UK lists Cryptomus and Heleket as one entity on a Russia ground, and the notice never mentions ransomware

One UK listing, four names, and a stated ground that does not mention ransomware

The UK Sanctions List entry added on 8 October 2026 is not filed under the name Cryptomus. The sanctions notice lists it as Xeltox Enterprises Ltd, with three name variations: Certa Payments Ltd, Cryptomus and Heleket. That is four names in one entry (Unique ID RUS3755). The notice says the Secretary of State has "reasonable grounds to suspect" that the company is or has been "obtaining a benefit from or supporting the Government of Russia" by carrying on business in a sector of strategic significance to it, "the Russian financial services sector", "through its ownership of CRYPTOMUS and activities linked to and continued via HELEKET".

That is the whole stated case. A text search of the 44-page notice, and of the Foreign, Commonwealth and Development Office's news release of the same day, finds the word ransomware zero times in each and the words money laundering zero times in each (derived). The release does not name Cryptomus, Heleket or Xeltox at all. The listing is made under the Russia (Sanctions) (EU Exit) Regulations 2019, not under the Cyber (Sanctions) (EU Exit) Regulations 2020 that OFSI's ransomware guidance describes. Yet Krebs on Security's report of 14 October 2026 is headlined "for RU Money Laundering" and opens on ransomware, narcotics, darknet markets and fraud, which it attributes to experts. Harms of that kind are cited by blockchain analysts and, in part, by Canada's financial intelligence unit. They are not the UK's stated reason.

What the public record does not establish is longer than what it does. It gives no share of ransomware payments that touched either platform, and no source read for this briefing has a denominator. It does not say that any UK business used either platform. It does not say what happens to the money users held on them. It does not say whether moving from one brand to the other evades the listing, although the entry itself names both. And it does not say what the listing means for a user with no UK connection. Each is taken in turn below, with the nearest source.

This briefing was read from 19:04 BST on Wednesday 14 October 2026. Primary sources: the UK sanctions notice and the FCDO release; OFSI's general, ransomware, reporting and enforcement guidance and its July 2025 cryptoasset threat assessment; Canada's FINTRAC penalty notice and news release; the FCA's cryptoasset pages; and NCSC, ICO and Home Office ransomware pages. Chainalysis and TRM Labs publish analysis of their own data and sell blockchain analytics to the compliance teams that screen this exposure, a commercial interest that applies to every figure of theirs below. Krebs on Security is read as press. The UK Sanctions List website itself returned an access denied error to automated requests, so the entries were read in the notice PDF that reproduces them, and the live list was not read.

Stated and not stated: the notice and the release, line by line

The table sets what the notice and the release state against what neither states. Not stated means not found in either document, read in full. It does not mean the information does not exist.

What the UK sanctions notice of 8 October 2026 (44 pages) and the FCDO news release of the same day state, and what they do not. Read from the PDF and the GOV.UK page on 14 October 2026.

Question	Stated	Not stated
What is listed?	One entity, Xeltox Enterprises Ltd, with the name variations Certa Payments Ltd, Cryptomus and Heleket, at a Canadian address.	Any separate legal entity for Heleket. TRM Labs says Heleket is a company incorporated in Georgia; the UK entry names none.
Under which law?	The Russia (Sanctions) (EU Exit) Regulations 2019.	Any listing under the Cyber (Sanctions) (EU Exit) Regulations 2020, the regime OFSI's ransomware guidance describes.
On what ground?	Reasonable grounds to suspect support for the Government of Russia through the Russian financial services sector, via ownership of Cryptomus and activities continued via Heleket.	Ransomware, money laundering, narcotics, darknet markets, fraud, child abuse material or any other crime. No transaction, volume or date is cited.
Which measures?	Asset freeze; trust services sanctions; director disqualification sanction; internet services sanctions; correspondent banking and processing payments sanctions.	Any explanation of the trust services and director disqualification measures in the notice text. Any general licence for Xeltox: the one general licence OFSI issued on 8 October is for another designated company.
What does the release call them?	"Three crypto exchanges and two payment platforms", "three linked to Kyrgyzstan and one linked individual".	Which entry is an exchange and which a platform. The release names none of the five.
Is there an A7 link?	The release says two of the entities "have processed and facilitated transactions with the A7 network".	Which two. Chainalysis ties TokenSpot to the A7A5 network; it makes no such link for Cryptomus or Heleket.
Who must comply?	Everyone in the UK, and every UK national or UK-incorporated company wherever it operates (OFSI general guidance).	Any effect on a user outside the UK with no UK connection.
What happens to funds?	An asset freeze: the designated person's funds and economic resources are frozen, not confiscated and not moved to OFSI.	How balances that customers hold on the platforms are treated, or whether either platform can still pay out.

The measures, in the notice's words, are an asset freeze, trust services sanctions, a director disqualification sanction, internet services sanctions, and correspondent banking and processing payments sanctions. The banking measure bars UK credit or financial institutions from a correspondent banking relationship with the designated person and from "processing payments to, from or via" it. The internet measure requires social media services, internet access services and application stores to "take reasonable steps to prevent users in the UK from accessing" content, sites or applications it provides. That one is aimed at platforms and access providers, not at ordinary businesses. Krebs's gloss, that the sanctions "freeze any Cryptomus assets at U.K. banks" and bar British companies from offering it "any business, virtual or otherwise", is a shorthand: the asset freeze is not limited to bank accounts, and the notice does not use the phrase any business.

Two questions come first for readers. For users outside the UK, OFSI's general guidance says financial sanctions apply to all persons within the territory and territorial sea of the UK and to all UK persons wherever they are in the world. Its enforcement guidance adds that what matters is a connection to the UK, which it calls a UK nexus, such as a UK company working overseas or transactions using UK clearing services. On that wording a user with no such connection is outside the scope of the freeze, which is a reading and not a statement in the notice. In practice the effect can still arrive through UK-connected banks, app stores and platforms. Whether the United States or the European Union list either platform was not checked against a primary list, although a web search found no report that they do. For users' funds, OFSI's guidance says an asset freeze does not change ownership of the frozen funds and does not confiscate them or transfer them to OFSI. The notice does not say how balances that customers hold on the platforms are treated. Krebs shows a Telegram support message of 8 October saying the platform was suddenly unable to process transactions. No source read says what became of those balances.

The days, the fine and the rate: what each number counts

Three dates carry the story, and the gaps are small. The UK designated on Thursday 8 October 2026, and the FCDO release is stamped 12:21 BST that day. The Chainalysis post is dated 8 October on the page; its machine-readable publication time is 01:14 UTC on 9 October, which is 21:14 on the evening of 8 October in New York (derived). Krebs on Security published on Wednesday 14 October, at 10:22 by the page's own stamp, with no time zone given. So Chainalysis came 0 or 1 day after the designation depending on which stamp is used, Krebs came 6 days after it, and Krebs came 5 or 6 days after Chainalysis (derived). The figure of more than 900 in Krebs's report is quoted from the Chainalysis post, so the report adds a reading, not a new count.

The Canadian fine is the number that travelled with the least care. FINTRAC's own notice gives CAD 176,960,190, imposed on 16 October 2025 and announced on 22 October, after FINTRAC proposed it on 17 July 2025. Krebs writes CAD 176 million in 2026; his 2025 article gave the exact figure once and also wrote "$173 million" in one sentence. Chainalysis writes CAD 177 million, and TRM Labs writes "nearly CAD 176 million" and dates it to 22 October. The primary rounds to 177 million. The base FINTRAC gives is a count, not a sum of money: the penalty covers 2,593 contraventions in six types, an average of CAD 68,245 each (derived; FINTRAC does not split the penalty by type). Of those 2,593, 2,586 are two counts for July 2024 alone: 1,068 suspicious transactions not reported and 1,518 large virtual currency transactions not reported (derived: 99.7 per cent). The other seven are single failures in three types plus four missed registration updates. FINTRAC's news release gives one more base: in 2024 to 2025 it issued 23 notices of violation totalling more than CAD 25 million, so this one penalty is at most 7.1 times that whole year (derived). The penalty is under appeal to the Federal Court, and no source read says how the appeal stands on 14 October 2026.

The FINTRAC notice gives no turnover, revenue, profit or transaction value, so no ratio of fine to revenue can be computed from it. As a rough scale only, mixing currencies and sources, CAD 177 million against TRM Labs's figure of USD 7 billion in total transactions since 2022 is about 2.5 per cent if the two currencies are treated as equal (derived). TRM's own profile page gives two totals, USD 7 billion in its text and USD 8.2 billion in its header as of March 2026, and does not define either beyond "total transactions". A blockchain analyst quoted by Krebs in 2025 said a fine of this size would be "the cost of doing business" to the company, and in 2026 that a fine "doesn't stop" a processor processing while sanctions "kill the operation".

Chainalysis says the number of illicit counterparties "surged to more than 900 in a single month in late 2025". Spread over a 30-day month that is 30 a day, over a 31-day month 29 a day, about one every 48 to 50 minutes round the clock (derived). The month is not named, "more than 900" is a floor, and the figure counts distinct counterparties that Chainalysis labels illicit and that sent funds in that month, not transactions and not new arrivals. Spreading it evenly across days is arithmetic, not a finding. Chainalysis adds its own caution: when authorities designate an entity, its past transactions can begin to count towards a service's illicit counterparties, so the spike "may also partly reflect new sanctions designations".

A look-alike number needs a warning. FINTRAC counted 1,068 suspicious transactions that Cryptomus failed to report in July 2024, which is 34 a day over 31 days (derived). That sits close to Chainalysis's 29 to 30 counterparties a day, and the two are not comparable: one is transactions a regulator says should have been reported, in one month of 2024; the other is distinct counterparties tagged illicit by a vendor, in an unnamed month of 2025.

What each figure counts and does not count. Derived figures are marked. Sources: FINTRAC (22 October 2025), the UK notice, Chainalysis and TRM Labs (8 October 2026), TRM Labs profile (20 April 2026).

Figure and source	What it counts	What it does not count
CAD 176,960,190 (FINTRAC)	An administrative penalty for 2,593 contraventions in six types, found proven against Xeltox Enterprises Ltd and under appeal.	Money collected, a transaction value, or a finding about how much of the business was ransomware.
2,593 contraventions (FINTRAC)	Instances across six types. 1,068 and 1,518 are July 2024 counts. The six types add to 2,593 only if the Iran directive failure counts once (derived), though the notice describes 7,557 Iran-origin transactions.	All of the company's activity, or anything after 2024.
More than 900 illicit counterparties in a month (Chainalysis)	Distinct counterparties Chainalysis labels illicit, both services combined, in one unnamed month of late 2025, with labels applied retrospectively.	Transactions, value, UK users, or ransomware payments as a category.
More than 15,000 illicit actors (Chainalysis)	Illicit actors that sent funds across every category Chainalysis tracks.	Whether the count is per service or combined, the period, or any share of any one category.
USD 7 billion or USD 8.2 billion (TRM Labs)	Total transactions processed since 2022, undefined further, with two totals on one page.	Illicit volume. TRM puts about 0.6 per cent of Heleket's 2025 incoming volume as illicit, in its labelled data, which does not say the other 99.4 per cent is clean.
38 designations (notice, FCDO)	23 entities, 3 individuals and 12 ships among the 38 additions (derived from the entries).	"38 entities", as the Chainalysis post words it.

Friendly names: who is on the other side of a payment processor

Every source uses a different label for the same listed person, and a label that describes a function is not a control. The labels here did real work: they put the business in a category that sounds routine and supervised. The table sets each label against what the record says.

Labels used for Xeltox Enterprises Ltd and its brands, what the record says about each, and what the label hides. Sources are named in the first column.

Label and who uses it	What the record says	What the label hides
"Payment processor" and "payment hubs" (Chainalysis); "payment processor and exchange" (TRM Labs)	Chainalysis says the services "presented themselves ostensibly as legitimate payment processors", with lax compliance. Ostensibly is its word.	A processor holds other people's money and sees every deposit and payout. The counterparty at a checkout is whoever the processor routes to.
"Money services business" and "reporting entity" (FINTRAC)	FINTRAC's notice describes a reporting entity providing virtual currency transaction services, at a Vancouver address associated with a mailbox service, with no employees working in Canada. Representatives dealt with FINTRAC from Uzbekistan and Spain. The UK entry gives the same Vancouver address.	Registration was a filing, not a supervised operation. FINTRAC records that the company admitted it deals only in virtual currency, not what its registration said.
"Cryptomus" and "Heleket" as two services (Heleket's support agent, as Krebs reports it)	The UK lists both as names of one entity. TRM Labs assesses with high confidence that they are operationally linked, and says Heleket is incorporated separately in Georgia. Krebs reports the denial of affiliation and says it is contrary to the evidence.	A brand is not a legal entity. A listing can name a brand, one entity can run several, and a separate company can sit behind one.
"Rebrand" (Krebs: the platform changed its name "most recently to" Heleket "last year after" the Canadian fine)	TRM Labs dates Heleket's launch to January to March 2025, as a parallel service, and the penalty was imposed on 16 October 2025: 199 to 288 days later (derived). The two ran side by side.	Order and replacement. On TRM's dates the second brand came before the penalty and did not replace the first.
"Mixer" against "processor" (Chainalysis)	Mixers are built to obscure where funds come from. Across five categories the two services still received more from illicit actors than all the mixers Chainalysis tracks.	That a label can make a higher-risk service look lower-risk than a tool built for concealment.
"VexPay" (Krebs)	The notice lists OJSC Processing KG, whose entry names the Kyrgyz Ministry of Finance as parent and lists websites. Krebs names the platform VexPay, and TRM Labs discusses VexPay under that entry. Its ground is business of economic significance to the Government of Russia, not the financial-sector ground of the other four platform entries.	That the listed person is the company, and that this entry rests on a different stated ground.
"Licensed" or "regulated" (Krebs, 2024 reporting)	Krebs reported that a body billing itself as the regulator overseeing cryptocurrency licences in a disputed territory in North-West Africa was linked through a shared director to the company then called Certa Payments Ltd. In 2026 he calls it phony. Not verified for this briefing.	A licence is only as good as the body that issued it.

The pattern has a precedent in OFSI's own words. In its July 2025 cryptoasset threat assessment OFSI judged that the reformulation of a designated Russian exchange under a new name was "likely to constitute a significant attempt to evade or circumvent sanctions", and noted that "supposedly separate entities may operate using shared infrastructure". Its enforcement guidance asks for "careful scrutiny" where designated persons appear to have tried to avoid thresholds, and lists recent changes of ownership as a thing to examine.

Here the listing does the work in one direction. The entry names Heleket, so a screening list built from the entry catches both brands, as TRM Labs also notes. What it cannot catch is a third brand, a differently incorporated company the entry does not name, or a wallet. The legal route for those is OFSI's ownership and control test: more than 50 per cent of shares or voting rights, the right to appoint or remove a majority of the board, or being able to ensure the entity's affairs are conducted in accordance with the person's wishes. Whether that test reaches the Georgian company TRM Labs describes is a question the public record does not answer. The same goes for a UK-incorporated company called Certa Payments Ltd that Krebs reported finding at Companies House in 2024: the record read here does not say whether it is the same legal person as the listed entry, and Companies House was not searched for this briefing.

What the record says about ransomware, and what it does not

No source read for this briefing says what share of ransomware payments touched Cryptomus or Heleket. The nearest statements are below, each about something narrower than a share.

Statements linking Cryptomus or Heleket to ransomware in the sources read, and what each does not establish. Vendor sources carry the commercial interest stated above.

Source	What it says	What it does not establish
FINTRAC notice (22 October 2025)	The 1,068 suspicious transactions not reported in July 2024 involved known darknet markets and wallets linked to criminal activity, such as child abuse material, fraud proceeds, laundering of ransomware payments and sanctions evasion.	How many of the 1,068 were ransomware, any ransom amount, or any UK victim.
Chainalysis statement to Krebs (December 2024)	It sees threat actors "engaged in ransomware", narcotics, darknet markets, fraud, cybercrime, sanctioned entities and hacktivism making deposits to Cryptomus.	A count or share, a date range, or that the deposits were ransom proceeds.
Chainalysis post (8 October 2026)	Proceeds from ransomware groups such as Black Basta have flowed through the services. The five categories where the services beat all tracked mixers are scams, sanctioned jurisdictions, escort services, terrorist financing and the EU 20th package category.	A volume. Ransomware is not among the five categories.
TRM Labs profile (20 April 2026)	One ransom payment of about USD 122,246 by a Canadian victim in December 2025, to a ransomware-as-a-service operation, was traced to deposits at both services, among others.	More than one case, a UK victim, or any share of ransomware cash-out.
UK notice, release and OFSI pages	None connects either brand to ransomware. No NCA or NCSC statement naming either was found: the NCA and FCA website searches returned no results, a web search found none, and the NCSC search page could not be read by script.	That none exists. This is absence in what was read.
Krebs (14 October 2026)	Experts see the platform as a major conduit for ransomware, narcotics, darknet market, fraud and cybercrime-service payments.	Who the experts are beyond one named analyst and Chainalysis, or any measure.

The list in Krebs's 2026 sentence matches the categories Chainalysis gave him in December 2024 (inference from the wording). That is a list of what is present. A conduit claim needs a denominator, such as ransom payments traced to the platforms over all payments traced in the same period, and nobody has published one.

UK sanctions law as OFSI's pages state it, in plain terms

Everything in this section is read from OFSI's general guidance, its enforcement and monetary penalties guidance, its reporting page and its ransomware guidance, as published on GOV.UK and read on 14 October 2026. It is not legal advice, and OFSI says the same of its own pages.

What the freeze forbids. It is generally prohibited to deal with the funds or economic resources of a designated person, to make funds or economic resources available to or for the benefit of one, directly or indirectly, and to circumvent the freeze. OFSI says cryptoassets are covered. The prohibitions also reach entities that a designated person owns or controls, even if they are not named on the list. If you know or have "reasonable cause to suspect" that you hold or deal with a designated person's funds you must freeze them, not deal with them, and report to OFSI. Reasonable cause to suspect is an objective test: whether there were factual circumstances from which an honest and reasonable person should have inferred knowledge or formed the suspicion.

Who is bound. Everyone in the UK and every UK person wherever they are. OFSI's enforcement guidance says a breach need not happen in the UK for OFSI's authority to be engaged: a connection is enough, and its examples include a UK company working overseas, transactions using UK clearing, and action overseas directed from the UK.

Who must report. OFSI lists cryptoasset exchange providers and custodian wallet providers among the relevant firms that must tell OFSI as soon as practicable if they know or reasonably suspect that a person is a designated person or has breached a prohibition. Its July 2025 assessment says cryptoasset firms were added to that list in August 2022, that just over 7 per cent of suspected breach reports since January 2022 involved cryptoasset firms, and that it is "almost certain" UK cryptoasset firms have under-reported. Since 28 January 2026 the UK Sanctions List is the only source of UK designations, and newly designated persons carry only a Unique ID, which OFSI asks reports to include.

What reduces the risk. OFSI does not mandate any system or control. It treats prompt and complete voluntary disclosure as mitigating and applies a discount of up to 30 per cent to a penalty for voluntary disclosure and co-operation. On ownership and control it treats appropriate due diligence as mitigating where the conclusion was reasonable and reached in good faith, and says the onus of showing that rests on the person OFSI is considering action against.

Licences. A licence is OFSI's written permission for an act the freeze would otherwise forbid. OFSI does not accept applications for general licences. One general licence was issued on 8 October 2026, to allow wind-down of dealings with another designated company. Of the three general licences GOV.UK search listed for 6 to 15 October, none concerns Xeltox (not found is not proof none exists). OFSI says ransomware payments are unlikely to be considered appropriate for a licence. Whether a UK business holding a balance on a listed platform may ask for it to be released without a licence is not answered by any page read.

The FCA registration regime and the travel rule, as read

The FCA is the anti-money laundering and counter-terrorist financing supervisor of UK cryptoasset businesses under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. Cryptoasset exchange providers and custodian wallet providers carrying on business in the UK must register with the FCA before they start, and have had to since January 2020. The FCA states that registration "is not a recommendation or endorsement of your business", and that being registered does not give customers access to the Financial Ombudsman Service or the Financial Services Compensation Scheme.

A new regime is coming. The FCA page, last updated 12 February 2026, says the government laid draft legislation in December 2025 and expects the regime, under which firms need authorisation under the Financial Services and Markets Act 2000, to come into force on 25 October 2027. The FCA's cryptoassets page records that it published final rules and guidance on 30 June 2026, which will apply to firms granted permission under that Act on or after 25 October 2027. Until then the registration regime above is the one in force.

The travel rule applies since 1 September 2023, under Part 7A of the same regulations. UK cryptoasset businesses must collect, verify and share information about the sender and receiver of cryptoasset transfers. The FCA expects firms to take all reasonable steps, says they stay responsible when they use a supplier, and says that when a transfer arrives from a jurisdiction without the rule with information missing, the firm should make a risk-based assessment of whether to make the assets available to the beneficiary. The rule applies to cryptoasset businesses. An ordinary company that pays or accepts crypto is not bound by it, though its exchange may ask it for related information.

OFSI's assessment encourages anyone dealing with a cryptoasset firm to check the FCA register, or the equivalent register of the firm's home jurisdiction. An FCA website search for Cryptomus returned no results. The FCA register itself was not queried, so this briefing does not say whether either platform was ever registered in the UK. Registration in a home jurisdiction proved a weak test here: Xeltox was a registered money services business in Canada, and FINTRAC found a mailbox address and no employees in the country.

Ransomware guidance as read: OFSI, the NCSC, the ICO and the proposals that are not yet law

UK ransomware guidance read on 14 October 2026, what it says about paying, and what it does not do.

Document and date	What it says	What it does not do
OFSI, financial sanctions guidance for ransomware (updated 28 January 2026)	Paying a ransom to a designated person risks civil and criminal penalties, for the payer and for anyone who facilitates or processes the payment. Ransomware payments are unlikely to be considered appropriate for a licence. If a victim reports through the NCSC portal and promptly and fully discloses a payment to OFSI, OFSI and the NCA are "more likely" to resolve a breach by means other than a monetary penalty or criminal investigation. OFSI says the UK government does not condone ransomware payments, whether you are dealing with a designated person or not.	Mandate a screening system or any control. The onus is on the organisation.
NCSC, guidance for organisations considering payment in ransomware incidents (14 May 2024, version 1.0, with ABI, BIBA and IUA)	Payments "may not be lawful" if made to an entity or area sanctioned by the UK. Review alternatives including not paying, record decision-making offline, report the incident, and know that paying does not fulfil regulatory obligations.	Override specific laws. The decision to pay stays with the victim.
ICO, ransomware and data protection compliance (page marked as under review after the Data (Use and Access) Act)	Encrypted personal data is a personal data breach. Notify the ICO within 72 hours of becoming aware unless the breach is unlikely to risk individuals' rights and freedoms, and keep a record either way. The ICO does not consider paying a ransom an "appropriate measure" to restore personal data.	Treat payment as mitigation. The NCSC page repeats that payment would not reduce a penalty.
Home Office, consultation response of 22 July 2025	Three proposals: a targeted ban on payments by the public sector and regulated critical national infrastructure; a payment prevention regime for everyone else; and mandatory incident reporting with 72 hours as the suggested time. Under the second, organisations not covered by the ban would tell the government they intend to pay, and the government could say whether the payment risks breaking the law by sending money to sanctioned groups.	Become law, as far as read. The response says the government will keep developing the proposals, and scope, penalties and thresholds are open.

The consultation ran from 14 January to 8 April 2025 and drew 273 responses. The response says that, if progressed, the package would be the first specific measures in UK law to counter ransomware. Its figures are views of respondents, not decisions: 72 per cent agreed with a targeted ban, 47 per cent net agreed with an economy-wide payment prevention regime, and 63 per cent net agreed with economy-wide mandatory reporting. The consultation page read was last updated on 2 September 2025, and a search of GOV.UK for ransomware material published since 1 January 2026 returned guidance and speeches, with no bill, regulations or commencement notice for any of the three. That is absence in one search, not proof.

For this story the payment prevention proposal is the relevant one. Today the sanctions check before a ransom payment is the payer's, and OFSI's guidance leaves the method to each organisation. If the regime comes, the response says victims who complied would get proof of engagement to show a payment broker or facilitator, and the government could say whether a payment risks breaking the law before it is made. Until then the check is the payer's, and the entry's designation date is 8 October 2026.

What a UK business should check, in order

The order follows risk: stop any breach you may be in now, then find your exposure, then fix the controls, then prepare for the next listing. This is a reading of the guidance above and not legal advice.

The question the listing exposes

Most sources in this briefing, the UK's own release included, describe the business by a function: processor, exchange, platform. The notice describes it as an entity with four names, the owner of one brand and the continuation of its activities through another. The word ransomware is in none of the UK's documents about it, and it is in the first paragraph of the Krebs report. If your payments team were asked tomorrow to name, for every crypto processor that you or your ransomware negotiator has used since 2022, the legal entity behind the brand, the country that registered it and the body that supervised it, how long would the answer take, and would it match what the UK Sanctions List says?

Key facts