The Nylo Migration: Offshore Casino Payment Rails Shift From ChainValley To Georgia

Scam-Or Project’s latest investigations into offshore casino payment infrastructure suggest a coordinated transition away from the Polish crypto gateway ChainValley toward a new Georgian processing entity operating under the Nylo brand. The operational pattern appears highly familiar: the same offshore gambling operators, the same disguised crypto-conversion structure hidden behind FIAT-branded payment methods, and the same lack of transparency regarding the ultimate recipient of player funds.

According to the reviewed evidence, payment flows involving Skrill, Neteller, Rapid Transfer, Paysafecard, and similar services increasingly route users through Nylo’s infrastructure hosted on app.nylo.pro.

2-Minute Overview

Over recent days, Scam-Or Project analyzed the cashier infrastructure of several offshore casinos, including SpinBoss, DudeSpin, Betify, Malina Casino, Betalice, and Oro.gg. The review identified a recurring operational pattern. In earlier investigations, these casino ecosystems were linked to the Polish crypto on-ramp ChainValley. The newest screenshots now show Nylo replacing that layer in multiple deposit flows.

The reviewed checkout pages follow a nearly identical two-step process. Players believe they are funding a casino account through a standard FIAT-branded method such as Skrill or Neteller. However, the payment page reframes the transaction as an “Exchange order” and requires the user to confirm the purchase of cryptocurrency that will be transferred to a specified wallet address.

This wording appears intentional and functions as the core legal wrapper of the transaction flow.

Nylo publicly markets itself as a payment gateway supporting bank cards, bank transfers, local payment methods, payouts, settlements, and multi-currency processing. The company identifies itself as Nylo LLC, registration number 412790154, incorporated in Kutaisi, Georgia on 18 February 2025.

Scam-Or Project’s working assumption is that utPay, ChainValley, and Nylo may represent sequential operational layers of a connected casino-payment ecosystem. No definitive public filing has yet proven shared ownership between Nylo and the UTORG/ChainValley structure, but the operational similarities appear significant.

Key Findings

1. Same Offshore Casino Network, New Processing Brand

Recent screenshots reviewed by Scam-Or Project show Nylo integrated into payment flows associated with casino brands previously connected to ChainValley-type rails.

The reviewed Nylo order pages hosted at app.nylo.pro displayed transaction IDs, EUR amounts, wallet logos, and the consent statement:

“I agree to buy crypto and send it to the specified address.”

This structure does not resemble a conventional casino deposit process. Instead, it appears to operate as a crypto-purchase rail disguised as a FIAT gambling payment.

2. The utPay → ChainValley → Nylo Progression Appears Systematic

Scam-Or Project previously documented the role of utPay in offshore casino payment processing.

UAB Utrg, operating as utPay, later announced the suspension of crypto-related services beginning 1 January 2026 pending MiCA authorization. The company’s published terms state that crypto services would remain unavailable until the required regulatory approvals were obtained.

UTORG’s licensing disclosures identify:

• UAB Utrg in Vilnius, Lithuania;
• UTORG LABS HOLDING LTD in Abu Dhabi as website owner.

The same licensing page included a “Buy Crypto” link directing users to app.chainvalley.pro, establishing a visible operational bridge between UTORG and ChainValley.

Corporate filings show that:

Polish corporate data identifies Ilie Cernisev as representative and shareholder of Chain Valley Sp. z o.o. during the latest recorded ownership period.

The UTORG connection is additionally reinforced by a prior Massachusetts regulatory opinion addressed to Ilie Cernisev in his role as CEO of Utorg OÜ.

While no equivalent corporate-level evidence currently connects Nylo directly to the UTORG ecosystem, the behavioral similarities strongly resemble another migration phase.

Core Finding 1: Nylo Operates as a Fake-FIAT Crypto Rail

The reviewed Nylo transaction structure consistently follows the same sequence:

Player → Casino cashier → Skrill/Neteller/Paysafecard/Rapid Transfer selection → Nylo exchange order → crypto purchase consent → crypto transfer → casino balance funding

From the player’s perspective, the process appears to be a standard casino deposit.

Operationally, however, the structure appears to function as a cryptocurrency purchase followed by an onward transfer to undisclosed wallets.

This mirrors the architecture previously identified in utPay and ChainValley flows, where FIAT-branded payment methods serve as entry points into automated crypto conversion systems.

Compliance Concerns

Core Finding 2: Nylo Presents Itself As A Full-Scale Payment Gateway

Nylo’s public website markets the company as a broad payment-processing provider offering:

• cards,
• bank transfers,
• local payments,
• deposits,
• payouts,
• settlements,
• multi-currency processing,
• fraud prevention,
• infrastructure services.

The reviewed casino flows suggest Nylo acts not merely as a passive software layer, but as the actual conversion intermediary within the payment chain.

Georgia’s National Bank defines VASP activity to include:

• exchange between FIAT and virtual assets,
• virtual asset transfers,
• safekeeping,
• trading platform operations,
• lending and ICO-related activities.

The National Bank of Georgia has also stated that only registered VASPs or authorized financial-sector entities may legally provide such services.

This raises a direct compliance question:

Is Nylo LLC registered with the National Bank of Georgia as a Virtual Asset Service Provider, and if so, where is that registration disclosed to users of app.nylo.pro?

Core Finding 3: The Domain Pattern Suggests A Rail-Migration Signature

The domain evolution appears remarkably consistent:

While many payment providers use app. subdomains, the similarity becomes more meaningful when combined with:

• identical casino verticals,
• identical payment methods,
• identical crypto-purchase wording,
• identical operational logic,
• sequential timing of migration.

Scam-Or Project believes the similarities are operational rather than coincidental.

Core Finding 4: ChainValley Already Showed Strong UTORG Connections

The ChainValley connection was previously supported by several public indicators.

UTORG’s own website linked users directly to app.chainvalley.pro for crypto purchases while simultaneously disclosing:

• UAB Utrg as legal entity;
• UTORG LABS HOLDING LTD as website owner.

At the same time, Polish corporate records identified Chain Valley Sp. z o.o. with Ilie Cernisev listed as representative and sole shareholder during the latest reporting period.

The Massachusetts Division of Banks also addressed Cernisev as CEO of Utorg OÜ in a 2022 regulatory opinion concerning virtual-currency business activity.

Taken together, those elements created a credible basis to associate ChainValley with the broader UTORG ecosystem.

The remaining unresolved issue is whether Nylo represents:

• a successor structure,
• a white-label implementation,
• a partner infrastructure,
• or another operational layer within the same payment network.

Scam-Or Project Working Hypothesis

Scam-Or Project’s current assessment is as follows:

The offshore casino infrastructure that previously relied on UAB Utrg/utPay and later ChainValley may now be transitioning toward Nylo LLC in Georgia.

The underlying payment logic appears unchanged:

• FIAT-branded payment methods initiate transactions;
• users are redirected into crypto purchase orders;
• purchased crypto is transferred to undisclosed wallets;
• casino balances are subsequently credited.

Possible motivations behind the migration may include:

• regulatory pressure,
• MiCA-related restrictions,
• negative publicity,
• banking-risk management,
• preservation of high-risk casino processing capacity.

This remains a working hypothesis rather than a definitive ownership conclusion.

However, the theory is supported by:

• overlapping casino brands,
• nearly identical checkout structures,
• identical crypto-consent wording,
• repeated use of Skrill, Neteller, Paysafecard, and Rapid Transfer,
• consistent app.[brand].pro architecture,
• timing correlation with earlier rail exposure.

Compliance Questions For Nylo, ChainValley, UTORG, And Related Operators

Scam-Or Project invites the involved entities to clarify the following:

1. Is Nylo LLC registered as a VASP with the National Bank of Georgia?
2. Does Nylo directly or indirectly process payments for offshore casinos?
3. Does Nylo share ownership, infrastructure, personnel, or processing relationships with ChainValley, UAB Utrg, Utorg OÜ, or UTORG LABS HOLDING LTD?
4. Why do Nylo’s casino flows closely resemble earlier ChainValley and utPay structures?
5. Who controls the destination crypto wallets referenced in Nylo exchange orders?
6. Are users clearly informed they are purchasing crypto rather than funding a casino directly?
7. Have Skrill, Neteller, Paysafecard, and Rapid Transfer approved the use of their brands within these crypto-conversion flows?
8. Which merchant or operator ultimately receives the economic benefit of player deposits?

Scam-Or Project Assessment

The situation resembles a classic regulatory “whack-a-mole” scenario.

First came utPay.

Then ChainValley.

Now Nylo appears to occupy the same operational position.

Each layer seemingly preserves the same core functionality:

allow offshore casinos to receive European player funds through familiar payment brands while reframing the underlying transaction as cryptocurrency acquisition.

The visible payment provider changes.
The legal wrapper changes.
The casino funding logic remains intact.

Players see Skrill or Neteller.
The processor sees an exchange order.
Banks may see a crypto on-ramp.
The casino receives funded balances.

That appears to be the operational mechanism behind the system.

For this reason, Scam-Or Project believes regulators, payment providers, wallet operators, and open-banking firms should review the Nylo flows carefully.

Whistleblower Request

Scam-Or Project is seeking additional information regarding:

• Nylo,
• ChainValley,
• utPay,
• UTORG,
• SpinBoss,
• DudeSpin,
• Betify,
• Malina Casino,
• Betalice,
• Oro.gg,
• related casino payment infrastructure.

Particularly relevant materials include:

• merchant agreements,
• destination wallet addresses,
• settlement records,
• onboarding documentation,
• cashier screenshots,
• KYC files,
• internal communications,
• infrastructure links between Nylo, ChainValley, UAB Utrg, Utorg OÜ, and UTORG LABS HOLDING LTD.

Individuals with relevant information may submit materials confidentially via Scam-Or Project Complaints.