A7’s OpenAI prompt was six words long: "Translate [name] to [language]. Answer only translated text."
Developer code leaked in 2025 from A7—the Kremlin-linked payment network designated by Treasury on October 1 as “a significant transnational criminal organization”—shows A7 used this prompt with OpenAI's API to create fake invoices, fake stamps, and a complex ledger that made Russian procurement look like ordinary trade.
Our investigative work, as featured originally in the “Big Shor” investigation and in subsequently featured in the New York Times and Financial Times, reveals that between January 2025 and June 2026, A7 laundered over $80 billion through the international financial system and continues to do so today. Zach was the principal researcher and Dawson peer reviewed the report and mentored the research team.
The common story is that sanctions cut Russia off from SWIFT and dollar clearing. In reality, Russia never left the Western financial system; A7 is how it re-entered at state scale. It still needs dollars and euros to buy components, sell oil, and pay intermediaries; China’s CIPS, yuan, crypto, and barter cannot replace them.
How the scheme works
A7 acts for Promsvyazbank, the state bank serving Russia's defense sector. A7 has laundered over $80 billion through roughly 435 financial institutions in at least 83 countries, funding Russia’s war in Ukraine, intelligence operations, election interference, and trade. Its clients have included Iranian oil sellers, which is why Treasury rolled the designation into Operation Economic Outcast.
A7’s shell companies, often run from Russia over VPNs, open accounts at local banks in Bishkek or Dubai’s free trade zones. Those banks rely on larger regional banks, which clear dollars through correspondents in New York or Hong Kong. Each sees only the customer in front of it. Card programs issued under sponsor banks give front companies and Russians access to payment rails without a direct banking relationship.
Fundamental to the scheme were fake invoices, produced at scale using OpenAI’s ChatGPT. A7 also used ChatGPT to forge stamps and automate intake of SWIFT payment confirmations from scanned receipts. Because A7 broke the operation into steps that each looked legitimate, OpenAI’s screening was unlikely to flag it—a gap AI companies must close.
This is where the burden falls on banks, and where the anti-money laundering (AML) framework fails. It was built to catch criminals hiding proceeds, not a state-backed service with intelligence-grade tradecraft. A7’s disposable shell companies are replaced faster than any sanctions list can be updated. To Western correspondent banks, its flows look like normal bilateral trade.
Banks can catch A7 only by tracking behavior over time: new free-zone trading companies moving outsized volumes, product descriptions that do not match the counterparty, and payment routes with no commercial logic. However, banks can only go so far on their own.
The deeper problem is permissive jurisdictions—UAE free zones, Hong Kong, Kyrgyzstan, and Türkiye—that offer fast incorporation, light ownership checks, and access to dollars and euros. Intermediating Russian trade is profitable, and many of these governments frame it as “neutrality” rather than evasion. In Kyrgyzstan, A7 relied on relationships reaching the highest levels of government and the banking sector.
The Macro Threat: Sanctions, SWIFT, and China
As former U.S. Treasury and intelligence officials, we see A7 as a sobering reminder that the first wave of financial sanctions on Russia fell short. The international banking system remains the indispensable engine of Russia’s war effort.
This exposes a broader geopolitical failure: adversary coordination. Russia, Iran, the DPRK, and China increasingly share intermediaries and methods to exploit Western finance rather than build their own. Yet the allied response remains fragmented, targeting networks like A7 one at a time.
This forces hard choices about dollar access. Washington could strip correspondent access from the Chinese and regional banks moving billions for U.S. adversaries. That might disrupt A7, but it raises the question of whether weaponizing dollar access compels compliance or accelerates Beijing and Moscow's push for a closed-loop financial system.
Changing the Equation: Government Actions
Allied governments must close systemic loopholes. Diplomacy with third countries has largely run its course; the leverage now lies in their banks’ access to Western finance. Tools like FinCEN’s Section 311 can force regional banks to choose between servicing networks like A7 and keeping their Western correspondent accounts. Regulators must treat nested correspondent relationships (banks clearing payments for other banks’ customers) and sponsored credit card programs (cards issued by smaller banks and fintechs under a bank’s license) as direct compliance liabilities.
Exams that test only static list-screening teach banks to build to that baseline. Exams should require network analysis, and governments should help scale these costly tools for vulnerable institutions in developing countries. This must be paired with mandatory information sharing: secure channels for client exit data and real-time international exchange of typologies.
Finally, authorities must treat AI and cloud infrastructure with the same scrutiny as traditional finance. Finalizing know-your-customer rules for cloud providers and requiring AI companies to flag behavioral anomalies would deny illicit actors the cheap infrastructure they need to scale.
A7 still moves billions every month. A week after Treasury acted, A7 announced a stablecoin USDT-SWIFT product; the timing was not a coincidence. Even if A7 is degraded, its model is highly portable, and Iran and North Korea are watching. The question for Washington, London, and Brussels is whether they can help industry disrupt these networks through a compliance culture that prioritizes real impact over list-based box-checking.
The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.
Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief
