UK Sanctions Cryptomus, Heleket, and TokenSpot in New Russia Package Targeting Crypto and Payment Channels

Key takeaways

• On October 8, 2026, the UK announced 38 Russia-related designations, including three crypto exchanges and two payment platforms it suspects Russia uses to circumvent financial sanctions, one linked individual, and a Moscow bank
• The UK listed Cryptomus and Heleket as name variations of a single designated entity, Xeltox Enterprises Ltd. TRM Labs assessed in April 2026 that Cryptomus was likely behind the launch of Heleket as a parallel service
• TokenSpot, the Kyrgyzstan-based exchange TRM assessed on October 6, 2026 as a front company for sanctioned exchange Grinex, sent more than USD 950 million to Grinex, Garantex, and the A7 network
• Three of the designated companies are registered in Kyrgyzstan: TokenSpot, Tsunami Payments, and Processing KG, whose UK listing names the Kyrgyz Ministry of Finance as its parent company. The UK also designated the director of Processing KG
• Compliance teams should screen both the Cryptomus and Heleket brands, review TokenSpot exposure alongside Grinex exposure, and monitor for successor services after today's action

{{horizontal-line}}

Overview

Today, the United Kingdom’s Foreign, Commonwealth, and Development Office (FCDO) designated 38 individuals, entities, and vessels in a package targeting Russian oil revenue, shadow fleet tankers, suppliers of military goods, and the financial channels Russia uses to move money around sanctions. The crypto and payments designations focus on platforms the UK says help Russia circumvent financial sanctions. The designation further stated that two of them processed and facilitated transactions with the A7 network, a Kremlin-backed sanctions evasion and illicit finance network that claimed to move more than USD 90 billion last year.

Two of today's crypto targets are services TRM has analyzed in public research this year. In April 2026, TRM assessed with high confidence that Cryptomus and Heleket are operationally linked. On October 6, 2026, TRM assessed with high confidence that TokenSpot and Grinex run on shared wallet infrastructure and function as parts of the same operation. Today's UK action designates the corporate owner of Cryptomus and Heleket, Xeltox Enterprises LTD, under one listing and designates TokenSpot directly.

What happened

The Foreign, Commonwealth and Development Office (FCDO) made the designations under the Russia (Sanctions) (EU Exit) Regulations 2019. The full package includes two Russian oil companies, Zarubezhneft and INK-Capital, 12 shadow fleet tankers, and 17 entities and individuals involved in supplying Common High Priority (CHP) goods to Russia's military-industrial base.

In its announcement, the UK government said: "The message is simple: if you help Russia fund or equip this war, you will face the consequences." The UK included the following crypto exchanges and payment platforms in its latest packages. 

• Xeltox Enterprises Ltd (also listed as Cryptomus, Heleket, and Certa Payments Ltd) — Canada
• TokenSpot CJSC — Kyrgyzstan
• Tsunami Payments LLC — Kyrgyzstan
• OJSC Processing KG — Kyrgyzstan
• Joint Stock Company Planeta (also listed as Planeta 365) — Russia
• Limited Liability Company Commercial Bank "Stolichny Kredit" — Russia

What we know about the key entities

Xeltox Enterprises Ltd (Cryptomus and Heleket)

The UK designated Xeltox Enterprises Ltd, a company registered in British Columbia, Canada, for supporting the Russian financial services sector "through its ownership of Cryptomus and activities linked to and continued via Heleket." 

Cryptomus is a crypto payment processor and exchange. In October 2025, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) imposed a penalty of almost CAD 177 million on Xeltox Enterprises Ltd for violations of Canada's anti-money laundering (AML) and terrorist financing legislation. Xeltox is appealing that penalty.

In April 2026, TRM assessed with high confidence that Cryptomus and Heleket are operationally linked. Heleket launched in January 2025, the month before Cryptomus introduced mandatory know your customer (KYC) controls. Cryptomus then saw its monthly on-chain volume fall from USD 153 million in January 2025 to USD 86 million in March 2025, while Heleket's volume rose. TRM found the two services share infrastructure, branding, personnel, unusual website phrasing, and a 0.4% processing fee whilst Garantex supplied early liquidity to both. TRM also observed cybercrime actors, including child sexual abuse material (CSAM) vendors, moving from Cryptomus to Heleket. In 2025, 0.6% of Heleket's incoming volume was illicit — almost five times the average for payment service providers in TRM data — and sanctions-related entities, mainly Garantex, accounted for 60% of that illicit inflow.

In April 2026, TRM data showed Cryptomus had received USD 1.86 billion and sent USD 1.63 billion on-chain with Garantex as its largest sanctioned counterparty. Cryptomus received over USD 204 million from Garantex whilst sending USD 101 million. As of October 2026 Heleket has transacted over 2.89 billion with its largest sanctioned counterparty being Rapira, which the UK designated on May 26, 2026. The two services also transact directly with each other, and TRM continues to observe some shared infrastructure.

TokenSpot CJSC

TokenSpot is a crypto exchange based in Bishkek, Kyrgyzstan. The UK designated it for supporting the Russian financial services sector.

On October 6, 2026, TRM assessed with high confidence that TokenSpot operates as a front company for Grinex, the exchange TRM has identified as a likely rebrand of Garantex. OFAC designated Grinex on August 14, 2025, and the UK designated Grinex LLC on August 20, 2025. TRM's analysis found that:

• After an April 2026 hack, Grinex publicly listed as its own an aggregator address that had collected USD 146.3 million from 126 TokenSpot deposit addresses
• Six TRON addresses are attributed to both exchanges, and a single address collects leftover TRX fee balances from both
• Grinex announced a "technical break" on April 15, 2026, and TokenSpot told customers it was carrying out "technical work" 25 minutes later

TokenSpot's TRON addresses received USD 3.54 billion and sent USD 3.14 billion between December 8, 2023 and September 27, 2026. A7 is its largest external counterparty: TokenSpot sent A7 USD 679.5 million and received USD 48.5 million from it. TokenSpot also sent USD 26.5 million directly to the A7A5 token. After the UK designated Garantex and Grinex, TokenSpot sent the two exchanges USD 269.2 million and received USD 285.7 million from them.

Tsunami Payments LLC

Tsunami Payments is a Kyrgyz payments company. The UK designated it for supporting the Russian financial services sector. Its UK Sanctions List entry gives an address of Office 402, Tower B, 125/1 Toktogul Street, Bishkek. TokenSpot's entry gives Office 1006 in the same building.

According to TRM’s October 6th reporting, Melis Batyrbekovich Umarhodjaev was director of both TokenSpot and Tsunami Payments, a Kyrgyz payments company, according to June 2024 reports by Kaktus and Aqparat that cite the Kyrgyz Justice Ministry. As of September 2026, the Justice Ministry registry no longer lists him.

OJSC Processing KG and Ulan Bukabaev

Processing KG is an open joint-stock company in Bishkek designated for carrying on business of economic significance to the Government of Russia. Its UK Sanctions List entry names the Kyrgyz Ministry of Finance as its parent company and lists two websites: processing-kg.com and vexpay.net. The UK also designated Ulan Arymbaevich Bukabaev, Processing KG’s director.

Financial Times reporting published in early October 2026 described VexPay as a payment system that A7 representatives presented to Kyrgyz authorities in 2025 as an alternative to SWIFT.

The UK keeps following Russia's financial infrastructure as it rebuilds

Today's action continues a sequence of coordinated designations against the same network. The UK designated Garantex on May 4, 2022, and Grinex LLC on August 20, 2025. On May 26, 2026, it designated 18 entities and individuals, including Huobi Global (HTX), Exmo, Bitpapa, Rapira, and A7-network infrastructure. On July 23, 2026, the EU's 21st sanctions package extended transaction bans to 14 crypto-related platforms in third countries and added four designations tied to the A7 network.

TRM's 2026 Crypto Crime Report described 2025 as the "year of the Russian rebrand," as Russia-linked services relaunched as parallel or successor platforms after enforcement. Today's designations reach two of those patterns directly. The Xeltox listing names Heleket, the parallel service TRM linked to Cryptomus, alongside Cryptomus itself. The TokenSpot listing reaches a separately registered exchange that shares wallet infrastructure with Grinex, which TRM assessed as a likely rebrand of Garantex.

Kyrgyzstan remains central to this network. Three of today's crypto and payments targets are registered there, and TRM has documented how A7 relied on Kyrgyz-registered entities for exchange infrastructure and for issuing the A7A5 ruble-pegged stablecoin.

What this means for compliance teams

All of today's designees are on the UK Sanctions List. UK persons must freeze funds and economic resources owned or controlled by these designees and must not make funds or economic resources available to them. Firms should screen against the updated list now.

Name screening needs to cover every brand a listing reaches. The Xeltox listing covers Cryptomus, Heleket, and Certa Payments, so screening on "Xeltox" alone will miss transactions with either payment processor. The same applies to TokenSpot and Grinex: TRM analysis shows funds from the two exchanges passing through shared aggregator and fee-collection addresses, so firms screening for Grinex exposure should apply the same treatment to TokenSpot addresses. Teams with TokenSpot exposure can review counterparty activity since August 20, 2025, when the UK designated Grinex LLC.

Firms should also review historical exposure. Cryptomus and Heleket serve merchants and users across many jurisdictions, and both processed volume with exchanges that are now designated, including Garantex, Rapira, and Grinex. Indirect exposure within one to two hops of these services can carry sanctions risk.

Past actions against this network show what to monitor next. Russia-linked services have repeatedly relaunched under new brands, moved customers to parallel platforms, and rotated wallet infrastructure after designation. Compliance programs should watch for new payment processors or exchanges that share infrastructure, liquidity sources, or customer bases with today's designees.

{{horizontal-line}}

Frequently asked questions (FAQs)

1. What did the UK announce on October 8, 2026?

The UK announced 38 designations under the Russia (Sanctions) (EU Exit) Regulations 2019. They target Russian oil companies, shadow fleet tankers, suppliers of military goods, and financial channels Russia uses to circumvent sanctions. The crypto and payments designations include Xeltox Enterprises Ltd (Cryptomus and Heleket), TokenSpot, Tsunami Payments, Processing KG and its director, and Planeta, alongside the Moscow bank Stolichny Kredit.

2. Why are Cryptomus and Heleket listed under one designation?

The UK designated Xeltox Enterprises Ltd for supporting the Russian financial services sector through its ownership of Cryptomus and activities "linked to and continued via" Heleket. TRM assessed in April 2026 that the two services are operationally linked, based on shared infrastructure, branding, personnel, liquidity sources, and coordinated on-chain activity.

3. How is TokenSpot connected to Grinex and the A7 network?

TRM assessed with high confidence that TokenSpot operates as a front company for Grinex. The two exchanges share a deposit aggregator, six TRON addresses, and a TRX fee-collection address. A7 is TokenSpot's largest external counterparty, and TokenSpot sent more than USD 950 million combined to Grinex, Garantex, and A7.

4. What are internet services sanctions?

When the UK designates an entity for internet services sanctions, social media services, internet access services, and app stores must take reasonable steps to prevent users in the UK from accessing that entity's content, sites, or applications. The UK applied these sanctions to Xeltox, TokenSpot, Tsunami Payments, Processing KG, and Planeta.

5. What should compliance teams do now?

Screen the updated UK Sanctions List, including every name variation on each listing. Treat Cryptomus and Heleket as one designated entity, and treat TokenSpot addresses with the same caution as Grinex addresses. Review historical and indirect exposure, and monitor for successor services that share infrastructure or liquidity with today's designees.