FinCEN alert FIN-2026-Alert007, issued on 1 October 2026, gives financial institutions a list of red flags for activity linked to the A7 Network, a sanctions evasion and money laundering service with ties to Russia. On the same day, the Office of Foreign Assets Control (OFAC) designated the network a significant transnational criminal organisation, and FinCEN proposed a special measure that would prohibit covered US institutions from transmitting funds involving A7-controlled Sub-Agents.
Red flags are a starting point, not a detection capability. This walkthrough shows how a transaction monitoring team can turn each group of A7 red flags into a scenario or review step, what data each one needs, how to tune it, and what to do when an alert becomes a case.
What the alert requires and what it does not
Three instruments arrived together, and they carry different weight.
- OFAC designation (in force). A7 property and interests in property in the United States or held by US persons are blocked, including transactions involving Sub-Agents acting for the network, and must be reported to OFAC.
- FinCEN proposed special measure (not final). The prohibition on transmittals involving Sub-Agents is a notice of proposed rulemaking and remains subject to the rulemaking process.
- FinCEN alert (guidance). The red flags help institutions detect and report suspicious activity. FinCEN asks that related Suspicious Activity Reports (SARs) include the key term "FIN-2026-A7NETWORK" in SAR field 2 and in the narrative.
FinCEN is explicit that no single red flag is determinative and that institutions should weigh the totality of facts, the customer's history and whether multiple red flags are present. That instruction shapes how the scenarios below should be built.
Why name screening alone will not find A7 activity
The network's design is the problem. A7 assigns a Sub-Agent, usually a company in a third country presented as owned by non-Russian nationals, to appear as the paying party on invoices and payment instructions. FinCEN reports that by June 2026 these companies held accounts at around 435 financial institutions in at least 83 countries. Unless a Sub-Agent has been publicly identified, sanctions screening against list names will not flag it. Behavioural and documentary signals have to do the work.
Mapping the red flags to scenarios
The table converts the alert's three red-flag groups into practical monitoring responses. Some are automatable scenarios. Others are better handled as list-based checks or investigator review steps.
| Red flag theme | Response type | Data required | Scenario or review logic | Tuning considerations |
|---|---|---|---|---|
| Transactions with suspected or identified Sub-Agents | List-based check | Counterparty names and identifiers; internal and published Sub-Agent lists | Screen counterparties in payment flows against identified Sub-Agents and their known identifiers | Maintain the internal list as intelligence develops; record the source of every entry |
| Shell companies in the Kyrgyz Republic or other jurisdictions of concern | Scenario | Counterparty jurisdiction, incorporation date, ownership data | Flag customers whose payments concentrate on newly formed or opaque counterparties in jurisdictions FinCEN names | Jurisdiction alone will create noise; combine with counterparty age and ownership opacity |
| Routing through several possible shell companies with no clear economic purpose | Scenario | Payment chain data, counterparty overlap across customers | Detect pass-through behaviour, where funds received are paid onward quickly to different counterparties across jurisdictions | Set the pass-through window and ratio per customer segment; trade businesses legitimately move funds quickly |
| A recently formed company starting high volumes of large transactions without recurring counterparties | Scenario | Account and company age, expected activity from onboarding, counterparty recurrence | Compare early activity with the expected activity declared at onboarding, weighting low counterparty recurrence | Use declared expected activity rather than a single absolute threshold |
| Transactions with entities in disparate lines of business, or goods inconsistent with the supplier's profile | Scenario plus review | Counterparty industry classification; trade documents where held | Flag customers whose counterparties span unrelated industries; route to trade review | Depends on counterparty enrichment quality; measure how often industry data is missing |
| Access from identified VPN infrastructure, or email domains linked to the network | List-based check at the channel and onboarding layer | Session IP data, registration email domains | Match session and onboarding data against the domains and IP ranges listed in the alert | Usually owned by fraud or digital channel teams; agree a hand-off into AML triage |
| Invoice anomalies: changed templates, vague goods, implausible prices, analog stamps on digital documents, stray Cyrillic characters, signs of AI generation | Investigator review step | Trade and invoice documents | Add these checks to the investigation checklist for trade-related alerts | Train investigators on examples; record which anomaly was found |
| Exposure to A7A5 or wrapped versions of it | Blockchain analytics | Wallet addresses, on-chain exposure data | Screen deposits and withdrawals for direct or indirect A7A5 exposure | Indirect exposure thresholds need documented rationale |
| Stablecoins used for large trade purchases, especially commodities not usually traded with digital assets | Scenario | Payment method, stated business, goods category | Flag trade customers settling large purchases in stablecoins, weighting dual-use goods, oil and petroleum | Narrow to customers whose profile does not explain stablecoin use |
| Over-the-counter digital asset firms with sudden, unexplained growth in jurisdictions linked to the network | Scenario plus customer review | Customer type, volume trend, jurisdiction | Flag OTC or block-trading customers with sharp volume growth and limited operating history | Trigger an enhanced due diligence refresh rather than a transaction-level alert |
Building the overlay without flooding the queue
A typology overlay like this adds alerts. A few design choices keep it useful.
Score combinations, not single indicators. Because FinCEN treats no single red flag as determinative, weight each indicator and alert when a customer accumulates several within a defined period. A recently formed company with low counterparty recurrence and payments to new entities in a named jurisdiction is a much stronger signal than any one of those facts.
Run a lookback. Activity linked to the network predates the 1 October designation. Running the overlay over a historical window will show whether existing customers fit the pattern and will give you real data to tune against.
Document every threshold. Record why each window, ratio and weighting was chosen and what the lookback showed. Auditors and supervisors will ask how the scenario was calibrated, not only whether it exists.
Measure conversion. Track how many overlay alerts become cases and how many cases lead to a SAR or to sanctions action. If conversion is very low after the lookback, tighten the combinations before raising volume thresholds.
When an alert becomes a case
Two separate outcomes may apply, and they should not be confused.
- Sanctions. If the investigation identifies property or interests in property of the A7 Network, including transactions involving Sub-Agents acting for it, OFAC blocking and reporting obligations apply for US persons. That is a sanctions decision, not a suspicious activity decision.
- Suspicious activity. Where activity is suspicious but no blocking obligation is established, file a SAR under the institution's normal procedures and include the FinCEN key term in field 2 and the narrative.
Institutions outside the United States should apply their own jurisdiction's sanctions and reporting rules. The FinCEN key term is a request for US filings. The red flags themselves remain useful typology input anywhere a customer base has exposure to the corridors and jurisdictions FinCEN describes.
How MemberCheck can help
MemberCheck's transaction monitoring supports configurable rules, alert triage and escalation into suspicious matter reporting, alongside sanctions screening with an audit trail behind each decision. Compliance teams can use the mapping above to decide which A7 indicators to configure as rules, which to handle as list-based checks, and which to add to investigator review.
Request a demo to see how configurable monitoring rules and screening can support typology-driven scenarios like these.
