From IBOX to SENDS? Alona Shevtsova, the ESBU’s UAH 5bn Miscoding Case, and Offshore Casino Payment Rails

The Holyluck whistleblower dossier has brought a key figure into focus: Alona Shevtsova, identified as the person with significant control of UK EMI Smartflow Payments Limited (dba SENDS). According to Ukraine’s Economic Security Bureau (ESBU), Shevtsova is a suspect in a large-scale UAH 5 billion miscoding case connected to illegal online casinos. In parallel, Polish authorities have detained Iryna Tsyhanok, described as an alleged accomplice in the same investigation (source).

In this follow-up analysis, Scam-Or Project reviews the ESBU’s statements, reconstructs the alleged transaction architecture, and explains why the intersection of offshore casinos, merchant masking, and regulated payment rails raises serious compliance concerns.

Key Findings

• Active ESBU investigation: Ukrainian authorities confirm that Iryna Tsyhanok was detained in Poland in connection with a UAH 5 billion miscoding scheme linked to illegal online gambling. Alona Shevtsova is listed as a suspect.
• IBOX Bank’s role: Ukraine’s central bank revoked the license of IBOX Bank in March 2023 due to systemic AML/CFT breaches.
• Emergence of SENDS / Smartflow: Smartflow Payments Limited is an FCA-authorised EMI (FRN 900873) operating in the UK, with Companies House records identifying Shevtsova as the person with significant control.
• Core mechanism – miscoding: ESBU reports indicate that transactions were disguised using false payment purposes and intermediary entities to present gambling activity as legitimate commerce.

The ESBU Case Explained

The ESBU describes a scheme based on transaction miscoding, where payments related to online casinos were routed through controlled companies and labeled as payments for non-existent goods or services. This manipulation allowed high-risk gambling transactions to bypass proper classification.

In April 2025, authorities in Poland detained Iryna Tsyhanok, who is alleged to have participated operationally in the same structure.

This pattern closely resembles earlier findings by the National Bank of Ukraine (NBU) concerning Leogaming Pay / LEO, where more than UAH 462 million in 2020 alone were processed under misleading categories such as:

• “sports poker”
• “e-sports tournaments”
• video game-related MCC 7994 classifications

In reality, funds were directed to illegal gambling operators.

Key Indicators of the Scheme

• Misuse of Merchant Category Codes (MCCs)
• False transaction descriptions
• Use of intermediary (“controlled”) companies
• Internal facilitation within financial institutions

Tsyhanok’s alleged position as a bank department director suggests involvement in operational processes such as:

• account onboarding
• compliance overrides
• approval of misleading transaction descriptors

Profile: Alona Shevtsova

Publicly available records describe Alona (Alyona Dehrik-) Shevtsova as a central figure in Ukraine-linked high-risk payment ecosystems.

Key Roles and Activities

• Founder of LeoGaming Pay and the LEO payment system
• Associated with transaction flows linked to illegal gambling operations
• Former shareholder and senior executive at IBOX Bank
• Person with significant control and director of Smartflow Payments Limited (SENDS)

This trajectory reflects a vertically integrated structure:

Authorities in Ukraine have imposed NSDC sanctions and initiated criminal proceedings related to illegal gambling and money laundering. However, at this stage, Shevtsova remains a suspect and is entitled to the presumption of innocence.

IBOX Bank and Iryna Tsyhanok

IBOX Bank plays a critical role as the historical compliance anchor in this case. The National Bank of Ukraine revoked its license and initiated liquidation proceedings due to systemic AML/CFT violations.

According to ESBU findings:

• Payments from illegal gambling users were processed via controlled entities
• Transactions were masked as legitimate commercial activity
• Internal banking processes may have enabled the scheme

Within this framework, Iryna Tsyhanok is described not as a peripheral actor but as an alleged operational participant.

Offshore Casino Payment Rails: Why It Matters

The Holyluck dossier outlined a recurring pattern:

• Offshore gambling platforms
• Misleading transaction descriptors
• Multi-layered routing chains involving entities such as TAS Link / PayLink, SENDS / Smartflow, and Quicko

While this does not constitute proof of wrongdoing by these entities, the ESBU case demonstrates that such architectures are already under active investigation.

The broader issue is not only illegal gambling itself, but how payment presentation layers are structured to obscure true transaction risk.

Sanctions Screening Risk: SENDS in OpenSanctions

An additional compliance concern arises from the inclusion of Smartflow Payments Limited (SENDS) in the OpenSanctions dataset.

Key Data Points

• Identifier: NK-UoszMKPbMFDALJozSi4NGN
• SWIFT/BIC: EPSLGB22
• Jurisdiction: United Kingdom
• Controlled by: Alona (Alyona) Shevtsova

While OpenSanctions aggregates risk data rather than issuing official designations, such inclusion represents a high-risk screening signal.

Compliance Implications

Financial institutions and partners interacting with SENDS should:

1. Treat the entity as a high-risk counterparty
2. Conduct enhanced due diligence (EDD)
3. Reassess existing exposure
4. Perform transaction pattern analysis
5. Run retrospective sanctions screening

In the context of the Holyluck payment trail, this listing significantly increases the overall risk profile.

Summary Table

Conclusion

This case highlights a critical compliance issue: the manipulation of transaction classification to disguise high-risk activity.

If the ESBU’s findings are accurate, the central issue is not only illegal gambling but the systematic misrepresentation of transactions within regulated payment frameworks.

The appearance of SENDS / Smartflow within this context does not prove repeated misconduct. However, it does justify heightened scrutiny by:

• regulators
• card networks
• financial institutions

Whistleblower Call

Scam-Or Project encourages individuals with relevant information regarding:

• Alona Shevtsova
• Smartflow Payments / SENDS
• IBOX Bank
• Iryna Tsyhanok
• miscoded casino transactions
• acquiring and payout infrastructures

to submit materials via the Scam-Or Project whistleblower section.

We are particularly interested in:

• onboarding documentation
• MCC assignment decisions
• descriptor mapping
• acquirer correspondence
• internal AML escalation records

Confidentiality is guaranteed.