From IBOX to SENDS? Alona Shevtsova, the ESBU’s UAH 5bn Miscoding Case, and the Offshore-Casino Payment Rail Question

The Holyluck whistleblower dossier has pushed one name to the foreground: Alona Shevtsova, the person with significant control of UK EMI Smartflow Payments Limited, dba SENDS. Ukraine’s Economic Security Bureau reports Shevtsova is a suspect in a UAH 5 billion “miscoding” case tied to illegal online casinos, and Poland has now detained alleged accomplice Iryna Tsyhanok in that same case. In a follow-up to the Holyluck report, FinTelegram examines what the ESBU announcement says, how the alleged laundering architecture worked, and why the combination of offshore casinos, merchant masking, and regulated payment rails deserves urgent scrutiny.

Key Findings

• ESBU case is real and current: Ukraine’s ESBU says Iryna Tsyhanok was detained in Poland in a case involving UAH 5 billion in alleged miscoded payments for illegal online casinos, and names Alona Shevtsova as a suspect.
• IBOX Bank is central to the historical scandal: Ukraine’s central bank revoked IBOX Bank’s license in March 2023 for systematic AML/CFT violations.
• SENDS/Smartflow adds a new rail: Smartflow Payments Limited is an active UK company and an FCA-authorized EMI under FRN 900873; Companies House lists Alona Shevtsova as the active person with significant control.
• The alleged method is the key story: The ESBU says the scheme used false payment purposes and controlled companies to disguise illegal-casino transactions as ordinary commerce — the same basic risk pattern raised in the Holyluck dossier.

The ESBU Case in Plain Terms

According to the ESBU, the alleged scheme revolved around miscoding: casino-related payments were routed through controlled companies and presented with false purposes for non-existent goods and services. The bureau says this enabled illegal online-casino flows to move outside their true risk classification. In April 2025, ESBU announced the detention in Poland of Iryna Tsyhanok, described as Shevtsova’s alleged accomplice and a wanted person in the same UAH 5 billion case.

This mirrors the earlier NBU findings on Leogaming Pay / LEO, where over UAH 462 million in 2020 alone were routed as “sports poker and e‑sports tournaments” to companies that never organised such events but in reality collected for illegal casinos, with miscoding to MCC 7994 (video games) rather than gambling MCCs.

In both cases, regulators highlight systemic failures (or abuse) of merchant category code assignment and transaction purpose fields, key indicators of deliberate transaction laundering. Tsyhanok’s alleged role as a bank department director suggests internal operational facilitation, including account opening, monitoring overrides, and acceptance of false descriptors for the controlled merchant network.

Shevtsova Profile

Public records portray the Ukrainian national Alona (Alyona Dehrik‑) Shevtsova as a central architect of Ukraine‑linked high‑risk payment ecosystems, spanning non‑bank payment systems, a bank, and a UK EMI. She founded LeoGaming Pay and the LEO payment system, which regulators later associated with large‑scale processing for illegal gambling via miscoded Visa/Mastercard transactions routed as “sports poker and e‑sports tournament” or video‑game payments, while funds in fact flowed to unlicensed casino operators such as Cosmolot and 1xBet.

She subsequently acquired a significant stake in IBOX Bank and served in senior governance roles, steering the institution into the gambling and high‑risk payments sector, and later emerged as the person with significant control and a director of the FCA-regulated E-Money Institution (EMI) Smartflow Payments Limited dba SENDS, creating a vertically integrated structure from non‑bank processor, to bank, to UK EMI. Ukrainian authorities have imposed NSDC sanctions on her and opened criminal proceedings for illegal gambling activities and money laundering, but at this stage she remains a suspect and is entitled to the presumption of innocence.

IBOX Bank and Iryna Tsyhanok

IBOX matters because it is the historical compliance anchor for the case. Ukraine’s central bank says it revoked IBOX Bank’s license and moved to liquidation over systematic AML/CFT violations. The ESBU’s later account gives the alleged mechanism: payments from illegal-casino players were accepted through controlled entities under false commercial descriptions. In that framework, Iryna Tsyhanok appears not as a peripheral name but as an alleged operational participant in the same miscoding architecture.

Why This Matters for Offshore-Casino Payment Rails

The Holyluck dossier alleged a familiar pattern: offshore gambling activity presented to payment systems through descriptors and coding that looked like lower-risk commerce, with a routing chain touching TAS Link / PayLink, SENDS / Smartflow, and Quicko. That dossier does not prove criminal intent by those firms. But the ESBU case makes the broader topic timely because it shows Ukrainian authorities are already pursuing a model in which illegal-casino payments were allegedly laundered through miscoding, front entities, and fragmented rails.

Companies House and FCA records confirm that Smartflow is an authorised electronic money institution (FRN 900873) and that Alona Shevtsova is the active person with significant control and director, tying the Holyluck flow structurally back to the same individual implicated in the IBOX Bank and LEO gambling‑miscoding cases.

Sanctions‑screening red flag: SENDS on OpenSanctions

An additional, material risk factor is that Smartflow Payments Limited (trading as SENDS) appears as a listed entity in the OpenSanctions consolidated dataset, under identifier NK‑UoszMKPbMFDALJozSi4NGN, with SWIFT/BIC EPSLGB22 and UK incorporation details matching the FCA‑authorised EMI controlled by Alona (Alyona) Shevtsova. OpenSanctions aggregates official and high‑risk lists from multiple jurisdictions and typology sources; an inclusion does not itself constitute a governmental designation, but for compliance purposes it is a clear high‑risk screening hit that should trigger enhanced due diligence and, for many counterparties, a risk‑based refusal to onboard or to continue the relationship.

In the context of the Holyluck payment trail—where SENDS/Smartflow acts as the acquiring endpoint for transactions that appear MCC‑masked and originate from an unlicensed offshore casino routed through Ukrainian TAS Link/PayLink layers—this OpenSanctions listing significantly amplifies the risk profile. Financial institutions, card schemes, and payment partners exposed to SENDS should therefore: (i) treat the brand as a sanctions‑screening “red” and subject to escalated review; (ii) reassess existing relationships and exposure to Holyluck and other high‑risk merchants transacted via SENDS; and (iii) ensure that all new and historical traffic involving SENDS is subjected to targeted AML/CTF reviews, including transaction‑pattern analysis and retrospective sanctions‑screening reconciliation.

Summary Conclusion

This is the compliance story to watch: not merely offshore casinos, but the payment presentation layer around them. If the ESBU is right, the scandal was never just gambling; it was about disguising gambling as something else. The Holyluck follow-up makes that issue newly relevant in a UK-regulated context because SENDS / Smartflow now sits on the map. That is not proof of repetition. It is, however, a strong reason for supervisors, schemes, and investigators to look much harder.

Summary Table

Whistleblower Call

FinTelegram invites insiders with evidence on Alona Shevtsova, Smartflow / SENDS, IBOX Bank, Iryna Tsyhanok, miscoded casino flows, or related acquiring and payout rails to contact Whistle42 securely. We are especially interested in onboarding files, MCC decisions, descriptor mapping, acquirer correspondence, and internal AML escalations.