The UK placed crypto payment brands Cryptomus and Heleket under one sanctions designation on Oct. 8, 2026. The target is Xeltox Enterprises Ltd. The Foreign, Commonwealth & Development Office lists Cryptomus, Heleket and Certa Payments Ltd. as variations of the same name.
One target, several names
Xeltox appears under ID RUS3755. The UK suspects it supported or benefited from Russia’s government through financial services, citing its ownership of Cryptomus and activities linked to Heleket. Measures include an asset freeze, trust-services restrictions, director disqualification, internet sanctions, and correspondent-banking and payment-processing restrictions.
The banking measure stops UK credit or financial institutions from starting or continuing correspondent relationships with the designated person. It also bars processing payments to, from or through that person. The internet measure requires social-media services, internet-access services and application stores to stop UK users from reaching content, websites or applications supplied by the designated person.
Control and jurisdiction
OFSI guidance says UK sanctions apply in UK territory and to UK nationals and entities established under UK law wherever they operate. Cryptoassets count as funds and economic resources. Control can pull in unnamed companies. Tests include holding more than 50% of shares or voting rights, the right to appoint or remove a majority of directors, or a reasonable expectation that a person can ensure the entity follows their wishes.
Licensing and execution
For a withdrawal inside UK sanctions jurisdiction, the legal basis matters even if the customer is not designated. It may be prohibited, covered by an exception, or allowed by a license. UK guidance separates an exception, which applies automatically when conditions are met, from a license, which gives written permission. General licenses can expire or be revoked. Written permission needs an issued license that covers the activity.
OFSI lists a return-of-funds licensing ground for designated money-services businesses. It requires UK registration for money-laundering purposes. Canadian registration alone does not meet that requirement. A provider switch leaves two questions: whether the balance can be transferred lawfully and whether the receiving route can process it.
A separate tracing case
Separate exchange tracing shows a different issue. Changing the legal operator may still leave a shared downstream route. TokenSpot CJSC has its own Oct. 8 designation, RUS3758, with the same restrictions. Chainalysis reports that downstream funds from TokenSpot, Grinex and Meer converged on one $HTX deposit address. The firm says the address received more than $308 million. That figure is an aggregate total. The convergence matters because different exchange brands can send funds into the same downstream route while presenting distinct services. A change in operator and a change in routing are separate questions. Any connection of Cryptomus or Heleket to this $HTX endpoint remains unestablished.
Xeltox also has a Canadian compliance history. FINTRAC’s Oct. 22, 2025 record says its director confirmed a C$176,960,190 penalty on Oct. 16, 2025, for 2,593 contraventions. Findings included failures to submit suspicious-transaction reports and comply with Canada’s Iran directive. Xeltox appealed to the Federal Court.
For a switch, check the operator, fund control, route and permission.
