Summary
- The U.K. sanctioned Cryptomus — also known as Certa Payments, Xeltox Enterprises, and now Heleket — on 8 October, freezing its assets at British banks and barring UK firms from doing business with it.
- Chainalysis reports the platform received more illicit funds than tracked crypto mixers combined, with illicit counterparties exceeding 900 in a single month in late 2025.
- TRM Labs found Cryptomus processed more than $7 billion in transactions since 2022, including payments linked to terrorist financing, human trafficking, and child sexual abuse material vendors.
- Canada levied a record CAD $176 million fine against the platform for anti-money laundering violations; the company appealed and launched Heleket as a parallel no-KYC service.
- This marks the first known case of a Five Eyes nation sanctioning a cryptocurrency operation incorporated in another Five Eyes jurisdiction.
What happened
On 8 October, the United Kingdom issued economic sanctions against Cryptomus, a cryptocurrency payment processor with a history of operating under multiple corporate identities. The sanctions freeze any Cryptomus assets held at U.K. banks and prohibit British entities from conducting any form of business with the platform. Also caught in the same action were three other virtual payment services: VexPay, TokenSpot, and Tsunami Payments.
A platform built on reinvention
Cryptomus emerged in 2022 under the name Certa Payments, later rebranded as Xeltox Enterprises, and most recently relaunched as Heleket — a move that followed Canada’s record CAD $176 million fine for alleged anti-money laundering violations. Rather than winding down operations, the platform appealed the Canadian penalty and launched Heleket as a parallel service that continued to offer no-KYC payment processing. Canadian sanctions, it turns out, were difficult to enforce against a cryptocurrency processor with no meaningful physical presence.
Scale of illicit activity
The numbers documented by blockchain analytics firms are substantial. TRM Labs found the platform had processed more than $7 billion in transactions since inception, with funds traced to child sexual abuse material vendors, terrorist financing networks, and human trafficking operations. Chainalysis observed that Cryptomus and Heleket together received more illicit funds across tracked categories than the crypto mixers in its dataset, and that the number of illicit counterparties surged past 900 in a single month in late 2025. The platform’s transaction volume did fall after it introduced KYC requirements — but the Heleket rebrand was a direct response to that drop, providing a no-KYC escape valve.
Why sanctions carry more weight than fines
Blockchain analyst Richard Sanders, who spent months mapping Cryptomus’s payment infrastructure, made the distinction plainly on LinkedIn: “A fine doesn’t stop a cryptocurrency payment processor from processing payments. Sanctions kill the operation. The distinction matters.” Canada’s fine was ultimately unenforceable and uncollectible. The U.K. sanctions, by contrast, cut off access to the British financial system and create legal exposure for any company that continues to transact with the platform.
A regulatory fiction at the foundation
The corporate structure underpinning Cryptomus raises its own concerns. The sole shareholder of the parent company Certa Payments was reportedly a 25-year-old Ukrainian woman who also led WS Management and Advisory Corporation — an entity that bills itself as a regulatory body overseeing cryptocurrency, foreign exchange, and online gaming licences in the Western Sahara, a disputed territory in northwest Africa that is not widely recognised as a sovereign nation. One of Certa Payments’ former websites shared server infrastructure with a site purporting to be the Central Reserve Authority of Western Sahara. In short, the platform’s claimed regulatory legitimacy appears to rest on a phantom institution in a non-sovereign jurisdiction.
A Five Eyes precedent
Sanders also noted this is the first known instance of a Five Eyes country — the intelligence alliance comprising Australia, Canada, New Zealand, the U.K., and the United States — sanctioning a cryptocurrency operation incorporated in another Five Eyes member state. That precedent may have implications for how allied nations coordinate responses to illicit crypto infrastructure that exploits the gaps between friendly jurisdictions.
Why it matters
For CISOs, this case illustrates how ransomware payment ecosystems and cybercrime service markets are sustained by layered financial infrastructure — processors that rebrand on demand, claim licences from non-sovereign regulators, and exploit enforcement gaps between allied nations. Any organisation that has paid a ransom, or whose vendors have exposure to these platforms, should be aware that the underlying payment rails are now subject to U.K. sanctions. Procurement and vendor risk teams should verify that third-party payment processors and cryptocurrency service providers are not operating under any of the sanctioned entity names: Cryptomus, Heleket, Certa Payments, Xeltox Enterprises, VexPay, TokenSpot, or Tsunami Payments.
What to do now
- Screen all cryptocurrency payment processors and virtual asset service providers used by your organisation or supply chain against the U.K. sanctions list, including the aliases Cryptomus, Heleket, Certa Payments, and Xeltox Enterprises.
- Brief legal and compliance teams on the U.K. sanctions issued on 8 October and the prohibition on British entities conducting any business with the listed platforms.
- Treat no-KYC cryptocurrency processors as elevated-risk counterparties in third-party due diligence frameworks, regardless of their stated regulatory credentials.
- When evaluating cryptocurrency service provider legitimacy, verify that claimed licences come from recognised sovereign regulatory bodies — not self-described oversight entities in disputed territories.
- If your organisation has previously transacted with any of the sanctioned platforms, seek legal advice on disclosure obligations and exposure under applicable sanctions regimes.
