UK sanctions Cryptomus, Heleket and VexPay: what it means for money transfers

The Foreign, Commonwealth and Development Office announced a new Russia sanctions package on 8 October 2026 — 38 designations in all. For the first time the list includes several crypto exchanges and payment platforms widely used for everyday transfers by Russian-speaking customers: Cryptomus, Heleket, VexPay, TokenSpot and Tsunami Payments. A Moscow bank, Stolichny Kredit, was frozen alongside them.

Who exactly was designated on 8 October 2026?

There are 38 new designations: 23 entities, 12 ships and 3 individuals. On the official UK Sanctions List all of them carry the designation date 08/10/2026 and run in a single block of reference numbers, from RUS3753 to RUS3790.

The money side of the package looks like this. XELTOX ENTERPRISES LTD, registered in Canada, is described by the FCDO as the owner of Cryptomus, with activities linked to and continued via Heleket; the entry also carries the former name Certa Payments Ltd and the addresses cryptomus.com and heleket.com. OJSC PROCESSING KG of Kyrgyzstan appears with the websites processing-kg.com and vexpay.net, and its director Ulan Arymbaevich Bukabaev, born 27 August 1974, is designated separately with a travel ban on top of the asset freeze. Also listed are the Kyrgyz companies TOKENSPOT CJSC and TSUNAMI PAYMENTS LLC and the Russian JSC Planeta, which runs planeta365.ru.

One bank is in the package: Limited Liability Company Commercial Bank Stolichny Kredit of Moscow, Ul. Baumanskaya 54, Building 1, INN 7718103767, OGRN 1027739199927, licence number 2853. The same entry also carries the names Capital Kredit and Commercial Bank Integral.

What happens to money already held with one of these services?

It is frozen. Every financial name in this group carries an asset freeze on the UK Sanctions List, plus an explicit prohibition on correspondent banking relationships and processing payments. The note attached to that measure says it plainly: UK credit or financial institutions are prohibited from establishing or continuing a correspondent banking relationship with a designated person, and from processing payments to, from or via a designated person. The same measures apply to firms the designated person owns or controls.

In practice a UK bank or fintech will not push your payment towards Cryptomus, Heleket, VexPay, TokenSpot, Tsunami Payments or Stolichny Kredit, and will stop an incoming transfer from them. Money sitting on the designated side cannot simply be withdrawn: releasing it requires a licence from the Office of Financial Sanctions Implementation (OFSI).

What is the risk of carrying on with a designated service?

UK sanctions bind everyone in the United Kingdom and all British nationals and companies anywhere in the world. OFSI puts it bluntly on its enforcement page: breaches of financial sanctions are a serious criminal offence. The regulator can impose a monetary penalty itself and refer cases to law enforcement agencies for investigation and potential prosecution.

ADV · A003We build websites for tradespeople and sole traders — £219Customers see your work and prices and message you straight away. Ready in 3 days, £219 instead of £438.Advertise here

Those penalties are not reserved for large corporations. OFSI's published list of decisions includes payment firms that serve ordinary customers: TransferGo Limited was fined £50,000 and ClearJunction Limited £36,393.45. The largest recent penalty went to Citibank N.A.'s London branch — £4,732,830.58, published on 2 September 2026.

How can you check whether a service or bank is sanctioned?

There is an official search tool at search-uk-sanctions-list.service.gov.uk, with full downloads of the list in CSV, XML and PDF. Do not search only the brand name you know: a single entry can carry up to five name variations, which is exactly why Cryptomus and Heleket sit inside the Xeltox Enterprises Ltd record and VexPay inside the Processing KG record. Remember the ownership and control rule as well: subsidiaries of a designated person are caught even when their own names do not appear.

What else is in the 8 October package?

On oil, the UK designated Zarubezhneft JSC and JSC INK-Capital, which owns Irkutsk Oil Company. The FCDO says UK sanctions now cover more than 90% of Russia's total oil production capacity. For Zarubezhneft, OFSI issued general licence INT/2026/11080040, which allows parties to wind down existing transactions; it takes effect on 8 October and expires at 23:59 on 21 November 2026, and records of anything done under it must be kept for at least six years.

On shipping, 12 more shadow fleet tankers were designated: Bellaris, Dakar, Daphne V, Flint Wind, Alexander Nevskiy, Anaya, Andrey Pervozvanniy, Midvolga-3, Pioneer, Vasily Surikov, Virent and Yehope. The FCDO says the total number of shadow fleet vessels under UK sanctions now exceeds 600.

The announcement also singles out A7, which London describes as a Kremlin-backed illicit finance network that claimed to have moved more than $90 billion last year — roughly half of Russia's annual military expenditure. Two of the platforms designated on 8 October had processed transactions with A7, according to the FCDO.