The UK's first A7 alert describes a network built to pass identity checks

The National Crime Agency published Flash Alert 0808-NECC on 31 August 2026. It sets out how the A7 network moves value across borders for sanctioned Russian clients. Four of its seven red flags describe the customer rather than the transaction.

The short version

• Issued by the National Crime Agency and the National Economic Crime Centre with OFSI and the FCDO, through the Joint Money Laundering Intelligence Taskforce, and published on 31 August 2026.
• That figure is A7's own claim as reported by the NCA, covering its first year of operating. A7 was established in 2024 and is backed by Promsvyazbank and VEB.RF.
• Shell companies registered around the world hold ordinary local bank accounts. The NCA says the liquidity, once introduced, "bears no association with its Russian origin".
• The NCA describes A7 creating websites and email addresses for the shell companies, and running VPNs so staff appear to be in the country whose banks they are approaching.
• Ownership information, jurisdiction of registration, the depth of a company's online presence, and whether an apparent banking location matches the customer's profile.
• The NCA says it has "not been analysed or evaluated in the same way as a Red or Amber Alert" and is not a statement that the activity is definitively illicit.

A7 claims to have settled more than USD 86 billion in its first year

The National Crime Agency published Flash Alert 0808-NECC on 31 August 2026. It describes A7, a settlement network established in 2024 and backed by Promsvyazbank, a sanctioned Russian state-backed bank. Within its first year of operating, A7 claims to have settled more than USD 86 billion in cross-border trade.

That number is A7's own claim, reported by the National Crime Agency rather than measured by it. Even discounted heavily it describes a payment channel of national scale, operating for clients who are cut off from the ordinary one.

Sanctions work by denying named parties access to the financial system. The denial is enforced almost entirely by private firms: banks, payment companies and their supervisors decide, transaction by transaction and customer by customer, whether the party in front of them is on a list. A network that can present unlisted customers holding ordinary bank accounts defeats that arrangement without ever appearing on a list itself.

The National Crime Agency describes A7 as "a commercial enterprise backed by PSB and VEB.RF", the second being a Russian state-owned development corporation and investment company. It was set up by Ilan Shor, whom the alert calls "the Russian-Moldovan oligarch and convicted fraudster". Promsvyazbank, in the alert's account, advertises A7 as offering a "unique mechanism" for Russian companies and their foreign counterparts to complete trade settlements "in the face of anti-Russian sanctions pressure". A7 and its affiliates have been sanctioned by the United Kingdom, the United States and the European Union.

The alert exists because the people who have to spot this are not investigators. They are onboarding teams and reviewers inside regulated firms, and the question the alert answers for them is what the network's customers look like from the inside of a bank.

Value enters the banking system through sub-agents that carry no trace of Russia

A7 creates pools of liquidity outside Russia and uses them to complete transactions for clients. The National Crime Agency says that when this money is introduced into the international financial system it "bears no association with its Russian origin". It arrives instead through shell companies, which A7 calls sub-agents, holding ordinary local bank accounts.

The historically most significant route ran through Kyrgyzstan and the Trading Company of the Republic of Kyrgyzstan, which was liquidated in February 2026. One estimate cited by the alert suggests around USD 8 billion flowed through that company by April 2025.

A7's instrument of choice has been the promissory note, or veksel, which is a written promise to pay that can be bought and redeemed like a credit note. Customers buy notes covering the value of the transactions they want executed abroad. The design matters because of what it removes: when a note is redeemed there is no correspondent bank transfer out of Russia. A correspondent bank transfer is a payment routed through an account one bank holds at another, and it is the point at which a Russian origin would normally become visible. Instead, a shell company completes what looks like a separate transaction, supported by false invoices the alert says A7 manufactures.

Those payments are then routed through shell companies incorporated in several intermediary jurisdictions, exploiting what the alert calls "complex, multi-layered correspondent banking arrangements". OFSI, the UK body that implements financial sanctions, has identified transactions between A7 shell companies and beneficiaries incorporated in the United Kingdom, routed through banks in several intermediary jurisdictions. The channel reaches British firms.

It has also moved. The alert records that 78% of A7 transactions went through Chinese jurisdictions in August 2025, and that A7 has opened offices in Nigeria and Zimbabwe. In Nigeria it established a relationship with a payments service provider, Pilot Finance Limited, now sanctioned by the United Kingdom, which the alert says had connectivity with British, Spanish and Ugandan financial entities. A payments provider adds another layer between the sub-agent and the bank, which is the point of using one.

A7 builds the customer that the bank checks, including its website and its location

The National Crime Agency says A7's sub-agents are controlled by individuals inside Russia despite being registered in other jurisdictions. A7 creates websites and email addresses for the shell companies, which its staff use when communicating with banks. It also maintains virtual private networks so staff appear to be in the same country as the banking services they are seeking.

A virtual private network, or VPN, routes someone's internet traffic through a computer somewhere else, so the connection appears to come from that location. Used this way, it makes a person sitting in Russia look to a bank's systems like a person sitting where the company is registered.

Read together, those three details describe a customer assembled to satisfy the checks a bank performs. There is a registered company in a plausible jurisdiction. There is a website and a corporate email domain. There is a director on paper. There is a connection originating from the right country. Each element is the kind of evidence an onboarding process asks for, and each has been supplied deliberately.

This enables A7 to avoid traditional anti-money laundering regulations and know-your-customer checks.

National Crime Agency and National Economic Crime Centre, Flash Alert 0808-NECC, August 2026

That sentence is worth sitting with, because it inverts the usual assumption. A control designed to detect an evasive customer assumes the customer is trying to give less than is asked. The network described here gives more, and gives it in the expected shape. A complete file is the output of the method rather than evidence against it.

This is the same structural problem another regulator described on the same day in a different context. FinCEN's proposal on the UAE branches of Banque Misr, published on 1 September 2026, identified 103 suspected front companies registered in third countries specifically, in its words, "to obscure beneficial ownership". Two agencies, two sanctions regimes, one mechanism.

Four of the seven indicators describe the customer rather than the payment

Flash Alert 0808-NECC lists seven red flag indicators for firms. Three concern transaction and invoice patterns. The other four concern the customer itself: how much is known about its owners and directors, where it is registered, how substantial its online presence is, and whether the location it appears to bank from matches its profile.

The National Crime Agency puts its own qualification first, and it belongs here too: "No single red flag is indicative of illicit activity associated with the A7 network and all surrounding facts and circumstances should be considered before determining whether specific transactions or customers are associated with the A7 network."

The seven, in the alert's own words:

• "Companies with a limited history completing large volumes of transactions with established entities in ostensibly different industries"
• "Invoices detailing goods or services which are distinct from the suppliers' usual products"
• "Multiple transfers completed between obscure companies operating ostensibly in different industries"
• "Limited information on ownership, directors or beneficiaries"
• "Companies registered or operating in known jurisdictions of high risk"
• "Companies with a limited online presence with websites containing generic stock photos and minimal to no details on individuals operating the company"
• "Use of VPNs to conduct banking, including companies or their representatives using VPNs that may match the jurisdiction in which they seek banking services but do not match their profile. For example, differing locations within the same jurisdiction, or at locations not associated with their address"

The last one is unusual in a published typology. It asks a firm to compare two things it holds in different systems: the network location a session came from, and the address on the customer file. Neither is new data. The signal only exists when they are read against each other, which is a question of whether the fraud and the compliance functions can see the same record.

The fourth indicator, thin ownership information, is the one most firms already collect against. It is also the one the alert's own account of A7 suggests will look satisfied, since a sub-agent is registered with a director and an owner. The distinction the alert is drawing is between having the information and the information being true, and that is a harder test than a completeness check. The United Kingdom has been tightening the registration end of it separately, through the fit and proper regime for company formation agents.

A Flash Alert is a warning about a typology, not a finding about any firm

The National Crime Agency states that a Flash Alert has "not been analysed or evaluated in the same way as a Red or Amber Alert". It says the report should be read as highlighting a matter of potential concern for recipients to consider alongside existing anti-money laundering controls, and "not a statement that the activity within is definitively of an illicit nature".

That tier matters for how a firm uses the document. It is intelligence about a method, published so that firms can look. It is not a list of entities, and it does not name the sub-agents. A firm cannot screen against it in the way it screens against a sanctions list, which is why the output the alert asks for is a suspicious activity report rather than a block.

The route is the ordinary one. A regulated firm that knows or suspects money laundering reports under Part 7 of the Proceeds of Crime Act 2002 and the Terrorism Act 2000. The alert asks that reports carry the text XXJMLXX and the reference 0808-NECC, so the agency can trace what its own publication produced. Where a firm instead identifies a frozen asset or a breach of financial sanctions, that goes to OFSI, and reporting it is a legal duty rather than a choice.

Rachael Herbert, Director of the National Economic Crime Centre, said the alert "will continue to ensure the industry is aware of the mechanisms used to attempt to evade sanctions", and placed it alongside Operation Destabilise, the agency's November 2025 action against a Russian-speaking money laundering network.

Alongside the alert, HM Treasury said on 31 August 2026 that the Chancellor will double the maximum fine available to OFSI, from 50% to 100% of the value of a sanctions breach. The announcement names no commencement date and no legislative instrument, so the higher ceiling is stated as an intention rather than a rule in force. It sits with a broader pattern. The United Kingdom acted on 26 May 2026 against A7's third-country enablers in Central Asia and West Africa, having already sanctioned the Grinex and Garantex crypto exchanges. It has made more than 500 designations under the Russia regime this year.

For a firm, the practical consequence is a timing one. Designations against this network have moved repeatedly through 2026, so a screening result that was clear at onboarding is not evidence of anything months later. That is the case the European Union made when it wrote a standing obligation to keep looking into its anti-money laundering regulation, and it is the same case here.

Key takeaways

The alert is intelligence, not a list.

Flash Alert 0808-NECC describes a method and asks firms to look for it. It names no sub-agents, so it cannot be screened against.

The scale claim is A7's own.

More than USD 86 billion in the first year is what A7 claims, reported by the NCA rather than measured by it.

The customers are constructed to pass.

Registered companies, manufactured websites and email domains, and VPN sessions matching the jurisdiction of the bank being approached.

Four of seven red flags are identity signals.

Ownership depth, jurisdiction, online substance, and whether an apparent banking location matches the customer's profile.

The OFSI penalty rise is announced, not in force.

HM Treasury said on 31 August 2026 that the maximum will double from 50% to 100% of a breach's value. No date and no instrument were named.

Using Didit for the checks this alert points at

Four of the seven indicators are things a firm holds about a customer rather than things it sees in a payment, so most of the work sits at onboarding and at review.

Business Verification (KYB) at $2.00 per check is the module that answers the fourth indicator, limited information on ownership, directors or beneficiaries, by resolving a company to its registry record and its beneficial owners. AML Screening at $0.20 per check covers the part of this that is a list problem: A7 affiliates and Pilot Finance Limited are designated, and a named entity is what screening catches. Ongoing AML Monitoring at $0.07 per user per year matters because designations against this network moved through 2026, so a clear result at onboarding goes stale. Transaction Monitoring at $0.02 per transaction addresses the first and third indicators, unusual volume between counterparties in unrelated industries. Wallet Screening (KYT) at $0.15 per screening covers the crypto leg the UK sanctioned separately through Grinex and Garantex. Current prices are on the pricing page.

Three limits, and the first is the important one. A beneficial ownership record shows registered ownership, which is precisely what the National Crime Agency describes A7 as manufacturing; a verified owner is not the same thing as a real one, and no vendor closes that gap. Second, the alert is intelligence rather than a list, so nothing sold by anyone can tell you whether a given company is an A7 sub-agent. Third, deciding to file under Part 7 of the Proceeds of Crime Act 2002, or to report to OFSI, is the firm's judgement and its legal duty, and it stays there.

Frequently asked questions

What is NCA Flash Alert 0808-NECC?

A Flash Alert issued by the United Kingdom's National Crime Agency and its National Economic Crime Centre, dated August 2026 and published on 31 August 2026, titled "A7 Sanctions Evasion Mechanism". It was issued in conjunction with OFSI, the Foreign, Commonwealth and Development Office and financial sector partners through the Joint Money Laundering Intelligence Taskforce.

What is the A7 network?

According to the National Crime Agency, A7 is a commercial enterprise established in 2024 and backed by Promsvyazbank, a sanctioned Russian state-backed bank, and by VEB.RF, a Russian state-owned development corporation. The NCA describes it as an alternative value transfer system that moves value across borders for clients in need of an obfuscation service. A7 claims to have settled more than USD 86 billion in its first year.

What are the A7 red flag indicators?

Seven: companies with a limited history completing large volumes of transactions with established entities in ostensibly different industries; invoices detailing goods or services distinct from the suppliers' usual products; multiple transfers between obscure companies in different industries; limited information on ownership, directors or beneficiaries; companies registered or operating in known high-risk jurisdictions; companies with a limited online presence and generic stock photos; and use of VPNs to conduct banking where the apparent location does not match the customer's profile.

Does the alert mean a firm has done something wrong?

No. The National Crime Agency states that a Flash Alert has "not been analysed or evaluated in the same way as a Red or Amber Alert", and that it should be read as highlighting a matter of potential concern rather than as "a statement that the activity within is definitively of an illicit nature". It also states that no single red flag is indicative of illicit activity.

Has the OFSI penalty limit changed?

It has been announced, not yet enacted. HM Treasury said on 31 August 2026 that the Chancellor will double the maximum fine available to the Office for Financial Sanctions Implementation from 50% to 100% of the value of a sanctions breach. The announcement names no commencement date and no legislative instrument.

Related reading

• FinCEN names one bank and 103 front companies — The Iranian version of the same structure, proposed the same week.
• FCA financial crime review: private markets — What firms report about their own controls, and where the thin parts are.
• AUSTRAC suspends a crypto ATM operator — A supervisor acting on the cash-to-crypto edge of the same problem.

Sources

1. Flash Alert 0808-NECC, A7 Sanctions Evasion Mechanism — National Crime Agency and National Economic Crime Centre · August 2026 · every red flag, typology and caveat quoted in this post
2. UK leads way in disrupting shadowy Russian sanctions evasion network — HM Treasury, National Crime Agency and the Rt Hon John Healey MP · 31 August 2026 · publication date, the OFSI penalty announcement and the Herbert quotation

Who wrote this

Tuan Nguyen — Growth · Didit

Writes about identity verification, fraud and compliance at Didit.

Last reviewed 1 Sep 2026 against the sources above