A player clicks ‘Top Up’ on the casino website. On the screen, they see the brand; on their bank statement, the payee. Who is in control of the money at this point? In the Kazakhstani case involving PIN-UP and PINCO, the Financial Monitoring Agency (FMA) has put forward its own explanation. According to the agency, a network of payment companies was behind the receipt of the funds, followed by transit accounts and cryptocurrency further down the chain. The investigation considers Dmitry Druzhinsky and Marina Levkovich (Ginzburg) to be the coordinators of this infrastructure. [1] [2]
We have cross-referenced the February wanted notice with the National Bank of Kazakhstan’s register, the Financial Markets Agency’s response regarding the case of the extradited blogger, and two press releases from November. This timeline shows how casino advertising and deposit processing converged in a single investigation. It also allows us to verify where the 106 billion tenge figure came from and why the sum of 191 billion appeared in a report about a network serving several brands at once. [3] [4] [5] [6] [7]
Dmitry Druzhinsky and Marina Levkovich: what the AFM has reported about them
On 2 February 2026, the Financial Market Agency (AFM) issued a warrant for the arrest of US citizen Dmitry Druzhinsky and Ukrainian citizen Marina Levkovich (Ginzburg). In the press release itself, Druzhinsky’s name is written as ‘Druzhinsky Dmitry’. The Kazakhstani publication BES.media uses the standard Russian spelling ‘Dmitry Druzhinsky’. The court authorised the detention of both individuals in absentia. The report confirms the decision on the preventive measure and the suspicion of organising an illegal gambling business in Kazakhstan. [1] [2]
The February press release links Druzhinsky and Levkovich to activities that usually take place behind the scenes of the casino website. According to the investigation, they recruited participants, liaised with payment organisations and commercial banks, and were involved in setting up and operating the system for receiving and withdrawing funds. The agency described their alleged roles collectively. The AFM did not disclose in its public statement what contracts each of them had entered into, to whom they gave instructions, or which accounts they had authority over. [1]
This is a significant gap in the details. Coordination can be verified through correspondence and agreements; access to funds through banking authorisations and statements; and the receipt of benefits through transfers to a specific recipient. The February report allows us to formulate all three questions. Separate documents are required to answer each one. [1]
AFM’s wanted list: four names and two dates
| Name | Statement from the Financial Markets Authority | What the statement says |
|---|---|---|
| Dmitry Druzhinsky | 2 February 2026 [1] | Wanted. The court has authorised their detention in absentia. The Financial Market Authority suspects them of organising an illegal gambling business. |
| Marina Levkovich (Ginzburg) | 2 February 2026 [1] | Wanted. The court has authorised their detention in absentia. The Financial Market Authority suspects them of organising an illegal gambling business. |
| Dmitry Punin | 4 November 2026 [6] | Wanted notice. A preventive measure in the form of detention has been specified. The Antimonopoly Committee suspects them of organising online casino operations for Kazakhstani users. |
| Marina Ilyina | 4 November 2026 [6] | Wanted notice. A preventive measure in the form of detention has been specified. The Antimonopoly Committee suspects them of organising online casino operations for Kazakhstani users. |
Kazakhstan has published two separate wanted notices with photographs. In February – for Druzhinsky and Levkovich; in November – for Punin and Ilina. As of 12 November 2026, we have found no information in verified sources regarding the actual arrest, extradition to Kazakhstan or conviction of Druzhinsky or Levkovich. [1] [4] [6]
Bonami LLP: how a bookmaking licence ended up in an online casino case
At the local level, the Financial Market Authority (AFM) refers to the company as ‘Bonami’ LLP. The company held a state licence to operate a bookmaking business under the PIN-UP.KZ brand. Online casinos are banned in Kazakhstan. According to the agency, the bookmaking business served as a front for online casino operations. To verify this claim regarding a specific payment, one must cross-reference the service purchased by the customer with the purpose of the transaction and the contract under which the intermediary processed it. [1] [6] [8]
The fact that the same logo appears on both websites says nothing about which legal entity receives the money on each of them. The licence specifies who has been authorised to carry out which type of activity. The acquiring agreement shows with whom the bank or payment organisation has agreed to accept funds. The entry in the transaction register shows to whom a specific deposit was transferred. The most thorough verification begins when all three documents can be cross-referenced for a single period. [1] [6] [8]
Gold Pay and Cyber Pay: what the National Bank’s register reveals
In its February press release, the Financial Markets Agency (AFM) named two payment aggregators: Gold Pay LLP and Cyber Pay LLP. According to the agency, Cyber Pay was subsequently renamed Pinnacle Financial Solutions. There is an independent documentary link between the names: in the National Bank of Kazakhstan’s register of electronic money systems, as at 22 December 2025, the Cyber Pay system is listed under number 31, and its operator is listed as Pinnacle Financial Solutions LLP. This means that documents can be searched for using both the system’s name and the operator’s legal name. [1] [3]
The register describes the structure of the electronic money system as at a specific date. Its entries do not show which system a particular PINCO deposit passed through, to whom it was transferred, or what amounts each intermediary processed. The AFM describes Gold Pay’s role in this matter. The February report does not provide a breakdown of turnover between Gold Pay and Cyber Pay. [1] [3]
According to the investigation, clients’ money was first accumulated in transit accounts, then converted into cryptocurrency via affiliated entities. This transfer can only be verified by comparing the bank transfer with the exchange transaction in terms of time, amount and counterparty. Even a known cryptocurrency wallet address rarely, on its own, answers the key question: who controlled it and was able to dispose of the funds. The February report did not publish the wallet addresses or the list of transactions. [1]
What the case of blogger Kaisar Kamza has added to the picture
In August, the Prosecutor General’s Office of Kazakhstan reported the extradition from Vietnam of a suspect accused of promoting an illegal online casino. The Financial Markets Agency (AFM) subsequently identified him as Kaisar Kamza and specified the extradition date as 6 August 2026. According to the investigation, Kamza attracted users via referral links and received remuneration. In its response to Tengri Life, the agency named Druzhinsky, Levkovich, Punin and Ilina as suspects in the same criminal case. [4] [5] [9]
This adds a link to the story that the February report barely touched upon — who was bringing in the players. Advertisements contain links and click-through data. The first deposit includes the time and transaction ID. Referral rewards include the sender and the reason for payment. By cross-referencing these records, it is possible to determine who paid to attract the audience and how the operator accounted for the players recruited. The AFM’s public response links names to the criminal case, whilst leaving individual actions relating to this episode outside the scope of the press release. [4] [5] [9]
106 billion, 191 billion and ‘a billion dollars’: what exactly was calculated?
On 4 November, whilst issuing arrest warrants for Dmitry Punin and Marina Ilina, the Financial Market Authority (AFM) once again mentioned Bonami LLP. The agency reported 24 payment terminals, 14 of which were used to accept money, and a volume of financial transactions exceeding 106 billion tenge. In its August statement on extradition, the Prosecutor General’s Office cited a figure of a similar magnitude for funds received via terminals at several online casinos between 2021 and 2025. The November press release does not provide a breakdown of turnover by brand, account or individual. [5] [6]
On 9 November, the Financial Markets Agency (AFM) announced that it had referred to court a case concerning the payment infrastructure that served PIN-UP, PINCO, Nomadgames, Sultangames, Vavada, Mostbet and 1WIN. The authority estimated the total volume of transactions at 191 billion tenge, with estimated commission fees amounting to 286 million tenge. According to the AFM, some of the transactions were recorded as payments for goods or services, whilst the money was transferred to foreign counterparties, including via cryptocurrency. Druzhinsky and Levkovich are not named in this report. [7]
| Amount | What lies behind it | Source |
|---|---|---|
| Over 106 billion tenge | The volume of financial transactions mentioned in the wanted notice for Punin and Ilina. | AFM, 4 November 2026 [6] |
| 191 billion tenge | The total volume of transactions processed by the network, which, according to the investigation, served several gambling brands. | AFM, 9 November 2026 [7] |
| 286 million tenge | Estimated commission fees in the same case involving intermediaries. | AFM, 9 November 2026 [7] |
| Over $1 billion | This estimate of funds allegedly transferred abroad is cited by ‘Sledstvie’. The original calculation has not been attached to the publication. | ‘The Investigation’, a secondary source. [10] [11] |
To add up the figures of 106 and 191 billion tenge, we first need to establish whether the terminals, dates and transactions overlap. To assess the losses, additional data on the amounts deposited and refunded will be required. ‘Sledstvie’ also reports on more than 70 searches, 35 payment companies and four banks. The FBRC cites a similar set of figures, referencing a Telegram channel. In the verified press releases from the AFM, we have found no independent confirmation of these figures in this specific combination. [1] [6] [7] [10] [11]
Ukrainian PIN-UP: where the comparison ends
In Ukraine, the story of the same brand led to a separate court ruling. According to the Ukrainian State Bureau of Investigations, the court handed down a sentence to the director of the local operator and ordered the special confiscation of over 2.6 billion hryvnias. The SBI later reported that over 2.8 billion hryvnias had been transferred to the state budget, including income from the management of the seized funds. This information relates to the Ukrainian operator and Ukrainian operations. [12] [13]
In an interview with NEXT.io, Marina Ilyina disputed allegations of links between the Ukrainian operator and Russia and explained the payments to the Cypriot company GuruFlow Team as royalties for intellectual property. PUNIN GROUP had previously denied that Dmitry Punin owned the PIN-UP casino. Both statements preceded the AFM’s November announcement. We have found no public response from Druzhinsky, Levkovich, Gold Pay or Pinnacle Financial Solutions to the February press release in verified sources. [1] [14] [15]
Related — What is known about the search for Marina Ilina and the role of payment intermediaries, Marina Ilina’s profile and Dmitry Punin’s dossier.
Three documents that will answer the question: ‘Where did the payments go?’
- Register of terminals and connection agreements. These details can be used to verify who processed the payments, for which services, and which terminals feature in each case.
- Transit account statements and exchange documents. A comparison of the transactions will reveal how much of the money went towards settlements with counterparties, how much remained with intermediaries, and what amount was converted.
- Powers of attorney and correspondence. Contracts, instructions and access to accounts will make it possible to verify who acted on behalf of the companies and which decisions were taken personally.
Kazakhstani authorities have already named the companies, the individuals involved and the scale of the operations. Now there is a specific question regarding the case files: is it possible to trace even a single deposit from the ‘Top Up’ button to the person who ultimately received the money?
The editorial team at KARTEL KHIMPROM welcomes comments from the individuals, companies and authorities mentioned. If you have any documentation regarding the payment chain, via Editorial contacts Please provide the time period, the legal entity and the type of transaction. For the initial enquiry, a copy with customer details and card details redacted will suffice.
Sources and official photographs
- Kazakhstan’s Financial Market Authority — search for Dmitry Druzhinsky and Marina Levkovich, 2 February 2026
- BES.media — report on the alleged coordinators of PIN-UP and PINCO, 2 February 2026
- National Bank of Kazakhstan — Register of Electronic Money Systems, entry dated 22 December 2025, line 31
- Tengri Life — the AFM’s response regarding the suspects in the Kaisar Kamza case, 13 August 2026
- Kazakhstan’s Prosecutor General’s Office — extradition from Vietnam and an estimate of revenues for 2021–2025
- Kazakhstan’s Financial Market Authority — search for Dmitry Punin and Marina Ilina, 4 November 2026
- Kazakhstan’s Financial Market Authority (AFM) — the case involving payment intermediaries totalling 191 billion tenge has been referred to court, 9 November 2026
- Kazakhstan’s Committee for the Regulation of the Gambling and Lottery Business – online casinos and licensing
- Kazakhstan’s Financial Market Commission — statement on the promotion of online casinos and the extradition of Kaisar Kamza
- ‘The Investigation’ — the original publication, including a secondary valuation of over $1 billion
- FBRK — a publication citing the source of the figures on the searches and payment companies
- Ukraine’s State Bureau of Investigation (DBR) — statement on the sentencing of the operator’s director and the special confiscation of over 2.6 billion hryvnias
- Ukraine’s State Bureau of Investigation (DBR) – revenue of over 2.8 billion hryvnias, including income from asset management
- NEXT.io — an interview with Marina Ilina about the Ukrainian operator, 10 February 2025
- PUNIN GROUP — statement regarding ownership of the PIN-UP casino, April 2024
- Kazakhstan’s Financial Market Authority (AFM) — an official photograph from the February wanted notice
- Kazakhstan’s Financial Market Authority (AFM) — an official photograph from the November briefing
