Unlicensed offshore casinos increasingly hide behind Cyprus‑based “payment agents” that sit between players, dubious Anjouan or Curacao operators, and EU‑regulated banks and fintechs. Super Spin and Rolly Spin, allegedly run by Comentive LTD in Belize under a low‑credibility Anjouan license, explicitly use Norvelic Limited in Cyprus — fronted by nominee director Georgia Chrysostomou — as their EU payment agent, exemplifying a structurally high‑risk model that tests the limits of PSD2 and EU AML rules.
Key findings
- Offshore casinos like Super Spin and Rolly Spin use Norvelic Limited, HE 475930, Nicosia as a Cyprus “payment agent” for Comentive LTD, their Belize/Anjouan operator.
- Cypriot law firms openly market Cyprus Payment Processing Agent Companies (CPPAC) as an unlicensed bridge between offshore gaming operators and EU banks / PSPs, exploiting group‑exemption rules under PSD2.
- These agents are deliberately inserted as a layer in the payment rails, so that EU financial institutions contract with an EU company instead of directly with the offshore casino operator.
- Where the Cyprus payment agent is a wholly‑owned group entity that “only” processes the parent’s player funds, providers argue it falls outside PSD2 licensing but it still falls squarely under EU and Cypriot AML/CTF obligations.
- If the underlying casino targets markets where it operates illegally (for example without local licenses), the Cyprus payment agent and its (nominee) directors risk facilitating illegal gambling and money laundering under both Cypriot and other EU laws.
- Nominee directors like Georgia Chrysostomou, who sign for these payment agents, can face personal exposure if they know or should know that the entity processes funds for illegal casinos and misleads EU banks or EMIs about the true business.
Compliance analysis
Why offshore + Cyprus payment agent structures?
Cyprus Payment Processing Agent structures are marketed as a way for offshore‑licensed casinos to obtain EU‑recognised banking, merchant accounts and PSP integrations that they could not secure directly. Banks and fintechs (including card acquirers and firms like Revolut) often refuse to board a Belize or Anjouan casino, but will onboard an EU company with a clean registry record and a generic “payment services / IT” business description.
Law‑firm marketing explicitly describes the architecture:
- Offshore operator (e.g. Comentive LTD, Belize/Anjouan) runs the casino and holds the cheap license.
- Cyprus PPA/CPPAC (e.g. Norvelic Ltd) is incorporated as a wholly‑owned subsidiary that handles all player payments and settlements within the EU.
- The Cyprus company contracts with EU banks and PSPs and invoices the offshore casino for “payment processing” or “management” fees.
This PPA layer is therefore deliberately inserted into the rails between the offshore casino and payment institutions, both to reduce risk perception and to exploit a regulatory niche in PSD2.
Cyprus compliance when the payment agent is “in‑group”
Cyprus advisors invoke Article 3(3)(n) of the EU Payment Services Directive (PSD2) and its local transposition, which exempt intragroup payment services (between a parent and its subsidiaries) from PSP licensing. On that basis, a Cyprus payment agent that processes only its own group’s gambling revenues may legitimately argue that it does not need a payment‑institution license from the Central Bank of Cyprus.
However:
- Even if PSD2 licensing is not required, such entities must still comply with Cypriot and EU AML/CTF rules and satisfy stringent KYC/AML expectations of their banks and EMIs.
- Supervisory commentary stresses that gambling‑related businesses are high‑risk and must implement robust customer due diligence, transaction monitoring and suspicious‑activity reporting to MOKAS (Cyprus FIU).
Where the sole function of the Cyprus company is to collect EU player funds for an offshore casino that lacks authorization in target markets, the structure moves from a legitimate efficiency tool into a facilitation mechanism for potentially illegal gambling and ML/TF risk.
EU‑wide implications of Cypriot agents for illegal casinos
If Cypriot payment agents like Norvelic facilitate casinos that are unlicensed and therefore illegal in certain EU jurisdictions, they and their banking partners risk:
- Constructively participating in illegal gambling payments, similar to the “payment‑blocking” logic used by German regulators under GlüStV 2021.
- Breaching the high‑risk third‑country and high‑risk sector obligations under the EU AMLD framework, including enhanced due diligence.
- Exposure to cross‑border enforcement, civil refunds and criminal investigations where players’ home states treat such offers as illegal and recoverable.
The use of nominee directors and generic service‑provider addresses does not shield the structure from EU law; rather, it is an additional red flag for willful risk obfuscation in the payment chain.
Responsibility of nominee directors
Nominee directors such as Georgia Chrysostomou, who front Norvelic Limited and many similar entities, cannot rely indefinitely on formalistic “nominee” labels:
- Under Cypriot company and AML law, directors owe duties of oversight, honesty and proper corporate governance; knowingly signing for a payment agent that processes funds for unlicensed or illegal casinos may constitute facilitation of criminal offenses or money‑laundering.
- If they participate in onboarding, bank representations or KYC documentation that mischaracterize the business (e.g. omitting the gambling profile or illegal target markets), they risk personal civil and criminal liability, including aiding and abetting fraud, ML, and regulatory breaches.
The more these directors appear across chains of high‑risk payment agents and gaming structures, the weaker any argument becomes that they are “unaware” of the underlying business model.
Summary compliance hypothesis
Cyprus‑based payment agents like Norvelic Limited are central to an intentional regulatory‑arbitrage strategy: offshore casino operators obtain cheap, weak licenses (e.g. Anjouan), then bolt on a Cyprus payment layer marketed by local law firms as PSD2‑exempt intragroup processing, while in practice using it to secure EU banking access and conceal the true nature and illegality of their gambling offers in key markets. From a compliance perspective, these structures should be treated as high‑risk conduits whose directors and counterparties carry direct AML and illegal‑gambling exposure across the EU.
Call to whistleblowers and players
FinTelegram is expanding its Rail Atlas mapping of Cypriot payment agents, nominee directors and offshore casino structures such as Comentive LTD, Norvelic Limited, Super Spin and Rolly Spin. Players, current and former employees of Cypriot law firms, corporate‑service providers, banks, EMIs and payment agents who have knowledge of these arrangements — including onboarding files, contracts, bank representations and internal risk assessments — are invited to provide information via our Whistle42 platform. All submissions are processed confidentially and can help regulators and courts dismantle high‑risk payment chains that expose EU consumers to illegal gambling and financial harm.
