Intelligence Brief: The “Colors & Animals” Payment Laundering Scheme

Executive Overview

A complex payment laundering framework has been uncovered that relies on the constant rotation of short-lived payment processors registered primarily in Cyprus. These entities are used to support illegal online casino operations aimed at players in the Netherlands and Germany.

The structure follows a recognizable “Colors & Animals” naming logic for payment shells, allowing operators to quickly abandon sanctioned entities and replace them with newly incorporated ones once regulatory pressure emerges.

This report builds on and expands intelligence provided via the Scam-Or Project whistleblower section, confirming a deliberate phoenixing strategy intended to bypass enforcement by the Dutch Kansspelautoriteit (KSA). The network preserves uninterrupted access to payment rails through a combination of corporate service providers and regulated fintech intermediaries.

Network Design and Operational Logic

The “Colors & Animals” Rotation Model

At the core of the system is a repeatable lifecycle: when one payment agent becomes exposed or sanctioned, transaction volume is rapidly rerouted to a newly activated entity with a different name but identical infrastructure.

Each shell follows a simple pattern:

• Color + Animal naming
• Cyprus-based incorporation (in most cases)
• Shared administrators and registered addresses
• Temporary operational lifespan

This model ensures continuity for the underlying casino brands while limiting regulatory exposure at the entity level.

Documented Payment Agent Timeline (2023–Present)

When Sarah Eternal was fined for operating the Casino Sky brand without mandatory player protection measures, processing activity was immediately redirected to Red Raven Limited. After Red Raven drew attention, the same flows shifted again—this time to Brown Bear Limited and Moody Moose, both of which remain active within Cyprus.

Centralized Infrastructure: Emidala & Lokemor

A Single Administrative Control Point

Despite the apparent diversity of companies, all identified payment shells converge on a single administrative hub in Limassol, Cyprus.

Key registry links include:

• Emidala Business Centre Ltd (HE 443388) – Director: Georgia Katsampa; Secretary: Lokemor Limited
• Lokemor Limited (HE 283397) – Secretary for multiple network entities
• Georgia Katsampa – Director across Emidala Business Centre Ltd, Nordam Invest Ltd, and Blue Triangle Limited
• Giorgoulla Tsiakkirou – Listed as liquidator in British Virgin Islands notices, suggesting cross-border entity coordination

All relevant companies are registered at 34 Makarios III, Hadjiyianni Building, 3065 Limassol, confirming a shared operational base.

Conclusion: identical secretary, overlapping directors, and a single address strongly support the existence of a centralized command structure.

Corporate Restructuring and Operator Obfuscation

The Deep Dive Tech B.V. Layer

Whistleblower documentation highlights a calculated shift in corporate presentation. Casino brands such as Bull Casino, Simple Casino, and Casino Sky were previously linked to Hero Gaming. These references have since been removed from public disclosures.

In their place, Deep Dive Tech B.V. now appears as the operator, registered in Curaçao under license 365/JAZ (registration number 154314). Despite the apparent change, payment routing remains unchanged, continuing through Emidala → Brown Bear / Moody Moose.

A critical disclosure confirms continuity: PlayBoom.com, operated by Deep Dive Tech B.V., openly lists Red Raven Limited and Silver Swan Limited—both registered at the Hadjiyianni Building—as service providers. This directly ties the Curaçao-licensed operator to the Cypriot shell infrastructure.

Hero Gaming’s Detachment Playbook

Removing casino brands from Hero Gaming’s public materials follows a familiar pattern in illicit gambling ecosystems. As scrutiny increases, parent groups reduce visible associations while preserving revenue via service contracts and intermediaries. This creates plausible deniability without disrupting cash flow.

Payment Rails and Fintech Enablement

Yapily Connect UAB as a Critical Facilitator

Throughout 2023, Yapily Connect UAB, operating as Yapily (https://www.yapily.com/), processed transactions for Red Raven Limited using open banking infrastructure.

Regulatory status:

• Bank of Lithuania – Payment Institution authorization code LB002045 (since 2020-12-23)
• UK FCA – Payment Institution reference 827001

Yapily publicly promotes its services to iGaming operators, emphasizing strong customer authentication and AML/KYC compatibility. However, continued processing for an unlicensed operator serving restricted Dutch and German markets raises serious questions about due diligence standards.

Previous Scam-Or Project payment rail reviews have repeatedly identified Yapily as a gateway for offshore gambling platforms.

Regulatory Arbitrage and Phoenixing Strategy

Core Characteristics

• Rapid Incorporation: Cyprus enables fast creation of replacement shells
• Shared Backbone: Common addresses, directors, and secretaries preserve continuity
• Multi-Jurisdiction Setup: Costa Rica (Sarah Eternal), Curaçao (Deep Dive Tech B.V.), Cyprus (payment shells)
• Fintech Cover: Regulated open banking providers add perceived legitimacy

This refined phoenixing approach neutralizes entity-specific sanctions while keeping the wider system intact.

KSA Enforcement Constraints

The €900,000 penalty imposed on Sarah Eternal exceeded the standard base fine due to aggravating factors:

• No age verification
• Acceptance of cryptocurrency
• Autoplay functionality
• Absence of Dutch geo-blocking

Despite its size, the sanction targeted only a single entity. No parallel action was taken against payment facilitators or service providers, allowing the network to resume operations almost immediately under new corporate identities.

Risk and Market Implications

Targeting High-Value EU Markets

Dutch and German players are deliberately targeted due to high lifetime value and strict domestic regulations. Demand for unlicensed casinos persists among users seeking to bypass deposit caps and self-exclusion systems.

Consumer Harm

Lack of age controls and responsible gambling tools exposes vulnerable users to addiction and financial loss. Crypto payments further reduce transparency and safeguards.

Money Laundering Exposure

Centralized payment routing through Cyprus, combined with offshore licensing and open banking APIs, aligns with FATF-recognized casino laundering typologies, particularly layering through seemingly legitimate transactions.

Recommendations

Immediate Measures

• Review Cyprus Service Providers: Examine Emidala Business Centre Ltd and Lokemor Limited for AML compliance failures
• Fintech Oversight: Assess Yapily Connect UAB’s onboarding and monitoring under PSD2 and AMLD5
• Joint Investigations: Coordinate between KSA, German GGL, and Cyprus regulators with a focus on payment infrastructure

Strategic Responses

• Shift enforcement from operators to payment rails and corporate enablers
• Strengthen beneficial ownership transparency in Cyprus
• Clarify liability for open banking providers servicing unlicensed gambling
• Create an EU-level intelligence exchange for emerging gambling payment shells

Conclusion

The “Colors & Animals” payment network demonstrates how illegal gambling operators adapt to intensified EU enforcement. By cycling disposable payment entities through a centralized Cypriot hub while retaining access to regulated fintech rails, the system renders entity-level sanctions ineffective.

Evidence from corporate registries, licensing data, and payment disclosures corroborates whistleblower intelligence. The Emidala–Lokemor nexus and Yapily’s facilitation represent clear pressure points where targeted regulatory action could disrupt the entire structure rather than isolated components.

Scam-Or Project will continue tracking developments within this network and support regulatory efforts aimed at dismantling the infrastructure that enables cross-border illegal gambling.