Threat intel

On October 8, 2026 the UK Foreign, Commonwealth and Development Office (FCDO) added 38 Russia-related designations to the UK Sanctions List. One of them is Xeltox Enterprises Ltd, a company registered in British Columbia, Canada, listed together with the names Cryptomus, Heleket and Certa Payments Ltd. Cryptomus is a cryptocurrency payment processor: it gives merchants a checkout that accepts crypto. Heleket is a near copy of it that launched in January 2025. A Kyrgyz exchange, TokenSpot CJSC, was designated in the same package.

This matters to more than crypto firms. Cryptomus has been the checkout behind dozens of Russian-language exchanges and cybercrime services, and Canada's financial intelligence unit found it failed to report suspected laundering of ransomware payments. If your business accepts or sends crypto, uses a crypto checkout for hosting, proxies or software, or has ever paid a ransom through an intermediary, these names may already sit in your payment history. Since October 8, any new dealing with them is a UK sanctions question.

What the designation covers

The FCDO designated Xeltox under the Russia (Sanctions) (EU Exit) Regulations 2019 for supporting Russia's financial services sector "through its ownership of Cryptomus and activities linked to and continued via Heleket", in the words reported by TRM Labs and Cryptopolitan. Because the brands are name variations of one entity, moving users from one brand to the other does not escape it.

Two obligations follow for UK persons and UK businesses. They must freeze funds and economic resources owned or controlled by the designated entity, and they must not make funds or economic resources available to it, directly or indirectly, unless an exemption or licence applies. Internet services sanctions also apply to Xeltox and TokenSpot: social media services, internet access providers and app stores have to take reasonable steps to stop UK users reaching their sites and apps.

The government's own announcement does not name the firms. It says three crypto exchanges and two payment platforms were sanctioned, two of which reportedly processed transactions with A7, which it calls a "Kremlin-backed illicit finance network". TRM Labs reports that TokenSpot sent more than $950 million to A7, Garantex and Grinex, including $679.5 million to A7 alone. Garantex was a Russian exchange the UK sanctioned in May 2022, and TRM assesses Grinex as its likely successor.

How one processor became three names

Cryptomus introduced mandatory KYC (know your customer, the identity checks a regulated firm runs on its clients) in February 2025. Heleket had launched the month before. TRM Labs found that Cryptomus's monthly on-chain volume fell from $153 million in January 2025 to $86 million in March 2025 while Heleket's rose, which it reads as users moving to the service with fewer checks.

In April 2026 TRM assessed with high confidence that the two services are operationally linked. It cited shared infrastructure, identical branding and unusual shared website wording, overlapping personnel, the same 0.4% processing fee, and early liquidity from Garantex for both. TRM reports Cryptomus received more than $204 million from Garantex.

Canada had already acted. In October 2025 FINTRAC confirmed an administrative penalty of C$176,960,190 against Xeltox, operating as Cryptomus and formerly known as Certa Payments Ltd. The largest violation was 1,068 suspicious transactions not reported in July 2024 alone, with grounds to suspect laundering of ransomware payments, child sexual abuse material sales, movement of fraud proceeds and sanctions evasion. Xeltox has appealed to the Federal Court.

The brand count may not stop at two. Risky Bulletin, citing research by Synaptic Systems, reports that the business now also goes by Mirocard. Synaptic Systems describes mirocard.com as the continuation of Heleket's crypto-funded virtual card business, with heleket.com/card serving Mirocard content, while noting it has not confirmed who owns it. Mirocard is not named in the UK listing, so it calls for enhanced checks rather than an automatic block.

Why ransomware responders should care

Cryptomus's customers included the infrastructure side of cybercrime. Chainalysis reports that it served as a payment rail for bulletproof hosting and proxy vendors. Krebs on Security found the same pattern in December 2024, when a researcher tested dozens of services, from bulletproof hosts to anonymous SMS and account shops, that all took payment through it. Both Chainalysis and FINTRAC link ransomware proceeds to the service.

UK guidance on ransomware is direct about this. Making funds, including cryptoassets, available to a designated person is a breach, whether you are the victim or the firm that processes the payment. The maximum civil penalty from the Office of Financial Sanctions Implementation (OFSI) is the greater of £1 million or 50% of the breach value, and OFSI says ransom payments are unlikely to be considered appropriate for a licence. A ransom note that routes payment through a Cryptomus or Heleket invoice now carries that risk on top of everything else.

What to do

1. Update name screening today. Add every name on the listing: Xeltox Enterprises Ltd, Cryptomus, Heleket and Certa Payments Ltd, plus TokenSpot CJSC. TRM points out that screening "Xeltox" alone misses both brands. Add the domains cryptomus.com and heleket.com to the rules your payments and procurement teams use, and flag mirocard.com for review.
2. Screen by entity, not only by address. The processors generate a fresh deposit address for each order, so a static address blocklist will miss most of them. Use a blockchain analytics provider that attributes addresses to the Cryptomus and Heleket clusters and flags indirect exposure. TRM notes that exposure one or two hops away can still carry sanctions risk.
3. Run a lookback. Search your wallet, exchange and accounts payable records for the names and domains above. Payments dated on or after October 8, 2026 come first, because those may be breaches. Earlier ones show which vendors and customers relied on the processor.
4. Check your vendors. Hosting, proxy, VPN and software suppliers that bill through a crypto checkout should tell you which processor they use. If it is Cryptomus or Heleket, move them to another payment route or stop paying them.
5. Change your ransomware playbook. Add an explicit sanctions screening step before any payment decision, covering the payment address and the processor behind any invoice link. Record who ran the check and when.
6. Freeze and report if you hold funds. UK firms that hold funds for, or owe money to, the designated entity must freeze them. Cryptoasset exchange providers and custodian wallet providers registered with the Financial Conduct Authority (FCA) must report to OFSI when they know or suspect a customer is a designated person, including the amount they hold.

If you already paid them

A payment made before October 8 is not a breach of this designation, though it may still matter under other regimes, such as earlier sanctions on Garantex. Keep the records, because your bank, auditor or a counterparty may ask about it. A payment on or after October 8 may be one. Stop further payments, collect the transaction IDs, amounts, dates and who approved them, take legal advice and make a prompt voluntary disclosure to OFSI. OFSI's ransomware guidance treats early, complete disclosure and cooperation with the National Cyber Security Centre (NCSC) and law enforcement as mitigating factors. For a ransomware incident, report through the government's cyber incident reporting service as well.

The wider lesson

A screening list that holds only legal entity names misses brands, and one that holds only wallet addresses misses processors that rotate them per order. Give payments, procurement and incident response a shared list of names, domains and analytics clusters, and update it when a listing changes.

Our compliance and audit readiness team helps firms build screening and payment controls that hold up to this kind of change, and our security operations team runs ransomware response with the sanctions step built in. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: UK government, new UK sanctions announcement, October 8, 2026, TRM Labs, UK sanctions Cryptomus, Heleket and TokenSpot, TRM Labs, Cryptomus likely behind Heleket, Chainalysis, Scorechain, Cryptopolitan, crypto.news, FINTRAC penalty notice, Synaptic Systems, Risky Bulletin, October 12, 2026, Krebs on Security, December 2024, OFSI financial sanctions guidance for ransomware, Osborne Clarke on cryptoasset reporting to OFSI.