Cryptomus

Overview

Cryptomus is one of the most mature and broadly- integrated crypto payment processors in the segment. Operating since 2022 under Xeltox Enterprises Ltd. (incorporated in British Columbia, Canada), the platform supports 100+ cryptocurrencies, a base commission of 0.4 % – 2 %, and drop-in CMS integrations across WooCommerce, WHMCS, PrestaShop, Magento 2, OpenCart, Ecwid, Zen Cart, Shopify and Shopware. Reported transaction volume sits around USD 8.2 billion as of March 2026. The directory owner has personally used Cryptomus and confirms the product works as advertised — checkouts route, payments process in 1 – 2 minutes, plugins integrate cleanly, payouts arrive.

This review is therefore not a scam allegation. The directory score of 2.5 / 10 reflects two independent and well-sourced risk factors that any merchant should fully understand before integrating Cryptomus.

Reason 1 — Mandatory KYC at the merchant layer

Cryptomus sits at the bottom tier of this directory’s privacy ladder: KYC Tier L5 — Mandatory. From Cryptomus’s own help-center pages: KYC is mandatory for using Cryptomus; the merchant must provide “a document that verifies your identity (ID card, passport, residence permit or driver’s licence) and a selfie”. A separate KYC check is required before the first fiat-payment transaction on top of the standard onboarding verification. This is confirmed by the directory owner’s direct experience: the verification is real, it is hard, and it cannot be bypassed.

If KYC were the only factor, the score would sit around 3.0 – 3.5 / 10, in the same bracket as Zadarma. The second factor is what pulls Cryptomus lower.

Reason 2 — The FINTRAC CAD 176.9M administrative monetary penalty (2025-10-22)

On 22 October 2025 Canada’s Financial Transactions and Reports Analysis Centre (FINTRAC) issued an administrative monetary penalty of CAD 176.9 million against Xeltox Enterprises Ltd., operating as Cryptomus. This is the largest AMP FINTRAC has ever issued against a money services business in Canada. The decision documents 2,593 violations of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, including:

• 1,068 unfiled suspicious transaction reports — Xeltox processed transactions that should have triggered an STR filing under PCMLTFA and did not file
• Violations specifically referenced flows linked to darknet markets, proceeds of child trafficking, fraud, ransomware payments, and sanctions evasion
• Failure to comply with a Ministerial Directive concerning financial transactions associated with the Islamic Republic of Iran

Independent reporting from CBC News, the Globe and Mail, the Victoria Times Colonist, Bennett Jones (legal analysis), Rescana and others corroborates the FINTRAC decision and the appeal that followed. Xeltox filed an appeal in Federal Court in late 2025 / early 2026 arguing that the FINTRAC findings rest on “errors of law”. The core defence is unusual: Xeltox argues that it merely licenses the Cryptomus platform from a Panama-based entity called Padel West S.A., and should not be held responsible for transactions conducted by other licensees of that platform. The appeal is unresolved at audit time. The Vancouver registered address tied to Xeltox in the filings is a mailbox-service address rather than a physical operating presence.

The implication for a clean merchant is operational, not moral. The product itself runs — merchants are being onboarded, transactions are clearing, payouts are arriving in 1 – 2 minutes. The risk is regulatory exposure: if the appeal fails, or if FINTRAC (or another regulator with visibility into the appeal) determines further operational issues, the platform infrastructure itself is at risk. Funds in transit through Cryptomus wallets at that moment would be subject to whatever enforcement action follows.

Reason 2b — The Heleket parallel-operator pattern (TRM Labs, March 2026)

TRM Labs’s March 2026 intel report on Cryptomus concludes with “high confidence” that Heleket, launched January – March 2025 as Handy Elect LLC (Georgia), was created by the operators of Cryptomus immediately after Cryptomus introduced KYC controls in February 2025. Evidence cited: identical branding, matching 0.4 % fees, shared privacy registrar, shared individuals across both organisations, shared liquidity through the now-sanctioned Garantex exchange, and a documented migration of high-risk users — including CSAM vendors and ransomware cash-out actors — from Cryptomus to Heleket after the Cryptomus KYC enforcement. TRM’s explicit assessment is that the architecture “appears designed to provide Cryptomus with sufficient separation to claim plausible deniability while continuing to service a high-risk user base.”

For a merchant choosing between the two products in this operator family: Cryptomus is the entity directly carrying the FINTRAC penalty and the active appeal. Heleket inherits the risk by operator linkage but has a shorter independent track record. Both score 2.5 / 10 in this directory because the practical risk to a clean merchant is functionally identical.

Why this is in the directory anyway

Three reasons. First, transparency: visitors looking up Cryptomus deserve a sourced, complete picture rather than discovering the FINTRAC penalty after they integrate. Second, the directory owner has personally used the service successfully — that data point is real, is included in the file as the largest single positive entry in the score breakdown (“Product works as advertised — direct user attestation: +12 trust”), and is not hidden. Third, comparison value: knowing exactly why Cryptomus scores 2.5 / 10 and why Card2Crypto scores 7.0 / 10 makes the merchant payment-processor category legible at a glance. Cryptomus is the worked example of a mature, broadly-integrated processor whose regulatory exposure is the dominant trust factor.

Pricing and product specifics

• Base commission: 0.4 % – 2 % per transaction depending on plan tier and volume
• Fiat-payment intermediary fee: additional 3.9 % on top of the base commission
• Withdrawal / API-withdrawal / bulk-payment fees: $0 — Cryptomus does not charge for these
• Network fees: pass-through on the underlying chain
• Supported cryptocurrencies: 100+ — the broadest list in the segment
• CMS plugins: WooCommerce, WHMCS, PrestaShop, Magento 2, OpenCart, Ecwid, Zen Cart, Shopify, Shopware
• Open API + drop-in plugins for technical integration
• Auto-conversion: incoming payments can be automatically routed to USDT
• Virtual cards: bundled with the merchant account
• AML-checker tooling on incoming payments, designed to filter illicit inflows from clean merchant flows
• Typical processing time: 1 – 2 minutes per transaction (cited consistently across Capterra, G2 and lowendtalk reviews)

Verdict

2.5 / 10. Cryptomus is a working crypto payment gateway with a mature product surface and the broadest cryptocurrency support in the category — the directory owner’s personal use confirms the platform functions exactly as advertised. The directory score is low for the two independent reasons stated: (1) mandatory KYC of the merchant before activation, which is the opposite of what this directory rates highest, and (2) the CAD 176.9M FINTRAC penalty against the operating entity issued on 2025-10-22 for 2,593 AML / CTF violations including flows linked to darknet markets, child trafficking, ransomware and Iran-sanctions evasion, with an ongoing Federal Court appeal whose novel “Panama licensor” defence is itself a material signal of corporate opacity.

Recommended use: only if you have already weighed the FINTRAC findings, are comfortable with the appeal outcome being genuinely uncertain, and your specific use case requires the breadth of supported assets, CMS integrations and product depth that Card2Crypto and similar no-KYC peers do not yet offer.

Not recommended: if your goal is identity-free merchant onboarding and minimised regulatory exposure, browse the rest of Other Services in this directory and start with Card2Crypto (7.0 / 10 — zero KYC and zero KYB on the merchant side, USDC-Polygon settlement, 26+ aggregated on-ramp partners, no regulatory enforcement record).