The list and the ledger

In 2014, around a billion US dollars vanished from Moldova’s banking system, stolen from one of Europe’s poorest countries. The businessman later convicted in his absence of orchestrating the theft, Ilan Shor, has since become the Kremlin’s most dependable instrument inside Moldova. He has bankrolled a banned political party, financed the vote-buying that marred the 2024 presidential election and EU referendum, and installed allies such as Evghenia Gutul, the Gagauz governor now serving seven years for channelling Russian money into Moldovan politics. Less known is what Shor has been building beyond Moldova’s borders. He is a co-owner of the company behind one of Russia’s most effective tools for wiring its way around western sanctions. The man who tried to buy Moldova is now helping Russia dodge the penalties for invading Ukraine.

That tool is a cryptocurrency called “A7A5”, launched at the start of 2025 and pegged to the rouble through deposits at Promsvyazbank, the Russian state bank that finances the country’s defence sector. It was set up through A7, a cross-border payments firm part-owned by Shor, and issued out of Kyrgyzstan. Its purpose is narrow and well understood. Western sanctions work by controlling the chokepoints of global finance: the Society for Worldwide Interbank Financial Telecommunication (SWIFT) messaging network, the correspondent banks that move money across borders, and the dollar-clearing system beneath most international trade. A rouble-backed token sidesteps all three. A Russian firm converts roubles into A7A5, moves the tokens abroad in minutes, swaps them for a dollar-linked coin somewhere more convenient, and cashes out. At the same time, the reserves and the controls stay in Russian and Central Asian hands, beyond the reach of any western regulator. The rouble peg is the deliberate part. Dollar-linked coins can be frozen by their western issuers, so the token works as a safe harbour that touches the dollar world only for as long as it takes to cash out. Blockchain analytics firms estimate that it has carried more than 100 billion US dollars in transactions since launch, at one point making it the largest non-dollar stablecoin in the world. The network behind it has claimed to move sums equivalent to roughly half of Russia’s annual military spending, which gives a sense of the scale these sanctions are meant to choke.

Brussels has noticed these developments. In October 2025, the EU’s 19th sanctions package did something it had never done before and banned transactions in a named cryptocurrency, A7A5, along with its Kyrgyz issuer. Six months later the 20th package, adopted in April 2026, went further. Instead of chasing a single token, it prohibited dealings with every crypto provider established in Russia or Belarus, added two more instruments to its banned list (RUBx, another rouble-backed token, and the digital rouble, Russia’s central bank currency, still in pilot), and, for the first time, triggered the bloc’s anti-circumvention tool against a third country, Kyrgyzstan, for hosting the trade. The digital rouble ban is the telling detail. The EU has outlawed the currency before Moscow has even rolled it out at scale, which it plans to do in September 2026. The shift to whole categories was an admission of failure as much as a show of resolve. The European Commission had concluded that naming targets one at a time was futile, as every operator it shut down simply reappeared under a new name. Britain has matched the EU step for step, targeting the token and the exchanges that trade it. It is also worth noting that Washington has pursued the same ecosystem.

That conclusion was well founded. When American authorities moved against the Russian exchange Garantex in early 2025, its operators resurfaced within months as a near-identical platform called Grinex, and A7A5 was the bridge that carried users across. The token was built without a central off switch that any western authority could pull, and its reserves were parked where European law does not reach. The same package had to chase an off-chain twin of the system as well. Firms decided to settle Russian trade by cancelling matching debts across mirrored accounts inside and outside the country. This was done so that no money ever crosses a border to be intercepted. Each time a rule names one layer, another is already carrying the load. Despite this, none of this means the measures are toothless. According to the analysts who track the token, daily volumes have fallen sharply and mainstream exchanges have begun refusing coins traced back to it. Yet the same trackers record the number of wallets holding the token still climbing through each successive ban, with no visible dip regarding any of them. A reasonable objection is that this is exactly what sanctions are for, since they are designed to impose friction and raise costs rather than to seal every crack. That is fair, and the friction is real. But friction is not interdiction, and interdiction is what the frontline states in the region actually need. A designation is cheap and quick to announce; the enforcement that would shut the route is slow, costly and politically awkward, and it depends on the cooperation of states that would rather withhold it. Kyrgyzstan, where much of the trade clears, has shown little appetite for closing it and has bristled at European pressure rather than act on it. That is where the effort thins out.

That gap is not an abstraction in a compliance report. This is because the network exploiting it is the same one working against an EU candidate state. Shor has spent years trying to drag Moldova back into Moscow’s orbit, and his payments venture is running at the precise moment when Brussels is moving to open the first clusters of accession talks with Moldova and Ukraine. For the frontline states, sanctions are not a gesture of disapproval. Indeed, they are a security instrument, the financial half of a war effort that the Baltic capitals, Warsaw and Helsinki have argued should be pressed harder. These are the governments that have pushed hardest for tougher financial measures against Moscow, precisely because they live closest to the cost of those measures failing. When the instrument leaks, the leak is not a technicality. It is a breach in the wall they are standing behind.

The uncomfortable conclusion is that Europe has become very good at the visible half of sanctions and weak at the half that does not openly declare its presence. A statement adding a token to a banned list looks like enforcement. It is only the opening move. The contest has shifted from the list, where the EU now acts with conviction, to the ledger, where value keeps moving regardless, and the two are not the same battle. Moscow grasped this some time ago, which is why it keeps building new rails rather than defending the ones already named. The real measure of any sanctions package is not the number of tokens it blacklists but the amount of money it stops. By that measure, Moscow is still ahead.

Marta Liduma is a Latvian corporate lawyer working in cross-border payments and fintech regulation, as well as a law student at the University of Groningen.