What happened
On October 8 the United Kingdom issued economic sanctions against Cryptomus, previously known as Certa Payments and Xeltox Enterprises, for processing payments that benefit the Russian government and its financial institutions. The designations freeze any Cryptomus assets held at UK banks and bar British companies from offering it any business. Three other virtual payment platforms, VexPay, TokenSpot and Tsunami Payments, were named in the same action.
Krebs on Security has tracked the platform since a December 2024 investigation that described Cryptomus as a key payment processor for dozens of Russian cryptocurrency exchanges and sites selling cybercrime services. The company changed names repeatedly after emerging in 2022, most recently to Heleket, after Canada levied a record CAD $176 million fine for anti-money laundering violations.
Blockchain analytics firms put numbers behind the designation. Chainalysis wrote on October 8 that Cryptomus and Heleket "have emerged as major payment hubs for illicit activity" and that together they received more illicit funds across tracked categories than the mixers in its dataset, with more than 900 illicit counterparties in a single month in late 2025. TRM Labs had found in April 2026 that Cryptomus processed more than $7 billion since 2022, including transactions linked to child sexual abuse material vendors, terrorist financing networks and human trafficking. TRM also noted that transaction volume collapsed once the platform introduced know your customer rules, and that Heleket launched as a parallel service that continued to offer no-KYC payment processing.
Blockchain investigator Richard Sanders drew the contrast that matters for compliance work: "A fine doesn't stop a cryptocurrency payment processor from processing payments. Sanctions kill the operation." He also noted this appears to be the first time a Five Eyes country has sanctioned a crypto operation incorporated in another Five Eyes jurisdiction. The 2024 reporting found that Cryptomus shared a Vancouver address with dozens of other currency dealers that did not appear to be there, and that the sole shareholder of its parent company also headed an entity claiming to be the regulator for crypto, foreign exchange and online gaming licences in Western Sahara.
Why this is a GRC story
The remedy shapes the deterrent. A penalty can be absorbed or appealed while the business keeps trading, as the Canadian fine was. Sanctions remove banking access and counterparties, which is why the enforcement design, not just the number, is the control.
Rebranding is a diligence signal. Repeated name changes plus a parallel no-KYC brand launched after a large penalty is exactly the pattern vendor onboarding should surface.
Verify the licence issuer, not just the licence. A regulator in an unrecognised jurisdiction is a documented fraud pattern, and it survives because checks stop at paperwork.
What to watch
Watch whether Canada, the EU or the US follow with matching designations, and whether Heleket is named next. For payment firms and exchanges, the practical question is what your onboarding file shows about corporate history, ultimate ownership and screening when the name on the licence is not the name on the bank account.
Attribution: Analysis based on Krebs on Security and related public reporting. This article is original commentary, not a repost of the source material.