Dissecting the "Entire Transnational Black Market Path" Behind OFAC's Latest Sanctions List

The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) has issued new sanctions notices targeting several transnational illicit financial entities. Two key groups on the list have drawn industry attention: one is the Russian-based Bulletproof Hosting (BPH) provider Aeza Group and its executives; the other is the Picado Grijalba criminal organization based in Costa Rica. These two types of entities share a common characteristic: they each play a specific role in the flow of illicit funds.

The Operating Model and Legal Exemption Traps of Bulletproof Hosting (BPH)

When studying service providers like Aeza Group, it's essential to first clarify the fundamental differences between bulletproof hosting and standard cloud services. Standard VPC (Virtual Private Cloud) or hosting providers typically adhere strictly to the Digital Millennium Copyright Act (DMCA) and compliance requirements in various jurisdictions. They act swiftly upon receiving complaints of abuse or legal enforcement requests (such as shutting down illegal DDoS nodes or phishing websites).

However, the core business model of bulletproof hosting providers like Aeza Group is based on "refusal to collaborate."

These service providers offer clients an operating environment resistant to administrative intervention by deploying physical servers in specific jurisdictions and using sophisticated network routing techniques to conceal the true location of their data centers. In the sanctions details disclosed by OFAC, Aeza Group is not a single entity. Its executives, Maksim Makarov and Ilya Zakirov, constructed a distributed hosting matrix through shell companies such as Smart Digital Ideas DOO registered in Serbia, Datavice MCHJ registered in Uzbekistan, and Hypercore Ltd established in various European locations. The significance of this structure is that even if a front-end domain is blocked, the illegal trading protocols running on the back end—such as the liquidation procedures of Grinex and its predecessor Garantex—can still continue to operate. This architecture directly enabled illegal trading platforms to maintain over 90% node online rate even when facing global blockades in 2025. The clearing hub in Russia's parallel financial stack: the niche of the A7A5 stablecoin. The physical support provided by the bulletproof mainframe is a key component of Russia's construction of a parallel financial stack. Due to the obstruction of traditional SWIFT settlement channels, Russian-affiliated entities shifted to a highly centralized stablecoin settlement model in 2025. Among them, the ruble-pegged stablecoin A7A5 became the core of this clearing network. The total transaction volume of A7A5 exceeded $72 billion in 2025. This was not the result of retail trading, but rather highly structured institutional behavior. By analyzing the A7 wallet cluster (with approximately $38 billion in associated funds), we can observe a clear "transfer-aggregation" pattern. Funds typically flow out from sanctioned entities and into non-compliant VASPs (Virtual Asset Service Providers) running on Aeza Group servers, where asset shuffling or cross-chain conversion is completed. This system is called a "parallel financial stack" because it forms a self-sufficient closed loop from hardware (Aeza's servers), assets (A7A5 stablecoins), to channels (non-compliant VASPs). A7A5 is not only used for cross-border trade settlements, but also widely used for ransomware and profit distribution in cybercrime. In this closed loop, the bulletproof host not only carries the clearing protocol, but also provides geographical deception for each transaction through its own IP asset pool, making it difficult for traditional geofencing-based compliance tools to identify the true origin of these transactions. The Necessity of Asset-Level Risk Auditing: Token Attributes and Sanction Liability With Aeza Group and A7A5-related wallet clusters being explicitly flagged by OFAC, the risk control logic of the crypto industry has changed. In previous analyses, the asset itself was often considered a neutral container, and only the identities of the transacting parties were the basis for compliance judgments. However, the action on January 22nd reiterated the concept of "asset-level risk." When A7A5 is characterized as a tool controlled by sanctioned entities and used to evade regulation, holding, liquidating, or providing liquidity for this token itself creates compliance flaws. For financial institutions, this is not merely a matter of identifying black addresses, but requires "multi-level screening" of every token protocol in the asset pool. If a liquidity pool is heavily flooded with A7A5 generated through Aeza custodian nodes, the overall risk level of that pool should be reassessed. This dual audit logic based on "asset + physical base" is a necessary product for coping with the complex financial environment of 2026. With the total amount of illicit funds expected to rebound to a high of $158 billion in 2025, any risk control system that ignores the compliance of the underlying infrastructure may fail in the face of such systemic evasion strategies. After dismantling the physical foundation of digital infrastructure, the other end of the sanctions list on January 22nd points to the final exit mechanism for illicit fund flows. If the Aeza Group provides a "blockade-resistant" logical survival space, then the Picado Grijalba organization in Costa Rica demonstrates a "retailization" cover logic for assets when settling in the physical world. Retail Disguise: Structural Transformation of Asset Outflow Logic Through Industrial Operations

Retail Disguise: Structural Transformation of Asset Outflow Logic Through Industrial Operations

The core of Picado Grijalba's operation lies in its deep penetration of the business ecosystem surrounding the port of Limón in Costa Rica. Unlike the traditional model that relies on large offshore accounts for multi-layered transfers, this organization exhibits strong localization characteristics in the asset off-ramp stage. According to the disclosed list of related entities, beauty salons, fishing companies, and real estate agencies became the final nodes in the asset conversion process. This choice has a clear economic logic. Beauty salons, small retail outlets, and the fishing trade typically feature high-frequency cash transactions, difficulties in standardizing labor costs, and relatively vague business growth logic. These physical business nodes, upon receiving crypto assets, can transform them into part of their daily operating cash flow. For example, crypto assets from illicit trade can be converted into seemingly legitimate operating income by fabricating service appointments, inflating the average price of a single service, or artificially increasing raw material procurement costs in beauty salons controlled by the organization. This method effectively combats monitoring algorithms based on large, abnormal transactions by "granularizing" and embedding illicit liquidity into the service industry. The sophistication of this "retailized" money laundering lies in its utilization of business logic consistency. In active trade zones like the port of Limón, the fuel consumption, parts replacement, and outsourced labor costs of fishing companies fluctuate significantly, providing excellent cover for the entry of illicit funds. This approach no longer attempts to conceal the source of funds but rather to reshape their origins by "creating legitimate business activities." The Picado Grijalba organization's control over the port of Limón—especially the Moín container terminal—is not merely logistical control but also financial settlement support. As a key hub for global cocaine trafficking, the port's business volume dictates a significant demand for cross-border value hedging in the region. The organization's industrial layout precisely aligns with this geographical characteristic. By controlling supporting service companies along the logistics chain, the Picado network has achieved an evasion model of "integrated trade and finance." They are not only responsible for the physical transfer of goods, but also use their controlled industrial networks to provide collection and payment services to downstream criminal networks. In this model, the cross-border movement of funds is no longer a simple currency transfer, but rather a "trade difference" or "service fee expenditure." In the 2025 crime flow analysis, stablecoins accounted for nearly 90% of the crypto asset flow in Central and Latin America. The Picado organization is a local executor of this trend. They leveraged the instant settlement capabilities of stablecoins to rapidly convert illicit profits from European or North American markets into real assets in Costa Rica. This "cloud-based revenue, local consumption" model shortened the time funds remained in the regulatory purview and increased the geographical difficulty of tracing their origins. The Picado Grijalba case challenges existing defense systems by demonstrating that even legally licensed businesses with physical locations can become key nodes in the global money laundering supply chain. The beauty salons and investment consulting firms on the list may superficially appear to fully comply with regulatory requirements in terms of legal status, registration information, and tax records. This means that the identification of such risks must shift from "verifying who the legal entity is" to "verifying what the business is doing." For example, when a fishing company's book profits continue to grow, but the frequency of its associated cryptocurrency deposits deviates significantly from the seasonal characteristics of fishing, or its average transaction value far exceeds the industry average, this deviation from business logic should be considered a key risk indicator. Under the pressure of sanctions in 2026, this "micro-infiltration" has become a common strategy for illicit financial systems to circumvent on-chain traceability. The Picado organization is not merely laundering money; they are actually building a "credit pool" based on real-world assets. These pools not only absorb their own illicit proceeds but also provide highly covert redemption services for other transnational criminal networks. For any financial system involved in these transactions, identifying the "fingerprint of the real economy" hidden behind ordinary business transactions has become the last line of defense against systematic evasion strategies. Part Three: The Full-Stack Link – The Closed Loop of the A7A5 Stablecoin and the Parallel Clearing System In the cross-border flow of digital assets, the physical stability provided by infrastructure and the exit channels provided by real-world nodes require a highly liquid medium that can bypass traditional bank monitoring to connect them. On-chain data from 2025 to early 2026 shows that the Russian-linked ruble stablecoin A7A5 is playing this role as a "full-stack link." According to an industry report from early 2026, A7A5's total transaction volume exceeded $72 billion in the past year (some research institutions believe it has approached $100 billion). Its scale transcends simple market activity, becoming a clearing protocol with sovereign-level hedging characteristics. A7A5's operating logic differs significantly from traditional USD stablecoins. Its issuance and clearing do not rely on centralized custodian institutions controlled by the US, but rather operate on a closed node network supported by bulletproof host providers such as Aeza Group. This deep integration of "hardware + assets" ensures that A7A5 can maintain clearing efficiency through dynamic migration of the underlying protocol even when facing global wallet blocking. Tracking the A7 wallet cluster (involving approximately $38 billion in transactions) reveals a highly structured interaction with Latin American retail nodes like the Picado network: large cross-border profits undergo initial aggregation through A7A5, then are converted into more liquid mainstream assets in non-compliant VASPs hosted on Bulletproof servers, and finally distributed to real-world exit points around the world. This parallel clearing system effectively creates a "quarantine zone" within the global financial system. Within this zone, fund flows no longer follow SWIFT logic, but rather the logic of a "new physical layer" defined by BPH physical nodes. For regulators, the challenge with A7A5 lies in its ability to spread risk from a single address to the entire token ecosystem—when all issuance, redemption, and transfer of a token operate on uncontrolled infrastructure, the asset itself becomes a systemic compliance red line.

Part Four: Integration of the LaaS Model—From “Money Laundering Solution” to “Money Laundering Platform”

The underlying logic exposed by the latest sanctions is the servitization of money laundering (Laundering-as-a-Service, The LaaS (Service-as-a-Service) model has fully matured. Current illicit financial networks are no longer sporadic, temporary transfer channels, but have evolved into a leasable and integrable "full-stack service platform." On this platform, Aeza Group provides "data center leasing and defense services," while the Picado network provides "industrial acceptance and cash conversion services." This service-oriented model significantly lowers the barrier to entry for cross-border crime. A typical money laundering client (such as a ransomware organization or drug trafficking group) only needs to purchase the complete LaaS solution: First, they use the API on the bulletproof server to access an anonymous clearing protocol; second, they transfer profits across borders using the A7A5 stablecoin; third, they complete the final withdrawal through "industrial boutiques" like Picado, located in Costa Rica or Southeast Asia. This streamlined collaboration eliminates the need for criminals to manage complex money laundering processes themselves. They can simply pay a service fee to utilize this readily available, stress-tested infrastructure. In 2025, this platform-based collaboration led to a significant reduction in money laundering cycles during crime flow monitoring. Previously, money laundering processes involving complex cross-border business operations could take months, but with the support of LaaS (In-Service as a Service), through high-frequency, automated asset conversion and pre-set business transaction hedging, the entire cycle has been compressed to within 45 days. This increased efficiency is essentially a "network effect" resulting from the completion of a fully closed loop in the money laundering supply chain at both the digital and physical ends. Part Five: The Future of Penetrating Auditing – From Identity Verification to “Behavioral Fingerprints” and “Physical Tracing” According to the latest sanctions announcement, a completely new paradigm has been defined for the defense logic of financial institutions. When illicit funds are deeply embedded in the algorithms of bulletproof servers or disguised in the financial documents of beauty salons, traditional KYC (Know Your Customer) based on “person/company name” has reached its limit. Future compliance work must transform towards “full-stack auditing.” This transformation requires financial institutions to have the ability to identify “physical fingerprints.” For example, when a VASP client claims to operate in a compliant region, but its backend traffic frequently maps to known IP ranges of Aeza Group, this physical-level fraud should directly trigger the highest level of risk warning. Similarly, audits of industrial clients require in-depth monitoring of "business logic deviation." Financial institutions need to analyze: Does the asset flow of a fishing company located near a port conform to the economic cycle of the fishing season? Does its cryptocurrency transaction frequency deviate from the growth curve of its fiat currency inflows? Under the global regulatory pressure of 2026, this ability to penetrate the "full-stack" path will become a core variable determining the security of a financial system. Illegal financial networks are building a "second world" to resist sanctions by combining digital infrastructure with physical industries. Identifying and blocking this pattern of connection across digital and physical boundaries, and understanding the operational logic of money laundering as a systemic service, is not only an inevitable direction for professional research, but also a core benchmark for assessing the boundaries of future financial security.