UK's Russia sanctions reach a payment firm owned by Kyrgyzstan's finance ministry

By count, the package is mostly ships and procurement ^[16]. Twelve shadow fleet tankers and 17 suppliers of goods for Russia's missile and drone production make 29 of the 38 designations ^[9][16]. The crypto and payment group is five, four companies plus one director ^[15], or about 13% of the list ^[17]. The biggest claim attaches to oil: with Zarubezhneft and INK Capital added, the government says UK sanctions now cover more than 90% of Russia's oil production capacity ^[8].

The crypto designations are fewer and more carefully drafted. The government counts three exchanges and two payment platforms ^[2], but four companies face the internet services sanctions ^[7], so at least one owner holds more than one platform ^[18]. Xeltox is the only target named with two brands ^[3]. The notice designates the Vancouver company for owning Cryptomus and for activities "linked to and continued via" Heleket ^[3]. That wording suggests the UK expected the business to keep operating under a second name, and so put the sanction on the owner, where a rebrand does not escape it ^[3].

Processing KG is the harder case for Bishkek. The VexPay operator's parent is Kyrgyzstan's Ministry of Finance, and its director, Ulan Bukabaev, was designated with it ^[5]. TokenSpot and Tsunami Payments, the other two Kyrgyz targets, share an office tower in the capital ^[4]. Kyrgyzstan told 50 companies in May to stop operating once state agencies had marked them as sanctions risks ^[12]. Its finance ministry now owns a company on the UK list ^[5].

The cash runs through A7. The government calls it a Kremlin-backed "illicit finance network" for getting around sanctions on Russia's financial sector, and says the network claimed transfers of more than $90 billion last year, about half of what Russia spends on its military in a year ^[1]. That ratio puts the spending near $180 billion ^[14]. The government said two of the new targets processed and facilitated A7 transactions but did not name them ^[6].

Kyrgyzstan could treat Processing KG as it treated the 50 firms in May ^[12]; the Cryptomus business could move to a third name, as the Heleket wording suggests it already moved once ^[3]; or the EU and US could follow. The EU named HTX two months after the UK sanctioned it in May for providing financial services to A7 ^[10]. The US has since designated A7 a transnational criminal organisation, and the EU has moved toward a ban on all crypto transactions with Russian entities ^[11].

I think the internet services sanction is the term that reaches counterparties. It obliges app stores, internet providers and social media platforms to take reasonable measures to keep UK users from reaching the four companies' sites and apps ^[7]. Firms with no Russian business now carry part of the enforcement. "The message is simple: if you help Russia fund or equip this war, you will face the consequences," the Foreign, Commonwealth & Development Office wrote on X ^[13]. The counter-case is that an access block touches only UK users, while A7, by the government's description, works for Russia's sanctioned financial sector ^[1]. If the EU has not named Xeltox, Cryptomus or the Kyrgyz firms by about December, two months on the HTX timetable ^[19], the exposure stays with UK persons and UK-facing platforms, and this view is wrong.