UK sanctions crypto exchanges Cryptomus, Heleket and TokenSpot over Russia links

Britain sanctioned three crypto exchanges and two payment platforms it says Russia used to evade financial restrictions, part of a 38-designation package the Foreign, Commonwealth and Development Office announced on Oct. 8.

The crypto targets Cryptomus and Heleket operate under Canadian-registered Xeltox Enterprises, while Kyrgyzstan-based TokenSpot was designated alongside payment firms Tsunami Payments and Processing KG, the operator of VexPay, CoinDesk reported. The office named Ulan Bukabaev, a director of Processing KG, as the linked individual in the package.

London suspects the entities helped Russia route money around sanctions, with two of them processing and moving transactions with the A7 network, according to the government notice. The notice describes A7 as a Kremlin-backed illicit finance network used to get around international restrictions on the Russian financial sector.

"The message is simple: if you help Russia fund or equip this war, you will face the consequences," the notice says. It puts A7's claimed volume at more than $90 billion last year, or roughly half of Russia's annual military spending. That figure comes from A7's own claims as relayed by the government, not from an independent audit, and the notice presents it as such.

The named entities

Xeltox Enterprises is the corporate shell at the center of the crypto designations. The Vancouver-registered company was designated through its ownership of Cryptomus and activities linked to and continued through Heleket, Decrypt reported. TRM Labs lists the designation as covering Cryptomus, Heleket and Certa Payments under the Xeltox name, in its Oct. 8 analysis.

TokenSpot is a Bishkek exchange designated as TokenSpot CJSC. Tsunami Payments shares an office tower in Bishkek with TokenSpot, Decrypt wrote. Processing KG sits inside unusual ownership: its parent company is the Kyrgyzstan Ministry of Finance, and the designation names its director Bukabaev alongside the company and its VexPay service. The government's top line describes the crypto slice as three exchanges and two payment platforms, including three linked to Kyrgyzstan and one linked individual.

On-chain researchers supplied the transaction detail behind the move. Cryptomus and Heleket received funds from thousands of illicit counterparties, peaking at 900 such entities in a single month in late 2025, Cointelegraph reported, citing Chainalysis. TokenSpot, along with Grinex and Meer, received over $308 million from the same HTX deposit address, according to the same report. Chainalysis dates its own write-up to Oct. 8 and adds that the two payment processors took funds from more than 15,000 illicit actors.

What the sanctions do

Assets the named entities hold in Britain are frozen, and British financial institutions are barred from processing their payments, CoinDesk reported. Four of the companies face an additional internet services sanction, which requires social media platforms, internet providers and app stores to take reasonable steps to stop UK users reaching their sites and apps, Decrypt reported.

The crypto slice sits inside a wider package aimed at oil and military supply. The notice names oil companies Zarubezhneft and INK Capital and says UK sanctions now cover over 90 percent of Russia's total oil production capacity. Twelve more shadow-fleet tankers joined the list, taking the sanctioned tanker count past 600, alongside 17 entities and people tied to goods feeding Russian missiles and drones. Other named financial targets include Planeta and Stolichny Kredit bank.

Xeltox is not new to enforcement. Canadian regulator FINTRAC imposed a CAD 177 million penalty on Xeltox and Cryptomus in October 2025, a fact both Chainalysis and TRM Labs record in their Oct. 8 write-ups. "We're also clamping down on those helping Russia evade sanctions, including through financial services and crypto exchanges," the notice says.

The designations were made under the Russia sanctions regulations, TRM Labs wrote. Media coverage landed Oct. 9 describing Thursday's action, a one-day lag behind the Oct. 8 notice, so the effective date is Oct. 8 and Oct. 9 is the reporting date. The notice did not specify which two entities handled the A7 transactions it cites.