Dropper Processing Is No Longer a "Payment Issue"

On October 14, 2026, Kazakhstan's Financial Monitoring Agency reported the break-up of cross-border networks that, according to investigators, served online casinos through controlled bank accounts. In one of the episodes, incoming card turnover exceeded 9.8 billion tenge. For the iGaming industry, this is a reason to discuss not just droppers but the entire chain: who takes players' money, on what basis the settlements are made, and why a high approval rate doesn't prove the payment model is legal.

An affiliate can have a clear commercial picture: registrations are coming in, deposits are getting confirmed, commissions arrive on time. But none of that says whether corporate accounts are being used for settlements, who controls the recipients of the money, or whether the activity itself complies with local law.

The real issue isn't just whether the payment goes through, but how transparent its legal and contractual foundation is.

This material is for informational purposes and is not legal advice. In the case described, the investigation is ongoing: information about the alleged scheme comes from the AFM's report, and only a court can establish the guilt of specific individuals.

• What happens when a state punishes not just the operator but the player too, for illegal gambling? In the article Betting as an Offense, we break down which jurisdictions impose fines and imprisonment for taking part in illegal play, why a foreign license doesn't always protect the user, and how these rules play out in real cases. We also explain what affiliates should check before launching traffic, so they don't create a false impression that an offer is legal. 

A high approval rate and on-time affiliate payouts can hide an opaque payment infrastructure, from taking deposits into controlled personal accounts to settling with unknown intermediaries. Using October's case in Kazakhstan as an example, together with 3S.INFO, we break down why a product's legality and the origin of funds matter more than transaction speed, which warning signs call for scrutiny, and what an affiliate needs to find out before launching traffic.

What's Known About the October Investigation

According to an AFM report cited by Zakon.kz, processing traders set up so-called drop farms using accounts belonging to citizens of Kazakhstan, Uzbekistan, and Kyrgyzstan. Investigators describe handing over control of banking apps to other participants and using a P2P platform to accept payments, verify them, and make payouts. According to the agency, settlements between participants were also conducted in cryptocurrency.

The publication describes two separate episodes.

The second episode, according to investigators, also involved the recruitment of minors. A court authorized pretrial detention for five suspects. That's a preventive measure, not a guilty verdict.

There are two other important limits on how to read this:

• 9.8 billion tenge is the incoming turnover on the controlled cards, not the organizers' established profit, the casino's GGR, or the size of the damage;
• 500 million and 9.8 billion tenge relate to two different episodes described, so they can't be mixed up with the number of cards and detainees.

Nothing in the report gives grounds to consider any third-party PSP or any individual affiliate a participant in this scheme. But it does show why payment infrastructure requires separate scrutiny.

Product Legality First, Processing Quality Second

For Kazakhstan, the starting point is unambiguous: online casino activity is prohibited. The AFM states separately that bookmaker services are provided under the relevant license. A foreign online casino license doesn't override the local ban.

So the check shouldn't start with the question "which payment provider handles KZ best." First, you need to establish:

1. Whether the product itself is permitted;
2. Whether the operator has the right to serve the chosen audience;
3. Whether the promotion and the affiliate model are permissible;
4. Whether the settlement infrastructure fits this type of activity.

Even a registered payment provider doesn't turn a prohibited product into a permitted one. And conversely: a licensed product doesn't justify the use of opaque accounts.

For an affiliate, a payment audit is an extra layer of verification, not a way to make an inadmissible offer "safe."

Why "That's a Payment Question" Is a Weak Position

Outsourcing transaction processing to an external provider is a normal business model. But handing off the function doesn't remove the need to understand who exactly is performing it.

Discussions often conflate three different scenarios:

Third-party involvement on its own doesn't prove a violation. Payment organizations and agents can operate legally. The problem arises when legal roles aren't disclosed, the recipient isn't tied to the contract, and actual control over the accounts belongs to other people.

Since September 16, 2025, Kazakhstan has had Article 232-1 of the Criminal Code on droppering. An official clarification from the Ministry of Internal Affairs classifies as relevant actions the illegal transfer, provision, or acquisition of access to a bank account, a payment instrument, or an identification means, as well as certain illegal settlements in the interests of third parties for a fee. Depending on the offense, penalties range from a fine to seven years' imprisonment with confiscation of property. Not every transfer to a third party automatically falls under this article: how it's classified depends on the circumstances.

Which Payment Infrastructure Warning Signs Call for Scrutiny

A red flag isn't proof of a crime. It's a reason to request an explanation, documents, and, if necessary, pause the integration.

The combination of signs matters most: one unusual element may have a legitimate explanation, but several inconsistencies call for a deeper review.

Asking someone to hand over access to a banking app, SIM card, or identification means is especially concerning. Such circumstances directly overlap with the risks described in the official clarification on droppering.

It's important not to base your assessment on the account holder's citizenship. A foreign citizen can legally open an account and use it. What needs checking is the authority, the actual control, the purpose of the transaction, and whether it fits the contractual model.

What to Verify With a Corporate PSP

A solid check starts with identifying the company, not with a demo of a successful deposit.

In Kazakhstan, the National Bank maintains a register of payment organizations. When checking, keep in mind that a payment organization goes through registration, while banks and other categories of participants have their own regime. The phrase "we're a licensed payment provider" without the organization's name and the type of its authority isn't enough.

1. Legal Entity and Status

Ask for:

• the full name and registration number;
• the country of registration;
• confirmation of current status;
• information on owners and controlling persons, to the extent needed for the check;
• the basis for providing the stated payment services.

Cross-check the information yourself against an official source, not just a PDF from a manager.

For a Kazakh payment organization, the starting point is the National Bank's register. An entry confirms the relevant registration status, but it doesn't mean approval for any product it services.

2. The Contract and the Scope of Services

The documents should make clear what the provider actually does: accept payments, run a technical gateway, make payouts, or act as an agent.

You need to establish:

• who the client is;
• who receives the money;
• who settles with the operator, and when;
• who is responsible for refunds and disputed transactions;
• which subcontractors may be involved;
• which products and countries the contract permits.

If an intermediary calls itself only a technical supplier, it's worth finding out who is actually providing the payment service.

3. The Basis for Servicing the Product

PSP registration documents don't replace confirmation that the banking and payment model in use actually permits the specific activity.

It's worth asking for evidence of the relevant permitted use, in a form that's available given banking and commercial secrecy. If the counterparty can't show the full contract, a statement, an official letter, or a check through their legal team may work instead.

The answer "the bank doesn't know what we process" isn't a commercial advantage — it's a reason to stop the conversation.

4. Accounting, AML, and Incident Handling

For an operator's team, it's important to assess:

• client identification and verification;
• monitoring of suspicious transactions;
• whether the payer complies with the product's rules;
• reconciliation of transactions and payouts;
• the integrity of logs;
• procedures for withholding and returning funds;
• notification of changes in banks and subcontractors;
• actions to take when servicing is restricted.

Documents shouldn't exist just for a presentation. The check should show how the process works in practice.

Why Third-Party Settlements Affect the Entire Chain

The October case describes an infrastructure where account owners, the people controlling the devices, the processing platform, and the participants in the settlements all existed separately. According to the AFM, this system served the payments of online casinos.

For a legitimate business, an opaque distribution of roles creates several risks.

The Operator Loses Control Over Settlements

If the money sits in accounts held by people with no clear obligations, it becomes harder to confirm balances, run reconciliations, and guarantee refunds. A fast transaction doesn't answer the question of who is obliged to return the funds if something fails.

Users Don't Know Who They're Paying

A recipient name that isn't connected to the product makes it harder to explain the payment and resolve a dispute, especially if the interface doesn't disclose the intermediary's legal role.

The Affiliate Depends on Someone Else's Infrastructure

Even if the partner doesn't accept deposits, a settlement failure can affect FTD confirmation, offer availability, and commission payouts.

That said, you can't claim that every affiliate automatically bears criminal liability for a PSP's actions. Their legal position depends on their actual role, their actions, their awareness, and the applicable rules. But not having access to the operator's cashier doesn't make checking the counterparty pointless.

Why Crypto Doesn't Make the Origin of Money Legal

In the AFM's October report, cryptocurrency is mentioned as one of the settlement methods. In one of the episodes, 27,000 USDT was seized. The mere presence of digital assets doesn't prove a separate violation, but it doesn't remove questions about the source of funds either.

You need to separate:

• what the payment was made in;
• what it was made for;
• where the funds came from;
• who has the right to dispose of them.

Paying a commission in USDT doesn't confirm that the advertised product is legal. It also doesn't replace a contract, an act, a commission calculation, or information about the payer.

The FATF lists the opacity of the origin and ownership of funds, unusual transaction patterns, and operations without a clear economic explanation as risk indicators. A single indicator doesn't equal proof of money laundering: the context and the combination of circumstances need to be assessed.

Similarly, a "clean" score for an address in an analytics service doesn't prove that the whole transaction is legal. Checking blockchain history solves one problem; checking the product and the contract solves another.

For an affiliate receiving digital assets, a reasonable documentary minimum includes:

• a contract with the actual counterparty;
• a commission calculation;
• proof of the obligations performed;
• agreed payment details and network;
• the transaction identifier;
• an explainable link between the sender and the contracting payer.

If the payment comes from a different person, the basis for that needs to be established before considering the matter closed.

How a Corporate PSP Differs From a Promise of "Deposits Without Declines"

An approval rate shows how successfully a specific set of attempts was processed. It isn't a legal characteristic.

Beyond that, without a methodology, the number itself can be misleading. You need to clarify the period, the payment method, the devices, the attempts excluded, and whether it's technical authorization or actual crediting that's being counted.

A professional check of a corporate PSP comes down to documents, authority, product approval, controls, and traceability. A test transaction is useful as a technical check, but it doesn't replace any of these elements.

• Choosing a PSP for an iGaming operator isn't a question of "who's cheaper" — it's about payment architecture, deposit conversion, and the ability to survive in a high-risk vertical. We'll break down the role a payment provider plays for a casino, which metrics and risks deserve attention, and how to build a payment stack so you're not dependent on one or two gateways.

What an Affiliate Should Request From the Advertiser

An affiliate usually doesn't have the authority to conduct a full audit of an operator's payment system. There's no point demanding raw player banking data or access to someone else's accounts.

But before launch, you can and should get a clear set of confirmations:

If a PSP isn't disclosed on grounds of commercial secrecy, alternative confirmations through the compliance team can be discussed. But commercial secrecy doesn't explain the absence of a legal entity, a contract, or the legal basis for the offer itself.

For Kazakhstan especially, it's important not to start with this table if the matter is promoting an online casino to the local audience: the prohibition on the activity comes first. Checking documents doesn't override it.

What to Do If Risk Signs Are Found After Launch

The first move isn't to look for a replacement for personal payment details or to help move funds around. You need to stop the actions that could increase the risk and bring in the legal and compliance teams.

A practical sequence:

1. Record the discrepancies you've found, along with the dates.
2. Pause new placements or the payment connection if the risk is significant.
3. Request a written explanation and supporting documents.
4. Preserve contracts, reports, correspondence, and the settlement history.
5. Don't collect unnecessary personal data about users.
6. On your lawyer's advice, determine whether to contact the bank, the provider, or a competent authority.
7. Resume operations only after the issues are resolved, not after a manager's verbal promise.

For an affiliate, this is also a budget question. Continuing to buy traffic on an opaque offer in the hope of "collecting the last payout" isn't real risk management.

Lessons From the October Case

According to the AFM, this wasn't a single transfer but an organized cross-border infrastructure with a large number of accounts and devices. Its alleged function was servicing illegal online casinos. The investigation is ongoing, and conclusions about the guilt of specific individuals would be premature.

But the business lesson doesn't require waiting for a verdict: high payment conversion doesn't replace checking the settlement model.

For an operator, this means understanding the entire chain of accepting and paying out money. For a PSP, it comes down to confirming its authority and the admissibility of the product it services. For an affiliate, the task is checking the legality of the offer and the party to the contract, even if the approval rate is high and commissions arrive quickly.

Good processing isn't the kind that moves money at any cost. It's infrastructure where the participants, the grounds for transactions, the obligations, and the origin of funds are all clear.