U.K. Sanctions Crypto Payment Platform Tied to Over $7 Billion in Illicit Transactions
The United Kingdom imposed economic sanctions on Cryptomus on October 8, 2026, a cryptocurrency payment platform that blockchain analysis firm TRM Labs says has processed over $7 billion in transactions since 2022, including funds tied to ransomware operators, narcotics distribution, darknet markets, and fraud. The U.K. also sanctioned three related platforms: VexPay, TokenSpot, and Tsunami Payments.
What the Sanctions Do
| Attribute | Detail |
|---|---|
| Sanctioning body | United Kingdom |
| Date | October 8, 2026 |
| Primary target | Cryptomus |
| Related platforms sanctioned | VexPay, TokenSpot, Tsunami Payments |
| Effect | Freezes Cryptomus assets at U.K. banks; bars British firms from doing business with it |
| Transactions flagged | $7 billion+ since 2022 (TRM Labs analysis) |
| Prior enforcement | Canada fined the platform CAD $176 million in 2025 for anti-money-laundering violations |
A Platform With a History of Rebrands
Cryptomus has operated under multiple names since emerging in 2022, including Certa Payments, Xeltox Enterprises, and most recently Heleket. TRM Labs' analysis found transactions on the platform associated with ransomware payments, child sexual abuse material vendors, terrorist financing networks, and human trafficking operations, in addition to narcotics and darknet market activity.
The platform's sole shareholder is reported to be a 25-year-old Ukrainian woman. Cryptomus has claimed regulatory authority through a body tied to the disputed Western Sahara region — a jurisdiction with no recognized authority to license a payment platform of this kind. After Canada's CAD $176 million fine in 2025, the operation launched Heleket as a parallel no-KYC service, allowing it to keep operating under a different brand while facing enforcement action under its original name.
Why It Matters
Cryptomus illustrates a pattern defenders and compliance teams should watch for: a sanctioned or fined platform doesn't necessarily disappear — it rebrands and keeps operating under a new name with the same no-KYC model that made it attractive to illicit actors in the first place. The U.K.'s action, following Canada's 2025 fine, adds pressure but doesn't by itself stop the underlying service from functioning for customers outside sanctioning jurisdictions.
Recommendations
- Screen for Cryptomus and its known aliases — Certa Payments, Xeltox Enterprises, and Heleket — in transaction monitoring and compliance programs, not just the current brand name.
- Apply the same scrutiny to VexPay, TokenSpot, and Tsunami Payments, sanctioned alongside Cryptomus in the same action.
- Treat no-KYC crypto payment processors as high-risk by default for any business accepting cryptocurrency, regardless of current sanctions status — this case shows enforcement often lags the platform's actual operation.
Key Takeaways
- The U.K. sanctioned Cryptomus on October 8, 2026, freezing its U.K. bank assets and barring British firms from doing business with it.
- TRM Labs ties the platform to over $7 billion in transactions since 2022 linked to ransomware, fraud, darknet markets, and other illicit activity.
- Cryptomus has rebranded repeatedly — as Certa Payments, Xeltox Enterprises, and Heleket — including launching Heleket specifically to continue operating after a CAD $176 million Canadian fine in 2025.
- Three related platforms — VexPay, TokenSpot, and Tsunami Payments — were sanctioned in the same action.