Kremlin-Backed Forgery Operation Channelled $6.9 Billion Through Global Banks

1. A Russian state-backed payments network used a mass document forgery operation to move more than $6.9bn through the international banking system despite sanctions imposed since 2022, according to a Financial Times investigation of hundreds of thousands of leaked internal files. The files, from inside a fintech company called A7, show payments handled not through some obscure back channel but through major international banks — Standard Chartered alone received $1.1bn from A7-linked entities in Hong Kong between late 2024 and August 2025, with Citigroup, Deutsche Bank and JPMorgan also named in the leak.

How A7 Actually Worked

A7 was launched by Promsvyazbank, a heavily sanctioned Russian state-owned military bank, in October 2024, with additional financial backing from VEB.RF, a Kremlin development institution. Its official purpose, as Promsvyazbank described it, was to be a “unique settlement mechanism” supporting Russian businesses locked out of Western finance after Russia’s banks were cut from SWIFT following the 2022 invasion. What A7 actually did, per the FT’s reporting, was build a network of front companies and existing legitimate businesses to gain access to the SWIFT system on Russia’s behalf, then hide that access behind an industrial-scale forgery operation producing counterfeit invoices — paperwork designed specifically to pass the compliance checks a sending bank is required to perform on its own customers. Some of the payments identified related to sensitive war-related products, including military hardware and security services bought from Russia.

The person running it is the detail that should have raised the most questions earliest. A7 is majority-owned and led by Ilan Shor, a Moldovan fugitive convicted in 2014 of siphoning roughly $1bn out of several Moldovan banks through a network of foreign shell companies — a scheme large enough that it’s remembered in Moldova as “the theft of the century.” Shor has publicly claimed A7 has moved $86bn in total since launch, a figure the FT’s $6.9bn finding only partially substantiates but doesn’t contradict, since the leaked files represent one slice of the network’s activity rather than its full ledger.

Why the Banks Missed It

The mechanism A7 exploited is a known, structural weak point in how SWIFT actually functions: the network itself performs no verification of who’s sending money — that responsibility sits entirely with the sending bank’s own know-your-customer and anti-money-laundering checks. A7’s forgery operation was built specifically to satisfy those checks on paper, which means the failure here sits with individual banks’ due diligence on their own customers, not with any gap in the sanctions regime itself. That’s a more troubling finding than a simple sanctions loophole, because it implies the compliance infrastructure banks are legally required to run failed against a scheme built explicitly to defeat it, at major institutions with some of the industry’s most well-resourced compliance functions.

Part of a Wider Pattern

EBM’s earlier coverage of European banks caught between EU sanctions and Russian asset seizures has already shown how complying with Brussels can still leave institutions exposed to losses and legal risk in Moscow — a genuinely difficult position for any bank operating across both jurisdictions. The EU’s own response has been to widen its net dramatically: a 21st sanctions package already added 170 entities and sanctioned 94 financial institutions, and Brussels is reportedly preparing to blacklist more than 1,600 additional companies suspected of supporting Russia’s war effort, in what would be the largest single sanctions package in the bloc’s history. Russia’s broader effort to build payment infrastructure outside Western control — the same 2022 SWIFT cutoff that motivated Europe’s own Wero payments alternative — is precisely the strategic gap A7 was created to exploit on Moscow’s behalf.

EBM TAKE: The uncomfortable finding in this story isn’t that Russia is trying to evade sanctions — that’s been the baseline assumption since 2022. It’s that a scheme run by a convicted fraudster, financially backed by a bank already under sanctions, using invoices forged specifically to defeat standard compliance checks, still moved close to $7bn through some of the world’s most heavily regulated financial institutions before anyone caught it. Sanctions enforcement was never going to be perfect. What A7 exposes is how much of that enforcement still depends on paperwork nobody is actually verifying at the point it matters — which is a bank problem as much as it is a Kremlin one.