Cryptomus Sanctions 2026: What Merchants Must Do Now

If you take crypto payments through Cryptomus or Heleket, assume that rail is finished. On 8 October 2026 the UK designated Xeltox Enterprises Ltd, the Vancouver company behind both brands, under its Russia sanctions regime. The listing names Cryptomus, Heleket and Certa Payments Ltd as the same target and comes with an asset freeze and a ban on UK banks and payment firms processing payments for it. Any exchange, OTC desk, EMI or bank that screens properly will now treat money that came through those gateways as sanctions exposure, whether or not you have any UK connection.

What to do this week: stop sending new volume through either brand, export every settlement and withdrawal record while you still can, build a source-of-funds file for anything that came through them, and move to a gateway whose licence you have checked on a public register. Don't move to a "new" brand that runs on the same infrastructure. Heleket launched as exactly that, and it is now on the same listing as Cryptomus.

Below: what the UK listed, who is bound, why the funds get flagged, the file to prepare, stuck balances and how to pick a replacement. This is not legal advice. If you or your company has any UK connection, take sanctions advice before you touch a balance held with these firms.

What the UK designated on 8 October 2026

The FCDO added 38 names to the UK Sanctions List that day under the Russia (Sanctions) (EU Exit) Regulations 2019, including three crypto exchanges and two payment platforms. The government says two of them processed transactions for A7, the Kremlin-backed network it says is used to get around sanctions. It did not say which two.

The crypto and payment entries, as published in the UK Sanctions Notice:

Each of these carries the same set of measures: an asset freeze, trust-services sanctions, a director-disqualification sanction, internet-services sanctions (social media, internet access and app store providers must take reasonable steps to stop UK users reaching their content), and the correspondent-banking and payment-processing prohibitions. No general licence was issued for the crypto platforms. The licence published the same day covers a Russian oil company, not these firms.

Three details matter for merchants:

• The listing names the operator, not only the brands. Screening tools that matched on "Cryptomus" alone would miss Heleket. The notice ties both to one legal entity, with its British Columbia registration number, Canadian business number, websites and support email.
• No wallet addresses were published. Address-list screening flags nothing. Exposure gets picked up through blockchain analytics firms attributing addresses to the entity. One vendor, Scorechain, says it attributes more than 120,000 addresses to the two gateways.
• The UK Sanctions List is now the only UK source. Since 28 January 2026 the old OFSI Consolidated List no longer updates. If your compliance tool or your provider still reads it, it is out of date.

Who is legally bound, and who is affected anyway

UK financial sanctions bind anyone in the UK and UK nationals and UK-incorporated companies wherever they operate. For them, dealing with Xeltox's funds, or making funds available to it, is prohibited from 8 October. Since June 2022 OFSI can impose civil penalties on a strict-liability basis: it doesn't have to prove you knew. The maximum is £1 million or 50% of the value of the breach, whichever is higher.

With no UK nexus, the UK rules don't bind you directly. You're still affected:

1. Your counterparties follow the list anyway. Most large exchanges, OTC desks and EU banks screen against UK, EU and US lists as policy, so a UK-only listing still closes doors.
2. UK crypto firms must report. Since August 2022, UK-registered exchanges and custodian wallet providers are "relevant firms" for sanctions reporting. They have to report to OFSI when they know or have reasonable cause to suspect they have dealt with a designated person. OFSI's July 2025 crypto threat assessment asks for addresses, transaction hashes, amounts and the route of indirect transfers. Your deposit can become part of that report.
3. The history was already bad. In October 2025 Canada's FINTRAC fined Xeltox C$176,960,190 for 2,593 contraventions, including 1,068 unreported suspicious transactions in July 2024 alone and a failure to apply Canada's ministerial directive on Iran. Xeltox has appealed.

As of mid-October 2026 we found no EU or OFAC designation of Xeltox, Cryptomus or Heleket. Check that yourself on the EU sanctions map and OFAC's search before relying on it. The EU's 21st Russia package, adopted on 23 July 2026, already listed 14 crypto-related entities outside Russia, including Rapira (named by TRM Labs as Heleket's largest sanctioned counterparty), and created a power to ban dealings with crypto providers established in a listed third country.

Why your exchange or bank will flag funds that touched Cryptomus

Blockchain analytics firms didn't wait for the UK. TRM Labs assesses with high confidence that Heleket, launched in January 2025, is operationally linked to Cryptomus, sharing infrastructure, branding, staff and the same 0.4% fee, and that Garantex supplied early liquidity to both. Chainalysis says the two together received more illicit funds across its tracked categories than all the mixers in its dataset combined.

So when your incoming USDT is traced back, the trail now ends at a designated entity. What to expect depends on who receives the funds:

• UK-regulated exchange or EMI: freeze, report to OFSI, possibly file a suspicious activity report with the NCA. You may not be told why.
• EU CASP or bank: hold the deposit and send a request for information, possibly followed by an exit, which is the same pattern we cover in business bank account frozen.
• Non-UK OTC desk: many will refuse the trade outright rather than take the risk.

Timing matters. Funds received before 8 October are a source-of-funds question you can answer with records. Anything after 8 October looks very different to a compliance officer.

Several of OFSI's red flags for crypto firms describe the typical Cryptomus merchant: exposure to services without KYC, many small transfers adding up to large volumes, and activity spiking right after a sanctions announcement. A rushed batch of withdrawals after the listing ticks that last box.

The first seven days: what to do

1. Stop new volume. Remove the Cryptomus or Heleket checkout, payment links and payout API keys from every site, funnel and affiliate dashboard. Don't leave it as a hidden fallback.
2. Export everything. Download the full transaction history, settlement reports, invoices, payout records and any KYB correspondence. Krebs on Security reported that Cryptomus's support bot was telling users it couldn't process transactions on 8 October. Dashboards can disappear without notice.
3. Map where the money went. For every withdrawal, record the receiving address, the transaction hash, the exchange or desk it landed on and what happened to it next (sold, sent to a bank, still held).
4. Check your UK nexus. UK directors, a UK company anywhere in the group, UK staff running the account or UK bank accounts receiving the proceeds all change your position. If any apply, talk to a sanctions lawyer before acting on any balance.
5. Tell your providers before they find it. A short, factual note to your exchange or bank's compliance team, with the file below attached, gets a better hearing than an answer to an RFI after a freeze.
6. Line up the replacement. Onboarding takes days to weeks. Start now, so you aren't tempted to grab whatever is quickest.

The source-of-funds file to prepare

Banks and exchanges won't take "it was customer payments" on trust. Build one file per entity that received money through Cryptomus or Heleket:

Keep it factual, with no rounded numbers or gaps, and describe the business exactly as your bank already has it on file. A mismatch with your KYB profile is a bigger problem than the gateway exposure. For the general mechanics of turning crypto receipts into bankable fiat, see our guide to USDT to fiat without bank rejections.

Balances still sitting with Cryptomus or Heleket

This is the part to take advice on, not guess.

If you have a UK nexus, money held by a designated person is frozen. Asking Xeltox to pay you out, or accepting the payment, is dealing with frozen funds, and OFSI's licensing system is the lawful route. Licence grounds exist for some situations, but they are narrow and slow, and a sanctions lawyer should assess whether your case fits one. Don't use a non-UK colleague, an affiliate or a third-party wallet to collect it for you. That is circumvention, a criminal offence in its own right.

If you have no UK nexus, UK law doesn't freeze your claim. Practically, though, any payout you get from the gateway after 8 October arrives as funds from a designated entity. Expect the receiving exchange to hold it and ask questions, and expect some to return or freeze it. Record any payout separately in your file, with the date and the full trail, and be ready to explain it.

Either way, plan cash flow as if the balance is unavailable for months.

Why switching to a rebrand on the same rails doesn't work

The Heleket story is the lesson. TRM Labs reports that Cryptomus introduced mandatory KYC in February 2025, the month after Heleket launched, and that Heleket continued no-KYC processing. Any merchant who moved to Heleket to keep no-KYC processing ended up on the same sanctions listing 21 months later.

UK, EU and US sanctions all reach entities owned or controlled by a designated person, not only the names on the list. A gateway with new branding but the same owners, the same wallets, the same liquidity sources or the same staff is, for screening purposes, the same counterparty. Blockchain analytics firms attribute new deposit addresses to known entities as they appear. The new brand gets flagged, and your funds with it.

Before you use any gateway, ask it to name its operating entity, licence and regulator, and who provides its liquidity and fiat settlement. If it onboards you in minutes with no KYB, it is selling exactly the feature that gets money frozen.

How to choose a licensed replacement gateway

You want a licence for the service you use, in the market where you're served, on a public register:

Then check:

• Match the licence to the activity. An exchange or broker-dealer licence doesn't automatically cover custody or merchant payment processing. Ask which licensed activity your contract sits under.
• Settlement currency. If you serve EU customers or settle into the EU, check the stablecoins the gateway pays out in. EU platforms are winding down non-MiCA stablecoins such as USDT by 8 January 2027 at the latest (see our USDT EU ban guide). Settling in USDC or EURC, or straight to fiat, avoids a second migration. Qivalis, the euro stablecoin backed by 37 banks, was licensed as an EMI by the Dutch central bank (announced 14 October 2026) but isn't issuing yet.
• Fiat leg. Fiat paid to your company's bank account from a named banking partner gives your bank a clean story.
• Travel Rule handling. Licensed providers collect originator and beneficiary data on transfers (the Travel Rule). That's a feature: it's the paper trail your bank wants.
• Your vertical. Be upfront about what you sell. A gateway that accepts it knowingly won't exit you when it finds out later.

If you'd rather not run that search yourself, our crypto on/off-ramp service matches operators with licensed gateways and OTC desks that accept their vertical, and we tell you when one won't.

Why the switch fails for some merchants

In the files we handle, migrations go wrong for the same few reasons:

• The new provider finds the history before you disclose it and declines or exits you. Disclose upfront with the file.
• The business description changes between providers. Calling yourself "digital services" at the new gateway when the old one had you as a VPN, gaming or nutra merchant is misdescription. It ends relationships, and it's not something we'll help with.
• Withdrawals after 8 October get chopped into small amounts. Many small transfers out of a newly designated gateway is a textbook OFSI red flag. If you're bringing any balance out, take advice first and move it in a documented way.
• Affiliate and partner payouts are ignored. If your affiliates or suppliers paid you or got paid through Cryptomus or Heleket, those flows are in your history too. Include them in the file.

The setup that works

The operators who come through this cleanly end up with the same structure:

• One licensed primary gateway, verified on a register, with fiat settlement into a company account at a bank or EMI that knows you take crypto.
• A second licensed provider onboarded and tested, so one exit doesn't stop your sales.
• Settlement in MiCA-compliant stablecoins or fiat if any EU exposure exists.
• Monthly exports of gateway, exchange and bank records kept in one place, so the next RFI takes an hour to answer instead of a week.
• Clear beneficial ownership and business descriptions, identical across every provider.
• Someone checking sanctions updates (UK, EU, OFAC) against every payment provider in your stack.

For large conversions, compare routes in our OTC desk vs exchange guide.

What to do next

Today: switch off Cryptomus and Heleket checkout and payouts, and export every record. This week: build the source-of-funds file, check your UK nexus with a sanctions lawyer if there is any doubt, and brief your exchange and bank before they ask. This month: get a licensed replacement live, with a backup behind it, and settle in a currency that survives the EU's January 2027 stablecoin cut-off. If you want help matching your vertical to licensed gateways and OTC desks that will take it, talk to us.