When a licence becomes the selling point
In September, the Financial Times reported that A7, a Kremlin-backed payments group, had moved more than $6.9 billion through the international banking system using front companies and forged trade documents, according to hundreds of thousands of leaked internal files. The UK's National Crime Agency followed with an industry-wide alert warning that the network depends on financial institutions in third countries to get around sanctions.
In October, the FT's reporting turned to a UK firm. Documents from the leak show A7 listing Wooshpay, a London payments business incorporated as Swooshtransfer and registered with the Financial Conduct Authority as a small payment institution, among the routes it could use to make payments. One internal A7 note, as reported by The Paypers, described the firm as holding an ‘extensive licence’ and listed it as a possible route to mainland China and Hong Kong. The documents don't establish whether Wooshpay knew how it was being described, and nothing here is a finding against the firm.
The licence was the attraction
What stands out is what the network valued. A regulatory registration is meant to reassure counterparties that a firm has met a recognised bar. In A7's own notes, it appears as a selling point: a credential that made a route more useful precisely because others would trust it. A licence that can reassure a legitimate counterparty can reassure an illegitimate one just as well.
Granted once, relied on every day
Registration with the FCA as a small payment institution comes with real, ongoing obligations: verifying customers and their beneficial owners, monitoring relationships, and telling the regulator about significant changes, such as changes to who owns or manages the firm. Those changes are a matter of public record: the FCA register shows who runs a firm, for anyone who checks. The harder signals are the ones no register captures. Who the firm has started doing business with, or whether its name has begun appearing in adverse reporting or alongside designated parties, may not surface anywhere until something goes wrong. That isn't a gap in supervision. The FCA oversees firms against their obligations, and each bank or intermediary still has to judge for itself whether a firm remains one it wants to rely on.
What a connected institution can watch
Monitoring individual transactions is the responsibility of each firm and its anti-money laundering providers. What a connected bank or intermediary can watch is the firm itself, continuously: links to sanctioned or designated parties, adverse reporting and the company it keeps, alongside the changes in ownership, management and regulatory status that are on the public record but only useful if someone is checking them. Those are the signals that move between annual reviews, and the ones a one-off check at onboarding will never see.
A licence is a sensible starting condition for doing business with a firm undertaking regulated activities. It comes with ongoing obligations to the regulator, but on its own it can't tell a bank or intermediary whether the firm is still one it wants to rely on today. What is needed alongside it is a view of each firm that stays current: who owns and runs it, who it is connected to, whether its standing has changed since it was first checked, and whether every institution relying on it is seeing the same picture, updated in real time as the evidence changes. Keeping that view current, for every firm in the network, is the infrastructure layer Invela is building.
Invela is the infrastructure layer that makes open finance trustworthy - accrediting who's in the network, monitoring risk in real time, and ensuring liability lands in the right place.
