A7: Jersey flags NCA warning on Russia’s hidden payment rail

Jersey - NCA Flash Alert: the A7 sanctions-evasion mechanism — what it is, what is actually known, and what firms should do:

Jersey’s External Relations notice of 9 September 2026 has pointed industry to a UK National Crime Agency (NCA) / National Economic Crime Centre (NECC) Flash Alert on the A7 network. The Alert — reference 0808-NECC, issued in August 2026 with OFSI, the FCDO and JMLIT partners — is a typology warning.

https://www.gov.je/gazette/Pages/NCAFlashAlertA7SanctionsEvasionMechanism.aspx

It is not a finding that every transaction matching the described pattern is illicit, and it is not equivalent to a fully evaluated Red or Amber Alert in every cited strand.

That distinction matters. The official record describes A7 as an alternative value-transfer system, not as a proven ledger of every dollar that has passed through it.

A7 itself has claimed more than USD 86 billion of settlements in its first year. That figure should be treated as A7’s own claim, not an independently audited total.

Open-source and on-chain work, including analysis by TRM Labs, has separately argued that some reported crypto volumes include circular internal transfers. Headline numbers should not be treated as proven illicit flow.

Why this is important:

A7 was established in 2024 as a commercial settlement mechanism backed by Promsvyazbank (PSB) — a sanctioned Russian state bank tied to the military-industrial base — and VEB.RF. The NCA says it was set up with Ilan Shor, a Russian-Moldovan oligarch convicted in Moldova over the 2014 bank fraud. The UK, US and EU have sanctioned A7 and affiliates.

PSB marketed A7 as a “unique mechanism” for trade settlement “in the face of anti-Russian sanctions pressure.” The NCA’s core allegation is operational, not merely branding: A7 builds liquidity outside Russia, then pays foreign suppliers so the international payment no longer looks Russian. Crypto, including the rouble-linked A7A5 token, is part of the toolkit. The Alert is explicit that fiat rails and correspondent banking are the larger operational problem.

This sits in the same threat picture as Operation Destabilise (November 2025), which linked professional money-laundering networks to an attempt to use Kyrgyzstan’s Keremet Bank as a payment building block for PSB. Kyrgyz state-linked vehicles, including the later-liquidated Trading Company of the Republic of Kyrgyzstan (TKKR), feature heavily in open-source reconstructions. Those reconstructions are useful context. They are not the same as a court judgment.

The practical risk for firms is therefore dual. First, exposure to designated persons and entities. Second, unwitting participation in trade-based money laundering dressed as ordinary cross-border settlement — including payments that can look commercially mundane until the economic buyer, invoice integrity and correspondent path are examined together. The NCA also frames a proliferation-financing concern: clients are said to include firms in Russia’s military-industrial complex.

The Alert’s operational picture is as follows:

1. A Russian (often sanctioned or high-risk) client needs to pay a foreign supplier.

2. Value is parked or credited in Russia via promissory notes / veksels — bills of exchange that record A7’s obligation without a correspondent transfer leaving Russia.

3. A shell “sub-agent” in a third country holds a local bank account.

4. That company pays the supplier with false invoices (goods descriptions swapped for mundane items; buyer identity swapped).

5. Staff inside Russia run the shells using websites, email addresses and VPNs so they appear to sit in the banking jurisdiction.

6. Payments hop through multi-layered correspondent chains. OFSI has identified suspected A7-linked shells paying UK-incorporated beneficiaries via intermediary banks.

The Alert says A7 has diversified away from a Kyrgyz-heavy model: 78% of transactions went through Chinese jurisdictions in August 2025; offices were opened in Nigeria and Zimbabwe; a relationship was built with Pilot Finance Limited (now UK-sanctioned).

No single red flag “proves” A7.

• The Alert lists, among others:

  • Thin-history companies doing large volumes with established counterparties in unrelated industries;

  • Invoices that do not match the supplier’s usual products;

  • Multiple transfers between obscure companies in ostensibly different sectors;

  • Thin ownership, director or beneficiary information;

  • Registration or operations in high-risk intermediary jurisdictions;

  • Thin online presence (generic stock-photo websites, almost no identifiable people); and

  • VPN use for banking that “matches” the target jurisdiction on paper but not the customer’s real profile.

• These overlap with ordinary TBML and third-country circumvention flags.

The value of the Alert is the combination: veksel / bill-of-exchange layer + Kyrgyz / Chinese / UAE / African shells + VPN-located operators + falsified commercial documents + a PSB / A7 nexus.

What a firm should do:

Jersey obligations sit alongside FIU suspicious-activity reporting; one does not replace the other.

Immediate (this week)

• Read the primary Alert, not a summary: https://www.nationalcrimeagency.gov.uk/who-we-are/publications/826-necc-a7-sanctions-evasion-mechanism/file.pdf

• Confirm screening coverage for A7 LLC / A7 Agent / related designations, Ilan Shor, PSB, VEB.RF, Old Vector (A7A5 issuer), Keremet Bank, TKKR (historical), Pilot Finance Limited, and any group aliases on the live UK Sanctions List: https://www.gov.uk/government/publications/the-uk-sanctions-list

• Do not rely on name-screening alone. Add pattern reviews: new mid-market traders paying large invoices in unrelated HS codes; Kyrgyz / UAE / HK / Chinese / African newly formed payers; promissory-note or “settlement agent” language in contracts.

• Map correspondent and PSP exposure to jurisdictions the Alert flags as historically used for liquidity introduction. Ask who the economic buyer is, not just the invoice party.

• If you are in Jersey’s regulated sector and you know or have reasonable cause to suspect a designated person or a SAFL offence from information obtained in the course of business, report to the Minister as well as considering an FIU SAR.

Reporting channels (Jersey and UK)

• Sanctions compliance / suspected breach / frozen assets / licence queries: sanctions@gov.je
  Form landing page: https://www.jerseyfsc.org/industry/international-co-operation/sanctions/sanctions-forms-for-licences-and-suspected-breach-notifications

• Suspicious activity (ML/TF/PF): Financial Intelligence Unit Jersey, in the usual way. Sanctions reporting does not satisfy the SAR duty.

• UK-regulated firms identifying frozen assets or financial-sanctions breaches: OFSI — OFSI@hmtreasury.gov.uk

• UK SARs that relate to this Alert: usual SAR portal, include 0808-NECC (and XXJMLXX in the text if following the Alert’s request).

• Non-SAR intelligence to the NCA: NECC.PPP@nca.gov.uk with reference 0808-NECC.

• Jersey compliance reporting form notice: https://www.gov.je/gazette/pages/financialsanctionsnoticesanctionscompliancereportingformnov2021.aspx

Controls to test (next 30 days)

• Trade document integrity: sample invoices for description mismatch, circular counterparties, and “agent / sub-agent / settlement company” payers with no industrial logic.

• VPN / access-channel anomalies in e-banking logs for corporate customers who claim a local office.

• Beneficial ownership refresh on recently onboarded trading companies in intermediary jurisdictions that suddenly process high-value payables.

• Crypto / VASP angle: A7A5 and related rails are sanctioned in several jurisdictions. Treat unhosted wallets, no-KYC swaps and chain-hopping into USDT as additional risk, not the whole story. Fiat correspondent abuse is the Alert’s main thesis.

• Update the firm-wide risk assessment for Russia circumvention and proliferation financing. The NCA explicitly asks supervisors, FIs, VASPs and DNFBPs to consider this threat in mitigation plans.

• Train first-line staff on the difference between a hit on “A7” and a typology hit (false invoice + third-country payer + Russian economic beneficiary).

• Legal privilege and tipping-off: informing a customer they appear on a public sanctions list is not automatically tipping-off; disclosing that you have filed a SAR or a Minister report can be. Take advice before exit letters.

What not to do:

• Do not treat every Kyrgyz, Emirati or Chinese trading company as A7. That is sloppy and will generate noise.

• Do not treat A7’s $86bn marketing claim as a verified loss to the sanctions regime.

• Do not assume crypto is the primary rail because it is easier to write about. The NCA says traditional payments and correspondent banking are extensively exploited.

• Do not file a SAR only because a party is designated; file a SAR when there is suspicion of criminality beyond the fact of designation (Jersey handbook position). Still make the separate Minister report where SAFL requires it.

Sources:

Official

• NCA Flash Alert PDF: https://www.nationalcrimeagency.gov.uk/who-we-are/publications/826-necc-a7-sanctions-evasion-mechanism/file.pdf

• UK government announcement (31 August 2026): https://www.gov.uk/government/news/uk-leads-way-in-disrupting-shadowy-russian-sanctions-evasion-network

• Wired-Gov reprint of the HM Treasury release: https://www.wired-gov.net/wg/news.nsf/articles/UK+leads+way+in+disrupting+shadowy+Russian+sanctions+evasion+network+01092026111500?open

• Jersey sanctions pages: https://www.gov.je/Industry/Finance/FinancialCrime/Sanctions/pages/internationalsanctions.aspx

• Jersey finance / Russia sanctions: https://www.gov.je/Industry/Finance/FinancialCrime/Sanctions/pages/sanctionsimplementation.aspx

• UK Sanctions List: https://www.gov.uk/government/publications/the-uk-sanctions-list

• Operation Destabilise (NCA, November 2025): https://www.nationalcrimeagency.gov.uk/news/operation-destabilise-nca-exposes-billion-dollar-money-laundering-network-that-purchased-bank-to-fund-russian-war-effort

Further reading (investigative reconstructions, not substitutes for the Alert or legal advice)

• Open Source Centre, The Big Shor: https://stories.opensourcecentre.org/the-big-shor/

• Centre for Information Resilience, A7 Abroad: https://www.info-res.org/app/uploads/2025/10/A7-Abroad-FINAL-Copy.pdf

• Lawfare on Shor and A7: https://www.lawfaremedia.org/article/to-evade-sanctions--the-kremlin-turns-to-a-convicted-money-launderer

• TRM Labs on-chain note: https://www.trmlabs.com/resources/blog/the-a7-leaks-trms-on-chain-analysis-of-russias-cryptocurrency-connections