UK Sanctions Cryptomus, Heleket and TokenSpot for Russia Links
On 8 October 2026, the UK's Foreign, Commonwealth and Development Office (FCDO) designated 38 entities for financing Russia's wartime economy, propping up its military-industrial base, and facilitating sanctions evasion. Three of those designations land squarely in the crypto sector: payment processors Cryptomus and Heleket, both operating under parent company Xeltox Enterprises Ltd., and Kyrgyzstani exchange TokenSpot CJSC. For any accounting firm, auditor, or CFO running crypto accounting software with exposure to these services, the compliance clock started ticking the moment the FCDO published the list.
What the FCDO Designated and Why It Matters
The October 2026 package is one of the broadest UK sanctions actions targeting Russia's financing infrastructure to date. Beyond the three crypto entities, it covers Russian oil companies Zarubezhneft and INK Capital, the bank Stolichny Kredit, twelve shadow fleet tankers, and seventeen individuals and entities tied to the import of machine tools, electronics, and materials used in ballistic missile and drone production. The FCDO's coverage of Russia's oil sector now exceeds 90% of total production capacity by the department's own reckoning.
The crypto designations, however, carry particular weight for financial professionals because they target services that presented themselves as ordinary payment processors rather than as mixing or obfuscation tools. That distinction has direct implications for how firms assess counterparty risk.
Cryptomus and Heleket: Scale of Illicit Exposure
Blockchain analytics work done prior to the designations shows that Cryptomus and Heleket together received funds from more than 15,000 distinct illicit actors spanning every tracked category of criminal activity: scam operators, fraud shops, ransomware groups including Black Basta, illicit dark-web marketplaces, and organised criminal networks. Proceeds from the $1.4 billion Bybit exploit attributed to North Korea's Lazarus Group reached both services indirectly.
The scale is striking in comparative terms. Across five key illicit categories, namely scams, sanctioned jurisdictions, escort services, terrorist financing, and related activity, Cryptomus and Heleket together received more funds from illicit actors than all tracked crypto mixer services combined. Mixers are purpose-built to obscure transaction origins; these two processors were nominally legitimate payment rails. The fact that they exceeded mixers in aggregate illicit receipt across those categories points to a structural compliance failure, not incidental misuse.
In late 2025, the number of illicit counterparties using the two services surged to more than 900 in a single month. Part of that spike is attributable to the earlier takedown of Russian crypto exchange Garantex: on-chain data confirms that many users held simultaneous accounts on Garantex and on Cryptomus or Heleket, strongly suggesting a migration of activity after Garantex was sanctioned. Part of the count also reflects a technical reality in sanctions analytics: when an entity is newly designated, its historical transactions begin registering against a service's illicit-counterparty tally even if those transactions occurred months or years earlier.
Advertising on Criminal Forums
Cryptomus actively marketed itself on dark-web forums, including BHF, a Russian-language cybercrime forum, and Nulled, which at its peak had more than ten million users. The advertisements, originally in Russian, promoted anonymous crypto payments and conversion without KYC or KYB requirements, explicitly targeting users who wanted to operate outside standard financial controls. That marketing posture is relevant to any firm conducting a retrospective counterparty review: use of these services was not simply accidental exposure, it was in many cases deliberate.
In October 2025, Canada's financial intelligence unit imposed a record CAD 177 million penalty on Cryptomus for AML and counter-terrorist financing violations, a penalty that predates the UK designation by roughly a year. The combination of that regulatory action, the dark-web advertising record, and the on-chain data constitutes a substantial body of pre-designation red flags that compliance teams should assess when reviewing their own transaction histories.
TokenSpot and the Kyrgyzstan Sanctions Evasion Network
TokenSpot sits within a broader cluster of Kyrgyzstan-based exchanges already sanctioned for facilitating Russian sanctions evasion. The network's architecture is becoming clearer with each successive designation.
Shared Infrastructure and Common Operators
A side-by-side comparison of TokenSpot's website with that of Meer.kg, which Canada's OSFI sanctioned in August 2025 for facilitating A7A5 token trades, reveals near-identical layouts, visual assets, and value propositions. Both are Russian-language crypto-fiat exchanges. Meer marketed itself as a cryptocurrency exchange for crypto-fiat pairs; TokenSpot advertised cryptocurrency services for business growth, with ruble-denominated purchases available to both individuals and legal entities. The shared design template is consistent with common operators or shared infrastructure behind both services.
Convergence at a Single HTX Deposit Address
On-chain tracing shows funds from TokenSpot, Grinex, and Meer converging on the same HTX deposit address, which received more than $308 million. The graph also reveals connections to addresses linked to AnyKey LLC, a company affiliated with the A7A5 instant swapper. That swapper allows users to exchange ruble-backed A7A5 tokens for dollar-backed stablecoins, a mechanism well suited to moving value across sanctions boundaries. HTX, formerly known as Huobi, was itself sanctioned by the UK in May 2026 for channelling more than $1.5 billion to Russia through flows from previously sanctioned entities.
The convergence point matters practically: it means that firms with historical exposure to any one of these Kyrgyzstani exchanges may have downstream connectivity to the same sanctioned deposit infrastructure. A narrow counterparty check limited to direct relationships is unlikely to surface that risk.
Accounting and Crypto Bookkeeping Implications
For accounting firms and corporate treasury functions using digital asset accounting software, these designations generate obligations across several dimensions.
Immediate Asset Freeze and Reporting Duties
Under the Russia (Sanctions) (EU Exit) Regulations 2019, as amended, any UK person or entity with funds or economic resources belonging to, held by, or controlled by a designated person must freeze those assets immediately and report to the Office of Financial Sanctions Implementation (OFSI). There is no de minimis threshold. A firm holding crypto received from or transiting through Cryptomus, Heleket, or TokenSpot needs to determine whether those assets are caught by the freeze requirement and, if so, report without delay. Late or incomplete reporting carries civil and criminal penalties.
Retrospective Transaction Review
The pre-designation on-chain data establishes that illicit activity at these processors stretches back to at least 2022 and accelerated through 2025. Firms should run a retrospective screen of crypto transaction histories against the newly designated names and, critically, against the associated addresses identified in analytical datasets. Good crypto bookkeeping software should allow export of transaction data by counterparty address for exactly this purpose. Where records are incomplete or addresses are not tagged in existing systems, engaging a blockchain analytics provider to conduct address-level tracing is a reasonable next step.
EU Sanctions Exposure and MiCA-Era CASP Obligations
The FCDO noted that Cryptomus and Heleket already had exposure to EU sanctions packages prior to the UK designation, meaning some transactions with these services may have breached EU law before 8 October 2026. Crypto-asset service providers operating under MiCA, and those preparing for MiCA authorisation, should factor that pre-designation EU exposure into their compliance assessments. The EU's travel rule and transaction monitoring requirements make it increasingly difficult to claim ignorance of counterparty sanctions status at the time of settlement. You can read more about how EU lawmakers are embedding crypto in the anti-corruption strategy for broader context on the regulatory direction of travel.
Correspondent and Banking Relationship Risk
Firms that processed payments on behalf of clients using these services, or that received fiat settlement derived from crypto liquidated through them, face potential correspondent banking risk. Banks with AML programmes that identify crypto-linked fiat flows may de-risk accounts associated with such activity. Proactive disclosure to banking partners, supported by documented transaction tracing, is preferable to reactive account closure.
The Wider Sanctions Package: Crypto Financing Military Procurement
The FCDO's inclusion of machine tool importers and drone component suppliers alongside crypto processors is not coincidental. Analytical work has traced how drone procurement networks backed by Russian state actors used open crowdfunding and crypto payment channels to source components. The October 2026 package reinforces that crypto is now treated as a financing layer within Russia's military-industrial complex, not merely as a vehicle for financial crime. That framing has implications for how firms classify sanctions risk in their digital asset portfolios: exposure to Russian-linked crypto flows is increasingly treated as a potential national security matter, not only a financial crime matter.
The Garantex precedent is instructive here. After its designation, a portion of its user base migrated to Cryptomus and Heleket. The pattern suggests that each successive takedown displaces activity rather than eliminating it, and that the network of compliant-presenting but laxly controlled payment processors serving this demand remains large. Firms should monitor future designations carefully. For background on how the Garantex action played out across jurisdictions, see our earlier analysis of Japan's Garantex sanctions and what firms need to know.
Practical Steps for Compliance Teams
The following table summarises the key obligations triggered by the UK designations and the teams most directly responsible for each.
| Obligation | Trigger | Responsible Team |
|---|---|---|
| Asset freeze | Any crypto or fiat held for or controlled by designated entities | Treasury / Compliance |
| OFSI report | Knowledge or reasonable cause to suspect a frozen asset | MLRO / Legal |
| Retrospective address screening | Historical transactions with Cryptomus, Heleket, TokenSpot or associated addresses | Crypto Accounting / AML |
| Client notification | Where client funds are affected by the freeze | Client-facing teams / Legal |
| Banking partner disclosure | Fiat flows derived from sanctioned crypto processors | CFO / Treasurer |
Firms that have not yet mapped their crypto transaction histories to a structured digital asset accounting software workflow should treat this designation package as the prompt to do so. The volume and breadth of illicit counterparties involved here means that coincidental exposure is plausible even for firms with conservative on-chain activity.
Source: Chainalysis
Frequently Asked Questions
What does the UK designation of Cryptomus, Heleket and TokenSpot mean in practice?
It means that any UK person or entity must immediately freeze funds or economic resources belonging to or controlled by those three entities and report the freeze to OFSI. Transacting with them without an OFSI licence is a criminal offence under UK sanctions law.
Our firm used Cryptomus for client crypto payment processing before the designation. Are we liable?
Liability for pre-designation transactions depends on knowledge and intent at the time. However, firms should document their position thoroughly, run a retrospective transaction screen, and take legal advice. OFSI has civil enforcement powers that apply even where criminal intent is absent.
How should we screen for exposure to TokenSpot's network given its links to Grinex, Meer and HTX?
Direct name screening is insufficient. You need address-level tracing that maps your historical wallet interactions against the on-chain cluster identified by analytical work: TokenSpot, Grinex, Meer, the A7A5 swapper addresses, AnyKey LLC-linked wallets, and the HTX deposit address that received more than $308 million. Blockchain analytics tools capable of cluster analysis are the appropriate instrument.
Does the designation affect EU-regulated CASPs, not just UK firms?
The UK designation is a UK legal instrument, but the FCDO noted that Cryptomus and Heleket already had EU sanctions package exposure before 8 October 2026. EU-regulated CASPs may therefore face separate obligations under EU sanctions regulations for pre-designation transactions and should review their own regulatory position independently.
How do these designations interact with MiCA travel rule requirements?
MiCA's travel rule requires CASPs to obtain, hold, and transmit originator and beneficiary information for crypto-asset transfers. Where a transfer involved a sanctioned counterparty, a missing or falsified travel rule record compounds the compliance failure. Firms should ensure their travel rule data is complete and accurate for any transactions touching these services.