From shadow gambling to government checks: How Alena Degrik-Shevtsova and iBox Bank laundered billions through Ukrposhta

During Ukrposhta’s first full‑scale financial monitoring audit, the NBU scrutinized transactions from January 2022 to July 2023. In that period, the postal operator took in UAH 11.9 billion in cash from businesses.

Moreover, 11.4 billion UAH – 95.8% of the total amount – was allocated to just six legal entities: “Metapay”, “Paybox”, “Elektrum Payment System”, “Globalmani”, the financial company “Kontraktovyi Dim” and “Swift Garant”.

The NBU was interested in more than just the concentration of cash. According to the audit, cash was sometimes accepted during hours when branches were officially closed; the same person, according to documents, deposited cash in geographically distant locations; and large sums were allegedly collected from certain payment terminals several times a day. Other documents revealed discrepancies in dates, and the cash contained bundles of 500-hryvnia bills with consecutive numbers. In the western regions, the volume of cash deposited by Ukrposhta suddenly increased exponentially.

There was one more detail. Ukrposhta’s standard commission for this service was approximately 0.2%, but six selected counterparties paid between 0.001% and 0.1%. The state-owned company earned UAH 8.7 million from their transactions; according to NBU calculations, the standard tariff would have earned it UAH 22.8 million.

Ukrposhta denies the accusations of facilitating money laundering. Its CEO, Ihor Smilyansky, explains the situation much more simply: the company effectively acted as a cash-in-transit agency for entities that were themselves under NBU supervision. Following an investigation, this practice was discontinued.

And this is an important disclaimer for the rest of this text. The mere fact that a company appears on the list of six does not prove the criminal origin of its funds, much less the involvement of its owners in money laundering. Some of the incidents described below are decisions of the NBU, some are facts from state registries and court decisions, and some are criminal proceedings in which suspicion is not equivalent to a conviction.

But if you start to analyze the biographies of these six companies, the random selection stops looking like a random one pretty quickly.

1. “Mєtapey”: a new legal entity for the old iBox

"Metapay" is the youngest of the six companies. It was registered on June 17, 2022, after the outbreak of full-scale war and literally within the period that subsequently attracted the attention of the NBU.

It quickly became the legal operator of one of the country’s largest payment terminal networks, iBox.

When the National Bank revoked IBOX Bank’s license in March 2023, the terminal network specifically emphasized that the terminals did not belong to the bank and were operated by Metapay. Forbes and other business publications also described this legal structure: the iBox brand, the terminal infrastructure, and IBOX Bank interacted closely, but were legally separate businesses.

The separation is crucial. It’s impossible to simply write that "Alena Shevtsova owned the iBox terminals": the documents don’t support this. But it’s equally wrong to pretend that the bank and the terminal network existed in separate universes. IBOX Bank was the network’s key banking partner, and its disappearance immediately impacted the terminals’ operations.

The scale was enormous. After the bank’s closure, market representatives said that iBox card top-ups alone generated approximately 12-15 billion hryvnias in monthly turnover for the network. This meant we weren’t talking about a few machines at metro stations, but rather about the infrastructure through which physical cash was converted en masse into non-cash money.

It is this process – cash-in – that is the key to the entire story with Ukrposhta.

British owner who came later

Today, Metapay has a rather unusual structure: the director is Evgeny Rastivsky, and 100% of the capital is owned by the British company 5CORP LTD. However, it’s important not to retroactively transfer this structure to 2022–2023. The British company only became an owner on July 25, 2024, when Tatyana Zhigurskaya left the founding group.

This day is worth remembering. Because exactly the same thing happened to another company on the NBU list.

2. “Paybox”: the second iBox in the same six

Paybox LLC was established earlier, in January 2018. It is historically associated with the rights to the iBox trademarks and the infrastructure for instant payment machines. Paybox is listed in the trademark registry as having the "iBox" brand.

Even before the collapse of IBOX Bank, court documents clearly established that iBox terminals are not the bank’s property, and that the corresponding trademark and terminal infrastructure are linked to Paybox.

This creates a curious setup. Among the six companies that deposited almost all the cash of interest to Ukrposhta, two legal entities belonged to the same iBox terminal ecosystem: the older Paybox and the younger operator Metapay.

And then a particularly remarkable coincidence occurs.

On July 25, 2024, after the NBU audit, the same British company, 5CORP LTD, became the owner of Paybox. The company retained the same director, Yevhen Rastivsky. Previously, the owner was listed as Lyudmila Stoyanova.

That is, today “Metapay” and “Paybox” are a completely obvious corporate pair: the same British owner, the same director, a common historical brand, and even the same date of transfer to a new owner.

This doesn’t mean that 5CORP controlled both companies at the time of the billion-dollar transactions with Ukrposhta; on the contrary, the register shows that it emerged later. However, the merger of the two main legal entities of the old iBox infrastructure into a single ownership group after 2023 is a fact that is hardly uninteresting. 

Alena Degrik-Shevtsova and the bank that the NBU closed for systemic violations

IBOX Bank was a small, established bank that, in its final years, suddenly transformed into a highly visible player in the payments industry. As of early 2023, 73.93% of its shares were owned by Volodymyr Drobot, and another 24.98% by Alena Shevtsova, also known as Alena Degrik-Shevtsova, the founder and CEO of the fintech company LeoGaming and the LEO payment system. The NBU officially approved her acquisition of a significant stake in the bank in January 2022.

Shevtsova became one of the bank’s key public figures and chaired its supervisory board. On the surface, the story looked like a fairly trendy Ukrainian fintech success story: a payment system, international expansion, its own bank, and a vast network of terminals.

However, at the same time, questions from the regulator were piling up.

Even before its liquidation, the NBU had already taken action against IBOX Bank for deficiencies in financial monitoring, including inadequate client due diligence. But on March 7, 2023, a radical change occurred: the National Bank revoked IBOX Bank’s banking license and ordered its liquidation due to systematic violations of anti-money laundering and terrorist financing laws.

In July 2023, the Bureau of Economic Security (BES) charged top managers and a co-owner of the bank with laundering nearly 5 billion hryvnias, which, according to investigators, came from illegal gambling. The BES describes the scheme as classic miscoding: more than twenty subordinate companies opened accounts at the bank, and players transferred money to them, ostensibly for goods and services, when in reality they were funding their gaming accounts. Investigators allege that the organizers received a commission for processing the payments.

By March 2025, the Bureau of Economic Security reported that the bank’s co-owner was abroad and wanted, and requested permission for a special pre-trial investigation. The case was classified under articles on illegal gambling and money laundering.

Here again, a legal distinction is necessary: two companies on Ukrposhta’s list are part of the iBox infrastructure; a banking partner of this infrastructure was liquidated specifically for systemic AML violations; and its management is under investigation for a multi-billion-dollar miscoding case.

And after the bank’s demise, the terminal infrastructure itself didn’t disappear. It simply moved on.

3. Swift Garant: How Nine Thousand iBoxes Turned into City24

Swift Garant LLC was established in 2015. Its ultimate beneficiary is currently businessman Sergei Gorban, associated with the Askania Group, and its director is Vyacheslav Shevchenko.

Gorban has a much more diversified business background than the typical payment company owner. Through Askania, he was involved in grocery distribution, flower sales, frozen food, energy, automotive, and other assets. In the registries, his name is linked to an entire network of the group’s companies.

But City24 is important for our story.

After IBOX Bank lost its license in March 2023, leaving the old iBox system without its traditional banking partner. Approximately nine thousand terminals from the former iBox network were leased to Swift Garant and began to be integrated into the City24 network. The agreement was for a one-year term with the option to extend.

This is perhaps the most obvious physical connection between those on the NBU list.

The same six include “Metapay” and “Paybox” – the legal entities of iBox – and “Swift Garant”, which, after the bank’s collapse, took over approximately nine thousand of the same terminals under City24.

This means we’re no longer simply talking about six companies "in the same sector." There was direct continuity of infrastructure between the individual participants.

Swift Garant itself subsequently encountered serious problems with financial monitoring. In December 2023, the NBU fined the company UAH 12.36 million for violating anti-money laundering legislation.

And in June 2026, a fine of a completely different magnitude followed—UAH 135.15 million. Swift Garant challenged the decision, and the NBU separately stated its intention to defend its legality in court. Therefore, this fine should for now be described as a regulatory decision, which the company does not definitively accept.

Following the recent publication of the Ukrposhta story, Swift Garant also announced that it was no longer working with the postal operator: the contract was valid from 2022 to March 2023.

And here comes the second giant of Ukrainian terminals – EasyPay.

4. "Contract House": Avramenko’s sons and a very long family history

The financial company "Kontraktovyi Dim" is the legal entity of the EasyPay network. Today, "Kontraktovyi Dim" is owned by Oleksiy and Anton Avramenko, each holding 50%. They are brothers. This is clearly stated in the ownership structure officially disclosed by the NBU.

But their father, Vladimir Avramenko, is a much more well-known figure in the old Ukrainian business world: the founder of the confectionery giant AVK, a former people’s deputy, and later the owner of Trust Bank.

Moreover, the father’s connection to EasyPay is not merely biographical. In the history of the Kontraktovy Dom registry, Vladimir Avramenko previously appeared among the ultimate beneficiaries; this entry was removed in 2018. The company was then finally registered in the names of his sons.

Therefore, it makes sense to begin the EasyPay family history not with a terminal at a supermarket, but with the chocolate factories of Donbass.

AVK: Empire, War, and $160 Million in Debt

AVK was founded in Donetsk in 1991 and gradually became one of the largest confectionery producers in Ukraine. The business included factories in Donetsk, Luhansk, Dnipro, and Mukachevo.

After 2014, the company suffered a truly severe blow. Production facilities in Donetsk and Luhansk were lost due to the war and occupation. Therefore, it would be too simplistic to describe all of AVK’s subsequent debt problems solely as the result of a deliberate "scheme."

But the scale of the debt is impressive. In 2016, Vladimir Avramenko himself stated that AVK owed creditors approximately $160 million. The main creditors were Ukrainian subsidiaries of Russian banks: Sberbank owed approximately $80 million, and Prominvestbank owed approximately $60 million.

Then, a multi-year battle ensued between banks over collateral. Prominvestbank eventually won the Dnipro factory’s assets in court; creditors attempted to recover their money through bankruptcy proceedings. In 2020, the AVK case included recognized bank claims totaling approximately UAH 4.5 billion.

In July 2021, the Commercial Court declared AVK PJSC bankrupt and initiated liquidation proceedings. However, there’s a detail often overlooked in exposés: in November, the appellate court overturned the bankruptcy ruling.

There were indeed criminal proceedings and extremely serious conflicts with banks surrounding the transfer and collateralization of production assets. In public documents, creditors accused Avramenko’s entities of attempting to expropriate assets. However, calling the entire AVK story a proven "Avramenko scam" would be overstating the case. There was a genuine collapse of part of the business due to the war, a genuine multi-billion dollar default, and numerous disputes over collateral—but this is not the same as a court-established fraud by the owner.

But the next episode looks especially interesting.

How a confectioner bought Trust Bank

On June 16, 2015, the NBU approved Volodymyr Avramenko’s acquisition of a 100% stake in Trust Bank. Other owners later retained some of the shares, but Avramenko became the controlling figure.

Thus, in the midst of AVK’s debt crisis, the confectionery businessman also turns into a banker.

And the family connection becomes even more direct: since April 2016, his son, Oleksiy Avramenko, the current co-owner of EasyPay, has served on the supervisory board of Trust Bank. This is documented in NBU documents regarding the management of the liquidated bank.

The bank didn’t last long. On December 6, 2016, the NBU declared Trust insolvent. By December 1, its capital was already negative—minus UAH 135 million. The regulator cited a significant volume of problem loans, including those from borrowers in the ATO territories, and the lack of a credible recapitalization plan.

But another episode is particularly disturbing. Effective July 2, 2016, the NBU restricted Trust Bank’s ability to accept deposits from individuals. Despite this, at the end of November—literally on the eve of its insolvency declaration—the bank resumed accepting deposits from individuals, offering high interest rates. The regulator specifically emphasized this in explaining its decision.

Again, this doesn’t prove a proven intent to "buy a bank, collect deposits, and bankrupt it." The NBU made no such conclusion. But the family business chronology is, at the very least, unusual: AVK’s enormous debts to banks; Volodymyr Avramenko’s purchase of his own bank; his son, Oleksiy, on its supervisory board; and, a year and a half after the change of control, the bank becomes insolvent.

And in parallel, there is another family business - EasyPay.

EasyPay: From Convenient Payments to a Hundred-Million-Ruble Fine

Kontraktovyi Dim was registered back in 2007 and, over the course of two decades, grew into one of the largest non-bank payment operators in the country. As of 2025, its annual revenue exceeded UAH 2.1 billion, and its owners were brothers Oleksiy and Anton Avramenko.

The company has also accumulated its own history of complaints from the regulator.

In January 2023, the NBU fined Kontraktovyi Dim UAH 204,000 for violating financial monitoring requirements. In December of the same year, a fine of almost UAH 8.95 million followed.

In subsequent years, other measures were taken for violations of payment market legislation, statistical reporting, and risk management deficiencies.

In May 2026, the NBU imposed a fine on Kontraktovyi Dom equal to City24’s: UAH 135.15 million for violating financial monitoring legislation. The company filed a lawsuit, and the NBU publicly announced on July 1 that it would defend its decision.

Therefore, the two largest terminal ecosystems—Avramenko’s family’s EasyPay and Serhiy Gorban’s City24—are united by more than just their involvement with Ukrposhta. In 2026, both were fined UAH 135.15 million by the NBU for AML violations, and are appealing both decisions.

5. Electrum Payment System: Criminal cases emerged long before Ukrposhta

"Electrum Payment System" is a much lesser-known name among the general public, although it was a significant player in the payments market in the mid-2010s.

The company was registered on January 29, 2016. In May of that year, it received a license from the National Bank of Ukraine (NBU) for funds transfers, and state-owned Ukrgasbank became its partner in issuing e-money. The system allowed for cash acceptance, deposits into e-wallets, transfers between users, and conversion back into cash or non-cash payments.

In other words, we are again faced with the same functional unit: cash → payment infrastructure → banking system.

EPS’s ownership history is quite checkered. At various times, Vyacheslav Lysenko, Ekaterina Postelnikova, and entities affiliated with Electrum Payment System Ltd/Electrum Paycom were listed as beneficiaries in the registers. At the end of 2022, the structure changed. Today, the largest owner and ultimate beneficiary is Azerbaijani citizen Shahsanam Akhmedova, with 62.5%. Artur Vitrenko owns 15.3%, Elena Sibileva 15%, and Vyacheslav Pozharsky 7.2%.

But for our story, what’s more important is not today’s owners, but what happened around EPS back in 2017-2019.

The SBU, ORDLO, and the seizure of accounts

In 2017, law enforcement opened a criminal investigation into Electrum in connection with alleged financial transactions across the demarcation line with the uncontrolled territories of Donbas and Crimea.

In March 2018, Kyiv’s Shevchenkivskyi District Court seized EPS’s accounts at Ukrgasbank. Investigators considered the payment system as a possible element of a money laundering scheme.

The company’s management categorically denied operating illegally in uncontrolled territories.

In January 2019, another seizure followed—this time of nine EPS accounts at Ukrgasbank. Court documents cited transactions related to, among other things, bookmakers 1xBet, Leon, and Favorit. Investigators considered the funds in the accounts to be material evidence and pointed to the risk of their withdrawal.

EPS also denied these accusations and publicly stated that it had no commercial relations with the aforementioned bookmakers and illegal online casinos.

And this is crucial again: the seizure of an account in a criminal case is not yet a verdict for its owner. I was unable to find any final guilty verdict in open sources that would establish criminal activity by EPS itself in these cases.

However, there are more recent and completely unambiguous decisions from the regulator. In January 2022, the NBU fined Elektrum Payment System UAH 204,000 for violating financial monitoring legislation. And in August 2023, the company was removed from the State Register of Financial Institutions, as it had not held the necessary licenses to provide financial services for three months. In November, the NBU further fined it as a payment system operator for late reporting.

Thus, one more company of the six had a history of both criminal attention to the movement of funds and actual punishment from the NBU for violating AML requirements long before the scandal with Ukrposhta.

6. GlobalMoney: The most telling case of why accusations need to be re-examined

Globalmani is the oldest of the six companies. It was registered on April 2, 2009, and for many years operated as a payment system and e-money operator.

Historically, Vladimir Karpov and Konstantin Tveritin were among the owners. In 2022, Tveritin left the company, and in September 2023, Karpov was replaced by Lyudmila Kalinina, who is currently both the sole owner and ultimate beneficiary of the company.

The issuer of GlobalMoney electronic money was Alliance Bank. It’s important to avoid the mistake that’s easy to make when trying to establish corporate ties: being associated with the issuing bank doesn’t automatically mean the bank’s owner is also the owner of GlobalMoney. These are different legal relationships.

GlobalMoney has had an extremely toxic reputation in the Ukrainian press for years. The company has been accused of ties to Russian banks, operating in uncontrolled territories, and other allegations.

In 2020, funds in three GlobalMoney accounts at Alliance Bank were indeed frozen. However, the court later established an important detail: the injunction prohibited the disposal of specific frozen funds, but did not prohibit GlobalMoney from opening other accounts. The injunction itself was subsequently lifted. Publications portraying the opening of new accounts as a violation of the injunction were deemed false or incomplete by the court, and media outlets were ordered to publish retractions.

A similar situation arose with allegations of GlobalMoney’s collaboration with banned Russian banks and entities in the occupied territories. The company filed lawsuits, and in several cases, the courts ordered those spreading these allegations to retract them.

But this doesn’t eliminate another set of facts—regulatory ones. In October 2021, the NBU fined GlobalMoney UAH 306,000 for violating financial monitoring laws.

A much more serious package of sanctions followed in September 2023. One of the fines amounted to UAH 10.08 million and was related to the improper organization and implementation of initial financial monitoring.

In August of that year, GlobalMoney was removed from the State Register of Financial Institutions. Unlike EPS, the NBU formulated the reasoning differently: the exclusion was based on documents submitted by the company, so it cannot be presented as a separate punitive measure by the regulator.

The GlobalMoney story clearly demonstrates why an article like this needs to distinguish between three completely different elements: a newspaper accusation, a criminal suspicion, and a proven regulatory violation. The first sometimes falls apart in court. The second has yet to be proven. The third is already an official fact.

Not one owner. One mechanism.

After analyzing all six companies, the initial theory—"they most likely have a single hidden owner"—appears overly simplistic. According to publicly available data, EasyPay, City24, Electrum, GlobalMoney, and the iBox entities do not have a single beneficiary.

But something perhaps more important is revealed.

All six companies are located in a very specific segment of the economy: on the border between physical cash and electronic money circulation.

“Мєтапей” and “Пейбокс” — iBox.

“Contract House” — EasyPay.

“Swift Garant” — City24.

Electrum is a system of transfers and electronic money.

GlobalMoney is a system of transfers and electronic money.

Moreover, individual elements of this infrastructure literally changed hands: after the liquidation of IBOX Bank, approximately nine thousand iBox terminals were transferred to City24. And the two legal entities of the old iBox system—Metapay and Paybox—were simultaneously transferred to a single British owner in July 2024.

And in almost every part of this story, the same term comes up: financial monitoring.

IBOX Bank was liquidated by the NBU due to systematic AML violations.

EasyPay/Kontraktovyi dim has been repeatedly fined for financial monitoring violations and in 2026 received a fine of UAH 135.15 million, which it is disputing.

City24/Swift Garant received an AML fine in 2023 and a similar 135.15 million fine in 2026, which it is also disputing.

Electrum received an AML fine in 2022.

GlobalMoney — AML fines in 2021 and 2023.

And in 2022–2023, these companies were massively contributing cash to another entity subject to primary financial monitoring—the state-owned Ukrposhta.

Why did they need Ukrposhta at all?

This is perhaps the central question of the entire story. The payment network faces a very practical problem. Thousands of terminals across the country are filled with banknotes every day. These bills must be physically collected, counted, transported, and converted into a bank account balance so that the system can pay the recipients.

Typically, this means a bank, a collector, and complex logistics. But during the war, the banking infrastructure in part of the country was greatly reduced, while Ukrposhta retained a gigantic network of branches and a constant need for cash for pensions and social payments. On paper, this creates a near-perfect symbiosis: the terminal company deposits cash into the postal service; the postal service uses some of the money for payments or collects the surplus; and the company receives cashless payments.

Such a mechanism in itself may well be legal.

The problem begins when the ability to reliably answer a basic question disappears: where did the specific millions in cash come from?

This is why the NBU’s audit details are so important. If the proceeds were indeed collected from terminals, there should be terminal logs: the specific machine, the time each banknote was received, the amount at the time of collection, the collector, the route, the bag or cassette, the withdrawal report, and the subsequent cash deposit.

If the documents show that the same person is located hundreds of kilometers apart at the same time, that the branch accepts money outside of business hours, that the terminal is physically “collected” several times a day for huge amounts, or that the bundles of banknotes have suspiciously sequential numbers, then the question arises: was this money actually in the terminal before it was declared terminal proceeds?

And this is much more serious than the name of the owner of this or that LLC.

What the investigation should actually be looking for

To prove a complete scheme, it’s not enough to show a list of six companies. The two halves of the money route must be connected.

On the one hand, there’s the origin of the cash: which terminals allegedly collected it, what client transactions were behind the receipts, and who withdrew the money and when.

On the other hand, there’s the fate of non-cash funds after Ukrposhta accepted cash: which accounts they were deposited into, who they were then transferred to, what goods or services were specified in the payment details, and whether the money was returned further through a chain of related companies.

It is especially interesting to identify the individuals who represented these six companies in their dealings with Ukrposhta.

Who signed the cash documents?

Who handed over the cash?

What collection companies were used?

Are the surnames repeated?

Which banks serviced the final accounts?

Who negotiated commissions of 0.001–0.1%, which were lower than the standard Ukrposhta tariff?

And why was 95.8% of the state-owned company’s vast, specialized business concentrated in just 6 operators?

This is where the real “common denominator” could potentially be found.

From chocolate factories and casinos to one bag of cash

Each of these stories could stand on its own.

Alena Degrik-Shevtsova builds LeoGaming and acquires nearly a quarter of IBOX Bank, after which the bank is shut down for systemic financial monitoring violations, and the State Security Service (BEB) investigates alleged miscoding for illegal casinos worth nearly UAH 5 billion.

Vladimir Avramenko creates the AVK confectionery empire, is left with $160 million in bank debt, buys Trust Bank, appoints his son Alexey to its board, and a year and a half later, the bank closes with negative equity. His other two sons, Alexey and Anton, control EasyPay, the largest payment network.

Sergey Gorban builds City24, and after the liquidation of IBOX Bank, his Swift Garant receives thousands of former iBox terminals.

Electrum has been under law enforcement scrutiny for its cash flow and payments since 2017, subsequently receiving an AML fine and losing its financial license.

GlobalMoney is experiencing the freezing of its accounts, winning media cases to refute some of the most high-profile accusations, but simultaneously receiving its own official AML fines from the NBU.

And suddenly, all these lines converge in a completely unexpected place—the cash registers of the state-owned Ukrposhta. That’s why the story of the 11.4 billion hryvnias is much more interesting than the latest scandal surrounding Igor Smelyansky.

The main question isn’t whether Ukrposhta laundered money. That hasn’t yet been established by the court.

The main question is why almost the entire multi-billion dollar cash flow, which the NBU deemed abnormal for the postal operator, was generated by this small group of payment market participants, a significant portion of whom had already had serious problems with financial monitoring before or after this.

The answer may be quite prosaic: we are dealing with the largest cash payment operators, who simply needed a large national collection channel during the war.

But anomalous documents, unusually low fees, physically questionable routes, strange banknotes, and the biographies of the participants themselves give the regulator every reason to ask the next question.

Did Ukrposhta really help six payment companies collect their cash proceeds? Or did terminal proceeds at some point become a convenient name for cash whose origins no one wanted to scrutinize too closely?

The answer could turn the story of the postal operator into one of the most interesting financial investigations of recent years.