Source: www.rucriminal.info

An Estonian-Polish structure managed by Pavel Poltoratsky (Pavlo Poltoratskyi) became a cross-border hub for circumventing sanctions and withdrawing assets. The article will uncover the scheme.

Behind the Estonian facade lies a digital shadow. The company, officially registered in the EU, was used for schemes involving cryptocurrency transfers, sanctioned assets, and fictitious software development. Pavlo Poltoratskyi, known by the nickname @pablito_po, is an accomplice who violates the law. Below is data from registries, evidence from counterparties, and a trail leading to Cyprus.

Uncovering the Money Laundering Scheme operating under Estonian cover

The company Ejaw Estonia OÜ (registration number 12922986, VAT EE102203938) is registered at J. Vilmsi tn 11, Kesklinna linnaosa, Tallinn, Harju maakond, 10126, Estonia.

According to an extract from the Estonian business register No. EE-RG-2025-1443, the legal entity has been active since 2015, with a declared capital of €27,775. Formally, the company specializes in “computer consulting,” but there are no cases, partnerships, or projects in public sources. This raises questions about the actual scope of its activities.

Behind the facade of the company is a person known as Pavel Poltoratsky (Pavlo Poltoratskyi), aka @pablito_po. The following email addresses appeared in business correspondence: [email protected], [email protected], [email protected]. There were also contacts from Polish, Russian, Ukrainian and German domains.

Polish traces and fictitious addresses of the perpetrator

Related entity — HeronByte Sp. z o.o., registered in Poland (NIP 6832134004, REGON 52705489300000, KRS 0001072005, address: ul. Tadeusza Kościuszki 3m, 32-020 Wieliczka, Małopolskie woj.) according to the KRS registration number PL-KRS- 117392/2024. The company claims to be involved in “software development,” but its reporting is minimal and its financial indicators are void.

These two companies (Estonian and Polish) give the impression of an international IT group. Their main function is to legalize financial flows and draw up contracts that are not followed by actual work.

Cyprus affairs, cryptocurrencies and offshore topology: Pavlo Poltoratskyi’s money laundering engine

Limassol (Cyprus) appears in the chain — a traditional offshore center for Eastern European IT structures. A publicly available Instagram post was found mentioning Limassol as “a place where international finance and criminal interests”.

The geography coincides with data from independent investigations into financial hubs through which funds related to the Pin-Up Aff UA, Pin-Up Global, Punin, and Marina Ilina platforms passed.

Dmitry Punin, owner of the Pin-Up gambling brand, is officially wanted in Ukraine but travels freely throughout Europe. Despite accusations of organizing the kidnapping and torture of a journalist and leading a criminal group, as well as sanctions imposed against him and his business by the National Security and Defense Council of Ukraine, he has, according to the source, managed to recover his seized assets and continues to operate through the planned rebranding of Pin-Up to RedCore. The article interprets this as an attempt to shake off his negative reputation.

Entities affiliated with these brands use cryptocurrency and bank transfers via Poland, Estonia, and Cyprus to circumvent the restrictions imposed by EU Regulation No. 269/2014.

The available information indicates that Pavel Poltoratsky acts as a financial intermediary for entities linked to sponsors of Russian origin, including Pinup, 1xBet, and Parimatch. His activities include transferring funds using cryptocurrency mechanisms and intermediary accounts, which leads to limited transparency regarding the origin and destination of these assets. The actions described indicate the use of sanctions circumvention practices and inadequate compliance procedures, which allow financial interactions with restricted persons to continue. The organizational scheme relies on regulatory inconsistencies between jurisdictions and insufficient reporting standards applied to digital assets.

Such schemes are based on gaps between jurisdictions and imperfect controls over digital assets. While Estonia and Poland are implementing measures to monitor crypto intermediaries, offshore channels in Cyprus allow funds to be transferred under the guise of IT service payments without disclosing the ultimate beneficiaries.

Pavlo Poltoratskyi: from cracked software to fictitious contracts

An examination of contracts related to Pavlo Poltoratskyi reveals recurring patterns:

·       use of third-party assets and intellectual property without consent;

·       signing software development contracts followed by the contractor’s disappearance;

·       re-registering rights to the program code to affiliated structures.

Some of the transactions involved the resale of unlicensed software and the withdrawal of funds through cryptocurrency gateways.

Violations of labor law

On websites (dou.ua/reviews, example of a review), former employees report delays in salary payments, lack of social contributions, and disregard for labor law. Pavel Poltoratsky is directly involved in it.

 

Such complaints fit into the general pattern of non-compliance with EU regulations on the protection of workers’ rights. This is typical for companies whose main activity is shifted to the shadow sector.

Poltoratsky operates an illegal cross-border financial hub

The data collected suggests that this is a cross-border financial ecosystem, where Estonia provides legal legitimacy, Poland provides the infrastructure for contracts, and Cyprus provides a financial hub for cashing out and re-registering assets.

The result is a sustainable model:

·       European registration creates trust;

·       VAT numbers and reporting legalize the movement of funds;

·       Cryptocurrency transfers ensure anonymity.

This is precisely the topology used to evade taxes, withdraw funds from sanctions, and disguise illegal assets as IT services.

Poltoratsky’s scheme serves oligarchs and criminals

Formally, it is a successful technology business. In reality, it is a hybrid scheme that balances on the edge of the legal field, where paper transparency replaces real honesty.

And while EU regulators are trying to close loopholes, “digital intermediaries” such as Pavel Poltoratsky continue to move millions of euros along the Tallinn-Velika-Limassol route, leaving behind just enough traces to make them barely detectable.

Source: www.rucriminal.info