UK sanctions Russian oil, tankers and crypto platforms, two linked to A7

What happened

The Foreign, Commonwealth and Development Office, or FCDO, announced new Russia sanctions on 8 October 2026. The GOV.UK release refers to 38 new designations, and the UK Sanctions Notice of the same date records 38 additions and 2 variations to the UK Sanctions List. The release lists two Russian oil companies, Zarubezhneft and INK Capital, and 12 shadow fleet tankers, which it says brings the total sanctioned to over 600. The release says UK sanctions now cover over 90% of Russia’s total oil production capacity. It also lists 17 suppliers of war-critical goods and five financial services and crypto targets: three crypto exchanges and two payment platforms.

The release says two of the five platforms have processed and facilitated transactions with the A7 network. It describes A7 as a Kremlin-backed illicit finance network used to get around sanctions on Russia’s financial sector. The UK government states that A7 moved more than $90 billion last year, roughly half of Russia’s annual military expenditure. The release does not say which two platforms handled A7 transactions.

Xeltox Enterprises Ltd, Unique ID RUS3755, has a Canadian registration in British Columbia and a Vancouver address, with Certa Payments Ltd, Cryptomus, and Heleket listed as name variations. The stated ground is the Russian financial services sector, through ownership of Cryptomus and activities linked to Heleket. Three entries sit in Bishkek, Kyrgyzstan: OJSC Processing KG, Tokenspot CJSC, and Tsunami Payments LLC. The notice gives the websites of OJSC Processing KG as vexpay.net and processing-kg.com and its parent company as the Kyrgyz Ministry of Finance. Its director, Ulan Arymbaevich Bukabaev, is also designated.

For these entries the notice lists an asset freeze, Trust Services Sanctions, a Director Disqualification Sanction, Internet Services Sanctions, and Correspondent Banking Sanctions. UK credit or financial institutions may not establish or continue a correspondent banking relationship with a designated person, or process payments to, from, or via one. The measures also reach institutions owned or controlled by the designated person.

Why it matters

The listings suggest the UK treats payment and crypto rails as targets in their own right, alongside oil and tankers. One legal entity carries three listed name variations, so screening on the legal name alone would likely miss Cryptomus or Heleket activity.

The extension to owned or controlled institutions means exposure may arrive through a counterparty rather than a direct hit. Rebadging, the evasion the release says the oil designations target, shows the same weakness: names change.

Practitioner angle

This is a live obligation for UK firms. The asset freeze, correspondent banking, and payment processing prohibitions apply to designated persons and to institutions they own or control. Put these questions to your own controls.

• Check whether screening holds every listed name, including Cryptomus, Heleket, and Certa Payments Ltd, and not only Xeltox. Add the Vancouver and Bishkek addresses and the vexpay.net and processing-kg.com websites.
• Check whether customers send or receive crypto to or through these platforms, and whether any payment processor you rely on uses them.
• Check whether any correspondent relationship or payment flow touches an institution owned or controlled by a designated person.
• Check trust and company services relationships and directorships. Trust Services and Director Disqualification Sanctions apply, so ask whether any client, structure, or director links to Ulan Arymbaevich Bukabaev or the listed entities.
• Check oil and shadow fleet exposure, including oil rebadged under unsanctioned entity names. The release flags shadow fleet vessels that may sail under false flags and are often over 20 years old.
• Treat Internet Services Sanctions as a separate measure. They require social media services, internet access services, and application stores to take reasonable steps to stop UK users reaching designated persons’ content, sites, or applications.

Load every listed name, address, and website into screening first.