Is Heleket safe to use now that the UK has sanctioned it?

Heleket is a real crypto payment processor, but since 8 October 2026 the United Kingdom lists it as one of the names of Xeltox Enterprises Ltd, the company behind Cryptomus. For anyone in the UK, that means no more dealings with it. For a business anywhere else, it means money that passed through this processor can be refused by the next bank, exchange or processor that checks payments against the UK list.

What the UK sanctions on Heleket say

On 8 October 2026 the UK designated Xeltox Enterprises Ltd under the Russia (Sanctions) (EU Exit) Regulations 2019. "Designated" means put on the sanctions list by name, with restrictions attached. The entry number is RUS3755.

The processor does not have a listing of its own. The entry names HELEKET, CRYPTOMUS and CERTA PAYMENTS LTD as name variations of the same company, so in UK law all three are one counterparty.

The UK's stated basis is that it has reasonable grounds to suspect Xeltox is or has been supporting the Government of Russia by carrying on business in a sector of strategic significance to it, the Russian financial services sector. The entry ties this to Xeltox's "ownership of Cryptomus and activities linked to and continued via Heleket". The entry attaches these measures:

• Asset freeze. Money and other assets the company owns, holds or controls are frozen wherever UK law reaches them, and no one bound by UK sanctions may make funds available to it, directly or indirectly.
• Banking cut-off. UK banks and other financial institutions may not keep a correspondent relationship with it or process payments to, from or via it.
• Internet services sanctions. Social media, internet access providers and app stores must take reasonable steps to stop users in the UK from reaching its sites and apps.
• Trust services and director disqualification. UK firms may not provide trust services to it, and it is barred from the management of UK companies.

Is Heleket legit, then?

For most of the service's life, asking whether it was legit meant asking whether it was a scam that would take your money. It is not a fake site: it is a working company with a public API and merchant documentation. Since 8 October 2026, though, the question has a second answer, and for a business it is the one that matters: the UK government treats the service as part of a company it has sanctioned.

That listing did not come out of nowhere. Two earlier signals point the same way:

• Canada's fine against the same company. On 16 October 2025, FINTRAC, Canada's anti-money-laundering supervisor, fined Xeltox Enterprises Ltd. (operating as Cryptomus, previously Certa Payments Ltd.) C$176,960,190. Among the violations, it failed to report suspicious transactions on 1,068 occasions in July 2024 alone.
• An analytics firm's reading of the money flows. TRM Labs, which traces money on blockchains, notes that Heleket launched in January 2025, the month before Cryptomus made identity checks mandatory. TRM estimates that 0.6% of the service's incoming volume in 2025 came from illicit sources, almost five times the average for payment processors in its data.

So "legit" now has a narrower meaning. A payout may still arrive. Whether you can lawfully take that money, and whether the next service will accept it, is a separate question, and the sanctions answer it.

Heleket or Cryptomus: does it matter which one you use?

It does not. In April 2026 TRM assessed with high confidence that the two services are operationally linked, and on 8 October 2026 the UK put both names into one sanctions entry.

A shop that moved from Cryptomus to Heleket therefore has the same counterparty it had before, now under sanctions. Like every Cryptomus user, it now needs to choose a Cryptomus alternative and move its payments there.

Who the Heleket sanctions apply to

UK sanctions bind people and companies by where they are and whose law they fall under, not by where the sanctioned company sits. The OFSI guidance (updated 12 May 2026) sets the reach. OFSI, the Office of Financial Sanctions Implementation, is the part of HM Treasury that enforces UK financial sanctions.

If you or your company are in the UK

UK financial sanctions apply to everyone on UK territory, and to UK nationals and UK-registered companies wherever they operate (OFSI guidance, section 1.4). If that is you, the asset freeze on Xeltox binds you from 8 October 2026.

In practice that changes three things:

• New payments stop. Sending customers through the sanctioned processor's checkout passes money to a designated company, which the freeze prohibits.
• Your balance there is frozen money. Funds a designated company holds are frozen under UK rules, and moving them counts as "dealing". A withdrawal you start yourself can be a breach.
• Permission comes from OFSI, not from the processor's support. OFSI can license an act that would otherwise breach sanctions, but it does not issue licences retrospectively.

A breach can lead to a criminal prosecution or a monetary penalty (OFSI guidance, section 3.1.2). A UK business with money on that balance should talk to a sanctions lawyer before pressing anything in the dashboard.

If you are outside the UK

UK sanctions do not directly bind a business registered outside the UK and run by people who are not UK nationals. The listing still reaches you through the services your money passes on its way out:

• UK banks. Any payout route that touches a UK bank stops, because UK banks may not process payments to, from or via the designated company.
• Exchanges and processors that screen. A service that checks incoming coins against sanctions lists can hold or refuse funds that came from the designated company's addresses.
• Your own country's rules. Other countries keep their own lists. This article covers the UK entry; whether your jurisdiction lists Xeltox or its brands is worth checking on its own list.

What Heleket reviews and AML holds tell you now

Reviews and forum threads about the service include stories of payments held for an AML check. AML stands for anti-money-laundering: the processor scores where incoming coins have been, and if the score says they passed through risky addresses, it freezes the payment and asks for documents.

Before 8 October 2026, an AML hold was something the processor did to its merchants. Now the processor itself is the risky stop on the coins' path. TRM warns that exposure within one or two transfers of these services can carry sanctions risk.

For a merchant, that turns the old complaint around. The coins you withdraw arrive at an exchange or another processor with a designated company in their history, and that service runs its own check. It is worth knowing how a crypto risk score is calculated and what an AML wallet check looks at before you send those coins anywhere.

Reviews written before October 2026 tell you how support answered last year. They do not tell you whether the next service will accept money that came from a designated company.

What to do if your shop takes payments through Heleket

The order matters here: the legal question comes first, and the money moves only after it is answered.

1. Find out which rules bind you. If you, your company or your bank are in the UK, stop and get a sanctions lawyer before touching your balance with the sanctioned processor. Outside the UK, check your own country's sanctions list and your bank's terms.
2. Stop routing new payments through the sanctioned processor. Take down its button, widget and payment links, so that no new customer money lands at the designated company. The cost is a few days with one payment method fewer.
3. Save your records from the old processor. Download statements, transaction hashes, invoices and the order each payment belongs to. The next exchange or processor may ask you to show where the money came from, and these records are your answer.
4. Move the old processor's balance only where you lawfully can. Outside the UK, start with a small test withdrawal to an address you control before moving the rest. In the UK, this step waits for a lawyer's view and, where needed, an OFSI licence.
5. Reconnect the checkout to a new processor. A site checkout needs the new processor's widget or API, and a bot needs its payment API. If customers pay you inside a Telegram chat, here is how to connect a crypto payment gateway to a Telegram bot.

What to check in the processor you move to

The point of moving is to end up with a counterparty that will not put you in the same position a year from now. Start with the name: search the service you are considering on the UK Sanctions List, which has a public search on gov.uk, and on your own country's list. A brand may sit in a list as a name variation of a company you have never heard of: Heleket appears there under Xeltox Enterprises Ltd.

If you move to CryptumPay, three of its terms bear on a switch like this one:

• Connection. Payment links, a checkout widget or the API.
• Withdrawals. Any time, with no minimum.
• Verification. Identity verification (KYC) is mandatory for every merchant, and the project is reviewed, usually within one business day.

If you came to Heleket because card processors turned your business down, the choice ahead of you is the one any high-risk merchant makes, and it helps to compare which high-risk payment processor fits and what it will cost you.

In short

Heleket is a real processor, but since 8 October 2026 it is, in UK law, the same sanctioned company as Cryptomus. A UK business cannot keep using it and should not move its balance without legal advice. A business elsewhere is not bound by the UK listing, but it should stop new payments through it, keep its records and move to a processor that passes the checks above.

Questions people ask next

Will sanctions close Heleket?

The UK listing does not order anyone to close. It freezes what falls under UK reach and cuts the company off from UK banks, app stores and service providers. Whether the service keeps running depends on the company and the partners it still has; the legal and screening risk for your business is there either way.

What happens to my Heleket API?

The API integration is what sends customer payments to the processor, so keeping it means every new payment still passes through a designated company. Changing the withdrawal address changes where the money ends up, not where it has been, and an AML check looks at the path. For a UK business, keeping the integration is not an option at all.

Is the Xeltox FINTRAC fine about Heleket too?

Not by name. FINTRAC's penalty of 16 October 2025 names Xeltox Enterprises Ltd. operating as Cryptomus and previously known as Certa Payments Ltd.; the newer brand does not appear in it. The link came later, when the UK put both brands into one entry under Xeltox on 8 October 2026, so the company Canada fined is the one the UK now sanctions.

This article is general information about UK sanctions as of November 2026, not legal advice. For a decision about your own business or balance, talk to a lawyer who works with sanctions in your jurisdiction.