Cryptomus and Heleket Hit the UK Sanctions List: What Matters Now

On October 8, 2026, the United Kingdom added several crypto payment platforms to its sanctions list. The services affected are Cryptomus and Heleket, both belonging to the Canadian-registered Xeltox Enterprises, along with the Kyrgyz platform TokenSpot. If you hold a balance there or settle payments through a service like this, the most important news is also the most awkward: the British measure does not bind you in Germany, yet it can still close your payout route.

A sanctions listing is an administrative measure. It carries no finding of guilt. The state imposing it freezes assets within its own jurisdiction and bars its own banks and service providers from doing business. For investors in Germany, the binding document is therefore the entry in the European Union's consolidated list. The British list has no force here. That distinction goes missing in the coverage time and again, and it decides whether you have to act or merely watch.

What the British Foreign Office listed on October 8

The measure forms part of a larger Russia package with 38 new listings, reported by CoinDesk on October 9, 2026. In crypto, the report names two strands. The first concerns Xeltox Enterprises, the Canadian-registered company behind Cryptomus, Heleket and Certa Payments. The second concerns TokenSpot, based in Kyrgyzstan.

There are also two payment service providers and one individual: Processing KG, operator of the VexPay service, the firm Tsunami Payments, and Ulan Bukabaev, a director of Processing KG. According to the report, the British government justifies the listings on the grounds that the platforms and payment services may have helped Russia circumvent financial sanctions.

That conditional is not there out of politeness. Sanctions law works to a standard of suspicion, without requiring proof of guilt. The British reasoning speaks of reasonable grounds to believe that the company supported the Russian financial sector. Whether that holds will not be settled by a criminal court; in a dispute it falls to an administrative challenge against the listing.

Why the names get muddled in the reports

Several reports speak of three sanctioned exchanges, others of one company plus TokenSpot. Both can be sourced, because Cryptomus and Heleket appear in the British entry as alternative names for the same firm. An alternative name is a further name under which a listed entity operates; it is not a separate entry, but it carries the same legal effect. So anyone searching for "Heleket" and finding nothing may simply have searched under the wrong name.

Xeltox Enterprises: Cryptomus and Heleket appear as a single entry

Cryptomus is primarily a payment processor rather than a conventional trading venue. Merchants embed the service in their shop, the customer pays in cryptocurrency, the service settles and credits the merchant with the amount. Heleket operates on the same technical foundation. One entry is therefore enough to capture both brands.

In practice that means two things. First, matching the brand name on your payment page is not enough; you need the name of the company standing behind it. Second, a single listing can hit several services at once that appear to have nothing to do with one another.

You will find the operating company's name in the terms and conditions, in the imprint or in the service's privacy policy. That detail is the key to every check you make afterwards. Without it, you search the lists past the brand name.

TokenSpot and the A7 network: what the A7A5 stablecoin has to do with it

A stablecoin is a token whose price is pegged to a currency, usually the US dollar. A7A5 is pegged to the Russian rouble and belongs to the so-called A7 network, a cluster of payment structures that Western governments say serves to circumvent financial sanctions.

According to the CoinDesk report, the British Foreign Office stated that two of the newly listed firms had settled or enabled transactions connected to A7. In the same announcement, the British government points to the network's own claim that A7 moved assets worth more than 90 billion dollars in the previous year. The report qualifies that account elsewhere: blockchain analytics firms dispute that actual activity around A7A5 runs that high. The report gives no solid counter-figure.

For your own reading, that matters more than it sounds. A figure drawn from a sanctioned network's self-presentation carries no weight as a market number. It is evidence of how the network presents itself, and no measure of its volume.

Asset freeze, payment ban, internet block: the legal effects a listing triggers

According to the report, the assets of the named entities in the United Kingdom are frozen, and British financial institutions are prohibited from settling payments to, from or through several of the firms. For users outside the United Kingdom, that payment ban is the consequence you actually feel.

The reason sits in the infrastructure. At some point, a crypto payment service needs a bridge into the banking system to pay out euros or dollars. That bridge often runs through correspondent banks, meaning banks that settle payments abroad on behalf of other banks. When a major financial centre drops out as a conduit, payouts become slower, more expensive or stop altogether, without your own balance ever having been officially frozen.

A British listing does not apply automatically in Germany

Since leaving the European Union, the United Kingdom has maintained a sanctions list of its own. An entry there binds British persons and companies. In Germany, the EU regulations on Russia apply, and what binds you is the entry in the consolidated EU list, which you can reach through the official EU Sanctions Map.

In practice, the lists tend to trail one another rather than move in step. In August 2026 the EU added the exchange HTX to its list, after the United Kingdom had already listed it in May; we described the case at the time in our article on the EU transaction ban of August 21, 2026. Whether the EU follows suit on Cryptomus, Heleket or TokenSpot is open for now. Which is exactly why the list you look up yourself is worth more than any report about it.

How to actually find an entry in the EU list

Searching the consolidated list usually founders on spelling. What helps:

• Use the operating company's name; the service's brand name rarely appears in the list.
• Try the legal form with and without its suffix, so with and without "Ltd" or "CJSC".
• Search the registered address as well, because alternative names often converge on the address.
• Add the name of the managing director if media reports name them; individuals are listed separately.
• Watch the date of the last update, because a new listing appears only once it is published in the Official Journal.

The EU framework: which dealings are already barred to investors in Germany

Whatever treatment the three platforms end up receiving in the EU, prohibitions already apply to you. The EU sanctions against Russia now also cover services around crypto assets, and have done for some time. Transactions with entities on the EU list are barred to persons in the EU, both directly and indirectly. Indirectly means this: the route through a third service that forwards the payment stays prohibited too.

Breaching EU sanctions is a criminal offence in Germany under the Foreign Trade and Payments Act, not a mere administrative fine. The penalty in an individual case depends on intent and scale and belongs in the hands of a specialist lawyer. For your decision, the direction is enough: running a payment through a listed service risks more than a blocked account.

A second front runs in parallel and has nothing to do with Russia. Stablecoins are subject to their own rules in the EU, and the supervisor has set deadlines by which exchanges must drop unauthorised tokens from their offering. So anyone holding a balance in stablecoins checks two things at once: whether the provider is clean, and whether the token itself remains tradable in the EU.

A balance on a listed platform: what to watch in the payout route

A platform whose assets are frozen is not the same as a user whose balance is frozen. Even so, the practical damage almost always starts at the payout route, and long before any authority has even heard your name.

If you hold a balance at one of the named services, work through it in this order. First secure evidence of the holding and the recent entries, meaning the account statement, the transaction list and the addresses you transferred to. Then test a small withdrawal instead of moving the entire holding in one booking; that way you spot a blocked route without tying up the full amount in it. Only then move the remainder, to a provider authorised in the EU or into your own custody.

Own custody, often called self-custody, means the private keys to your coins sit with you and not with a company. A sanction against a service provider does not reach a wallet whose keys you hold yourself. You pay for that advantage with full responsibility for the backup, and that trade-off belongs on the table before any decision.

One limit remains. If the platform itself is on the EU list, you may no longer deal with it at all, not even to get your money out. In that case the route runs through a release from the competent authority, and not through a quick withdrawal. That is the main reason to check the list before you move anything.

Merchants accepting crypto: the role the payment processor plays

For online shops that accept cryptocurrencies as a means of payment, the news hits a different nerve. The shop rarely picks an exchange; it picks a payment processor, and that processor determines which routes the money travels. Cryptomus was widespread in that role, particularly among smaller merchants and services with an international audience.

Anyone running a shop should therefore know three details from their contract: the company behind the payment module, where that company is based, and the bank or institution through which the euro payout runs. If one of those details is missing from the paperwork, that is already a finding, independently of any sanctions list.

If it turns out the processor belongs to a listed group, the payment route needs closing, and watching it is no longer enough. Outstanding receivables and balances in the processor account then belong in a schedule you keep. Cases like these are wound up over months, and anyone whose figures are not in order loses them twice.

MiCA licence and the BaFin register: how to recognise a regulated provider

The EU has ordered the market for crypto assets with a regulation of its own, known by the abbreviation MiCA. Anyone offering crypto asset services in the EU needs authorisation from a national supervisor and is entered in its register; in Germany that supervisor is BaFin.

An authorisation is no guarantee against losses. It does shift two things in your favour. There is a supervisor that can compel an institution to provide information, and there is a registered seat in the EU where claims can be enforced. With a processor registered in Canada and an operational trail in Central Asia, both are missing. For an overview of the houses that can show European authorisation, see our comparison of regulated crypto exchanges.

What the supervisor does not take off your hands

No register tells you of its own accord that your provider is in trouble. The duty to check stays with you, and it costs two or three glances a year: once when setting up the account, once on a report like this one, and once when a payout takes longer than usual.

Sanctions lists: only the EU entry binds you

The British listing of October 8 is a signal. It issues you no instruction. What you make of it comes down to three concrete steps:

1. Establish the name and check the list. Take the operating company's name from your service's terms and conditions and search for it in the consolidated EU list. If you do not find it there, no prohibition applies and you decide freely. For a move to a house with European authorisation, our comparison of crypto exchanges helps.
2. Separate your custody. Do not leave long-term holdings with a payment processor whose business depends on someone else's banking relationships. For the devices that do the job and what they cost, see the hardware wallet comparison.
3. Get your records in order. Pull out transaction lists and account balances while access still works. You need that data for your tax return anyway, and in a wind-up it is your only evidence; you will find the tools for it in our overview of crypto tax tools.

Over the coming weeks, watch one thing above all: whether the EU takes over the British entries. Until it does, your position is unchanged, and any decision you take calmly now beats one that a blocked payout takes for you.

(As of October 9, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)