Switching from Cryptomus to Heleket leaves the same UK sanctions target

On Oct. 8, 2026, the UK placed crypto payment platforms Cryptomus and Heleket under a joint sanctions designation targeting Xeltox Enterprises Ltd. Moving from one brand to the other leaves the underlying designation relevant for any counterparty assessment.

When merchants select a payment processor or customers try to retrieve funds, the actual operator is just as important as the checkout label. Notice details from the Foreign, Commonwealth & Development Office identify Cryptomus, Heleket, and Certa Payments Ltd. as alternative names for Xeltox.

What changes for payments and UK access

Xeltox appears in the official notice under unique ID RUS3755. The UK government states it has reasonable grounds to suspect the firm has backed or profited from the Russian government via the Russian financial-services sector, pointing to its ownership of Cryptomus and operations connected to and sustained through Heleket.

Imposed measures involve an asset freeze, trust-services limitations, director disqualification, internet-services restrictions, and correspondent-banking alongside payment-processing limits.

Under the banking measures, UK credit or financial institutions are barred from starting or keeping correspondent relationships with the designated entity, as well as processing payments to, from, or through it. This restriction also encompasses credit or financial institutions owned or controlled by that entity.

The internet-related rules carry a different mandate. Application stores, internet-access providers, and social-media platforms must implement reasonable measures to block UK users from reaching content, websites, or applications provided by the designated entity, thereby enforcing a UK access restriction.

Guidelines from the Office of Financial Sanctions Implementation (OFSI) note that UK financial sanctions cover individuals and activities inside UK territory, alongside UK nationals and entities formed under UK law regardless of where they operate. Because cryptoassets fit the broad definitions of funds and economic resources, the impact on any given transaction depends entirely on the participating parties, the specific activity, and the applicable jurisdiction.

Control criteria also extend past explicitly listed brand names. OFSI ownership and control rules include holding greater than 50% of shares or voting rights, possessing the power to appoint or dismiss a majority of directors, or holding a reasonable expectation that a person can direct an entity’s affairs to align with their wishes. Consequently, an unlisted company may fall under financial restrictions due to underlying control.

When dealing with a withdrawal inside UK sanctions jurisdiction, the legal foundation of the transfer matters even if the customer is not personally designated. Whether a transfer is forbidden, covered by an exception, or allowed via a license relies on the specific funds and actions involved.

UK government policies separate exceptions—which trigger automatically when specified criteria are satisfied—from licenses, which grant written authorization for otherwise prohibited actions. General licenses also feature conditions and can expire, change, or face revocation. Moving a customer’s funds for an otherwise barred transfer demands a relevant exception or license. A licensing ground simply outlines a potential basis for an application, whereas written licensing permission requires an active, issued license that covers the specific activity.

The current OFSI general-license index highlights why verifying which entities fall under a given permission is critical. Its Oct. 8 addition, a Zarubezhneft wind-down license, applies to that specific oil company and its owned or controlled subsidiaries.

Additionally, OFSI outlines a return-of-funds licensing ground for designated money-services businesses, which mandates UK registration for anti-money-laundering purposes alongside other criteria. Holding Canadian registration alone fails to satisfy this requirement.

Achieving legal permission and executing a transfer successfully are two separate matters. Changing providers consequently leaves two distinct requirements to fulfill: executing a lawful transfer of the existing balance and finding a receiving pathway capable of processing it.

Separate exchange names can share a route

Analysis of separate exchange tracing reveals another challenge: changing the legal operator might still leave users exposed to a shared downstream pathway. TokenSpot CJSC received its own designation on Oct. 8 under RUS3758, featuring the same restriction categories, and designates a corporate entity distinct from Xeltox.

Data from Chainalysis shows that downstream funds originating from TokenSpot, Grinex, and Meer all converged on a single HTX deposit address, with certain funds reaching that target via intermediary wallets.

In its Oct. 8 report, the analytics firm noted that the address accumulated over $308 million in total receipts. This figure reflects the aggregate receipt total for the address, as the report provides no specific observation timeframe or exchange-by-exchange breakdown.

This convergence is significant because distinct exchange brands can route funds into identical downstream channels while presenting entirely separate interfaces to customers. For a merchant assessing alternative platforms, shifting operators and shifting routing channels are two different questions: the first pertains to the counterparty and legal control, while the second concerns where funds travel after entering the service.

Earlier coverage by CryptoSlate regarding US enforcement actions against A7 and Iran-Russia settlement ties highlighted the function of payment intermediaries. The recent tracing data offers another routing example concerning TokenSpot, Grinex, and Meer. However, the analysis does not establish any connection between Cryptomus or Heleket—or any corporate group tied to those exchanges—and this HTX endpoint.

A Canadian penalty preceded the UK designation

Xeltox also accumulated a compliance record in Canada prior to the UK sanctions. Documentation from FINTRAC dated Oct. 22, 2025, details that its director verified an administrative monetary penalty of C$176,960,190 on Oct. 16, 2025, penalizing 2,593 violations across six distinct categories.

The regulatory findings pointed to failures in submitting suspicious-transaction reports and adhering to Canada’s Iran directive. The Oct. 22 record confirms that Xeltox challenged the penalty in the Federal Court.

The UK Sanctions List update log, reviewed on Oct. 11, indicated Oct. 8 as its most recent update. For any customer contemplating a provider switch, the necessary proof remains specific to the transaction at hand: identifying the operator, determining who holds or controls the funds, analyzing the pathway, and verifying the applicable legal permissions.

?Frequently Asked Questions

01Why did the UK sanction both Cryptomus and Heleket?

The UK placed both crypto payment brands under sanctions on Oct. 8, 2026, because they share the same designated parent target, Xeltox Enterprises Ltd. The Foreign, Commonwealth & Development Office lists Cryptomus, Heleket, and Certa Payments Ltd. as names associated with Xeltox under unique ID RUS3755.

02What restrictions apply to Xeltox Enterprises Ltd. under UK sanctions?

The listed measures include an asset freeze, trust-services limitations, director disqualification, internet-services restrictions, and strict correspondent-banking and payment-processing bans that forbid UK financial institutions from handling transactions or maintaining relationships with the firm.

03Does changing my crypto payment processor remove sanctions risks?

Not necessarily. Switching between brands operated by the same parent company—or utilizing a downstream route shared by multiple exchange brands—means the underlying compliance and legal control risks may still apply.