The UK placed crypto payment brands Cryptomus and Heleket under the same sanctions designation on Oct. 8, 2026, naming Xeltox Enterprises Ltd. as the target. Switching between the two brands leaves the shared designation relevant to the counterparty assessment.
For merchants choosing a payment processor and customers seeking access to funds, the operator matters as much as the name on the checkout. The Foreign, Commonwealth & Development Office’s notice lists Cryptomus, Heleket and Certa Payments Ltd. as variations of Xeltox’s name.
What changes for payments and UK access
Xeltox appears in the notice under unique ID RUS3755. The UK says it has reasonable grounds to suspect the company has supported or benefited from Russia’s government through the Russian financial-services sector, citing its ownership of Cryptomus and activities linked to and continued through Heleket.
The listed measures include an asset freeze, restrictions on trust services, director disqualification, internet-services sanctions and correspondent-banking and payment-processing restrictions.
For the banking measure, the notice prohibits UK credit or financial institutions from establishing or continuing correspondent relationships with the designated person and from processing payments to, from or through it. It also extends the measure to credit or financial institutions owned or controlled by that person.
The internet measure imposes a different obligation. Social-media services, internet-access services and application stores must take reasonable steps to prevent UK users from accessing content, websites or applications supplied by the designated person. The requirement establishes a UK access restriction.
Guidance from the Office of Financial Sanctions Implementation (OFSI) says UK financial sanctions apply to people and activities within UK territory and to UK nationals and entities established under UK law wherever they operate. Cryptoassets fall within the broad definitions of funds and economic resources. The effect on a transaction therefore depends on its parties, activity and jurisdiction.
The control question also reaches beyond explicitly named brands. OFSI’s ownership and control tests include holding more than 50% of shares or voting rights, having the right to appoint or remove a majority of directors, or a reasonable expectation that a person can ensure an entity conducts its affairs according to their wishes. An unlisted company can therefore fall within applicable financial restrictions because of control.
For a withdrawal within UK sanctions jurisdiction, the transfer’s legal basis matters even when the customer is not designated. Whether the transfer is prohibited, covered by an exception or permitted by a license depends on the funds and activity involved.
UK government guidance distinguishes an exception, which applies automatically when its defined conditions are met, from a license giving written permission for otherwise prohibited activity. General licenses also have conditions and can expire, be amended or be revoked. For an otherwise prohibited transfer, moving a customer’s funds requires an applicable exception or license. A licensing ground identifies a potential basis for an application; written licensing permission requires an issued license covering the activity.
The current OFSI general-license index illustrates the importance of checking which entities a permission covers. Its Oct. 8 addition, a Zarubezhneft wind-down license, covers that oil company and its owned or controlled subsidiaries.
OFSI also lists a return-of-funds licensing ground for designated money-services businesses that requires UK registration for money-laundering purposes, alongside other conditions. Canadian registration alone does not meet that requirement.
Legal permission and successful execution are separate questions. A provider switch therefore leaves two further requirements: a lawful transfer of the existing balance and a receiving route able to process it.
Separate exchange names can share a route
Separate exchange tracing illustrates a different issue: changing the legal operator may still leave a shared downstream route. TokenSpot CJSC has its own Oct. 8 designation, RUS3758, with the same listed categories of restrictions; its entry designates a separate entity from Xeltox.
Chainalysis reports that downstream funds from TokenSpot, Grinex and Meer converged on one HTX deposit address. Some services reached that destination through intermediary wallets.
In the analysis published Oct. 8, the firm says the address received more than $308 million. This is the address’s aggregate receipt total; the narrative gives no observation period or exchange-by-exchange breakdown.
The convergence matters because different exchange brands can send funds into the same downstream route while presenting distinct services to the customer. For a merchant evaluating alternatives, a change in operator and a change in routing are distinct questions: the first concerns the counterparty and legal control; the second concerns where the payment goes after entering the service.
CryptoSlate’s earlier coverage of US action against A7 and Iran-Russia settlement links examined the role of payment intermediaries. The new tracing supplies a separate routing example. The described trace concerns TokenSpot, Grinex and Meer. Any connection of Cryptomus or Heleket to this HTX endpoint, or a corporate group with those exchanges, remains unestablished in this analysis.
A Canadian penalty preceded the UK designation
Xeltox also has a Canadian compliance history that predates the UK designation. FINTRAC’s Oct. 22, 2025 record says its director confirmed a C$176,960,190 administrative monetary penalty on Oct. 16, 2025, for 2,593 contraventions across six violation types.
The regulator’s findings included failures to submit suspicious-transaction reports and comply with Canada’s Iran directive. The Oct. 22 record says Xeltox appealed the penalty to the Federal Court.
The UK Sanctions List update log, checked Oct. 11, showed Oct. 8 as its latest update. For a customer considering a switch, the remaining evidence needed is specific to the transaction: the operator, who holds or controls the funds, the route and the applicable permission.
