CoinCasino Operates Without KYC Controls Despite Serving 18% US Traffic Through Anonymous Payment Gateways

Executive Summary

CoinCasino is a crypto-first offshore gambling operation marketing aggressively into Western markets while operating under an Anjouan e-gaming license. Our test registrations from multiple EU jurisdictions—including one explicitly listed as “restricted”—succeeded without KYC and allowed deposits via crypto and fiat (cards & Google Pay).

The site’s own terms state the service is owned by EOD Code SRL (Costa Rica, Corp. ID 3-101-910497) and claims license ALSI-142311005-FI2 (Anjouan). Card and Google Pay processing appears to be routed through opaque, content-less payment domains (ChanneltoPay and AgPayer), while the on-site “Buy Crypto” flow uses Changelly but completes with MoonPay (KYC by Sumsub), functioning as a de-facto fiat on-ramp.

Traffic intelligence suggests the audience is concentrated in Western jurisdictions (incl. the U.S., Germany, Italy, Netherlands). Overall risk: High (unlicensed/unauthorized targeting, KYC evasion vectors, high-risk payment facilitation).

Operator, Licensing & Regulatory Posture

Operator — conflicting disclosures. CoinCasino’s legal-entity naming is inconsistent across sources and (per your observation) across subdomains.

(a) Confirmed facts

• Operating entities named by CoinCasino:
  • EOD Code SRL (Costa Rica; Corp. ID 3-101-910497) is stated as owner/operator in the Terms on the main domain.
  • Igloo Ventures SRL (Costa Rica) is named as operator on the play.coincasino.com subdomain Terms (per our test capture), creating a conflicting disclosure across CoinCasino properties. This company is also the stated operator for the crypto-first casinos CoinKings and Telbet.
• License claim: Offshore e-gaming authorization from Anjouan (Union of Comoros), license ALSI-142311005-FI2 (as advertised by the brand).
• UBO transparency: No public disclosure of ultimate beneficial owners or controlling persons on site or in Terms.
• Payments footprint observed by FinTelegram tests:
  • Card / Google Pay routed via pay.channeltopay.com → checkout.agpayer.com → Google Pay (recipient “agpayer”).
  • “Buy Crypto” flow embedded via Changelly, completing with MoonPay (KYC by Sumsub), functioning as a de-facto fiat on-ramp into the casino wallet.

(b) Unverified OSINT claims (treat as leads, not facts)

These items circulate in affiliate forums, review sites, or secondary aggregators. We have no primary documents tying them to CoinCasino. Use for investigative follow-up only.

• Curaçao network assertions: Links to Entretenimiento Rojo B.V. (152924) under C.I.L. 5536/JAZ master license; overlap with MIBS N.V. (162031) and Simba N.V. operating sister brands.
• Cyprus payments vehicle: RDL Rojo Digital Media Ltd (HE 396053) purported as a payment/marketing subsidiary in the wider network.
• Group linkage claim: Igloo Ventures SRL allegedly “connected” to EOD Code SRL, Simba N.V., MIBS N.V., operating overlapping brands/licensing routes.
• Note: None of the above have been corroborated by registry extracts, regulator listings, operator disclosures, or PSP confirmations that explicitly reference CoinCasino.

Compliance note: Until the operator conflict (EOD Code SRL vs. Igloo Ventures SRL) and licensing nexus are evidenced with primary documents, we rate the Corporate Structure control as weak with elevated governance and accountability risk (UBO opacity, merchant-of-record ambiguity, and potential regulatory perimeter breaches in EU/UK).

Regulatory Environment — Critical Assessment:

The Anjouan licensing regime lacks credibility and enforcement capacity. The Central Bank of the Comoros has repeatedly disavowed the Anjouan Offshore Financial Authority (AOFA), explicitly stating it does not recognize AOFA or similar island entities as legitimate regulators of financial services. While these warnings address offshore banking specifically, the institutional basis for Anjouan’s gambling licensing apparatus rests on the same discredited AOFA framework.​

Anjouan licenses require minimal due diligence, feature no meaningful ongoing supervision, and offer no player dispute resolution mechanisms. The jurisdiction is frequently characterized as a “Curaçao alternative” for operators seeking minimal regulatory oversight.​

Compliances Violations:

CoinCasino’s operational model violates:

• EU Payment Services Directive (PSD2): Strong Customer Authentication (SCA) not implemented
• 5th Anti-Money Laundering Directive (5AMLD): Crypto service providers must conduct CDD
• EU Gambling Regulations: Unlicensed gambling services illegal in member states
• GDPR: Personal data processing without lawful basis
• National Gambling Acts: Violations in Germany (Interstate Treaty), Italy (ADM monopoly), Netherlands (Kansspelautoriteit), UK (Gambling Act 2005), Australia (Interactive Gambling Act)

Beneficial Owners & Key Persons

• Disclosed principals: None public on the website or Terms; only the Costa Rican corporate holder is named. We did not find verifiable public disclosures of UBOs or executives on official pages. (CoinCasino)
• Community allegations: External forum commentary references historic Curaçao/Anjouan licensing and a different Costa Rica vehicle; these are allegations and remain unverified by primary sources. (Treat as intelligence leads only.) (Reddit)

Product & Market Conduct

• Offering: Casino, live casino, crash games, sports; “No crypto? No problem!” messaging explicitly promotes Visa/Mastercard, Apple Pay, Android Pay for deposits—i.e., card rails are integral, not ancillary. (CoinCasino)
• KYC stance (as advertised): “Instant sign-ups; streamlined ID” with large monthly withdrawal caps (to $500k), indicating high-velocity player flows. Terms reserve the right to request KYC at withdrawal. (CoinCasino)
• Geo-targeting: Similarweb comparison pages list United States, Germany, Netherlands among top country sources, consistent with Western targeting and contradicting the “restricted” posture. (Similarweb)

Payment Stack & On-Ramp Mechanics

• Direct fiat acceptance: Card & Google Pay are prominently advertised. (CoinCasino)
• Observed routing (our test): Google Pay deposits flowed via pay.channeltopay.com to checkout.agpayer.com, then to Google’s checkout identifying “agpayer” as the recipient. The ChanneltoPay domain is referenced in prior FinTelegram high-risk payment investigations; AgPayer presents multiple look-alike domains and portals with minimal transparency.
• “Buy Crypto” = de-facto fiat on-ramp: The in-cashier Changelly widget ultimately redirects to MoonPay, where KYC is done via Sumsub; net effect: a fiat → crypto → casino funnel completed inside the CoinCasino flow, serving as an additional payment method rather than independent exchange activity. (Changelly publicly states it uses partners incl. MoonPay for fiat.)

FinTelegram Test Findings (Oct 2025)

• Unrestricted access: EU testers from multiple jurisdictions registered and deposited without KYC.
• Country mismatch: Despite being listed as restricted, Austria was accepted for Google Pay fiat deposit; the payment succeeded through the ChanneltoPay/AgPayer route. (Screens/logs on file.)
• On-ramp behavior: “Buy Crypto” in-flow (Changelly → MoonPay) functioned as fiat top-up into the player wallet after minimal external friction.

Compliance Assessment

Primary Risks

1. Illegal remote offering into EU/UK restricted markets; ineffective blocking. (CoinCasino)
2. KYC/AML evasion vector—seamless play & deposit without upfront KYC; KYC triggered only at late stage (withdrawal or MoonPay account creation). (CoinCasino)
3. High-risk payment facilitation leveraging opaque PSP routing domains and embedded on-ramps to simulate card acceptance while avoiding direct merchant-of-record exposure. (FinTelegram)
4. Governance opacity—no public UBOs, minimal corporate footprint beyond a Costa Rican SRL named in Terms. (CoinCasino)

Regulatory Implications (EU/UK)

CoinCasino represents a paradigmatic case of offshore gambling regulatory arbitrage. The platform deliberately structures its operations to minimize regulatory accountability while maximizing access to prohibited Western markets. The combination of controversial licensing, anonymous corporate ownership, absent KYC controls, opaque payment routing, and systematic jurisdictional restriction bypass creates an unacceptable compliance risk profile.

Summary Data Table

Conclusions & Recommendations

• For regulators/PSPs: Review ChanneltoPay and AgPayer routing into CoinCasino; assess Google Pay and card scheme exposure. Embedded Changelly → MoonPay on-ramp should be scrutinized where it functions as a payment method for gambling rather than an independent crypto purchase. (FinTelegram)
• For compliance teams: Treat CoinCasino as a high-risk merchant (Gambling MCC) with jurisdictional blocking failures and UBO opacity. Heightened EDD, blacklist/monitoring, and chargeback-risk controls advised.
• For consumers: Risk of account blocking / withdrawal friction typical of offshore crypto casinos; no EU/UK recourse.

Call for Information

FinTelegram invites insiders, PSP staff, affiliate partners, or former employees with verified information on CoinCasino’s beneficial owners, PSP arrangements (ChanneltoPay / AgPayer relationships), and operational hubs to contact us confidentially via Whistle42.