UK Sanctions Cryptomus and TokenSpot Over Russia Evasion Links

The UK government has sanctioned three cryptocurrency exchanges and several payment platforms, accusing them of helping Russia sidestep Western financial restrictions. The action, which forms part of a package of 38 new designations, targets entities allegedly connected to the Kremlin-backed A7 network and its ruble-pegged A7A5 stablecoin. For accounting firms, auditors, and CFOs with digital asset exposure, the designations are not a distant regulatory headline: they create concrete, immediate obligations under UK sanctions law.

What the UK Has Done and Who Is Named

The UK Foreign Office announced the designations as part of a broader package tied to Russia's ongoing war in Ukraine. The full list of 38 designations spans several sectors, but the crypto and payment-platform elements are the most directly relevant to financial professionals working in digital assets.

The designated exchanges and platforms

The entities named in the crypto and payments portion of the package are:

• Xeltox Enterprises, the Canadian-registered company behind the crypto exchanges Cryptomus, Heleket, and Certa Payments
• TokenSpot, a Kyrgyzstan-based crypto exchange
• Processing KG, which operates the payment service VexPay
• Tsunami Payments, another payment platform
• Ulan Bukabaev, a director of Processing KG, designated individually

The UK government states that two of these businesses processed or facilitated transactions involving A7, a Kremlin-linked network that issues the A7A5 stablecoin, a ruble-pegged token that UK authorities allege is used to circumvent restrictions on Russia's financial sector. According to the government's own statement, A7 claimed last year to have moved more than $90 billion.

The wider package context

Beyond crypto, the same package covers Russian oil producers Zaribezjmeft and INK Capita, 12 shadow-fleet tankers, and suppliers of machinery, electronics, and components that UK authorities say feed into Russia's missile and drone production. The crypto designations are therefore one strand of a coordinated, multi-sector enforcement effort, not an isolated fintech action.

The A7A5 Stablecoin: Why It Matters for Compliance Teams

The A7A5 stablecoin sits at the centre of this enforcement wave, and understanding its alleged role is critical for any firm assessing counterparty risk in digital asset portfolios.

How the network allegedly operates

A7 is described by UK authorities as a Kremlin-backed network. Its A7A5 token is pegged to the ruble and, according to the UK's position, designed to move value across borders in a way that sidesteps the correspondent banking restrictions imposed on Russia since 2022. The UK government's designation documentation links two of the newly sanctioned businesses directly to transaction flows through this network.

Prior enforcement actions on the same network

This is not the first time Western regulators have moved against infrastructure connected to A7. UK authorities had previously sanctioned Grinex and Garantex, two exchanges that had also been tied to the broader Russia sanctions-evasion ecosystem. The EU moved against 14 crypto companies in a July package that included four designations specifically related to the cross-border A7 network. The new UK action deliberately extends scrutiny beyond those earlier targets, reaching into payment processors and exchange operators that had not previously been named. Firms should treat this as a signal that the UK and EU are widening their enforcement perimeter, not merely repeating prior actions. For a closer look at how the EU's earlier Russia-linked crypto designations fit into the wider anti-corruption push, see our coverage of the EU lawmakers' crypto and anti-corruption strategy.

Legal Effect of UK Designations

Under the UK's sanctions regime, designation has precise and immediate legal consequences. Getting these right is not optional.

Asset freezes

Any assets held by the named entities within UK jurisdiction are frozen with immediate effect. UK persons and businesses are prohibited from making those assets available, directly or indirectly, to the designated parties. For a custodian, exchange, or payment processor that has accounts or wallet balances connected to any of the named entities, the freeze obligation applies the moment the designation is published.

Payment prohibitions

UK financial institutions, including e-money institutions and crypto asset firms registered with the FCA, are barred from processing payments to, from, or through the designated entities. This prohibition extends to indirect flows: routing a payment through an intermediary that then transacts with a sanctioned party can itself constitute a breach. Compliance officers at firms using automated payment rails that touch Kyrgyzstan-based or Canada-registered counterparties should review those pipelines now.

Reporting obligations

UK-regulated firms that hold or control funds belonging to a designated person are required to report that fact to the Office of Financial Sanctions Implementation (OFSI). Failure to report is itself a criminal offence, separate from the substantive breach of making funds available. The reporting deadline is not deferred by uncertainty: if there is a reasonable belief that assets are held, the report must be made.

Accounting and Audit Implications

For accounting practices and finance teams advising digital asset businesses, the designations create several distinct areas of work that need attention in parallel.

Client and counterparty screening

Any firm using crypto accounting software to manage client portfolios or consolidate digital asset transactions should run an immediate screen of active counterparties against the OFSI consolidated list, now updated to include the newly designated entities. This is not a box-tick: the screen needs to cover wallet addresses, entity names, registered company numbers, and named individuals (including Ulan Bukabaev). Where automated screening tools flag a potential match, the standard is reasonable grounds for belief, not certainty, before a freeze obligation kicks in.

Transaction history review

If any historical transactions in a client's ledger route through Cryptomus, Heleket, Certa Payments, TokenSpot, VexPay, or Tsunami Payments, those transactions warrant a closer look. For audit purposes, the relevant question is whether the client was dealing with a sanctioned entity at the time of the transaction, though the designation is prospective, prior dealings do not automatically create a breach. What matters is whether there are ongoing obligations, balances, or open positions that now need to be frozen or reported.

Financial statement disclosures

Where a client holds assets on any of the designated platforms that are now frozen, those balances may need to be reclassified in the financial statements. A frozen balance is not freely accessible and may not meet the definition of cash or a liquid asset depending on the applicable accounting framework. Under IFRS, this could affect classification, impairment assessment, and disclosures around significant judgements. CFOs should discuss the treatment with their auditors without delay rather than waiting for the year-end process.

Digital asset accounting software audit trails

Any digital asset accounting software used to record client transactions should be capable of flagging counterparties against sanctions lists and producing an audit trail of when that screening occurred and what the result was. Regulators and auditors will increasingly expect this as a baseline control, not an enhancement. If a firm's current tooling cannot produce this evidence, the gap needs to be addressed as a priority.

What Firms Should Do Right Now

The following steps are not a complete compliance programme, but they represent the minimum immediate response to this designation package.

Immediate actions

First, update your sanctions screening lists to include all newly designated entities and Ulan Bukabaev. OFSI publishes the consolidated list and it should be the authoritative source your screening draws from, not third-party summaries that may lag. Second, run a retrospective screen of all active client accounts and counterparty relationships against the new names. Third, if any match is identified, freeze the relevant assets immediately and take legal advice on your OFSI reporting obligation. Fourth, document every step of this process with timestamps: the date of the screen, the parameters used, the result, and the action taken. That documentation is your defence in any subsequent supervisory review.

Medium-term compliance hygiene

The broadening of UK and EU sanctions to cover payment processors and exchange operators beyond the headline names signals that the regulatory perimeter is moving outward. Firms should review their onboarding procedures for clients who use or have used any of the newly designated platforms, even if the client itself is not designated. The connection to a sanctioned entity is a risk factor that warrants enhanced due diligence, regardless of whether it creates a legal freeze obligation on its own. For additional context on how similar enforcement has played out in another jurisdiction, our analysis of Japan's Garantex sanctions and what they mean for compliance teams covers the parallel action taken by Japanese authorities.

The Broader Enforcement Trajectory

Taken alongside the EU's July package targeting 14 crypto companies and four A7-related entities, this UK action confirms a coordinated, multi-jurisdictional approach to crypto sanctions enforcement. The pattern is consistent: regulators identify a network, sanction its most visible nodes (exchanges), then extend to the payment infrastructure that sustains the network (processors, stablecoin issuers, named individuals).

For firms operating in crypto accounting, custody, or advisory roles, the lesson is straightforward. The enforcement perimeter is not static. An entity that was not on a sanctions list six months ago may be on it today, and the firm that processed transactions on behalf of a client dealing with that entity may face difficult questions from its regulator. Robust, frequent, and well-documented screening is the only reliable defence. Firms that rely on annual or quarterly sanctions reviews rather than continuous or event-triggered screening are operating with a material compliance gap that these designations make more visible.

The UK's use of individual designations, naming a director of Processing KG alongside the corporate entities, also signals that personal liability is part of the enforcement toolkit. Compliance officers and senior managers at UK-regulated crypto asset firms should be aware that their own conduct in responding to, or failing to respond to, these designations is subject to regulatory scrutiny.

Source: CoinDesk Policy

Frequently Asked Questions

Which entities did the UK sanction in this package?

The UK designated Xeltox Enterprises (the Canadian company behind Cryptomus, Heleket, and Certa Payments), TokenSpot, Processing KG (operator of VexPay), Tsunami Payments, and Ulan Bukabaev, a director of Processing KG. These designations are part of a wider 38-entity package also covering Russian oil producers, shadow-fleet tankers, and military supply networks.

What is A7A5 and why is it relevant to sanctions compliance?

A7A5 is a ruble-pegged stablecoin issued by the Kremlin-backed A7 network. UK authorities allege it is used to move value across borders in a way that bypasses restrictions on Russia's financial sector. Two of the newly designated businesses are accused of processing transactions through this network. Any firm whose clients hold or have transacted in A7A5 should treat that as a high-risk indicator requiring enhanced due diligence.

What must a UK-regulated firm do if it holds assets belonging to a designated entity?

The firm must freeze those assets immediately and report the holding to OFSI. Making assets available, directly or indirectly, to a designated party is a criminal offence under the UK's sanctions legislation. The reporting obligation arises from reasonable grounds for belief, not certainty, so firms should not wait for a definitive match before acting.

How should accounting firms update their crypto bookkeeping software workflows in response?

Firms should ensure their crypto bookkeeping software or digital asset accounting software can screen counterparty data against the OFSI consolidated list and generate a timestamped audit trail. Any transaction history touching the newly designated platforms should be flagged for review. Where frozen balances exist on client accounts, the accounting treatment, particularly the classification and disclosure under IFRS or UK GAAP, should be discussed with the client's auditors promptly.

Does a client's past use of Cryptomus or TokenSpot automatically mean a breach?

Not automatically. Sanctions designations are prospective: transactions completed before the designation date do not constitute a retrospective breach. However, any ongoing balance, open position, or future transaction with the designated entity after the designation date would. Past use is nonetheless a risk factor that warrants enhanced due diligence on the client relationship and a review of whether any residual exposure remains.