Full Report
British payments specialist Michael Donald, a former board member of Visa UK, appears in documents related to VexPay, a Kyrgyz payment platform that the…
Analysis Summary
# Threat Actor: A7 Network
## Attribution & Identity
* **Actor Name:** A7 Network (also referred to as the A7 "shadow banking" network).
* **Designation:** Identified by the U.S. Treasury Department as a "significant transnational criminal organization" (October 2024).
* **Key Individuals:**
* **Ilan Shor:** Fugitive Moldovan oligarch and primary architect of the network.
* **Michael Donald:** British payments specialist and former Visa UK board member; identified in leaked minutes as a VexPay executive (Donald denies this role).
* **Dmitry Kuptsov:** Major shareholder in ImageNPay with links to Russian-born business interests in Monaco.
* **Known Associations:**
* **Promsvyazbank (PSB):** Russian state-owned bank serving the defense sector.
* **VexPay / Processing KG:** A Kyrgyz state-linked payment platform utilized by the network.
* **Skolkovo Innovation Center:** Linked to historical business development attempts by associates.
## Activity Summary
The A7 Network operates a sophisticated "shadow banking" infrastructure designed to facilitate international payments for Russian companies, bypassing Western sanctions and the SWIFT messaging system. Between January 2025 and June 2026, the network reportedly processed over $17 billion. Key operations include the development of **VexPay** in Kyrgyzstan to create alternative payment channels and the movement of $6.9 billion through international banks using hundreds of intermediary shell companies.
## Tactics, Techniques & Procedures
* **Sanctions Evasion:** Utilizing non-SWIFT payment rails to move capital for sanctioned Russian defense and commercial entities.
* **Industrial-Scale Forgery:** Creating fraudulent documentation to disguise the nature of financial transfers.
* **Transaction Laundering:** Disguising payments linked to sanctioned entities as ordinary, legitimate international trade transactions.
* **Intermediary Shell Companies:** Utilizing a global web of hundreds of front companies to obscure the origin and destination of funds.
* **Jurisdiction Hopping:** Leveraging third-country financial infrastructures (specifically Kyrgyzstan) to gain access to the global financial system.
* **Software Development Exploitation:** Utilizing Russian programmers and "innovation hubs" (Skolkovo) to build proprietary payment technologies.
## Targeting
* **Sectors:** Global Finance, Defense (Russia), International Banking, Fintech.
* **Geography:** Russia (Primary beneficiary), Kyrgyzstan (Operational hub), UK, Moldova, Monaco, and various international banking jurisdictions.
* **Victims:** The global financial system’s integrity is the primary target; specific victims include Western banking institutions unknowingly processing laundered funds.
## Tools & Infrastructure
* **VexPay:** Kyrgyz-based payment platform intended as a SWIFT alternative.
* **ImageNPay:** A UK-based payments business used by Donald and Kuptsov with historical ties to the Russian market.
* **A7 Cryptocurrency Network:** A digital asset infrastructure utilized for rapid, cross-border value transfer (sanctioned by the EU in July 2026).
* **Processing KG:** Kyrgyz state company serving as the formal facade for VexPay.
## Implications
The A7 Network represents a high-tier strategic threat to the efficacy of Western sanctions. By integrating legitimate Western financial experts (such as former Visa executives) and leveraging state-backed resources in Central Asia, the actor provides the Russian defense sector with a resilient "financial back door." This undermines the global AML/CFT (Anti-Money Laundering/Combating the Financing of Terrorism) framework and allows the Russian state to sustain military and economic operations despite international isolation.
## Mitigations
* **Enhanced Due Diligence (EDD):** Financial institutions should conduct rigorous screening of transactions involving Kyrgyz payment aggregators and shell companies linked to Ilan Shor.
* **Sanctions Monitoring:** Immediate screening against U.S. Treasury and EU sanction lists for any entities associated with the A7 Network or "A7" branded crypto-services.
* **Geopolitical Risk Assessment:** Heightened scrutiny of "fintech" partnerships emerging from the Skolkovo Innovation Center or involving former Soviet states attempting to bypass SWIFT.
* **KYC (Know Your Customer):** Thorough vetting of board members and shareholders of UK and EU-based fintech firms to identify Russian "shadow" stakeholders.