Cryptomus Sanctioned for Enabling Ransomware and Cybercrime Payments
Cryptomus deliberately operated as a no-KYC (Know Your Customer) cryptocurrency platform, allowing ransomware actors, darknet markets, and sanctioned entities to move funds without identity verification. When Canada fined the platform for anti-money laundering (AML) violations, rather than comply, the operators launched a parallel service (Heleket) to continue the same illicit activity — a clear indicator of willful regulatory evasion. This case highlights how inadequate due diligence on financial service providers and crypto payment processors can expose organizations and individuals to legal liability and complicity in cybercrime. For enterprises and security teams, it underscores the critical importance of vetting all financial technology partners for AML and sanctions compliance before onboarding them.
Tactical Insight
Immediate actions
- Screen all current cryptocurrency payment processors and financial service vendors against OFAC, UK OFSI, and EU sanctions lists immediately.
- Suspend any business relationships with platforms that cannot demonstrate KYC/AML compliance documentation.
Third-party due diligence
- Require formal AML and KYC compliance certifications from all fintech and crypto payment partners before contract execution.
- Monitor regulatory news feeds (OFAC, UK OFSI, FinCEN) to receive real-time alerts when vendors are sanctioned or fined.
- Include sanctions compliance clauses and audit rights in all vendor contracts.
Long-term improvements
- Establish a formal Vendor Risk Management (VRM) program that includes periodic sanctions and compliance re-screening of all financial service providers.
- Train finance, procurement, and security teams on cryptocurrency-related AML red flags, such as no-KYC platforms and darknet market associations.
- Implement transaction monitoring controls to detect payments routed through high-risk or newly identified sanctioned entities.