On October 8, 2026, the UK designated Xeltox Enterprises, Processing KG, TokenSpot and Tsunami Payments under sanctions-list identifiers RUS3755, RUS3756, RUS3758 and RUS3763. The Foreign Office did not publish an announcement time. Its package contained 38 new designations, including three crypto exchanges and two payment platforms. The government said two targeted businesses had handled transactions involving the Kremlin-backed A7 network, which claimed to have moved more than $90 billion last year.
The action matters to payment operators because it goes beyond an asset freeze. The listed companies also face restrictions on correspondent banking, payment processing and internet services in the UK. The designations give compliance teams several corporate names, service aliases and ownership links to add to screening systems.
Which services the UK listed
The RUS3755 record names Xeltox Enterprises Ltd as the designated entity. It lists Cryptomus, Heleket and Certa Payments Ltd as variations of the primary name. The Secretary of State said there were reasonable grounds to suspect that Xeltox obtained a benefit from or supported the Russian government through business in Russia’s financial-services sector. The statement ties that finding to Xeltox’s ownership of Cryptomus and activity linked to and continued through Heleket.
The record places Xeltox at an address in Vancouver, Canada. It also supplies Canadian federal and British Columbia registration numbers. This makes the designation relevant to screening against both a legal company and the customer-facing Cryptomus and Heleket brands. Matching only the Xeltox name would miss aliases that the UK record treats as primary-name variations.
The TokenSpot record identifies TokenSpot CJSC as a closed joint stock company in Bishkek, Kyrgyzstan. The UK said it had reasonable grounds to suspect that TokenSpot supported or obtained a benefit from the Russian government by operating in Russia’s financial-services sector. The record includes registration and tax numbers, giving exchanges and payment providers identifiers beyond the TokenSpot name.
The Processing KG record identifies an open joint stock company in Bishkek. Its listed websites are processing-kg.com and vexpay.net, while the record names the Kyrgyz Ministry of Finance as its parent company. The UK’s stated ground is that Processing KG carried on business of economic significance to the Russian government.
The government separately designated Ulan Arymbaevich Bukabaev under identifier RUS3757. The individual record says he is a director of Processing KG. His restrictions include an asset freeze, travel ban, director disqualification and trust-services sanctions.
The Tsunami Payments record identifies a limited liability company at 125/1 Toktogul Street in Bishkek, the same street address listed for TokenSpot but in a different office. The UK said Tsunami Payments operated in Russia’s financial-services sector. Its record also provides company registration and tax numbers.
The official records present different relationships between legal entities and service names. Xeltox is one designated company with Cryptomus, Heleket and Certa Payments listed as name variations. Processing KG is a separate designated company whose record supplies the VexPay website. TokenSpot and Tsunami Payments each have their own company registration, tax number, sanctions identifier and office number. Bukabaev has a separate individual record tied to his role at Processing KG. Those distinctions matter when a screening system must decide whether a name, domain, corporate identifier or individual is a match. The records also prevent an operator from treating every brand in the package as a separate designated company.
What the restrictions require
The sanctions records apply four main measures to each of the four companies: an asset freeze, director disqualification, trust-services sanctions and additional restrictions covering internet services and payment processing. Bukabaev’s individual designation differs because it includes a travel ban and does not list the internet or payment-processing measures.
The records explain the payment restriction directly. UK credit and financial institutions may not establish or continue correspondent banking relationships with a designated person. They may not process payments to, from or through one. The restriction also covers credit or financial institutions owned or controlled by the designated person under the regulations.
The internet-services measure creates a separate distribution constraint. Social-media services, internet-access services and application stores must take reasonable steps to prevent UK users from accessing content, websites or applications supplied by a designated entity. For Cryptomus, Heleket, TokenSpot, VexPay and the listed payment businesses, the operational effect can therefore reach access to a service as well as movement of money.
Payment companies, exchanges and wallet operators serving UK customers now have several screening tasks. They need to map the four entity identifiers to the aliases in the records, include Bukabaev’s individual identifier, and assess entities owned or controlled by a designated business. A screen limited to the primary legal names would not cover Cryptomus, Heleket, Certa Payments or the VexPay website named in the official records.
The A7 connection remains partly undisclosed
The Foreign Office announcement says the package targeted three crypto exchanges, two payment platforms, three entities linked to Kyrgyzstan and one associated individual. It says two of the businesses processed or facilitated transactions with the A7 network. The government describes A7 as a Kremlin-backed illicit-finance network used to circumvent international sanctions on Russia’s financial sector.
A7 claimed to have moved more than $90 billion last year, an amount the government described as roughly half of Russia’s annual military expenditure. That is A7’s claim as relayed by the UK, not a transaction total independently established in the sanctions records.
The announcement does not identify which two targeted businesses processed or facilitated A7 transactions. The individual sanctions records state the government’s grounds for each designation, but they do not resolve that attribution. The next verifiable milestone will be any update to the UK records or enforcement notice that names the businesses and specifies the transactions behind the A7 finding.
