Shadow Banking at LuckyWins: Unmasking the Open Banking and Fake FIAT Rails of Novatrix SRL

A fresh Thursday test of LuckyWins’ “Playback Thursday” promotion shows the same core compliance pattern seen across offshore casino networks: jurisdictionally weak gambling licensing claims, domain mutation/redirect tactics, and payment rails that touch regulated EU/UK payment infrastructure. LuckyWins (operated by Costa Rica-based Novatrix SRL) presents a Tobique Gaming Commission licence, but this does not constitute local authorisation to offer gambling services in Europe, Great Britain, or most North American jurisdictions.

Key Findings

• Unlicensed Operations & Domain Mutation: Operated by Costa Rica-registered Novatrix SRL, LuckyWins utilizes evasive mirror domains (e.g., www.luckywins2.com) and relies on the “Tobique Gaming Commission”—a self-regulatory body with zero legal authority in the UK, EU, or North America.
• Open Banking Abuse: LuckyWins exploits open banking rails via the unlicensed Bulgarian FinTech Contiant and the Lithuanian EMI Yapily Connect UAB, directly initiating payments from European banks like Revolut to the unlicensed offshore merchant.
• The “Fake FIAT” Crypto Pipeline: Traditional bank transfers are disguised using the Polish VASP ChainValley (the successor to the suspended utPay). Players execute fiat bank transfers that secretly purchase USDC stablecoins, which are then routed to the casino. Web traffic intelligence indicates that the Luxembourg/UK-regulated PPRO acts as the underlying fiat processor for these ChainValley transactions.
• Direct EMI Complicity: MiFinity, an e-wallet regulated by the UK FCA and Maltese MFSA, is actively facilitating direct deposits to Novatrix SRL, disregarding the merchant’s lack of regional licensing.

Compliance Analysis: The Anatomy of a Shadow Rail

1. The Merchant: Novatrix SRL & The “Tobique” Facade

To understand the severity of the payment rail violations, one must first understand the merchant’s illegality. Novatrix SRL is registered in Costa Rica, a jurisdiction that does not issue traditional, internationally recognized interactive gaming licenses. To project a veneer of legitimacy, LuckyWins displays a crest from the Tobique Gaming Commission (TGC).

The TGC is essentially a self-regulatory or sovereign-nation registry based in Canada, holding no regulatory weight, oversight capability, or legal standing in major European markets. Consequently, LuckyWins illegally solicits players in the UK, EU, and North America in direct violation of local gaming and AML laws. The use of constantly rotating mirror domains (like luckywins2.com) is a deliberate tactic to bypass national ISP blacklists.

2. Open Banking Exploits (Contiant & Yapily)

Open banking was designed to democratize financial data, but it is increasingly being hijacked for transaction laundering. When a user selects Revolut at the LuckyWins cashier, they are funneled through a multi-hop rail:

1. The Gateway: Traffic hits paywith.contiant.com, operated by an unlicensed Bulgarian FinTech.
2. The Initiator: The API call is passed to Yapily Connect UAB (a licensed EMI in Lithuania).
3. The Settlement: Yapily triggers the deposit via oba.revolut.com, listing the unlicensed Novatrix SRL as the ultimate payee.

By using an authorized Payment Initiation Service Provider (PISP) like Yapily, the transaction bypasses the standard risk-scoring mechanisms of the consumer’s bank.

Read our Yapily reports here.

3. The “Fake FIAT” Pipeline (ChainValley & PPRO)

To circumvent banking blocks on gambling Merchant Category Codes (MCC 7995), offshore casinos are shifting to “Fake FIAT” transactions. At LuckyWins, when a player selects a standard bank transfer, they are routed to app.chainvalley.pro.

• The ChainValley Pivot: ChainValley Sp. z o.o. is a registered Polish Virtual Asset Service Provider (VASP) that has seamlessly taken over the illicit market share of the recently suspended Lithuanian processor, utPay.
• The Mechanism: The player believes they are funding a casino account with fiat. In reality, ChainValley uses the player’s funds to execute an immediate crypto purchase (typically USDC stablecoins), which is auto-forwarded to Novatrix SRL’s decentralized wallets.
• The PPRO Connection: ChainValley cannot process fiat directly without banking partners. Our January web traffic analysis reveals that an overwhelming 88.5% of outgoing link traffic from the ChainValley gateway terminates at PPRO (ppro.com). PPRO, a massive B2B payment infrastructure provider regulated as a Payment Institution in Luxembourg and an EMI in the UK, appears to be the primary fiat engine fueling this Polish crypto-laundering machine.

Read our ChainValley reports here.

4. The MiFinity Loophole

While open banking and crypto rails rely on technical obfuscation, the presence of MiFinity (mifinity.com, mifinity.mt) is a glaring case of direct compliance failure. Regulated by both the MFSA (Malta) and the FCA (UK), MiFinity allows users to deposit funds directly to Novatrix SRL. Processing payments for an entity that explicitly targets UK and EU consumers without a local license is a direct violation of standard EMI operating conditions.

Download the full LuckyWins Compliance Report here.

Ecosystem Summary

Export to Sheets

Whistle42 Call to Action: Help Us Expose the Network

The flow of illegal gambling funds relies on the silent complicity of European compliance departments. FinTelegram is calling on industry insiders to step forward. We are specifically seeking actionable intelligence from:

• Employees at PPRO: Are your risk committees aware that your infrastructure is powering ChainValley’s “fake FIAT” pipeline for offshore casinos?
• Insiders at Yapily & MiFinity: Who approved the merchant accounts for the Costa Rican shell company Novatrix SRL?
• Payment Gateway Developers: Who operates the shadowy checkout.siti.ws and Contiant infrastructures?

If you have processing agreements, internal compliance memos, or bank settlement records regarding LuckyWins, ChainValley, or Novatrix SRL, please share them with us. Your identity and security are strictly protected.

Submit your tips securely via our whistleblower platform.