SHADOW GATEWAYS EXPOSED: NGPayments and Cyperion Solutions Unmasked as the Financial Engine for Galaktika N.V.

A leaked transaction receipt from a victim of the Galaktika N.V. casino scheme reveals the use of “NGPayments.” This technical layer acts as a cloaking device, allowing high-risk offshore casinos to exploit the Skrill and Rapid Transfer networks while masking the true destination of funds through UK and Cyprus-based shell companies.

Key Facts

• Cyperion Solutions Limited (Cyprus, reg. no. HE 460916) acts as a merchant/payee for online casino deposits routed via Skrill/Rapid Transfer.​
• Payments are processed over the NGPAYments infrastructure, which provides a white‑label cross‑border payment platform.​​
• At least one victim reports misuse of KYC and payment data across multiple casino accounts and has allegedly filed complaints with law enforcement, the bank, and payment providers.

While there are no shared directors between the two entities, compelling evidence suggests they function as coordinated components of the same financial infrastructure used to facilitate unlicensed gambling transactions.

The Corporate Shell Game: Cyperion Solutions Limited

Our research into Cyperion Solutions Limited reveals a classic “split-jurisdiction” strategy designed to confuse regulators and banks:

• The UK Entity (Cyperion Solutions Ltd): Incorporated on June 2, 2025 (Company No. 16488847), with a registered office in Northwich, England. It is registered under SIC code 70229 (“Management consultancy activities other than financial management”). This misclassification is a hallmark of transaction laundering—claiming to provide “consultancy” while actually processing millions in high-risk gambling funds.
• The Cyprus Entity (Cyperion Solutions Limited): (Reg. HE 460916) Incorporated in June 2024. This entity is often used to hold merchant accounts with European banks, providing the “legitimacy” needed to access the SEPA and Rapid Transfer networks.

Factual Overlap of the Cyperion Entities

Export to Sheets

Evidence of Operational Connection

• Identical Branding and Timeline: Both companies use the same name and were established within exactly one year of each other. This is a standard pattern in creating a “multi-layered” corporate structure to obscure the final destination of funds.
• The “PayFac” Model: Investigative evidence shows “Cyperion Solutions Limited” appearing as a beneficiary for payments to illegal gambling brands like Boomerang-Bet and Slotoro. The Cyprus entity typically holds the merchant account with European banks, while the UK entity provides a “legitimate” consultancy front to bypass automated compliance triggers at major processors like Skrill.
• Transaction Laundering Evidence: A player-provided bank statement explicitly links Cyperion Solutions Limited to a payment instrument where the bank statement entry appears as “SKR*Skrill.com” despite the funds being routed to Cyperion. This proves that one or both of these entities are being used to mask the true nature of high-risk gambling deposits.
• Geographic Arbitrage: Using British directors for the UK shell and a Cypriot director for the Cyprus arm is a tactical move to prevent immediate linking through simple database searches. This “distance” allows the network to keep one entity active if the other is flagged or “burned” by regulators.

In summary: While they are legally distinct, their identical names, proximate incorporation dates, and shared role in the Galaktika N.V. payment rail strongly indicate they are sister shells in a professional money laundering operation.

Technical Analysis: Decoding “NGPayments”

In the context of the player’s report, NGPayments is not a consumer-facing bank but a technical payment gateway or aggregator. It serves as the “middleman” software that connects the illegal casino’s checkout page to regulated payment processors like Skrill.

• The Masking Layer: The receipt shows a payment of 20.00 EUR to Cyperion Solutions Limited, yet the statement note explicitly warns that it will appear as SKR*Skrill.com. This is a definitive indicator of Transaction Laundering (TL).
• The NGPayments Role: NGPayments likely operates as a “White Label” payment gateway. It allows the operator to swap merchant accounts (like Cyperion Solutions, Novaforge, or Briantie) instantly if one is flagged or “burned” by bank compliance teams.
• Bypassing KYC/AML: By using the NGPayments instrument, the Galaktika network can present a “clean” transaction to Skrill, making it appear as a standard e-commerce payment rather than a high-risk deposit into an unlicensed casino.

The Cyperion Connection: A Professional Analysis

The evidence suggests that Cyperion Solutions Limited acts as a specialized Payment Facilitator (PayFac) for the Galaktika N.V. brands (Boomerang-Bet, Slotoro).

• Identity Hijacking: The player’s report that their KYC data was reused across multiple unauthorized emails (e.g., jony35@inbox.lv) suggests that entities like Cyperion are not just processing money, but may be part of a broader “Mule” network.
• Regulatory Arbitrage: By utilizing NGPayments to route through a UK/Cyprus-registered entity (Cyperion), the operators exploit the trust associated with European jurisdictions to process funds from victims in Latvia and beyond.

Conclusion for FinTelegram

This receipt is the “smoking gun” for regulators. It proves that Skrill and Paysafe (Rapid Transfer) are being systematically bypassed by the NGPayments/Cyperion nexus. The technical manipulation reported by the victim—including rigged slots and malicious APKs—is funded entirely through this specific payment rail.

Whistleblower Call to Action: Are you an employee of a payment gateway or bank who has flagged NGPayments or Cyperion Solutions Limited? We need to know which acquiring banks are providing the merchant IDs (MIDs) for these transactions. Contact us via Whistle42.