UK Sanctions Cryptomus, Heleket and TokenSpot in Russia Package
On 8 October 2026, the UK's Foreign, Commonwealth and Development Office (FCDO) announced 38 Russia-related designations spanning shadow fleet tankers, military suppliers, and, critically for the crypto industry, three digital asset exchanges and two payment processors. The crypto-focused designations are among the most operationally detailed the UK has issued, backed by blockchain analytics showing billions of dollars flowing through platforms tied to sanctioned Russian counterparties. For accounting firms, auditors, and CFOs using any form of crypto accounting software, the action creates immediate legal obligations that require same-day review.
The Legal Framework Behind Today's Action
The FCDO issued the designations under the Russia (Sanctions) (EU Exit) Regulations 2019. These regulations give the UK government the power to freeze assets, prohibit transactions, and restrict financial services involving designated persons. Once a designation takes effect, UK persons, including financial institutions, accounting firms, and any business with UK-regulated activities, are legally prohibited from making funds or economic resources available to a designated entity, directly or indirectly.
The broader package also targets Zarubezhneft and INK-Capital (two Russian oil companies), 12 shadow fleet tankers, and 17 entities and individuals involved in supplying Common High Priority goods to Russia's military-industrial base. The UK government's public statement was unambiguous: "The message is simple: if you help Russia fund or equip this war, you will face the consequences."
Why the Crypto Designations Stand Out
What makes today's crypto listings unusual is the depth of the underlying intelligence. Two of the five crypto and payments entities had been assessed by blockchain analytics researchers just days or weeks before the FCDO acted, with the findings pointing squarely at shared infrastructure, common personnel, and direct fund flows to the A7 network, a Kremlin-linked sanctions evasion structure that reportedly moved more than USD 90 billion in a single year. That sequence, from analytical assessment to formal designation, compressed into days, signals a tighter feedback loop between on-chain intelligence and government enforcement than the industry has seen before.
Cryptomus and Heleket: One Corporate Entity, Two Brand Faces
The UK designated Xeltox Enterprises Ltd, a company registered in British Columbia, Canada, for supporting the Russian financial services sector through its ownership of Cryptomus and its activities linked to and continued via Heleket. Critically, Cryptomus and Heleket are listed as name variations of a single designated entity, not as two separate listings. That distinction matters enormously for compliance screening: blocking only one brand while continuing to transact with the other would not satisfy UK sanctions obligations.
The Canada Connection and the FINTRAC Penalty
Xeltox's regulatory history adds further context. In October 2025, Canada's Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) imposed a penalty of almost CAD 177 million on Xeltox Enterprises Ltd for violations of Canada's anti-money laundering and terrorist financing legislation. Xeltox is appealing that penalty. The UK designation therefore follows a significant Canadian enforcement action against the same corporate parent, reinforcing the view that regulators across multiple jurisdictions have been tracking this entity for some time.
How Heleket Emerged After KYC Controls Hit Cryptomus
The operational link between the two brands follows a recognisable pattern. Heleket launched in January 2025, the same month that Cryptomus introduced mandatory know your customer controls. In the months that followed, Cryptomus's monthly on-chain volume fell from USD 153 million in January 2025 to USD 86 million in March 2025, while Heleket's volume rose. Blockchain analysis found the two services share infrastructure, branding, personnel, and a 0.4% processing fee, with Garantex providing early liquidity to both. Cybercrime actors, including vendors of child sexual abuse material, were observed migrating from Cryptomus to Heleket during this period.
The scale of illicit exposure is significant. In 2025, 0.6% of Heleket's incoming volume was assessed as illicit, nearly five times the average for payment service providers. Sanctions-related entities, primarily Garantex, accounted for 60% of that illicit inflow. As of April 2026, Cryptomus had received USD 1.86 billion and sent USD 1.63 billion on-chain, with Garantex as its largest sanctioned counterparty: USD 204 million received and USD 101 million sent. As of October 2026, Heleket had transacted over USD 2.89 billion, with Rapira (itself designated by the UK on 26 May 2026) as its largest sanctioned counterparty.
TokenSpot: A Front for Grinex, Which Is Itself a Rebranded Garantex
TokenSpot is a crypto exchange based in Bishkek, Kyrgyzstan. The UK designated it for supporting the Russian financial services sector. Blockchain analysis assessed with high confidence, just two days before the FCDO acted, that TokenSpot and Grinex share wallet infrastructure and function as parts of the same operation. OFAC had designated Grinex on 14 August 2025, and the UK designated Grinex LLC on 20 August 2025. Grinex itself had previously been assessed as a likely rebrand of Garantex, which the UK first designated on 4 May 2022.
The On-Chain Evidence Linking TokenSpot to Grinex
The technical evidence is unusually specific. After an April 2026 hack, Grinex publicly listed as its own an aggregator address that had collected USD 146.3 million from 126 TokenSpot deposit addresses. Six TRON addresses are attributed to both exchanges, and a single address collects leftover TRX fee balances from both platforms. When Grinex announced a "technical break" on 15 April 2026, TokenSpot told its customers it was carrying out "technical work" just 25 minutes later.
The transaction volumes are material. Between December 2023 and late September 2026, TokenSpot's TRON addresses received USD 3.54 billion and sent USD 3.14 billion. The A7 network is its largest external counterparty: TokenSpot sent A7 USD 679.5 million and received USD 48.5 million from it. TokenSpot also sent USD 26.5 million directly to the A7A5 token. After the UK designated Garantex and Grinex, TokenSpot continued to transact with both, sending USD 269.2 million and receiving USD 285.7 million.
Tsunami Payments and Processing KG: The Kyrgyz Payment Layer
Two Kyrgyz payment companies complete today's crypto-adjacent designations.
Tsunami Payments
Tsunami Payments is designated for supporting the Russian financial services sector. Its UK Sanctions List entry gives an address of Office 402, Tower B, 125/1 Toktogul Street, Bishkek. TokenSpot's listing gives Office 1006 in the same building, a co-location that compliance teams should note when mapping network exposure. According to public records cited by Kyrgyz media in June 2024, Melis Batyrbekovich Umarhodjaev was director of both TokenSpot and Tsunami Payments at that time, though the relevant Kyrgyz registry no longer listed him as of September 2026.
Processing KG and the VexPay Connection
Processing KG is an open joint-stock company in Bishkek designated for carrying on business of economic significance to the Russian government. Its UK Sanctions List entry names the Kyrgyz Ministry of Finance as its parent company and lists two websites: processing-kg.com and vexpay.net. The UK also designated Ulan Arymbaevich Bukabaev, Processing KG's director. Reporting published by the Financial Times in early October 2026 described VexPay as a payment system that A7 representatives presented to Kyrgyz authorities in 2025 as an alternative to SWIFT. The designation of a firm whose stated parent is a sovereign ministry underscores how deeply embedded this evasion network has become in Kyrgyz financial infrastructure.
How This Fits the Broader Enforcement Sequence
Today's action is not an isolated event. It continues a coordinated, multi-jurisdiction enforcement campaign against what appears to be a single interconnected network. The UK designated Garantex in May 2022. Grinex was designated by both OFAC and the FCDO in August 2025. On 26 May 2026, the UK designated 18 entities including Huobi Global (HTX), Exmo, Bitpapa, Rapira, and A7 network infrastructure. Each wave has reached deeper into the operational layers supporting Russian sanctions evasion, moving from the primary exchange to its rebrands, its feeder platforms, and now its Kyrgyz payment processing infrastructure.
For compliance professionals, the pattern suggests further designations are likely as investigators follow the remaining transaction flows. Firms that map their exposure only to today's listed entities, without considering what successor services may emerge, are likely to find themselves behind the curve again within months. Reviewing our earlier analysis of Japan's designation of Garantex and what it means for compliance teams provides useful context on how the Garantex network has been pursued across jurisdictions.
Practical Steps for Accounting Firms and CFOs
The legal and operational response to today's designations has several distinct components. Firms using crypto bookkeeping software or digital asset accounting software should ensure their sanctions screening workflows are capable of catching brand variants and parent-subsidiary relationships, not just exact entity name matches.
Immediate Screening Actions
Screen for both Cryptomus and Heleket as a single designated entity under Xeltox Enterprises Ltd. Any transaction counterparty checks that covered Cryptomus but not Heleket (or vice versa) are now incomplete. Re-run wallet address screening against TokenSpot deposit addresses alongside any existing Grinex exposure checks, given the shared infrastructure finding. Flag and freeze any identified assets pending legal review, and document the screening decision with a timestamp for your AML file.
Counterparty and Client File Reviews
For accounting firms advising clients with digital asset holdings or crypto treasury positions, today's designations are a trigger for a targeted counterparty review. Clients who have used Cryptomus as a payment processor, held accounts on Heleket, or traded on TokenSpot may have frozen or legally restricted assets. The obligation to report to the Office of Financial Sanctions Implementation (OFSI) and, where relevant, to FINTRAC in Canada arises as soon as a firm knows or reasonably suspects a sanctions breach, not only after a formal determination. Understanding AML red flags from crypto bridge hacks every compliance team should know is also relevant here, as the TokenSpot-Grinex shared infrastructure pattern resembles techniques seen in bridge-related laundering cases.
Ongoing Monitoring
Given the history of this network spawning successor services after each designation (Garantex to Grinex, Cryptomus operating alongside Heleket), compliance teams should establish a monitoring trigger for any new exchange or payment processor that shares infrastructure, personnel, fee structures, or website characteristics with today's designated entities. The 0.4% processing fee shared by Cryptomus and Heleket, the shared Bishkek office building, and the co-director of TokenSpot and Tsunami Payments are all indicators that can be used to identify successor entities before they receive a formal designation.
Source: TRM Labs
Frequently Asked Questions
Are Cryptomus and Heleket treated as separate designations?
No. The UK listed them as name variations of a single designated entity, Xeltox Enterprises Ltd. UK sanctions obligations apply to both brands under one listing. Screening only one brand does not satisfy your legal obligations.
Does today's UK action affect firms outside the UK?
Directly, the asset-freeze and transaction-prohibition obligations bind UK persons and UK-regulated activities. However, given that OFAC has already designated Grinex and that FINTRAC imposed a substantial penalty on Xeltox, firms in the US and Canada face overlapping obligations from their own regulators. Global firms should treat this as a multi-jurisdiction alert and check domestic sanctions lists in each relevant country.
What should a firm do if it finds existing exposure to TokenSpot or Cryptomus?
Freeze the relevant assets immediately and seek legal advice before taking any further action. Report to OFSI (in the UK) or the relevant authority in your jurisdiction as soon as reasonably practicable. Document every step of the discovery and response process with timestamps.
Why does the Kyrgyz Ministry of Finance appearing as a parent of Processing KG matter?
It means a sovereign entity is named in the UK Sanctions List as the parent of a designated company. That raises the legal and reputational stakes significantly for any financial institution or accounting firm with Kyrgyz government-linked counterparties. It also signals that the network's infrastructure has been embedded in official financial structures, which may complicate successor-entity identification.
How should crypto bookkeeping software handle multi-brand sanctioned entities?
Your screening workflow needs to match on all known operating names, domain names, wallet addresses, and corporate parent names, not just the legal entity name that appears on the sanctions list. Today's action is a clear prompt to audit whether your current digital asset accounting software and manual procedures can catch parent-subsidiary and brand-variant matches reliably.