On 4 November 2026, Kazakhstan officially placed Marina Ilyina and Dmitry Punin on its wanted list in connection with the PIN-UP and PINCO online casino case. Five days later, Kazakhstan’s Financial Market Agency (AFM) reported that it had referred to court the case concerning the payment network which, according to the investigation, served these and other platforms. One report mentioned over 106 billion tenge and the names of the two individuals wanted by the authorities. In another, 191 billion tenge were linked to a wider network, with none of these names mentioned. The question now posed to the authorities and the business community is clear. Who connected the terminals, to whom did the money go, and who could have stopped the payments? [1] [2]
In our first article, we examined the Ukrainian wanted notice, personal sanctions and Ilyina’s role at PIN-UP Global. In a separate piece, we documented when the wanted notices first appeared in Kazakhstan. A new phase begins with the announcement that the case has been referred to court. This allows us to see how the AFM describes the operations of payment intermediaries and to compare this account with public statements regarding business transparency. [2] [3] [4]
Astana has issued a wanted notice. What exactly is the Financial Market Authority (AFM) accusing her of?
The warrants for Ilyina and Punin were issued on 30 October, Kazinform reported, citing a Kazakhstani legal statistics portal. The search is being conducted by the Astana Department of Economic Investigations. On 4 November, the Financial Monitoring Agency published a statement naming the individuals. The agency suspects both of organising the illegal operations of the online casinos PIN-UP and PINCO, which target players from Kazakhstan. The notice specifies that both are subject to a preventive measure in the form of detention. The Financial Monitoring Agency did not mention in the notice whether they had actually been detained or handed over to Kazakhstan. [1] [5]
This is the public aspect of the case. The authority has named the individuals involved, the alleged offence and the scale of the operations. The press release contains no details of individual actions. It does not state who, acting on behalf of Ilyina or Punin, signed a specific contract, gave instructions to the payment company or received transfers. The search for these documents is more important than speculation about who conducted the negotiations. It is these documents that will make it possible to establish where the role of an international business executive ends and responsibility for a specific payment route begins. [1]
The term ‘wanted’ here is explicitly supported by the official statement from the Financial Markets Agency (AFM). This statement does not contain a public notice from Interpol, an extradition order or a conviction against Ilyina and Punin. This is important both for those involved in the case and for people whose payments may have passed through the infrastructure described. Every subsequent action taken by the authorities must be confirmed by a formal document. [1] [5]
Where a bookmaker’s licence met a casino
In its November statement, the AFM identified ‘Bonami’ LLP as the Kazakhstani entity. According to the agency, it obtained a licence to operate as a bookmaker under the PIN-UP.KZ brand. The investigation claims that the legal bookmaking business served as a front for an online casino. This is a serious allegation, which can be verified by examining individual contracts, transactions and details of payment recipients. What type of service was specified in the payment documents? What service did the customer actually receive? Who verified that the two matched? [1]
The Financial Market Authority (AFM) claims that the scheme involved acquired payment organisations, figurehead directors and bank terminals. The agency identified 24 terminals, 14 of which were used to accept payments. The total value of financial transactions published by the agency exceeds 106 billion tenge. A terminal is, in itself, a point of collection. To understand who controlled the proceeds, one must trace where the money went after the initial transaction, who managed the accounts and who received the commission. [1]
There is also a February episode to this story. On 2 February 2026, the AFM issued arrest warrants for Dmitry Druzhinsky and Marina Levkovich (Ginzburg). According to the agency, they co-ordinated interactions with banks and payment organisations. The same statement mentioned Gold Pay and Cyber Pay – later renamed Pinnacle Financial Solutions – as well as a theory regarding transit accounts and the subsequent conversion of part of the payment flow into cryptocurrency. The February alert names Levkovich, whilst the November one names Ilyina. The names and alleged actions must be verified against the relevant documents. [1] [6]
The key question for banks and payment intermediaries arises before any dispute over the extent of the damage. How did they determine who to grant a terminal to? What data did they use to cross-check the declared business activity against actual payments? Who, and when, could have seen that the transactions were serving online casinos, according to the AFM’s version of events? The public statement asserts that representatives of the financial sector facilitated the connection and operation of the terminals. It does not name the banks or employees to whom a claim could be addressed personally. [1]
9 November. The Financial Market Authority (AFM) referred the case, involving 191 billion tenge, to court
In a new statement, the agency described the case as one of aiding and abetting an illegal online casino operation. According to the investigation, transactions were carried out on behalf of several foreign platforms via the infrastructure of three controlled companies and hundreds of terminals in various banks. In addition to PIN-UP and PINCO, the list includes Nomadgames, Sultangames, Vavada, Mostbet and 1WIN. The Financial Market Authority (AFM) reported transactions totalling 191 billion tenge and settlement fees of 286 million tenge. According to the agency, the case has been referred to court. [2]
The investigation also described the method used to process payments. According to its findings, fictitious contracts and websites created the appearance of payments for ordinary goods and services, whilst the money was actually transferred to foreign counterparties, including via cryptocurrency. The agency reported that a preventive measure had been imposed on an unnamed organiser and that 103 million tenge in cash and four vehicles had been seized. The published text does not name Ilyina or Punin. It is not clear from the press release whether these measures relate to any of the individuals named in the 4 November wanted notice. [1] [2]
| Cifra | What lies behind her? |
|---|---|
| Over 106 billion tenge | The volume of transactions according to the AFM’s version, published alongside the wanted notices for Ilyina and Punin. [1] |
| 191 billion tenge | The total volume of transactions, as reported in the case involving the intermediaries who served several gambling brands. [2] |
| 286 million tenge | Estimated commission fees in the same case involving the payment intermediaries. [2] |
| Over 2.8 billion UAH | A separate Ukrainian special confiscation order, along with income from the management of the seized assets, according to the State Bureau of Investigation (DBR). [7] [8] |
There is no basis for adding up the Kazakhstani figures. Both press releases mention the same brands, but do not provide a breakdown that would allow for the exclusion of overlapping transactions. To do this, we need the calculation period, lists of terminals and the identification of transactions for each business. As long as such data is not included in the reports, the 191 billion cannot be treated as Ilyina’s personal turnover, nor can the 106 billion be treated as the amount of proven damages. [1] [2]
Ukraine. Wanted notice, personal sanctions and the director’s sentence
In February 2025, SportClan reported that Ilyina had appeared in the Ukrainian Ministry of Internal Affairs’ database. The surviving industry report also mentions that Dmitry Punin had been placed on the wanted list earlier. In the extract published by our editorial team, Ilina is listed as being under investigation by the Kyiv Regional Directorate of the State Bureau of Investigation (DBR) and is charged under Part 1 of Article 111-2 of the Criminal Code of Ukraine for aiding an aggressor state. Azart.Media also published specific details of the allegations, citing journalist Yevgeny Plinsky. This refers to the information published at that time. The current status of the individual records held by the Ukrainian Ministry of Internal Affairs as at the date of this article has not been independently verified. [4] [9] [10] [11]
The Ukrainian sanctions document is being examined separately. On 23 August 2025, Decree No. 612/2025 brought the NSDC’s decision into force. Ilyina is listed in item 24 of the first annex. The measures listed include the freezing of assets, restrictions on transactions and a ban on the transfer of technology and intellectual property rights. The latter point is particularly important for businesses that have justified their relationships with operators on the basis of licensing. The decree itself does not specify which contracts have been amended, which payments have been suspended, or what decisions the counterparties have taken in each jurisdiction. [4] [12] [13]
The Ukrainian legal proceedings have already had concrete consequences for the local operator. In June 2025, Forbes Ukraine reported that PlayCity’s licence for ‘Ukr Game Technology’ had been revoked. According to the State Bureau of Investigation (DBR), on 10 July, the Shevchenkivskyi District Court of Kyiv handed down a guilty verdict against the company’s director, and in August the verdict came into force. The court ordered the special confiscation of over 2.6 billion hryvnias and the proceeds from the management of the seized funds. The State Bureau of Investigation subsequently reported that over 2.8 billion hryvnias had been paid into the state budget. This is the outcome of the court proceedings concerning the director of the Ukrainian operator. The sanctions decree, the wanted notices and the Kazakhstani investigation remain separate sources of information regarding Ilina’s status. [7] [8] [14]
Ilyina spoke of transparency. Where are the contracts?
In an interview with NEXT.io on 10 February 2025, Marina Ilyina explicitly referred to the Cypriot company GuruFlow Team LTD as her own and stated that the Ukrainian operator paid her royalties. According to her account, the payments were for intellectual property; there were no transfers to Russia, and the allegations of links to Russia were a means of putting pressure on the business. She also contested the application of Article 111-2 to earlier events. This is her public stance on the events in Ukraine, expressed prior to Kazakhstan’s November guidance. [15]
On 26 August 2025, the group itself announced the rebranding of PIN-UP Global to RedCore. In July 2026, RedCore once again presented Ilyina as CEO and founder and published an article on her views regarding regulation, grey markets and business cooperation with the state. Corporate continuity is evident at the level of public statements. The investigation needs to go a step further. Which legal entities signed the contracts, who owned the rights to the software and the brand, which contracts were in force in Kazakhstan, and who was responsible for vetting partners? [16] [17]
Punin has a separate public stance. In April 2024, PUNIN GROUP denied reports that he owned the PIN-UP casino and stated that the group had no assets in the gambling industry. This statement predates both the August sanctions against Ilina and the Kazakhstani wanted notice of 2026. We found no separate response from Ilyina, Punin or their companies to the AFM’s reports of 4 and 9 November in the sources we examined. [1] [2] [18]
Four claims that can be verified
- Kazakhstan’s Financial Market Authority. How are the terminals and transactions divided between the 106 and 191 billion tenge transactions? Which aspects of the investigation are attributed specifically to Ilyina and which to Punin?
- Banks and payment intermediaries. What checks were carried out when organisations were connected to the network, who monitored the actual nature of the transactions, and what action was taken once a risk was identified?
- Ilyina and RedCore. Which companies within the group worked with counterparties in Kazakhstan, and who made decisions regarding the brand, software and licences? Did GuruFlow Team or any affiliated entity receive payments from participants in the Kazakhstani payment chain?
- Ukrainian authorities. What is the current legal status of Ilyina and Punin, and what restrictions under Decree No. 612/2025 have been imposed on Ukrainian assets and rights?
The brand has a corporate history. The investigation should have statements, contracts and decisions that explain the flow of funds. Kazakhstan has already named two sums, issued a public arrest warrant and announced that one case has been referred to court. The next response should reveal who was responsible for the route of a specific payment and who benefited from it. [1] [2]
The editorial team is open to responses from Ilyina, Punin, RedCore, banks and government departments. If you have worked with the payment infrastructure or have documents relating to transactions, please contact KARTEL KHIMPROM. To verify this, simply specify the period, the name of the organisation and the type of transaction. Players’ personal details and bank details are not required in the initial message.
