The UK lists Cryptomus and Heleket as names linked to Xeltox Enterprises Ltd. The designation restricts asset access and payment processing, while also limiting UK access to the company's internet services.
On Oct. 8, 2026, the UK added Xeltox Enterprises Ltd. to a package of 38 Russia-related sanctions designations. The company appears under unique ID RUS3755. The notice also identifies Cryptomus and Heleket as names linked to Xeltox, and lists Certa Payments Ltd. For customers with funds on the service, and merchants weighing a processor, the key questions are who operates or controls it and whether a transfer is legally permitted.
The designation does not by itself make every transaction involving either brand illegal everywhere. Its effect depends on the parties, the activity and the jurisdiction. The UK measures directly concern UK financial institutions and, under the applicable rules, UK people and entities. They do not establish a separate U.S. designation.
Industry publications citing Chainalysis report that Cryptomus and Heleket received funds from more than 15,000 distinct illicit counterparties, spanning all categories of criminal activity tracked by the analytics firm.
The operator behind the brand
The Foreign, Commonwealth & Development Office's notice lists Cryptomus and Heleket as variations of Xeltox's name. It also names Certa Payments Ltd. The UK says it has reasonable grounds to suspect Xeltox supported or benefited from Russia's government through the Russian financial-services sector. The stated basis cites Xeltox's ownership of Cryptomus and activities linked to, and continued through, Heleket. That is the basis for the designation, not a finding about every customer or transaction.
The measures impose an asset freeze and restrict trust services. They also include director disqualification and internet-services sanctions. Separate limits apply to correspondent banking and payment processing. UK credit and financial institutions cannot establish or continue correspondent relationships with the designated person, or process payments to, from or through it. The banking restriction also covers institutions owned or controlled by the designated person. CoinDesk's sanctions report describes the payment and correspondent-banking restrictions.
The internet restriction operates separately. Social-media services, internet-access providers and app stores must take reasonable steps to prevent UK users from accessing content, websites or applications supplied by the designated person. That restricts access in the UK. It does not, by itself, determine whether a particular customer's balance can be returned.
In April 2026, TRM Labs assessed with high confidence that Cryptomus and Heleket shared infrastructure, personnel, branding and liquidity sources. That analysis provides independent context for treating the two brands as operationally connected, but it does not replace the UK's legal designation or establish the status of every transaction.
A transfer still needs permission
The Office of Financial Sanctions Implementation says UK financial sanctions apply to people and activities in UK territory. They also cover UK nationals and entities established under UK law wherever they operate. Cryptoassets can count as funds or economic resources under the rules.
OFSI's ownership-and-control tests reach beyond names printed on a sanctions list. Control can mean holding more than 50% of shares or voting rights. It can also mean having the power to appoint or remove a majority of directors. A reasonable expectation of being able to direct an entity's affairs is another test.
For a customer seeking a withdrawal under UK jurisdiction, the legal basis matters even if that customer is not designated. A transfer may be prohibited, covered by an exception or authorized by a licence, depending on the funds and activity. An exception applies automatically only when its stated conditions are met. A licence is written permission for otherwise prohibited activity. A licensing ground gives someone a possible basis to apply, not permission already granted.
OFSI guidance lists a return-of-funds licensing ground for designated money-services businesses. It requires UK money-laundering registration and other conditions. Canadian registration alone does not meet that UK requirement. Even with permission, the transfer needs a receiving route able to process it.
Whether a balance can lawfully move is a separate question from whether the destination can accept it. The distinction between a service's public brand and its regulatory position also appears in a German licensing case. There, a platform's trading and euro-deposit access were affected after BaFin denied its MiCA application. The legal circumstances differ, and a replacement provider does not resolve the permission or access problem by itself.
Separate tracing evidence
A different UK sanctions entry and a separate blockchain analysis show why payment routes need to be assessed apart from the operator. TokenSpot CJSC has its own UK designation, RUS3758, with the same listed categories of restrictions. It is not the Xeltox entry. On Oct. 8, Chainalysis reported that funds downstream from TokenSpot, Grinex and Meer converged on one HTX deposit address. Some services reached it through intermediary wallets.
Chainalysis said the address had received more than $308 million. That is the address's aggregate receipt total. The report description gives neither an observation period nor an exchange-by-exchange breakdown. The trace concerns those named services and that destination. It does not establish that Cryptomus or Heleket used the address or belonged to a corporate group with those exchanges.
The sanctions package also included organizations linked to the A7 network. A7 said it transferred more than $90 billion over the previous year. The UK announcement did not specify which designated organizations handled those flows, so the figure cannot be attributed directly to Xeltox, Cryptomus or Heleket.
Xeltox's Canadian compliance record predates the UK action. FINTRAC's Oct. 22, 2025, record says its director confirmed a C$176,960,190 administrative monetary penalty on Oct. 16, 2025. The penalty covered 2,593 contraventions across six violation types, including failures to file suspicious-transaction reports and to comply with Canada's Iran directive. The record says Xeltox appealed the penalty to the Federal Court.
