On October 8, 2026, the UK added 38 individuals and entities to its Russia sanctions list. Five of them operate in crypto and payments. The UK Foreign, Commonwealth and Development Office (FCDO) designated three crypto exchanges and two payment platforms that it suspects Russia uses to evade financial sanctions. Three of the five platforms are linked to Kyrgyzstan. The head of one of them was also sanctioned. The same package also targeted two Russian oil companies, 12 so-called shadow fleet tankers and 17 suppliers of goods to the Russian military. The Office of Financial Sanctions Implementation (OFSI) also published a general license that allows companies to wind down business relationships with one of the oil companies until November 21, 2026.
What did the UK announce on October 8, 2026, and what does it mean for crypto businesses?
On October 8, 2026, the FCDO added 38 entries to the UK Sanctions List under the Russia (Sanctions) (EU Exit) Regulations 2019, adopted after the UK left the EU, and amended the terms of the restrictions applied to two individuals or entities already on the list. The government's official announcement divides the new measures into four areas: Russian oil companies, 12 more shadow fleet tankers, suppliers of goods to the Russian military and financial services. The last category directly affects sanctions compliance in the crypto industry. The UK says it is imposing restrictions on three crypto exchanges and two payment platforms that Russia allegedly uses to evade financial sanctions. According to the UK authorities, two of these platforms processed and facilitated transactions for the A7 network. This Kremlin-backed payment network has claimed that more than $90 billion passed through it last year.
The names of the entities are given in the official sanctions notice. Four entries cover the five platforms, one covers the head of one of them, and two more cover a Russian bank and a Russian financial services company.
Crypto and payment entities sanctioned on October 8, 2026
| Name on the sanctions list | Other names and identifiers | Location | Restrictions imposed |
|---|---|---|---|
| Xeltox Enterprises Ltd | Cryptomus, Heleket, Certa Payments Ltd; cryptomus.com, heleket.com | Vancouver, Canada | Asset freeze, trust services sanctions, director disqualification, internet services sanctions, correspondent banking and payment processing restrictions |
| TokenSpot CJSC | Cyrillic name on the sanctions list; Kyrgyz registration and tax numbers | Bishkek, Kyrgyzstan | Asset freeze, trust services sanctions, director disqualification, internet services sanctions, correspondent banking and payment processing restrictions |
| OJSC Processing KG | vexpay.net, processing-kg.com; parent entity: Ministry of Finance of Kyrgyzstan | Bishkek, Kyrgyzstan | Asset freeze, trust services sanctions, director disqualification, internet services sanctions, correspondent banking and payment processing restrictions |
| Tsunami Payments LLC | Cyrillic name on the sanctions list; Kyrgyz registration and tax numbers | Bishkek, Kyrgyzstan | Asset freeze, trust services sanctions, director disqualification, internet services sanctions, correspondent banking and payment processing restrictions |
| Ulan Arymbaevich Bukabaev | Head of OJSC Processing KG | Kyrgyzstan | Asset freeze, travel ban, trust services sanctions, director disqualification |
| LLC Commercial Bank Stolichny Kredit | Russian bank | Russia | Asset freeze, trust services sanctions, director disqualification, internet services sanctions, correspondent banking and payment processing restrictions |
| JSC Planeta | Planeta 365; planeta365.ru | Moscow, Russia | Asset freeze, trust services sanctions, director disqualification, internet services sanctions, correspondent banking and payment processing restrictions |
UK sanctions take effect from the moment of publication. From that point on, persons subject to UK jurisdiction must freeze any funds and economic resources they hold on behalf of the designated entities and stop dealing with them. UK credit and financial institutions are prohibited from maintaining or establishing correspondent relationships with them and from processing payments to, from or through them. Similar restrictions apply to institutions that these entities own or control. For five of the seven entries, internet services sanctions also apply: social media platforms, internet access providers and app stores must take reasonable steps to prevent users in the UK from accessing the relevant content, websites and apps.
The Kyrgyz connection is not new.
In May 2026, 18 more targets were sanctioned, including A7-linked individuals and a major international exchange that Bloomberg identified as HTX. The UK suspects this platform helped channel more than $1.5 billion to the Kremlin. The October sanctions add new payment channels to an already familiar scheme: TokenSpot and Tsunami Paymen
How does the UK approach differ from EU sanctions packages?
The EU and the UK are trying to close the same financial channels used by Russia, but they use different tools and act at a different pace. The EU imposes sanctions in numbered packages that bundle hundreds of new entries and systemic restrictions. Its 20th package introduced a sector-wide ban on crypto platforms registered in Russia and banned the A7A5 stablecoin. The 21st package added 14 more platforms from six jurisdictions and provided for the possibility of banning crypto-asset services from an entire third country. Each package is a large-scale but relatively infrequent event that a compliance department can prepare for in advance.
The EU's 21st sanctions package: 14 crypto platforms, the A7 network, and a ban on entire countriesJul 27, 2026Read more
The UK acts on each entity separately. The FCDO imposes sanctions when the intelligence gathered justifies it and updates the UK Sanctions List the same day. Companies do not need to wait for the next numbered package: there is no fixed calendar. Crypto-relevant sanctions were imposed in August 2025, May 2026 and October 2026. The UK has introduced neither a sector-wide ban on crypto platforms nor a power similar to the EU's to ban crypto services from an entire third country. Its main tool is the designation of a specific entity on the sanctions list, with the full set of associated financial restrictions. That is how, within a single campaign, a Canada-registered payment company and three platforms from Kyrgyzstan were sanctioned without a general sector-wide ban.
The scope of the rules differs too. UK measures are binding on persons subject to UK jurisdiction and on transactions connected to the UK, regardless of where the counterparty is located. EU measures apply to EU persons and to entities connected to the EU. A company licensed in an EU member state but working with UK customers, using sterling payment channels or served by a UK correspondent bank may be subject to both regimes at once. Complying with one of them does not automatically mean complying with the other.
UK and EU Russia sanctions in the crypto sector: a brief comparison
| Criterion | UK (Russia (Sanctions) (EU Exit) Regulations 2019) | EU (EU Council packages) |
|---|---|---|
| Legal basis | The Russia (Sanctions) (EU Exit) Regulations 2019, UK domestic legislation | EU Council regulations adopted as numbered packages |
| Who imposes and enforces the sanctions | The FCDO imposes sanctions and publishes the UK Sanctions List; OFSI within HM Treasury enforces financial sanctions | The EU Council takes decisions; competent authorities of member states enforce them |
| Who the restrictions apply to | Persons subject to UK jurisdiction and transactions connected to the UK | EU persons and entities connected to the EU |
| Frequency | New measures are introduced as intelligence comes in, with no fixed schedule; crypto-relevant campaigns took place in August 2025, May 2026 and October 2026 | Large packages are adopted several months apart: the 20th in April 2026, the 21st in July 2026 |
| Crypto-specific tools | Sanctions against individual entities, including asset freezes, trust services sanctions, director disqualification, bans on correspondent banking and payment processing, and internet services sanctions | A sector-wide ban on platforms registered in Russia; sanctions against individual platforms from third countries; the A7A5 ban; the possibility of banning crypto-asset services from an entire third country |
| Latest campaign | October 8, 2026: 38 new entries, including three crypto exchanges and two payment platforms (Xeltox Enterprises, listed together with Cryptomus and Heleket; TokenSpot; Processing KG; Tsunami Payments) | 21st package, July 2026: 14 more crypto platforms from six jurisdictions and the possibility of banning crypto-asset services from a third country |
| Where to check the list | The UK Sanctions List maintained by the FCDO; since January 28, 2026, this is the only UK source of such data | The EU Financial Sanctions Consolidated List and the regulations of the relevant packages |
| Licenses and wind-down | OFSI general licenses, for example INT/2026/11080040 for winding down transactions with Zarubezhneft; valid until November 21, 2026 | Wind-down deadlines and exemptions are set by each package's regulation; authorizations are issued by member states' competent authorities |
| Reporting obligation | Relevant firms, including cryptoasset exchange providers and custodian wallet providers, must report to OFSI as soon as practicable if they know or have reasonable cause to suspect that a person is designated or has breached a prohibition or failed to comply with an obligation. Lawyers determine which information must be reported | Information is passed to the competent authority of the relevant member state |
What does OFSI require of a crypto company's sanctions compliance program?
OFSI is part of HM Treasury and is responsible for enforcing financial sanctions. For a crypto company, this means one more regulator alongside the Financial Conduct Authority (FCA). The FCA oversees registration, financial promotions and anti-money laundering measures, while OFSI is responsible for compliance with obligations related to designated individuals and entities. A company does not need FCA authorization to fall under OFSI's requirements. If it is a person subject to UK jurisdiction, the relevant obligations apply to it.
The starting point is the sanctions list itself.
Entities added to the list after that date receive a Unique ID, but not an OFSI Group ID. For example, Xeltox Enterprises has the number RUS3755. A screening system that still uses the old list or searches for matches by the old ID will not detect any of the entries added on October 8.
Two obligations matter most. The first is to freeze funds and stop dealing: identify funds and economic resources the company holds on behalf of a designated individual or entity, freeze them and stop the relevant transactions from the date of designation. The second obligation is to report suspicious circumstances. Cryptoasset exchange providers and custodian wallet providers are among the categories of firms subject to the relevant requirements. Such a firm must notify OFSI as soon as practicable if it knows or has reasonable cause to suspect that a person is designated, has breached a prohibition or has failed to comply with an obligation under the regulations, and this information came to its attention in the course of its business. If the designated person is a customer of the company, the report must also include the nature and amount of the funds or economic resources the company held on behalf of that customer at the time it first knew or suspected the breach. If historical transactions went through Cryptomus or TokenSpot, a lawyer must assess this against the reporting criteria. It is the lawyer who determines which information must be passed to the regulator.
OFSI also issues general licenses, permissions for certain actions that would otherwise be prohibited by sanctions. The license published alongside the October campaign shows how this mechanism works. General license INT/2026/11080040 allows any person to wind down or terminate transactions with Zarubezhneft JSC or a company it owns or controls, including closing out open positions. UK financial institutions are permitted to take the actions reasonably necessary to complete such transactions. The license took effect on October 8, 2026, and expires at 23:59 on November 21, 2026. Record-keeping requirements are set out in its text.
Indirect exposure to sanctioned entities is the area where simple name matching is no longer enough. A counterparty may not be on the sanctions list but still route funds through Cryptomus, an A7-linked wallet or a platform sanctioned in one of the earlier campaigns. Whether such exposure meets the criteria for a report to OFSI must be assessed by a lawyer. This requires tracing the flow of funds at the level of blockchain addresses and entities, supporting the link with evidence rather than assuming it. The example of a platform that hid its services from sanctions compliance specialists shows the other side of the problem: some platforms split their services across different channels and restrict access depending on who the user is. As a result, a screening specialist may see a different interface from the one customers use.
Why does the A7 network remain a source of risk even after sanctions?
The A7 network was created to move money in Russia's interests after traditional financial channels were closed. It was founded by Ilan Shor, a Moldovan oligarch who has obtained Russian citizenship, and 49% of the network is owned by the Russian state-owned defense bank Promsvyazbank. The network's ruble-pegged stablecoin A7A5 can be swapped for widely used stablecoins without verifying the user's identity. The UK has gradually sanctioned different parts of this network: in August 2025, the A7A5 infrastructure and the Grinex exchange; in May 2026, A7-linked individuals; and in October, two platforms that, according to the UK authorities, processed A7 transactions. The EU banned A7A5 in its 20th sanctions package and added four more A7-linked targets in the 21st package, including entities connected to the network's activities in Africa.
Wallets that held A7A5 before the sanctions continue to exist, liquidity keeps moving, and the network's operators still have an incentive to create new addresses, use tokens wrapped in other tokens and route funds through platforms with weaker checks. An analysis of A7A5 movements after the sanctions against Grinex found a single wallet holding 94.5% of the token's entire supply. This points to a restructuring of the network rather than an end to its activity. The October campaign follows the same pattern: the UK named new payment channels, but the network they served remained the same.
The sanctions list itself identifies legal entities. For the listed platforms, the October 8 notice gives official names, alternative names, websites, registration numbers, phone numbers and postal addresses, but not the blockchain addresses of any of them. A company that wants to block on-chain transactions linked to Xeltox Enterprises or TokenSpot has to establish on its own which addresses belong to the relevant entity. Every company screening the same names does this work separately and relies on its own data sources. Sanctions authorities should publish blockchain identifiers at the time of designation and update them as an entity moves to new addresses. A list that includes both the legal entity and its associated wallets, with addresses updated in a timely manner, allows a screening system to apply restrictions on the day of publication.
For a sanctions compliance program, the practical takeaway is this: the mere presence of the word «A7» on a list is the least useful form of risk identification. Real exposure to the network shows up in links at the level of blockchain addresses, and these links change over time.
This is exactly the data and evidence a supervisor expects to see from a company when it asks: «How do you know this address is linked to the designated entity?».
