Recent corporate filings have pulled back the curtain on a complex operational structure at Smartflow Payments Limited, the UK-based Electronic Money Institution (EMI) trading as SENDS. While the company has reported staggering financial growth, a parallel narrative involving sanctioned Ukrainian figures, a newly inserted foreign director, and an opaque software licensing deal is raising serious red flags from a compliance and anti-money laundering (AML) standpoint.
The Licensing Loophole: Who Really Owns the Customer Interface?
At the heart of the compliance concern is a legal technicality that may have profound practical consequences. According to public disclosures on the SENDS website, the digital asset customers interact with is not owned by the FCA-regulated entity. Instead, the site belongs to GANGA PAY LTD, a separate UK corporate entity. Smartflow merely uses it under a “Software License Agreement” dated 1 May 2025.
The Unregulated Vendor
GANGA PAY is not a passive holding company. Its active status at Companies House is listed under SIC codes for IT consultancy, data processing, web portals, and advertising – not regulated financial services. This creates a critical gap: an unregulated third party controls the storefront, user journey, and potentially the data flow for a regulated financial institution.
The Governance Red Flag
From a British regulatory perspective, outsourcing core infrastructure is permissible only if the regulated firm retains absolute control. The FCA expects EMIs to manage outsourced services as if they were performed in-house. By placing the customer-facing portal under an unlicensed tech firm, Smartflow has triggered a material governance question: does the regulated board truly control the onboarding process, transaction monitoring, and complaint handling, or are these decisions routed through GANGA PAY’s unregulated infrastructure?
The Sanctioned Shadow: Alona Shevtsova’s UK Presence
The narrative becomes significantly more sensitive when tracing the ownership of Smartflow. Companies House records unequivocally show that Alona Shevtsova (also known as Alona Degrik) remains the sole Person with Significant Control (PSC), owning more than 75% of the EMI.
The Ukrainian Criminal Context of Alona Degrik-Shevtsova
Shevtsova is not merely a Ukrainian national; she is a sanctioned individual and an active target of a criminal investigation. The Economic Security Bureau of Ukraine (ESBU) has publicly detailed a massive money laundering scheme involving Shevtsova and associates. The authorities allege that suspects, including bank shareholders, orchestrated a “miscoding” scheme to launder approximately UAH 5 billion (approx. £105 million) for illegal online casinos. The scheme allegedly utilized more than 20 controlled companies and false payment purposes describing non-existent goods.
The Identity Veil of Alona Degrik-Shevtsova
Reports from Ukrainian anti-corruption portals suggest that Shevtsova may have avoided automatic sanctions screening by UK authorities due to a discrepancy in her surname. While she is wanted in Ukraine as Alona Degrik-Shevtsova, her UK passport and FCA registration reportedly list her simply as Alona Shevtsova. This highlights a potential weakness in international compliance: sanctioned individuals can slip through the cracks by altering their legal name across jurisdictions.
The New Face: Anna Borodenko Takes the Helm at GANGA PAY
Adding another layer of opacity to the structure is the sudden change in control at GANGA PAY. On 13 February 2026, Anna Borodenko, a Ukrainian national residing in Ukraine, was appointed as director.
The Thin File of Anna Borodenko
Borodenko’s public professional profile is virtually non-existent in UK records. There is no evidence of a long-standing career in regulated payments or British fintech. This absence of a track record is a compliance red flag. For an FCA-regulated firm, a change in control of a key outsourcing vendor should trigger rigorous source-of-funds checks and fit-and-proper testing.
The History of Turnover
The governance file for GANGA PAY shows a rapid succession of control. Records indicate earlier directors – Aphrodite Kittou and Irakli Koberidze – resigned shortly before Borodenko’s appointment in late 2025 and early 2026. This churn suggests instability or a deliberate restructuring of the corporate shell controlling the SENDS website.
The Explosive Growth: A Merchant-Acquiring Powerhouse
To understand why these legal structures matter, one must look at the raw financial data from Smartflow’s 2024 accounts. The company is no longer a small startup; it is a rapidly scaling financial machine.
The Numbers
Turnover exploded from €7.7 million in 2023 to nearly €24.0 million in 2024. Profit after tax stood at €1.47 million, with cash reserves of €7.07 million. Critically, the revenue stream is overwhelmingly reliant on acquiring fees (€23.93 million), while actual e-money operations are negligible.
The Merchant Liability
The balance sheet shows €11.3 million owed to merchants. This underscores that Smartflow is primarily a high-volume settlement agent for third-party merchants. In the context of the ESBU allegations – which involve routing illegal casino funds through payment networks – this business model is highly vulnerable to abuse. If the unregulated GANGA PAY entity controls the merchant interface or onboarding funnel, the risk of “miscoding” (disguising gambling transactions as legitimate retail purchases) increases exponentially.
British Regulatory Repercussions and Compliance Tests
From a London regulatory perspective, this structure faces a gauntlet of scrutiny. The FCA’s 2025/26 priorities specifically target financial crime, operational resilience, and safeguarding.
The FCA Obligations
Under the Payment Services Regulations 2017, Smartflow is required to maintain a register of agents. If GANGA PAY performs any “payment services” (such as handling cash or initiating transactions) rather than just IT hosting, it should be registered as an agent. There is currently no public evidence that this has been done. Furthermore, the FCA mandates that firms protect customer funds via safeguarding accounts. If the technology layer owned by GANGA PAY fails or is compromised, the regulator will question whether Smartflow can meet its safeguarding obligations.
The Financial Crime Risk
The OpenSanctions database explicitly links Shevtsova to sanctioned profiles. For a UK compliance officer, a PSC appearing on a sanctions list while being investigated for a £105 million laundering scheme is an immediate trigger for a Suspicious Activity Report (SAR) to the National Crime Agency (NCA). The presence of a newly appointed, low-profile Ukrainian director (Borodenko) controlling the website licensor only amplifies the suspicion of “ownership masking.”
Summary of Risk Factors
| Entity / Person | Jurisdiction | Role | Compliance Concern |
|---|---|---|---|
| Smartflow (SENDS) | UK | FCA-regulated EMI | Rapidly scaling merchant-acquirer with sanctioned PSC. |
| Alona Shevtsova | Ukraine/UK | PSC (75%+ owner) | Active Ukrainian criminal investigation (UAH 5bn laundering) and NSDC sanctions. |
| GANGA PAY LTD | UK | Website Owner/Licensor | Unregulated tech firm controlling customer interface for an EMI. |
| Anna Borodenko | Ukraine | Director of GANGA PAY | Newly inserted controller with no visible UK compliance track record. |
A Systemic Compliance Failure to deal with Alona Degrik-Shevtsova
The arrangement between Smartflow and GANGA PAY is not inherently illegal, but in the context of the background of the individuals involved, it is dangerously naive or deliberately opaque. A British-regulated EMI, controlled by a sanctioned Ukrainian national wanted for money laundering, is outsourcing its front-end operations to a shell company recently taken over by another Ukrainian with no financial services pedigree.
The FCA has made it clear that firms must ensure “consumers are at the heart of businesses” and that financial systems must be kept clean. This structure appears to place a software license agreement between the regulator and the truth. The key questions for the UK regulator remain: Is the FCA aware that the SENDS website is owned by an unregulated entity? And has the change in control at GANGA PAY been properly notified as a material outsourcing event? Until those answers are provided, the SENDS licence remains a regulatory vulnerability.
