UK Sanctions Cryptomus for Aiding Russian Illicit Finance

“TRM Labs found Cryptomus had processed more than $7 billion in transactions since its inception in 2022.”

Oct. 8 U.K. sanctions: what was ordered and who was named

On October 8 the United Kingdom imposed economic sanctions against Cryptomus — a payments platform previously known as Certa Payments and Xeltox Enterprises — citing its role in “processing payments that benefit the Russian government and its financial institutions.” The measures freeze any Cryptomus assets held at U.K. banks and bar British companies from offering it any business, virtual or otherwise. The sanctions also targeted three other virtual payment services: VexPay, TokenSpot, and the Tsunami Payments service.

What blockchain analysts say about the platform’s role

Chainalysis framed the U.K. action as targeting “the broader infrastructure supporting Russia’s wartime economy,” and described Cryptomus and Heleket as “major payment hubs for illicit activity.” In an October 8 blog post Chainalysis wrote that “together, these services received more illicit funds across tracked categories than the mixers in our dataset and the number of illicit counterparties surged to more than 900 in a single month in late 2025.” Richard Sanders, a blockchain analyst who spent months mapping Cryptomus’s payment infrastructure and transacting with its customers, said the sanctions were important because earlier remedies had not stopped the platform’s operations.

Scale, illicit streams, and operational changes: TRM Labs’ findings

TRM Labs reported that Cryptomus processed more than $7 billion in transactions since 2022, including flows associated with vendors selling child sexual abuse material, terrorist financing networks, and human trafficking operations. TRM noted Cryptomus’s transaction volume “cratered” after the platform instituted new know-your-customer (KYC) rules, and that, following Canada’s enforcement action, the company launched Heleket as a parallel service that continued to offer no‑KYC payment processing.

Aliases, enforcement attempts, and the shell of legitimacy

Cryptomus has repeatedly changed names. After Canada levied a record CAD $176 million fine against the platform for alleged anti‑money laundering violations, the company appealed the penalty, launched Heleket as a parallel service, and continued processing large volumes of questionable transactions, Sanders said. Previous reporting cited a shared Vancouver address used by Cryptomus and dozens of other foreign currency dealers and money transfer businesses — none of which appeared to be physically located there.

Investigators’ work also traced a thin veneer of regulatory and corporate formality. The company’s parent, Certa Payments, was reported to have a sole shareholder described in earlier reporting as a 25‑year‑old Ukrainian woman who also headed other firms, including WS Management and Advisory Corporation. That entity bills itself as the regulatory body that exclusively oversees licenses for cryptocurrency, foreign exchange and online gaming businesses incorporated in the disputed Western Sahara region; its website, crasadr.com, lists entities awarded licenses for cryptocurrencies, gaming and foreign exchange services. One of Certa Payments’ former sites, certa.website, shared a server with 12 other domains including rasd-state.ws, the site for the Central Reserve Authority of the Western Sahara.

Sanders wrote on LinkedIn that “a fine doesn’t stop a cryptocurrency payment processor from processing payments” but that “sanctions kill the operation. The distinction matters.”

What this means for policymakers, blockchain analysts, and financial service providers

• Policymakers and regulators: The U.K. move is notable in its use of sanctions rather than fines. The source describes this as the first known instance of a “Five Eyes” country sanctioning a cryptocurrency operation incorporated in another Five Eyes jurisdiction — a development that, if sustained, changes the toolkit beyond monetary penalties.
• Blockchain analysts and investigators: Firms such as Chainalysis and TRM Labs will continue to quantify flows and map counterparties; Chainalysis reported that illicit counterparties tied to these services surged to more than 900 in a single month in late 2025, a metric investigators will seek to track for signs of dispersal or persistence.
• Financial service providers and exchanges: British companies have been explicitly barred from dealing with Cryptomus; any institution with U.K. exposure must assess asset freezes and compliance risk tied to counterparties that used the platform, particularly given the platform’s history of renaming and launching parallel services like Heleket.

The sanctions mark a shift from fines toward cutting off access, but the record presented here also shows how payments infrastructure can be repackaged, relocated, and propped up with nominal regulatory trappings. Whether the U.K. action succeeds in the way Richard Sanders described — by “killing the operation” rather than merely penalizing it — is now the immediate test for enforcement and for the investigators who have spent years mapping the networks that used Cryptomus and Heleket.

https://krebsonsecurity.com/2026/10/u-k-sanctions-cryptomus-for-ru-money-laundering/