FinTelegram’s latest casino payment-rail reviews indicate a coordinated migration from the Polish crypto on-ramp ChainValley to the Georgian payment gateway Nylo. The pattern looks disturbingly familiar: the same offshore casinos, the same fake-FIAT crypto-buy flow, the same Skrill/Neteller/Rapid Transfer/Paysafecard wrappers — and the same opacity around the true gambling beneficiary.
2-Minutes Briefing
Over the last days, FinTelegram reviewed the payment rails of several offshore casinos, including SpinBoss, DudeSpin, Betify, Malina Casino, Betalice, and Oro.gg. The reviews produced a striking pattern: where FinTelegram previously observed the Polish crypto on-ramp ChainValley, the reviewed casino cashiers now increasingly route players through Nylo, a Georgian payment gateway operating through app.nylo.pro.
The reviewed screenshots show a familiar two-step structure: the player believes they are making a normal casino deposit via Skrill, Neteller, Rapid Transfer, Paysafecard or similar payment methods. In reality, the checkout screen frames the transaction as an “Exchange order” and asks the player to agree to buy crypto and send it to a specified address. That wording is not incidental. It is the core legal and compliance wrapper of the rail.
Nylo’s public website presents the company as a payment gateway supporting cards, bank transfers, local payments, deposits, payouts and settlements. It discloses Nylo LLC, identification number 412790154, registered on 18 February 2025 in Kutaisi, Georgia.
FinTelegram’s working hypothesis is clear: utPay, ChainValley and Nylo may represent successive operating layers of the same or closely connected casino-payment network. We have not yet found a public corporate filing proving common ownership between Nylo and the UTORG/ChainValley network. But the operational evidence is too strong to ignore.
Key Findings
1. Same casino ecosystem, new on-ramp label
FinTelegram’s current screenshots show Nylo appearing in payment flows connected to offshore casino brands previously reviewed with ChainValley-style rails. The observed Nylo screens include:
| Casino / Review Context | Observed Rail | Player-Facing Method | Underlying Structure |
|---|---|---|---|
| Betify | Nylo | Skrill / Neteller-style wallet flow | “Exchange order” / buy crypto and send onward |
| Malina Casino | Nylo | Neteller-style flow | Crypto-purchase wrapper |
| Betalice | Nylo | Neteller-style flow | Crypto-purchase wrapper |
| Oro.gg | Nylo | Neteller-style flow | Crypto-purchase wrapper |
| DudeSpin | Nylo | Skrill / Paysafecard / Rapid Transfer / Neteller variants | Crypto-purchase wrapper |
| DudeSpin | MiFinity | MiFinity cashier overlay | Separate wallet rail with opaque recipient label “CME” in screenshot |
| DudeSpin | Perspecteev / Revolut | Open-banking authorization | Revolut authorization shown for PERSPECTEEV SAS |
FinTelegram recognized Nylo order pages at app.nylo.pro, with order IDs, EUR amounts, payment-brand logos, and the consent statement: “I agree to buy crypto and send it to the specified address.”
That is not a normal casino deposit flow. It is a casino funding rail disguised as a crypto purchase.
2. The utPay → ChainValley → Nylo sequence is not random
FinTelegram previously documented utPay’s role in offshore casino payment rails. UAB Utrg, operating as utPay, later announced that it had suspended all crypto-asset services from 1 January 2026 pending MiCA authorization. Its terms state that crypto-related services have been suspended and will not be provided unless and until UAB Utrg obtains the necessary MiCA authorisations.
UTORG’s own licensing page identifies UAB “Utrg” at the Vilnius address and discloses UTORG LABS HOLDING LTD in Abu Dhabi as owner of the website. The same page also contains a “Buy Crypto” link pointing to app.chainvalley.pro, creating a visible operational bridge from the UTORG web stack to ChainValley.
Chain Valley Sp. z o.o. is a Polish company with KRS 0001036419, NIP 7252331409, based in Warsaw, registered on 16 May 2023. Polish corporate data shows Ilie Cernisev as representative and shareholder, with Cernisev holding 100% of the shares in the most recent ownership period shown.
The UTORG link is reinforced by an earlier Massachusetts regulatory opinion addressed to Ilie Cernisev, CEO of Utorg OÜ, confirming his role in the Utorg ecosystem.
The ChainValley link to the UTORG ecosystem is therefore much stronger than merely circumstantial. The Nylo link is not yet proven at corporate level — but the rail behavior now looks like a third migration step.
Entity & Rail Intelligence Table
| Entity / Brand | Jurisdiction | Public Corporate / Regulatory Data | Observed / Reported Role |
|---|---|---|---|
| UTORG LABS HOLDING LTD https://utorg.com | Abu Dhabi, UAE | Disclosed by UTORG as owner of the UTORG website; registration no. 000008060, Abu Dhabi address. | Holding / brand layer for UTORG web stack |
| UAB Utrg / utPay https://utpay.io | Lithuania | Legal name UAB Utrg; Vilnius address; utPay terms say crypto services suspended pending MiCA authorization. | Earlier casino crypto-payment rail |
| Utorg OÜ https://utpay.io | Estonia | Ilie Cernisev was addressed by Massachusetts regulator as CEO of Utorg OÜ. | Historic / related UTORG operating layer |
| Chain Valley Sp. z o.o. / ChainValley https://chainvalley.pro | Poland | KRS 0001036419; Warsaw; website chainvalley.pro; Cernisev shown as shareholder/representative. | Successor rail after utPay in casino crypto-purchase flows |
| Nylo LLC / Nylo https://nylo.pro | Georgia | Identification no. 412790154; registered 18 Feb 2025; Kutaisi, Georgia; markets itself as payment gateway. | Newly observed casino crypto-purchase rail via app.nylo.pro |
Core Finding 1: The Nylo Flow Is a Fake-FIAT Crypto Rail
The reviewed Nylo payment processes are not ambiguous. They show:
Player → Casino Cashier → Skrill/Neteller/Rapid Transfer/Paysafecard selection → Nylo exchange order → crypto purchase consent → onward transfer to specified address → casino balance credit
The player-facing reality is “deposit €20 or €50 into a casino.”
The legal/technical reality appears to be “buy crypto and send it elsewhere.”
This is the same architecture FinTelegram previously flagged with utPay and ChainValley: a fake-FIAT rail where fiat-branded payment methods are used as funding instruments for an automated crypto conversion and transfer to an undisclosed destination wallet.
That structure raises obvious compliance questions:
| Risk Area | Concern |
|---|---|
| Consumer disclosure | Does the player understand they are not making a casino deposit but purchasing crypto? |
| Chargeback / refund rights | A crypto purchase may weaken the player’s refund expectations compared with a card/wallet casino deposit |
| Merchant-of-record transparency | The visible payee is the on-ramp, not the casino operator |
| AML/CFT monitoring | The true gambling beneficiary may be obscured behind a crypto-transfer wrapper |
| Gambling compliance | Licensed payment providers may not see the transaction as gambling funding |
| MiCA / VASP perimeter | The rail may move the transaction from PSD2-style payment processing into crypto-asset service territory |
Core Finding 2: Nylo Is a Fresh Georgian Entity With a Broad Payment-Gateway Pitch
Nylo’s website does not present it as a small experimental tool. It presents a mature “payment gateway” promising easy integration, fraud prevention, 24/7 support, cards, bank transfers, local payments, deposits, payouts, settlements and multi-currency processing through “own infrastructure and trusted partners.”
This matters because the reviewed casino flows do not show Nylo as a simple technology widget. They show Nylo as the conversion node in a player-facing transaction.
Georgia’s National Bank defines VASP activities to include exchange between convertible virtual assets and fiat currencies, transfer of convertible virtual assets, safekeeping/administration, trading-platform administration, lending and ICO-related services. The National Bank of Georgia has also warned that only registered VASPs or authorized financial-sector entities may provide virtual-asset services, and urged citizens to verify the activity status of providers.
FinTelegram should therefore ask Nylo directly:
Is Nylo LLC registered with the National Bank of Georgia as a Virtual Asset Service Provider? If yes, where is the registration certificate displayed for users, including on
app.nylo.pro?
This question is particularly important because the reviewed Nylo checkout is not a passive payment page. It appears to execute or intermediate a crypto-purchase-and-transfer transaction.
Core Finding 3: The Domain Pattern Looks Like a Rail Migration Signature
The domain pattern is almost too clean:
| Brand | Main Domain | Checkout / App Domain | Observed Role |
|---|---|---|---|
| utPay | utpay.io | app.utpay.io | Earlier casino crypto rail |
| ChainValley | chainvalley.pro | app.chainvalley.pro | Successor casino crypto rail |
| Nylo | nylo.pro | app.nylo.pro | Newly observed casino crypto rail |
By itself, an app. subdomain proves nothing. Many payment providers use this pattern. But in this context, the pattern becomes relevant because it appears in the same casino vertical, with the same fake-FIAT checkout logic, the same wallet/voucher funding methods, and a clean temporal handoff from one brand to the next.
FinTelegram’s conclusion: this is not merely a domain similarity. It is a behavioral and operational similarity.
Core Finding 4: ChainValley Already Had a Visible UTORG Link
The ChainValley chapter was not speculative. UTORG’s own website displayed a “Buy Crypto” product link to app.chainvalley.pro, while disclosing UAB Utrg as the legal name and UTORG LABS HOLDING LTD as the website owner.
In parallel, Polish corporate data identifies Chain Valley Sp. z o.o. and shows Ilie Cernisev as its representative and 100% shareholder in the latest ownership period. The Massachusetts Division of Banks addressed Cernisev as CEO of Utorg OÜ in a 2022 opinion concerning virtual-currency purchase and sale activity.
That combination gave FinTelegram a credible basis to describe ChainValley as part of, or at minimum closely connected to, the UTORG operational universe.
The open question now is whether Nylo is the next shell, partner, successor, or white-label instance of the same payment network.
FinTelegram Hypothesis
FinTelegram’s working hypothesis is:
The offshore casino ecosystem that previously used UAB Utrg/utPay and then ChainValley may now have migrated to Nylo LLC in Georgia. The migration appears to preserve the same payment logic: familiar fiat-branded methods are used to trigger crypto purchase orders, with the purchased crypto sent to undisclosed wallet addresses linked to casino funding. The shift may be designed to preserve high-risk casino payment capacity after regulatory pressure and negative media exposure affected earlier rails.
This is a hypothesis, not yet a final ownership finding. But it is supported by:
- The same casino vertical and overlapping brands.
- The same fake-FIAT crypto-purchase architecture.
- The same user consent wording: buy crypto and send to a specified address.
- The same wallet/voucher rails: Skrill, Neteller, Rapid Transfer, Paysafecard.
- The same
app.[brand].procheckout architecture. - The timing: utPay suspension, ChainValley exposure, then Nylo emergence.
- The lack of transparent disclosure of the ultimate casino beneficiary or destination wallet.
Compliance Questions For Nylo, ChainValley, UTORG, and Casino Operators
FinTelegram invites the involved parties to answer the following questions:
- Is Nylo LLC registered as a VASP with the National Bank of Georgia?
- Does Nylo process deposits for offshore casinos, directly or indirectly?
- Does Nylo share management, ownership, technology, code, processing partners, wallet infrastructure, merchant contracts, employees or beneficial owners with ChainValley, UAB Utrg, Utorg OÜ or UTORG LABS HOLDING LTD?
- Why do Nylo’s casino flows mirror the earlier ChainValley and utPay flows?
- Who controls the destination crypto addresses in the Nylo exchange orders?
- Are players told, before payment, that they are purchasing crypto rather than making a direct casino deposit?
- Do Skrill, Neteller, Rapid Transfer and Paysafecard approve the use of their payment methods for these offshore casino crypto-purchase flows?
- Which casino operator, payment agent or merchant-of-record receives the economic benefit of the player’s funds?
FinTelegram Assessment
This is a classic regulatory whack-a-mole pattern.
First came utPay.
Then came ChainValley.
Now comes Nylo.
Each layer appears to preserve the essential function: allow offshore casinos to accept European players’ money through familiar payment brands while reframing the transaction as a crypto purchase. The true casino beneficiary disappears behind a conversion layer. The player sees Skrill, Neteller, Rapid Transfer or Paysafecard. The processor sees an exchange order. The bank or wallet provider may see a crypto on-ramp. The casino receives funded player balance.
That is the magic trick.
And this is precisely why FinTelegram believes regulators, payment providers, wallet operators and open-banking firms should examine the Nylo flows immediately.
Whistleblower Call To Action
FinTelegram is seeking further information about Nylo, ChainValley, utPay, UTORG, and the casino payment rails used by SpinBoss, DudeSpin, Betify, Malina Casino, Betalice, Oro.gg, and related brands.
We are particularly interested in:
- merchant contracts;
- wallet destination addresses;
- internal settlement records;
- Slack/Telegram communications;
- screenshots of casino cashier flows;
- payment-provider onboarding documents;
- KYC files;
- links between Nylo, ChainValley, UAB Utrg, Utorg OÜ and UTORG LABS HOLDING LTD.
Insiders, players and compliance officers can submit information confidentially via Whistle42.
