FinCEN proposes to bar fund transfers involving the A7 Network's sub-agents

On 5 October 2026 FinCEN published a finding and proposed rule aimed at one network (91 FR 63208). FinCEN describes the A7 Network as "a global wholesale sanctions evasion and money laundering service with ties to Russia." It finds that transactions involving "any company operating outside of the United States that is controlled by the A7 Network" are a class of transactions of primary money laundering concern, and it proposes a new special measure at 31 CFR 1010.668.

Comments on the proposed rule are due 4 November 2026.

The legal basis is a little unusual

FinCEN's better-known special measures come under section 311 of the USA PATRIOT Act (31 U.S.C. 5318A), which sets out five of them. This one is made under section 9714(a) of the Combating Russian Money Laundering Act, as amended by the FY2022 National Defense Authorization Act. FinCEN treats the section 311 factors as "instructive," and it explains why none of the five standard measures, including the fifth (restrictions on correspondent accounts), would be effective here. So it proposes something different: "a special measure prohibiting certain transmittals of funds involving the A7 Network's Sub-Agents."

What would be prohibited

Covered financial institutions could not send or receive transmittals of funds to or from an A7 Network Sub-Agent, or "from or to any account or CVC address administered by or on behalf of an A7 Network Sub-Agent." "Transmittals of funds" includes convertible virtual currency, and the proposal treats the A7A5 stablecoin as CVC. For some CVC transfers, institutions would have to reject the transfer, with some discretion where the originating address can't be reached.

"Covered financial institution" "has the same meaning as 'financial institution' in 31 CFR 1010.100(t)."

The proposed definition of Sub-Agent names six companies: Galadriel Trading FZCO, Gimli Trade LLC-FZ, Hydrofusion Resources FZ-LLC, Pearl Bridge, Power Sphere LLC-FZ and Sigizmund FZCO. The list is "including, but not limited to," and covers any other entity FinCEN identifies. FinCEN would share a fuller list privately with covered institutions through its secure FI-Portal and update it from time to time. It is keeping the list out of public view because, it says, wider access could let the network swap in new sub-agents.

What institutions would have to do

The proposal adds three obligations to the prohibition itself:

• If an institution knows or has reason to believe a transmittal involves a Sub-Agent and is prohibited, it must notify affected persons it has a direct commercial relationship with. No certification is required.
• Institutions "shall take a risk-based approach" to deciding what added diligence they need, with screening meant to catch Sub-Agents as originators, beneficiaries or references in payment messages.
• There is no new reporting, but institutions must document how they met the notice requirement.

FinCEN says compliance "should not require tools or competencies other than those already employed" under existing AML and sanctions programs, and gives commercial sanctions screening software as an example. The measure is meant "to apply in concert, not conflict with the existing sanctions." Where an OFAC blocking obligation applies, institutions should still block and report, and if the two conflict, meeting the blocking obligation counts as meeting this rule.

What it could mean

For a typical community bank or credit union, the practical work here is screening, and FinCEN is right that most of it can be done with tools you already have. The part that's different is the private list. Your screening vendor won't have it unless you load it, or unless the vendor has a way to take FinCEN's FI-Portal list from you. We'd ask now who in your institution has FI-Portal access, who would receive the list if the rule is finalized, and how fast it would get into your filters. That chain is where a small institution is most likely to fall behind.

We'd also check how your system handles the six public names today. Two of them are borrowed from Tolkien, and most carry suffixes like FZCO or LLC-FZ, which fuzzy matching may score oddly. A quick test run costs nothing.

Direct exposure to Russian sanctions evasion is unlikely at most small institutions. Indirect exposure through a customer's foreign trading partner is the realistic case, and that's where the risk-based diligence language matters. If you bank importers, exporters or customers who pay or are paid by trading companies abroad that you know little about, we think this proposal is worth a short note to your BSA committee before the comment period closes.