A Russian state-backed payments network used front companies and forged documents to route more than $6.9 billion through the international banking system, according to a Financial Times investigation based on hundreds of thousands of leaked internal files.
The FT attributed the activity to A7, a cross-border payments network associated with Moldovan businessman Ilan Shor and Russia’s state-owned Promsvyazbank. The newspaper’s findings describe transactions involving accounts or customers at major international banks, but they do not establish that those institutions knowingly participated in sanctions evasion or that every payment breached the law applicable to each bank.
That distinction is important. The reported activity exposes how documentary fraud and layered corporate structures can carry Russia-linked payments back into mainstream correspondent banking even after sanctioned Russian banks have been disconnected from Swift.
What the leaked records reportedly show
According to the FT findings summarized by Finextra and other reports, A7-linked entities sent more than $6.9 billion through international banks. Accounts at Standard Chartered in Hong Kong reportedly received $1.1 billion from those entities between late 2024, when A7 was established, and August 2025. DBS in Hong Kong was reportedly sent $273 million, while Citigroup customers received $74 million during the same period.
Those figures describe payments involving accounts or clients at the named banks; they are not findings that the banks owned the funds or knowingly serviced A7. The disclosed institution-level amounts also represent only part of the reported $6.9 billion total.
The FT reportedly identified 100 A7 front companies making payments and references to at least 100 more. The network included companies in the United Arab Emirates, Hong Kong, Kyrgyzstan and Indonesia. Some of the payments were linked in the leaked records to military equipment and purchases by Russian security services, the FT reported. These are investigative findings from leaked material, not court judgments or published regulator findings.
A7 depended on the banking system it was meant to replace
A June investigation by the Open Source Centre, conducted with TRM Labs, provides independent context for the payment architecture. OSC said thousands of documents showed that A7 relied heavily on traditional banking despite being promoted as a crypto-enabled alternative to Western payment channels. The researchers estimated that the wider network had likely moved tens of billions of dollars through the international financial system.
OSC identified Kyrgyzstan as a central hub. It said A7 used the state-owned Trading Company of the Kyrgyz Republic to retain access to major currencies, banks and payment channels through Bishkek. Front companies in Hong Kong, Hungary, Mongolia and the UAE extended the network’s reach, according to the researchers.
The United Kingdom formally targeted A7 in a sanctions package that took effect on May 26, 2026. The UK government described A7 as a Kremlin-backed network designed to bypass Western restrictions, finance military procurement and process oil-sale proceeds for Russia’s war economy. That designation post-dates the late-2024-to-August-2025 transaction window highlighted in reports of the FT leak.
The timing prevents a simplistic conclusion that every reported transfer was automatically prohibited when processed. Legal exposure depends on the parties, beneficial ownership and control, transaction purpose, jurisdiction, designation date, and any applicable license or exemption. Payments involving already sanctioned entities or prohibited goods can create separate issues, but those questions require transaction-level analysis.
Why Swift exclusion was not enough
Swift is a secure financial-messaging network, not a universal sanctions-enforcement authority. Removing named Russian banks from Swift restricts their direct access, but it does not stop a newly formed company elsewhere from obtaining an account and sending a payment if the company’s ownership, purpose or documents evade scrutiny.
The reported A7 method appears to have targeted that boundary. A front company can present fabricated corporate records, invoices or trade documents during onboarding and payment review. Once accepted by an originating bank, a transfer can move through correspondent institutions that may see only limited information about the underlying trade or ultimate beneficiary.
This shifts the control challenge from simple name screening to network detection. Banks and payment providers need to test whether newly incorporated customers share directors, addresses, devices, counterparties, invoice templates or transaction patterns with other entities. Geographic exposure to known transshipment hubs should inform risk assessment, but it cannot substitute for evidence about a particular customer or payment.
The compliance lesson is documentary integrity
The case highlights three control layers. First, customer due diligence must verify beneficial ownership and business purpose rather than merely collect incorporation records. Second, transaction monitoring should connect related customers and counterparties across accounts, currencies and jurisdictions. Third, trade and invoice review needs controls for duplicated documents, inconsistent pricing, implausible routes and counterparties that do not match the stated business.
Correspondent banks face a related problem: the institution carrying a payment may not have the originating customer’s full file. Risk-based requests for information, payment transparency rules, nested-relationship controls and escalation procedures therefore become critical when transaction data conflict with the apparent customer profile.
The reported $6.9 billion flow is not proof that Swift controls failed in isolation. It is evidence, if the leaked records are accurate, that sanctions screening can be defeated when front companies and forged documentation obscure who is behind a payment. For payment firms, the operational warning is clear: a clean name-screening result cannot compensate for weak identity, ownership and trade-document verification.