A7 investigation shows how forged documents can defeat isolated AML checks

A Financial Times investigation based on hundreds of thousands of internal A7 files says the group used front companies and forged trade documents to channel more than $6.9 billion through the international banking system. The records described activity beginning in late 2024 and included transactions through August 2025.

The FT found evidence of 100 A7 front companies making payments, while the internal documents referenced at least another 100. The network extended across multiple jurisdictions, including the United Arab Emirates, Hong Kong, Kyrgyzstan and Indonesia. Front companies obtained access to conventional bank accounts and used the Swift system to settle payments for Russian clients.

The reported method went beyond submitting an occasional false invoice. A7 staff allegedly maintained libraries of corporate stamps, altered customs codes and changed buyer, seller, product and delivery details to construct plausible paper trails. Documents could be prepared in advance and kept consistent with earlier explanations when a bank asked questions. Some records reviewed by the FT related to sensitive war-linked goods and purchases by Russian security services.

The FT also reported that banks raised compliance questions and that some relevant accounts were subsequently closed or restricted. The article does not suggest that the named banks knowingly participated in the scheme. The operational problem is that each institution could see only part of a wider network designed to make individual customers and payments look legitimate.

Official records provide separate context for A7's status. In August 2025, the US Treasury described A7 as a Russian cross-border settlement platform used for sanctions evasion and said it was owned by sanctioned Moldovan oligarch Ilan Shor and sanctioned Russian bank Promsvyazbank. The EU had listed A7 the previous month in connection with efforts to influence Moldova's 2024 presidential election and constitutional referendum.

The central lesson is that document consistency is not the same as truth. A forged invoice may pass basic presence, formatting and arithmetic checks. A coordinated network can go further by making several false documents agree with one another, creating a convincing but manufactured commercial history.

Document intelligence is therefore most useful when extracted information is compared with independent evidence rather than merely read accurately. The goods, customs codes, counterparties, jurisdictions, transaction values and payment purpose still need to make economic sense when considered together.

Screening only the immediate customer or beneficiary presents a similar weakness. A front company may not appear on a sanctions list and may have ordinary formation records, a plausible business description and professionally prepared documents. The review needs to consider ownership and control, whether the entity may be acting for another party, and whether its activity is consistent with the commercial role it claims to perform.

The investigation also shows why patterns across cases matter. A reused document template, corporate stamp, bank account, address or intermediary may be inconclusive on its own. Recurrence across supposedly unrelated entities can materially change the risk assessment. Those connections need to remain visible without turning a shared attribute into automatic proof of wrongdoing.

Finally, the network reportedly changed routes after scrutiny increased, shifting more activity from Kyrgyzstan towards the UAE. A relationship that passed onboarding can therefore become riskier as new intermediaries, jurisdictions or transaction patterns appear. Continuous monitoring should connect those changes to the original customer evidence and trigger reassessment when the story no longer holds together.