction is the central feature of the case.

A7 did not need to make PSB itself acceptable to Western banks. Instead, the Russian buyer could make a payment in roubles inside Russia, often through PSB, while an A7-controlled offshore company made the corresponding payment to the foreign supplier. That second transaction travelled through ordinary international clearing infrastructure and, where required, SWIFT-connected banks.

The architecture effectively separated the sanctioned Russian institution from the international payment visible to a correspondent bank.

The weak point was then moved into the paperwork.

A7 maintained a library of false company stamps and altered invoices, product descriptions and Harmonized System customs codes. Goods carrying sanctions or export-control risks could be presented as ordinary consumer products, household appliances or spare parts. For a bank assessing an individual transaction, the documents could therefore look substantially different from the underlying commercial purpose.

That is an important distinction. The system did not necessarily defeat compliance by persuading a bank that PSB was legitimate. It sought to prevent the bank from seeing the Russian connection in the first place.

A network built around jurisdictional friction

The corporate structure was similarly designed to distribute risk.

The leaked material identifies more than 100 dedicated shell companies and at least 100 additional affiliated entities across several jurisdictions. Hong Kong accounted for at least 87 of the identified shell companies, making it the principal gateway to Asian banks and SWIFT clearing. The UAE contained at least 61 entities, while Kyrgyzstan had at least 16 and Indonesia at least 14. Three entities had operated in the UK before targeted enforcement, while a Hungarian company served as a core entry point for goods into the European Union.

The geography matters because no single jurisdiction appears to have needed to accommodate the entire operation.

A transaction could originate with a Russian importer, pass through a corporate intermediary in one country, enter an international bank through another, and ultimately reach a supplier or bank in China. More than half of the $6.9 billion traced in the files ended up in accounts at banks in mainland China, with Hong Kong and other transit hubs providing part of the route.

For compliance departments, that creates a familiar problem on an industrial scale. Each institution sees only a section of the chain.

A bank may know its immediate corporate customer. It may not know the real commercial purpose of the transaction several layers further along, particularly when the originating documentation has already been manipulated.

Billions passed through major banks

The figures in the leaked material make the problem difficult to treat as marginal.

First Abu Dhabi Bank processed about $1.8 billion across 17 A7-linked accounts before closing them after detecting suspicious activity. Standard Chartered processed $1.1 billion. DBS handled $273 million, Citigroup $74 million, and Deutsche Bank $18 million. JPMorgan Chase also processed transactions through client-clearing networks, although the briefing does not establish a comparable volume.

These institutions operate at the core of the international banking system. Their involvement does not, by itself, establish wrongdoing by the banks or their employees. The available material instead raises a more consequential question about how far conventional correspondent-bank controls can identify a coordinated network whose defining feature is the manipulation of information supplied to those controls.

The A7 case is therefore less about one bank missing one suspicious payment than about the limits of transaction-by-transaction compliance.

If invoices, company identities and customs classifications are systematically altered before they reach a correspondent bank, screening systems may be examining accurate-looking documents that describe the wrong transaction.

That is where KYCC - Know Your Customer's Customer - becomes particularly difficult. The farther a bank is removed from the underlying buyer, supplier, and end use of a product, the more dependent it becomes on information supplied by intermediaries.

A7 appears to have exploited precisely that distance.

The military trail makes the system harder to dismiss

The leaked transactions also provide evidence that the network was not simply facilitating ordinary Russian trade.

One payment of €1.77 million covered CNC machine tools sent to CJSC Interkonsul, a Russian company linked to GRU military intelligence networks. The UK sanctioned Interkonsul on June 16, 2026, over its ties to GRU military procurement.

Another transaction covered 500 units of night-vision equipment, with a payment of 3.6 million renminbi, or about $510,000. The dataset also contains transactions explicitly connected to Russian security agencies, military departments and defence manufacturers, involving electronic components, engines and specialised machinery.

Those examples matter because they turn the financial architecture into a map of procurement.

The value of the A7 files may ultimately extend beyond identifying individual payments. Once shell companies, accounts, intermediaries, suppliers and product descriptions can be linked, investigators can begin to reconstruct supply chains that were previously fragmented across jurisdictions.

That creates an intelligence opportunity for sanctions authorities and law-enforcement agencies. A transaction that looks innocuous in isolation may become significant once connected to several other entities using the same intermediary, documentation pattern or payment route.

Crypto adds another layer

A7’s traditional banking operation was accompanied by cryptocurrency clearing structures associated with fugitive Moldovan businessman and politician Ilan Shor. The internal documents also reference promissory notes, or veksels, exceeding $20 billion.

The available material does not establish that the full $20 billion represented completed transactions. It does, however, indicate that the $6.9 billion identified in the leaked files may represent only part of the network’s broader financial activity.

The parallel use of conventional correspondent banking and cryptocurrency is significant because it gives the network more than one mechanism for managing liquidity and moving value across borders.

The briefing does not provide enough evidence to establish the precise mechanics of every cryptocurrency platform involved. But the coexistence of crypto-fiat clearing with the A7 banking architecture points to a wider model: conventional finance is not being replaced by alternative payment systems so much as combined with them.

The enforcement question is now harder to avoid

Britain sanctioned A7 in May 2025, while First Abu Dhabi Bank shut the 17 accounts linked to the network after its own detection of suspicious activity.

Yet as of September 22–23, 2026, the briefing records no formal enforcement declarations from OFAC, the US Treasury, the Federal Reserve, the European Central Bank or European regulatory authorities concerning the participating banks. Standard Chartered, Citigroup and DBS had also not issued detailed formal responses regarding audit findings.

That absence leaves an important question unresolved: whether the exposure of A7 will result primarily in penalties against individual entities or in a broader reassessment of how correspondent banking controls are designed.

The traditional model relies heavily on lists of sanctioned entities and on documentation passing between banks. A7 points towards a different problem. The sanctioned institution can remain outside the transaction that the international bank actually sees, while the commercial purpose of the payment is concealed through layers of companies and altered paperwork.

The implication for enforcement is structural. Blacklists can identify a sanctioned bank. They are less effective against a network designed so that the sanctioned bank is several steps removed from the payment crossing the border.

For correspondent banks, the harder task is no longer simply recognising a prohibited name. It is establishing whether the trade documentation, corporate relationships, customs classifications and payment flows tell the same story.