Offshore casinos are increasingly funneling FIAT and crypto deposits through anonymous, no-site “payment routing” domains that obscure the merchant of record, defeat geo-blocks, and enable transaction laundering. Our tests (incl. CoinCasino) and traffic-intelligence work (incl. Freshbet) show repeat use of the same domains across multiple brands and operators.
Introduction: How the scheme works
Recent analyses show that offshore casino operators are increasingly leveraging anonymous domains to process FIAT and crypto payments. Unlike traditional payment gateways, these operational-only domains exist without a public presence or corporate transparency. They typically:
- Mask the true merchant’s identity
- Bypass payment network rules and regional restrictions
- Enable consumers in prohibited or high-risk jurisdictions to fund gambling activity
Every casino relying on these domains fits a pattern of regulatory evasion—defeating the due diligence safeguards imposed by banks, payment service providers (PSPs), and international card networks.
These domains act as operational-only PSP portals (no public website/contacts), masking the true merchant, proxying MCCs, and routing card/wallet payments (incl. Google Pay) to offshore gambling operators. This violates card-network transparency rules, frustrates AML/CFT controls (UBO opacity, weak CDD/SOF), and constitutes transaction laundering—processing for a prohibited/undisclosed merchant via a front domain. Regulators and FIUs have repeatedly flagged such practices in the high-risk gambling vertical.
Compliance Risks and Regulatory Violations
Anonymous payment routing domains pose an unacceptable risk under financial crime and gambling regulations for the following reasons:
- Violation of Card Network and Banking Rules:
Visa and Mastercard prohibit proxy merchant category representation and require that all payment recipients are transparently identified. These domains enable disguised payments—frequently for merchants banned by acquirers and processors. - AML/KYC Evasion:
The absence of verifiable beneficial ownership, customer due diligence, source of funds checks, or sanctions screening violates core AML and anti-terrorist financing statutes. - Transaction Laundering:
Use of these domains constitutes transaction laundering—a process where the payment facilitator hides the true nature of processed transactions, rendering compliance checks ineffective. - Regulatory Enforcement:
Regulators and FIUs have issued repeated warnings and taken enforcement action against operators and PSPs involved in such payment flows. - Market Impact:
The widespread presence of these domains—appearing frequently in traffic, payment traces, and outgoing transactional links—reflects how offshore casinos (e.g., CoinCasino, Freshbet, MyStake, GoldenBet) aggressively target consumers in regulated territories, including the EU and US, without local license or controls.
Recent corroborations.
- CoinCasino: deposits routed via pay.channeltopay.com → checkout.agpayer.com → Google Pay in our tests; site promotes cards/wallets alongside crypto (Source: CoinCasino).
- Freshbet (Ryker B.V.; payment agent RYKER DEVELOPMENT LIMITED, Cyprus): Terms confirm Ryker B.V. operator and Cyprus payment agent; our traffic analysis logs show checkout.agpayer.com as the dominant outbound transactional target (Source: m.freshbet.com).
- Santeda group casinos (MyStake, GoldenBet): Terms & PDF disclosures confirm Santeda International B.V. (Curaçao) with SANTEDA INTERNATIONAL LIMITED (Cyprus) as payment agent.
Table — Discovered Anonymous Payment Routing Domains (v1)
| Domain | Role in Flow | Linked Casinos (examples) | Operator / Agent (if known) | Notes / Jurisdictions |
|---|---|---|---|---|
| agpayer.com | Payment routing / checkout hub | CoinCasino; Freshbet; MyStake; GoldenBet | Freshbet: Ryker B.V. / RYKER DEVELOPMENT LTD (CY); Santeda group for MyStake/GoldenBet (payment agent in CY) | Repeated Google Pay/card flows; front-end at checkout.agpayer.com. m.freshbet.com+2m.freshbet6.me+2 |
| checkout.agpayer.com | Final checkout page (incl. Google Pay) | Freshbet; MyStake; GoldenBet | Same as above | Dominant outbound from Freshbet per FinTelegram traffic logs. |
| pay.channeltopay.com | Gateway/API hop | CoinCasino | (Unclear; previously linked to high-risk processors in FinTelegram coverage) | Opaque, no public site; used across offshore casinos. fintelegram.com |
| rapidob.com | Anonymous routing/backend | CoinCasino; MyStake (observed) | Unknown | Opaque ownership; follow-up requested. |
FinTelegram will publish and continually update this table on our website as an industry reference for banks, PSPs, card networks, regulators, and investigators.
Required actions & evidence requests
- PSPs/Card acquirers: Treat traffic via these domains as high-risk/prohibited until (i) merchant-of-record letters, (ii) descriptor mappings, (iii) UBO/AML files, and (iv) jurisdictional licensing proofs are supplied and verified.
- Operators/Agents (e.g., Ryker B.V.; Santeda International B.V.; Cyprus agents): Provide current registry extracts (incl. UBO/PSC), processing contracts, and proof of local gaming authorization where customers are targeted/accepted. Freshbet’s Curaçao/Cyprus structure is acknowledged in its own terms; documentary substantiation is requested.
- Compliance teams: Add these domains to block/alert lists, enhance geo-blocking and source-of-funds checks, and escalate any Google Pay/card funnels using anonymous routing.
Conclusion.
The systemic use of anonymous routing domains is a clear financial-crime vector in online gambling. It undermines network rules, AML/CTF controls, and consumer protections across the EU/US. FinTelegram’s living database will drive transparency and coordinated enforcement—and we invite further submissions via Whistle42.
