UK Sanctions Crypto Platform Cryptomus for Enabling Russian Money Laundering and Ransomware Payments
What Happened – The United Kingdom has placed economic sanctions on Cryptomus (formerly Certa Payments, Xeltox Enterprises, and now operating as Heleket) for processing payments that fund the Russian government, ransomware groups, darknet markets, and other illicit cyber‑crime services. The sanctions freeze any Cryptomus assets held at UK banks and prohibit British companies from doing business with the platform or its affiliated services (VexPay, TokenSpot, Tsunami Payments).
Why It Matters for Trust & Control Assurance
- The case illustrates how a third‑party payment processor can become a conduit for sanctioned activity, exposing organizations to regulatory, reputational, and financial risk.
- Continuous vendor‑risk monitoring and evidence‑based sanctions screening are core control objectives that a control‑assurance program must capture and retain.
- Verisq’s Third‑Party Risk Management capability provides automated, up‑to‑date sanctions lists and transaction‑monitoring evidence to demonstrate due diligence in audit reviews.
Who Is Affected – Financial‑service firms, crypto‑exchanges, SaaS platforms handling payments, and any UK‑based organization that might have used Cryptomus or its affiliates for transaction processing.
Recommended Actions
- Immediately review all vendor relationships for exposure to Cryptomus, VexPay, TokenSpot, or Tsunami Payments.
- Update sanctions‑screening controls and ensure KYC/AML processes cover any indirect reliance on these services.
- Collect and archive evidence of due‑diligence (screening logs, contract reviews) to support audit readiness.
Technical Notes – The sanctions target a cryptocurrency payment hub that processed > $7 billion since 2022, including funds linked to ransomware, child‑sexual‑abuse material vendors, terrorist financing, and human‑trafficking networks. The platform evaded prior Canadian AML fines by launching a parallel “Heleket” service with no‑KYC processing. Source: Krebs on Security