Documents show a private intelligence firm sought details on the “business, political and personal” vulnerabilities of government officials directing proceedings against the concession provider.

A private intelligence firm hired by Steward Healthcare sought to identify the “pressure points” and “vulnerabilities” of individuals within the Maltese government directing proceedings against the hospital concession provider, both in official and unofficial capacities.

Documents seen by Amphora Media and the Times of Malta reveal that CT Group, a UK-based private intelligence firm, asked Steward to map out individuals, their political priorities, and their vulnerabilities “in business, political and personal terms” that they could “target”.

CT Group also requested information on the relationships between these officials and former Prime Minister Joseph Muscat, who has been charged over his role in the hospital concession deal, and whether those ties could “influence” their behaviour.

The firm sought detailed profiles of the parties involved, including their preferred outcomes and, crucially, what Steward could “offer” that would be “acceptable” to resolve the dispute.

It also asked Steward to outline weaknesses in the government’s position on the concession.

In a reply to questions sent, CT said its “position is clearly set out in our previous emails to Times of Malta, OCCRP, and Boston Globe, dated 14, 17, 21, and 28 June 2024, in response to assertions made and questions asked by them at that time.”

“We have nothing to add to what we said in those emails,” it said.

Joseph Muscat said he “would be more than open to give comments”, but due to a court order, he “is prevented from making any comment on issues relating to the Hospital’s concession.”

A previous investigation by OCCRP, the Boston Globe and the Times of Malta , supported by the Daphne Caruana Galizia Foundation, revealed that Steward paid over €6.5 million to private intelligence firms CT Group and Audere to conduct surveillance and disinformation operations against its critics.

The costs of this intelligence work were paid by Steward’s Malta subsidiary, which was largely funded by Maltese taxpayers.

It was coordinated by senior Steward executives who corresponded regularly with private spies, according to emails, encrypted messages, and financial records.

Steward executives prioritised paying these intelligence firms, which sometimes charged the company as much as $170,000 per month, even as bills for critical medical services in its U.S. hospitals went unpaid.

The investigation revealed how Steward corresponded with the intelligence firms about “false flag” operations against a critic who ran a financial research company that issued a negative report about Steward.

That critic was later spied on in his home and followed, according to surveillance reports in the possession of Audere obtained by OCCRP.

Audere also collected embarrassing personal information and photographs of a former Steward employee after Steward feared he would leak financial information to its auditor.

Steward had also engaged CT Group, to target then-Health Minister & Deputy Prime Minister Chris Fearne as their main “opponent” of its concession. It created a report alleging the minister had taken a large bribe, which was then circulated to journalists.

Fearne, who has himself been charged over the hospitals’ scandal, demanded a police investigation into the smear campaign.

Dallas-headquartered Steward Health Care was awarded a €2.1-billion Maltese government contract in 2018 to renovate and manage three public hospitals.

Although Fearne initially backed Steward taking over the contract from Vitals Global Healthcare in February 2018, the relationship appears to have soured thereafter. 

By 2021, senior Steward staff contemplated suing Fearne and Malta’s government in the US, where they planned to allege extortion and solicitation of bribes, a leaked email shows. 

No lawsuit followed, however, former Steward Malta director Armin Ernst appeared to have kept tabs on Fearne, and operations codenamed ‘Project Albacore’ and ‘Project Bluefin’ were launched, e-mails and documents show. 

In a December 2021 e-mail, Ernst flagged a media report claiming irregularities linked to the Foundation for Medical Services, which fell under Fearne and the Foundation’s former CEO, Carmen Ciantar’s remit. 

That same month, Steward directed its law firm, Quinn Emanuel, to hire CT Group, an intelligence firm whose staff includes the UK government’s former counter-terrorism chief. 

In July 2022, CT Group pledged to “deploy into the public domain information about the main opponent of the Client’s concession in Malta” in a commercial proposal obtained by OCCRP. The aim was to identify “improper” behaviour and leak it anonymously to Maltese media.

A Maltese court annulled Steward’s hospital concession in 2023, citing an audit that found “collusion between Steward and senior government officials or its agencies” and called the deal “fraudulent.

The inquiry led to corruption and money-laundering charges against Malta’s former Prime Minister, Joseph Muscat, who was arraigned in court in May alongside more than two dozen others, including Fearne, connected to the hospital deal. All have pleaded not guilty.

It took over the contract from Vitals Global Healthcare, which signed its 30-year concession in September 2015.

However,  journalist Daphne Caruana Galizia revealed months earlier that the government had already struck a deal with Oxley Capital Group, a Singaporean private investment firm, for the refurbishment of the Gozo and St Luke’s hospitals.

After acquiring an unredacted version of the contract, Times of Malta revealed that the government and VGH had signed a memorandum of understanding by February 2015, two months before the request for proposal was issued.

If you have any information you would like to share, please feel free to reach out to julian@amphora.media or contact us on Whatsapp

By Joanna Demarco

Updated with a comment from Komunità Malta agency.

Alexander Kuksov, a Maltese passport holder and the brother of Semen Kuksov, is wanted by the United Kingdom’s National Crime Agency. He is suspected of ‘proceeds of crime offences’ in relation to an operation investigating a Russian ‘billion-dollar money laundering network’.

Britain’s National Crime Agency (NCA) this month announced charges against Alexander Kuksov, 23, putting him on its “most wanted” list. The NCA alleged he was “involved with an organised crime group responsible for the transfer and movement of multi-millions of pounds of criminal cash”. The details have been revealed in a joint investigation between Amphora Media, OCCRP, and Times of Malta.

The agency lists the offences as including “entering into or being concerned in the acquisition, retention, use or control or criminal property [sic], in this case, cash.”

Amphora Media, OCCRP and Times of Malta previously revealed that Alexander Kuksov’s brother, Semen, was stripped of his Maltese citizenship in October last year, following his five-year sentence. Semen, 25, was convicted in the U.K. of involvement in a group the NCA called a “professional banking service for criminals across the world.” 

The brothers, together with their father Vladimir Anatolyevich Kuksov, appear on a list of people granted citizenship in 2022 by Malta. The Kuksovs appear to have been given Maltese citizenship just weeks before Russians were excluded from passport sales to wealthy investors in the wake of the Kremlin’s February 2022 invasion of Ukraine.

In July 2022 – about six months after receiving his Maltese citizenship – Semen began managing “couriers to collect criminal money and deliver the laundered money overseas,” according to a statement by the UK’s Crown Prosecution Service.

The NCA now alleges that Alexander Kusksov was also involved in the criminal money laundering operation.

Lawyers for the elder Kuksov told OCCRP in 2024 that he had “no comment to make but notes that he and his adult son have lived separate lives for some years.” 

Vladimir Kuksov did not respond to a request for comment about the new allegations against his younger son, Alexander, whose whereabouts are unknown.

The Kuksovs received Maltese passports through a controversial citizenship-by-investment program. The so-called “golden passport” scheme was eliminated this year, following a damning judgement by the Court of Justice of the European Union. 

The Komunità Malta Agency, which oversaw the citizenship-by-investment programme, responded by saying, “We can confirm that the name of the person in question has come to the attention of the national authorities, and we shall be following any developments in this case closely.”

Under Maltese law, passports can be revoked if an applicant is sentenced within seven years of becoming a citizen to a jail term of a year or longer.

The charges announced by the NCA against Alexander have not been tried in court, and the money laundering allegations against him are not proven.

When the NCA announced its “Operation Destabilise” investigation in December 2024, it said the money laundering bust was its biggest in a decade, OCCRP reported at the time. The agency said the ring run out of Moscow and Dubai had been moving billions in cryptocurrency and hard cash for criminal operations, ranging from Russian ransomware attacks to street-level drug deals in the U.K.

Several alleged members of the network were sanctioned, and the NCA said it had arrested 84 people. They included Semen Kuksov, who later pleaded guilty to laundering more than $15 million of “criminally obtained cash,” according to the UK prosecution service.

The operation uncovered a complex scheme in which the networks collect funds in one country and make the equivalent value available in another, often by swapping cryptocurrency for cash. The crime agency stated that the investigation exposed and disrupted Russian money laundering networks that support crime worldwide.

The Malta Police Force did not respond to a request for comment on the U.K. case against Alexander or whether it was investigating the allegations against him.

Previous reporting by Amphora Media had also highlighted the lag between the government initiating the passport revocation process and the citizenship being officially revoked.

Malta eliminated its citizenship-by-investment programme earlier this year following a damning judgement by the Court of Justice of the European Union, bringing anend to a long-winded saga.

Malta had tried to defend the scheme, claiming that it is being unfairly targeted despite similar schemes existing in other countries – a false claim. It has now expanded a discretionary citizenship scheme for individuals of ‘exceptional merit.

Ozan Elektronik Para Anonim Şirketi, an electronic money institution, has been allegedly “used to introduce criminal assets into the financial system under the guise of legitimate commercial activity,” according to the Istanbul Chief Public Prosecutor’s Office statement. 

Meanwhile, prosecutors allege that Aveon Global Sigorta A.Ş., an insurance company majority-owned by Ozan Özerk, was allowing “money to be transferred under the guise of insurance premiums or commercial transactions”.

Turkish authorities have reportedly seized 72 million TL (some €1.47 million) of assets in relation to the investigation, linked to illegal betting activities. Ozan Elektronik has confirmed it has been placed under a trustee, which the prosecution said was in order to “preserve its financial structure and prevent the destruction of evidence”. 

“Upon completion of the compliance procedures and controls required by legislation and by the ongoing investigation, the return of customer and merchant funds will commence,” Ozan Elektronik said in a statement posted to LinkedIn last week. Aveon Global Sigorta did not respond to a request for comment.

UK corporate records confirm that Ozan Özerk is the beneficial owner of the targeted Turkish companies. Our reporting partners at OCCRP, CIReN, VG and Times of Malta could not confirm Özerk’s status or whereabouts, and they could not reach him for comment. 

Özerk’s other companies also hold financial licenses from other countries, including Malta. In Malta, he is the founder and beneficial owner of OpenPayd Financial Services Malta, an e-money institution. This company is not under investigation in Türkiye.

OpenPayd’s spokesperson said the company “is aware of reports concerning investigations by Turkish authorities into two companies, Ozan Elektronik Para A.Ş. and Aveon Global Sigorta A.Ş. which are owned by the same UBO as Openpayd. Those companies are not held within the OpenPayd group of companies, and we do not share operations with any of these companies.”

The spokesperson added that “This matter does not affect OpenPayd’s operations or the services provided to its clients as the UBO has no involvement in the board of directors or management teams of the respective OpenPayd entities. The company will continue to monitor the situation and provide updates as appropriate.”

Alleged scammer platform held account at OpenPayd

Scam Empire, a collaborative investigation led by OCCRP that included Amphora Media and Times of Malta, revealed how OpenPayd Financial Services Malta processed transactions for networks that allegedly con ordinary people around the world out of hundreds of billions of dollars.

Reporters found no evidence suggesting the company was aware the payments were linked to scams, but Malta’s Arbiter for Financial Services has indicated that payment processing companies should shoulder greater responsibility for protecting victims of such schemes.

Scam Empire revealed that victims were often led to believe that they were making payments to their own accounts, held at financial institutions, when, in reality, the accounts belonged to the alleged scammers.

Reporters found that numerous scam victims, many in Spain and the UK, transferred large amounts to the account of CurrencyRock UAB, a Lithuania-based company trading as Insirex, which used an account opened with OpenPayd to transfer the funds further.

OpenPayd, established in Malta in 2016 and licensed in 2019, was one of the payment firms used by alleged scammers to funnel money from would-be investors to fraudsters via sham financial trading platforms. When contacted by Scam Empire’s reporters, the company acknowledged its relationship with entities linked to the alleged scam, but said it had terminated this relationship “all for reasons related to their failures to maintain adequate controls”.

Explore the Scam Empire project

In one instance, a total of €2.5 million in small payments over three months was entered and rapidly withdrawn from the OpenPayd account held by CurrencyRock.

OpenPayd told reporters that “it monitors all transactions to/from its clients for fraud or other financial crime red flags, including through a comprehensive fraud monitoring programme designed to combat fraud from end customers”.

A spokesperson for the Malta Financial Services Authority, which regulates OpenPayd, declined to comment on specific individuals or ongoing investigations.

“However, the authority takes note of any information that may be relevant to the fitness and properness of persons linked to MFSA-licensed entities and will take appropriate action where necessary,” the spokesperson said.

Victims filed complaints against OpenPayd with Malta’s Financial Arbiter

In 2024 alone, three victims of various scams filed complaints with the Financial Arbiter in Malta after studying the account numbers of their scammers and identifying OpenPayd as the service provider that had opened these accounts.

In all cases, OpenPayd argued against any obligations to the victims because the company did not have a business relationship with them. Instead, OpenPayd only had a business relationship with the accused companies.

In one case, which concerned Hasbix Analytics sro, OpenPayd declared to the Arbiter that the accused company had been added to OpenPayd’s Fraud Monitoring Programme.

“Hasbix was seemingly left operating without suspension under a ‘60-day grace period’ permitted by OpenPayd before the relationship and account of Hasbix with OpenPayd was eventually ‘fully terminated on 29 May 2024’ after ‘a 60-day notice for Hasbix to cease operations and stop any transactions on the account, in line with OpenPayd’s terms and conditions’,” according to the case documents.

“If the Client fails to improve their management of fraud and/or reduce its fraud rates within a reasonable period of time, we terminate the relationship,” the representative added before specifying that relationships with 21 clients were terminated due to fraud-related reasons over the past three years and that its monitoring system identified 0.07% of transactions on their platform as fraudulent.

In all three cases, the Financial Arbiter concluded that the victims were ineligible to seek justice in Malta by not individually being the financial service provider’s customers.

“I am concerned not only with the quantity but also with the quality of these fraud schemes,” Financial Arbiter Alfred Mifsud wrote in the institution’s newsletter.

“Get-rich-quick schemes are invariably too good to be true. They are carefully laid out to tempt vulnerable consumers to try their luck with a small sum. Once inside the scheme, it gets progressively more difficult to extricate themselves out, and they are quite often convinced to continue paying into the false scheme until, finally, the truth is exposed, with hurtful results – both financial and psycho-social.”

However, the legal loophole that left OpenPayd without responsibility for facilitating payments demanded from victims by alleged scammers is being closed by recent legislation.

In April, Amendments to the Arbiter for Financial Services Act were adopted, updating the definition of an eligible customer. The new provisions state that “in the case of suspicious fraudulent payment transactions involving financial services providers, the victim of fraud exhibiting immediate, genuine and legitimate interest shall be deemed to be an eligible customer of any one of the financial services providers involved in the suspicious fraudulent payment transaction and this proviso shall be applicable with effect from 1st October 2025”.

“The aim is to render all victims of fraud as eligible customers of any licensed  financial services provider involved in the suspected fraudulent payment transaction,” financial services arbiter Alfred Mifsud wrote in reply to the reporters’ questions before the amendments were adopted.

Already in February, the Arbiter ruled that OpenPayd failed to protect “unquestionably a vulnerable, old person who was being aggressively manipulated by fraudsters”. It further stated: “The Arbiter does not accept that the Service Provider has no responsibility for the damages suffered by the Complainant when it was the Service Provider who offered and enabled the vIBANs [virtual IBAN] service to the third party”.

The Maltese citizenship of 25-year-old Russian national Semen Kuksov was officially revoked by the government after he was sentenced in the United Kingdom for running a “professional banking service for criminals across the world as part of a wider billion-euro money-laundering network”.

The citizenship deprivation process for Kuksov was initiated by the government following revelations by Times of Malta, OCCRP and Amphora Media journalists in 2024.

Published in the Government Gazette on Tuesday, the official announcement confirmed that Kuksov’s Maltese citizenship, which was acquired at the beginning of 2022 through Malta’s controversial cash-for-passports scheme, was revoked.

Kuksov was jailed in February 2024 for five years and seven months after pleading guilty to laundering “more than £12 million (US$15 million) of criminally obtained cash,” according to a statement that the UK’s Crown Prosecution Service published.

Details about Kuksov’s role in the network featured in an investigation codenamed Operation Destabilise. It uncovered a complex scheme in which the networks collect funds in one country and make the equivalent value available in another, often by swapping cryptocurrency for cash.

The crime agency stated that the investigation exposed and disrupted Russian money laundering networks that support crime worldwide.

As part of the network, Kuksov and an associate helped launder over €14 million during a 74-day period.

Kuksov had admitted to operating an underground cryptocurrency exchange.

Kuksov had appeared on the citizenship list with his father, Vladimir Anatolyevich Kuksov; however, the elder Kuksov has no connection to his son’s criminal case. 

When the Community Malta Agency, which oversees the citizenship program, was questioned about the status of Kuksov’s citizenship following the revelations, reporters were informed that it was reviewing the case.

The agency is “seriously considering offering to advise the Minister to initiate the process of deprivation of citizenship,” CEO Joseph Mizzi had said in an email.

The Kuksovs appear to have been given Maltese citizenship just weeks before Russians were excluded from passport sales to wealthy investors in the wake of the Kremlin’s February 2022 invasion of Ukraine.

Citizenship revocations have proved a challenge for the Maltese government, particularly among those who acquired their passport through the IIP program, or the golden passports scheme.

Before Kuksov, Pavel Melnikov was the only known citizenship buyer to have lost his Maltese passport. He was found guilty of aggravated tax fraud and aggravated accounting fraud in Finland earlier this year.

Evgeniya Vladimirovna Bernova, a Russian national named on a US sanctions list for allegedly enabling Russia’s intelligence services and helping it evade Western sanctions through the notorious Serniya network, remains a Maltese citizen nearly three years after the Home Affairs Ministry announced its intention to revoke her citizenship.

Malta eliminated its citizenship-by-investment program earlier this year following a damning judgement by the Court of Justice of the European Union, bringing an end to a long-winded saga. 

Malta had tried to defend the scheme, claiming that it is being unfairly targeted despite similar schemes existing in other countries – a false claim. It has now expanded a discretionary citizenship scheme for individuals of ‘exceptional merit. 

Amphora Media’s fact-check has shown that as of July 2024, less than 10% of the reported €1.4 billion generated from the scheme had been allocated to social projects, and that just €41,847,629, or one-third of the promised amount, had been paid out. It remains to be seen what will happen with the rest of the fund.

A €650,000 loan routed through a Maltese company linked to one of the country’s fish farm operators is now under scrutiny. This follows the seizure of approximately €50 million in assets tied to convicted mafia associate Emanuele Catania in Sicily.

Court documents analysed by Amphora Media and IrpiMedia reveal how Medina Ridge Holding Limited, a Malta-registered company now in dissolution, financed Emanuele Catania’s purchase of shares in Azzurra Pesca, a company that operated a tuna-farming vessel, named ‘Angelo Catania’, in 2012.

Medina Ridge Holding has had the same shareholders as Fish & Fish Limited, which holds 10 aquaculture permits and is one of Malta’s five fish farm operators, primarily dealing in bluefin tuna. 

Medina Ridge was founded in 2012, the same year it lent money to Emanuele Catania. At the time, it was owned by Emanuel Azzopardi and Joseph Caruana. Both men have since died, with their heirs now serving as the shareholders. David Azzopardi, now a minor shareholder, was the company secretary at the time of the deal and has been serving as the company’s director since 2018. 

David Azzopardi confirmed the transactions when responding to questions from journalists. He said that “any funds lent to the representative of the company for the purpose of acquiring additional shares in Azzurra Pesca Srl have either been repaid or settled through services rendered”.

“The companies I represent have a quota to manage aquaculture farms in Malta, and the business has always been conducted in compliance with legal requirements,” he said.

He stressed that neither he nor the companies he represents were aware “of any investigations or allegations against the company [Azzurra Pesca]”.

How €650,000 From Malta Ended Up in Mafia-Linked Fishing Firm

Azzopardi and Caruana took over Fish and Fish in 1996 and remained the primary shareholders until their deaths. Azzopardi and Caruana’s shares were transferred to their heirs in 2019 and 2021, respectively.

According to official documents, the €650,000 “loan” was transferred from Malta in two tranches via Bank of Valletta. A €400,000 transfer was made on 19 April 2012, followed by a €250,000 transfer on 27 July; Medina Ridge ordered both.

These sums were used to purchase the full shareholding of Azzurra Pesca for €643,000. The exact source of the €650,000 remains unknown to investigators.

Azzurra Pesca and Catania himself would later come under investigation by Italian anti-mafia prosecutors. 

Catania was convicted of mafia association for his role in helping the Rinzivillo faction of Cosa Nostra infiltrate Sicily’s legal economy and launder illicit proceeds through the seafood trade.

He was ruled to be an active member of the Rinzivillo mafia clan. He was found to have played a key entrepreneurial role in supporting the group’s infiltration of the legal economy, using legitimate businesses to launder illicit funds.

Court records describe the Catania family as long-standing operators in the fishing industry in the Southern Sicilian town of Gela, beginning with the launch of the seafood business ‘Fratelli Catania’ in 1978, represented legally by the same Emanuele Catania.

In court documents, Catania is also described as having allegedly acted as a trusted man for the Rinzivillo mafia clan, including expansions into Morocco.

A Guardia di Finanza press release has revealed that Italian police have seized assets worth approximately €50 million. This includes real estate, fishing vessels, company shares, and business complexes with operations spanning Sicily, Italy, and Morocco.

Azzurra Pesca, Fish & Fish and The ‘Angelo Catania’ Vessel

The document also names the ‘Angelo Catania’, the fishing vessel purchased with funds transferred through Medina Ridge.

David Azzopardi confirmed that Fish & Fish purchased fish from “quotas assigned annually to the fishing vessel ‘Angelo Catania’ by the Ministero dell’Agricoltura, della Sovranità Alimentare e delle Foreste and registered with ICCAT, the international governing body regulating the conservation of bluefin tuna.”

He added that the fish purchases from Azzurra Pesca Srl  “were carried out in compliance with all regulatory requirements.”

“These transactions were registered in the e-BCD system and monitored by both ICCAT observers and regional observers appointed by the Italian Government. Official documents will show that fish were purchased as part of a quota both when the assets of the company were under management and during the period when a court-appointed curator managed the company’s assets between 2007 and 2014, and then again from 2019 to 2021.”

He stressed that neither he nor the companies he represents were aware “of any investigations or allegations against the company”. 

Azzopardi says Italian or Maltese authorities have never contacted him or the companies he represents. 

Medina Ridge Holding’s corporate accounts for 2012, published around seven years late in 2019, following Catania’s 2017 arrest, appear to reflect the loan, with a €650,000 entry under “other receivables”.

There is scant record of the €650,000 beyond that year, and it could have been absorbed into a growing line of “Loans to third parties”, which ballooned over subsequent years to €4 million by 2016 and remained at that level until being fully repaid in one single year in 2020.

Meanwhile, borrowings “due to shareholders” hit €5.33 million by 2023, and were entirely waived in 2023.

Malta’s Police said it was not in a position to confirm or otherwise when asked for a response on the court documents.

Who Is Behind Medina Ridge?

At the time of the 2012 loan, Medina Ridge Holding Limited was owned by two Maltese nationals: Joseph Caruana and Emanuel Azzopardi. Both are now deceased.

The two men were the owners of Fish and Fish, one of Malta’s main fish farm operators, from 1996 until their deaths. Their shares in Medina Ridge were transferred to their heirs in May 2024.

Medina Ridge is currently in dissolution, which was announced after the heirs took over in June 2024.

The company did not publish audited financial statements for the first seven years of its operations. Accounts for 2012 were published in 2019, while accounts from 2013 to 2024 were published in 2024.

Malta-registered betting company E-Play 24 ITA Ltd has surfaced in an investigation by Italian prosecutors into a Malta-Italy network suspected of illegal online gambling operations, an investigation by Amphora Media and IRPI Media has found. 

According to media reports, the alleged scheme detailed by Italian prosecutors mirrors another identified in previous law enforcement investigations into gambling-related tax evasion.

In the alleged scheme, betting sites with the Italian web domain “.it”, which is a legal requirement for Italian gambling sites, are used as a facade for bets that are actually sent to sites with the global commercial domain “.com”.

Prosecutors suspect that this allows operators to evade Italian tax authorities.

Investigative records in the ongoing probe, named “Kappa”, show that two Italian sites were allegedly used in such a scheme. Both sites were owned by E-Play 24 ITA, according to a judicial ordinance authorising arrest warrants from a court in Messina, Italy.

The investigation into the online gambling network’s activity spans the period from 2018 to this year.

Iosif Galea, the former MGA official convicted of tax evasion and currently facing financial crime charges in Malta, had links to companies connected to E Play 24 ITA during the period when it was under investigation.

However, his most prominent roles within E Play 24 ITA took place in 2015, which was three years before the period Italian investigators are focusing on. He is not mentioned in the documents reviewed by reporters.

Company records show that several companies were linked by shareholding and can be considered affiliated. Malta Business Registry records analysed by Amphora Media and IRPI Media show that from May 2014 to November 2021, Galea was a director of one of the companies affiliated with the firm. He was the director of a second affiliated firm between 2016 and 2021.

Records show that Galea’s executive position as a director at E-Play 24 ITA was in June and July 2015, three years before the period Italian investigators are focusing on. He also held executive positions in another firm that had the same shareholder as the company. 

He was also the director and legal representative of E-Play 24 ITA’s then main shareholding company between July and August 2016. 

The affiliated companies are not mentioned in the Kappa investigation. Galea did not respond to requests for comment in time for publication.

Role of Directors

According to Maltese law, directors of Malta-registered companies, such as E-Play 24 ITA, are responsible for the general governance of the company and the supervision of its affairs. They are bound to “act honestly and in good faith.”  

Under Maltese gaming regulations, directors of companies holding a gaming license are “required to have full knowledge, understanding and access to the [license holder’s] operations”.

Ambrose Muscat, a Maltese financial compliance and anti-money laundering expert, explained: “The role of the board of directors is to approve a business plan, agree on a strategy to achieve it, and ensure the business has adequate resources to meet its objectives whilst remaining compliant with the various laws and regulations applicable to the company.”.

“All directors are deemed to be accountable for any malfeasance or lack of compliance by the company on whose board they sit,” Muscat added.

While E-Play 24 ITA is named in the Italian prosecution documents, company representative Donato Menechella said the firm “is completely unrelated” to the investigation, and has “not received any requests from the judiciary.”

He added that, in 2022, E-Play 24 ITA “was acquired by an international group whose majority shares are held by the Cirsa Group.” 

Founded in 1978 in Spain, Cirsa Group describes itself on its website as an international network of companies involved in manufacturing and managing recreational products and centres. Cirsa Group did not respond to a request for comment before publication.

E-Play 24 ITA said that, upon reading media reports naming some of the individuals under investigation, the company acted by “immediately suspending all commercial relations with them.”

Galea’s other business operations under law enforcement scrutiny

In 2022, Galea was found guilty of evading over 1.7 million euros in taxes through an unrelated Malta-registered company he ran. The firm offered sports betting to customers in Germany, where operators of the company’s software forwarded the bets they collected to its branch in Malta, the German judgement shows.

In 2023, Galea was charged with financial crimes in Malta, according to an August 2023 court order that froze his assets and is still in force. Local media reported that Galea has denied the allegations against him, which include unexplained transfers of more than €150,000 to a Malta Gaming Authority official and his wife. 

While Galea did not respond to questions about his pending case in Malta, it does not appear to have been resolved yet. The court has not published its judgement, as is customary when a case is resolved, and the order to freeze his assets is still listed on Malta’s Asset Bureau website.

Iosif Galea, 44, currently faces money laundering charges in Malta, according to a court order freezing his assets. He has pleaded not guilty in the case, which reportedly involves unexplained payments to a gaming official..

• Denise Agius, the wife of Robert Agius, received €207,000 from We Media as “consultancy fees” and “wages”, as well as a €24,000 “loan advance”.
• Robert Agius received a €4,975 payment from We Media, and a suspected further €6,000 from a company linked to We Media’s owner.
• Evidence in police possession suggests Jamie Vella funnelled payments to the partner of a convicted drug trafficker with the aid of We Media.
• We Media owner Edmond Mugliette (also appearing as Mugliett) is subject to an investigation order on “reasonable suspicion” of money laundering and handling the proceeds of crime. The probe is ongoing.

The owner of a significant production company, Edmond Mugliett, has been investigated for links with a suspected organised crime group convicted of journalist Daphne Caruana Galizia’s murder. Among others, the company has produced popular shows like Xarabank and Istrina.

Transaction records show that production company We Media sent €207,000 to Denise Agius, the wife of Robert Agius, one of the Maksar brothers, in 63 separate transfers between November 2016 and September 2021.

The payments were listed for “consultancy fees”, “wages”, as well as a €24,000 “loan advance”. By August 2019, Agius was receiving a monthly net salary of €4,000.

The trial and eventual conviction of Robert Agius, Adrian Agius and Jamie Vella have shone a light on the family business operations, which authorities suspect of having ties to international organised crime groups. 

Public documents analysed by Amphora Media, OCCRP, and The Times of Malta reveal Denise’s property deals and private loans, all while holding jobs ranging from hairdresser in Rabat to consultant at We Media.

Robert Agius also received a €4,975 payment from We Media Ltd. for “camera equipment”. Information in the possession of investigators shows that Agius received an additional €6,000 for the same reason from another company where Mugliette is a nominal shareholder. 

The transactions were found mixed among legitimate business transactions by We Media.

Encrypted communication in the possession of investigators suggests that Jamie Vella, another suspected gang member, funnelled payments to a convicted drug trafficker with the aid of We Media.  

Vella communicated with drug trafficker Ronnie Galea about money on several instances in 2020. As proof of payment, Vella sent Galea three bank transfer confirmation documents from We Media’s Bank of Valletta account. The transfer confirmation documents sent by Vella were printed by “Edmond Mugliette”. 

Asked about the transactions, BOV’s representative said, “the Bank is unable to comment publicly on client matters due to data protection regulations. We reaffirm that we have in place very strong due diligence and credit governance processes that meet regulatory requirements and expectations.”

Neither Vella’s lawyer nor Mugliette replied to reporters’ questions. 

Transaction records show that We Media transferred funds to Edina Szegvari. Galea’s Facebook posts indicate that he’s in a romantic relationship with a woman by that name. 

Investigation documents list several recipients of funds from Denise and Robert: one of them is Edina Szegvari, who received €1,000 from each of them, in 2014 and 2015 respectively. Jamie Vella and Adrian Agius are also listed among recipients of funds from Denise Agius.

Denise Agius, Szegvari and Galea did not respond to reporters’ questions.

Robert Agius, his brother Adrian, and Vella have long been suspected of leading the Maltese operations of an international criminal network suspected of drugs and contraband trafficking, weapons smuggling, and other crimes.

Robert Agius and Jamie Vella have been found guilty of complicity in the car-bomb assassination of Daphne Caruana Galizia.

Adrian Agius has been found guilty of the murder of lawyer Carmel Chircop in a case which counted Vella and hitman George Degiorgio as accomplices. Neither of the brothers’ lawyers responded to reporters’ questions.

Owner under investigation

We Media’s owner, Edmond Mugliette, is the subject of multiple intelligence reports focusing on suspect financial transactions and, according to one July 2022 report, “participation in an organised criminal group.”

In March 2022, a court authorised an investigation order sought by the Attorney General compelling all local banks and financial institutions to hand over any financial information they have on Mugliette, We Media, and five other companies linked to him. 

The order was approved due to a “reasonable suspicion” that Mugliette was involved in money laundering and handling the proceeds of crime. 

Sources familiar with the investigation told Times of Malta that the probe is “ongoing” and the police have already questioned Mugliette.

Another intelligence report details how Mugliette was caught with €38,000 in undeclared cash while travelling from Malta to Türkiye in December 2021. The cash stash, according to the report, included €30,000 worth of €500 notes.

Eurozone banks ceased issuing €500 notes in 2019, amid concerns that the notes facilitated the transportation of large amounts of cash by criminals. 

The police and customs spokespersons did not reply to reporters’ questions.

A January 2022 intelligence report indicates that Mugliette was helping Denise Agius recover money owed to her husband by James Zammit, whose company provided a €1.3 million loan to Ages Investment, a company owned by Denise.

According to the report, Robert Agius used to give Zammit, a car dealer, vehicles to sell on his behalf, thereby preventing his name from appearing on any paperwork. Denise Agius was seeking to close the business relationship. 

Mugliette met with Zammit to terminate the “business relationship” so that funds that belonged to Robert Agius are transferred into Denise’s account, the report states. In response, James Zammit said the meeting was about a loan and not about car business.

“I categorically deny any involvement – not only to the fact that I never did any illicit trade with the said Maksar gang, but also with anyone,” Zammit said in response to reporters’ questions, adding, “our companies have gone public in 2024, entailing a very meticulous 14-month DD [due diligence] exercise by FIAU, MFSA, Malta Stock Exchange and other bodies, which as you surely know work in tandem with the police prior to any such public call.”

• Robert and Adrian Agius, known as the Maksar brothers, generated millions through property deals and private loan agreements.
• The Maksar brothers and their accomplice Jamie Vella are placed in a trafficking network with international organised crime groups.
• Loans, car deals, and real estate transactions masked the brothers’ operations.
• Ages Investments Ltd., whose sole shareholder is Denise Agius, Robert’s wife, handled over €2.5 million in property and loans.
• Deals continued even after the Agius brothers were charged with the murders of Daphne Caruana Galizia and Carmel Chircop.
• Maksars appear to have leveraged indirect streams to sidestep financial oversight, including:
  • Property deals and private loans with Brian Cutajar, who helped settle debts linked to the Chircop murder.
  • James Zammit and his Finance House issued a €1.3 million loan to Ages Investments.
  • Businessman Hugo Chetcuti issued a private loan to the Maksar family and purchased a boat yard from them.

Two helmeted gunmen push through the doors of a Birkirkara bar. Shots are fired. Raymond Agius, a suspected contraband smuggler, is murdered, leaving behind a wife and two sons, Adrian and Robert Agius. 

Over the next decade or so, the brothers, known by their family nickname Tal-Maksar, amassed a fortune through suspect property deals, private loans and various enterprises, with the assistance of family members and financial instruments.

Investigators have placed the Agius brothers, along with co-convicted Jamie Vella, within a sprawling international trafficking network of fuel, cigarettes, and drugs – with ties to organised crime groups in the UK, the Netherlands, Albania and Libya.

At one point, a document in the possession of investigators shows that the family claimed to hold almost €9 million in assets and an annual turnover of €1.7 million.

Robert Agius, a self-declared taxi driver from at least 2013 to 2018, had his assets frozen multiple times. First, from 2013 to 2018, over cigarette smuggling charges, and then from 2017 to 2020 over a 2012 heroin smuggling case. He was cleared in both cases.

Robert and his brother Adrian, at one point clients of Prime Minister Robert Abela, also had their assets frozen after being arrested for the murders of Daphne Caruana Galizia and Carmel Chircop in February 2021, when they were both listed as working in construction. 

Robert has since been found guilty of supplying the bomb that murdered Caruana Galizia, and Adrian has been found guilty of the murder of Chircop. They have been sentenced to life in prison.

Each moment could have marked an end to the brothers’ illicit financial activities. However, their operations appear to have merely shifted course into the hands of Robert’s wife, Denise, who investigators suspect was a regular collaborator, and a company called Ages Investments Ltd., which was set up months after Robert’s assets were frozen in 2017.

Official records, public registry filings, and other documents analysed by OCCRP, Amphora Media, Times of Malta, and IrpiMedia have uncovered how Denise, an associate and accomplice, played a central role in acquiring, financing and selling off properties worth millions.

The documents further expose how the brothers and their family members employed private loans and property deals to finance their operations, and often used the same channels, including Brian Cutajar, James Zammit, and the murdered tycoon Hugo Chetcuti.

Neither of the brothers’ lawyers responded to the reporters’ questions. Hugo Chetcuti’s heirs could also not be reached for comment. Meanwhile, James Zammit replied to “categorically deny any involvement – not only to the fact that I never did any illicit trade with the said Maksar gang, but also with anyone.”

Maksar, Denise Agius, and Ages Investments: €2.5 Million in Real Estate Deals, a €1.3 Million Loan, High-Value Cars and a We Media ‘job’

Ages Investments Ltd. was registered in 2017, five months after Robert’s assets were frozen, with Denise listed as the sole shareholder. Denise and Robert, married in 2011, have a separation of assets.

From 2019, the company acted as a vehicle for several asset purchases and sales. Between 2021 and 2024, it sold €1.3 million in assets.

Police and intelligence records analysed by reporters indicate she has worked as a hairdresser, making 50 euros a day, and that before registering Ages Investment, she told a bank she was a bingo hall cashier or receptionist. 

Denise Agius did not reply to requests for comment.

The company’s first significant activity was the purchase of a €470,000 villa in Baħrija, listed as the registered residence of Robert Agius, from James Zammit’s company. Zammit has been involved in several other transactions with Ages Investments & the Agius family. 

Ages Investments would purchase €765,000 worth of assets between March and October 2020, with the aid of a €1.29 million loan through Finance House p.l.c. Zammit, who is managing director at Finance House, said that only €892,000 of the loan was utilised. 

Some of the transactions happened while Robert Agius was subject to a freezing order, and ended around four months before both Agius brothers were charged in connection with the murders of Carmel Chircop and Daphne Caruana Galizia.

The brothers are believed to have had informants within the police force.

In a secret testimony to a public inquiry, ex-assistant police commissioner Ian Abdilla admitted that the Agius brothers “are well connected within the police to be honest. Well-connected within customs, and well-connected with politicians from both sides”.

The police spokesperson did not reply to reporters’ questions.

Over the period, Ages Investments acquired:

• A garage in Qawra (€30,000);
• Airspace to develop apartments in Rabat for €300,000;
• Airspace to develop a maisonette and apartment in Mosta for €185,000;
• The purchase of a penthouse in St Paul’s Bay for €250,000 from a company owned by Adrian Agius, Denise’s brother-in-law.

The €1.29 million loan James Zammit’s Finance House issued to Ages Investments Ltd financed several other deals, including:

• Payment on the remaining €270,000 balance on Zammit’s Baħrija property;
• Acquisition of a portion of land along Triq L-Imdina;
• Acquisition of a Mercedes GTR worth €190,000;
• Acquisition of the two sites in St Paul’s Bay, including Adrian’s apartment;
• And settling outstanding €330,000 debts.

The loan, of which Zammit says only €892,000 was utilised, was guaranteed on a property subject to the lifelong usufruct of Polly Agius, known as Paola or Pauline, who is the mother of Robert and Adrian Agius, and their co-shareholder in Ter-Nova Holdings, and numerous other companies with her sons.

Polly Agius could not be reached for comment via the family’s lawyers.

Zammit categorically denied any involvement or complicity with the brothers’ criminal activities, stressing that his companies had undergone a “meticulous” due diligence process and had been subject to audits.

He added that there were no freezing orders or criminal proceedings against Denise that would have been flagged by their AML specialist. Denise and Ages Investment were not subject to any freeze order.

“The time has now come to discuss a settlement plan with Ages Investments Ltd for the full outstanding amount plus interest and charges,” Zammit said.

Zammit also said that since some of the facility covered a debt which was secured by Pauline Agius, it meant that she had “ a direct interest in acting as guarantor”.

Ages Investment continued its activities beyond the brothers’ arrest and further asset freezes.

In 2021, Ages bought land in St Paul’s Bay and Ħaż-Żebbuġ worth a total of €460,000. Between 2021 and 2024, the company sold four properties for a total of €1.09 million, through separate projects in St Paul’s Bay, Mosta, and Rabat. 

Investigators suspected Denise was representing Robert in the Żebbuġ deal.

Denise, Robert and Adrian acquired several high-value vehicles

Between 2010 and 2017, Denise acquired and transferred 14 cars, and as of December 2017, had four more registered in her name. 

One of the car transfers involved Adelina Pop, the then-partner of George Degiorgio, who has pleaded guilty to murdering Daphne Caruana Galizia. 

In 2017, Denise transferred her car, valued at €55,000, to Adelina – and raised suspicions among investigators. Pop did not reply to questions about the transfers.

Court sittings have revealed that seven vehicles, valued at approximately between €184,000 and €213,700, were found in Robert’s possession when he was arrested in 2021. 

Sources have also described how Robert and Adrian controlled several high-value vehicles over the years.

Nine cars, including a Mercedes and a BMW, were acquired by Robert over one calendar year, with one car bought and sold on the same day.

The moving of assets by companies owned by the brothers or their family members highlights possible shortcomings in Malta’s enforcement of financial crime regulations, experts said.

Kathryn Westmore, who leads the financial crime policy work of the UK NGO Royal United Services Institute (RUSI), said the transactions should have attracted the scrutiny of banking compliance teams.

“If you are banking [Ages Investment] you need to ask what are the purposes of the loans and transactions, what is their commercial rationale. If you’re a bank that has that company as a client, you would hope that your [client] onboarding process would pick up the links to someone under an asset freeze, and then the transactions would merit further investigation; you need to check someone’s made sure they have a legitimate purpose,” she said.

Manfred Galdes, the former head of Malta’s Financial Intelligence Unit, said “freezing orders very often fail to identify the assets that might have already been transferred to third parties. If not preceded by a parallel financial investigation that traces the movement of assets, the effectiveness of the freezing order is extremely limited.” 

Any failure to trace and target assets means that there would be “lots of gaps for people to transfer assets to companies,” he added.

Leaked transaction records also show that We Media, one of Malta’s most prominent media companies, which has produced shows like Xarabank, acted as a facilitator, sending €207,000 to Denise in 63 separate transfers between November 2016 and September 2021, registering her as a full-time employee.

This includes a €4,000 per month ‘salary’ she received between August 2019 and September 2021 as ‘wages’ and ‘consultancy fees,’ as well as €24,000 as a ‘loan advance’.

Robert Agius also received a €4,975 payment from WeMedia Ltd. for “camera equipment”. Information in the possession of investigators suggests that Agius received an additional €6,000 for this from another company where Mugliette is a nominal shareholder.

Neither We Media nor its owner Edmond Mugliette replied to requests for comment.

A Web of Different Money Flows: From Carmel Chircop to Brian Cutajar, James Zammit and Hugo Chetcuti 

The story of the Agius empire does not begin—or end—with Ages Investments. Rather, it was the latest vehicle to generate and move funds throughout the years.

The murder of Carmel Chircop: More Supermarkets & the villa in Bahar ic-Caghaq 

Documents seen by journalists lay out several transactions linked to the failed More Supermarket venture, of which Adrian Agius was a shareholder, and the €750,000 debt tied to the murder of Carmel Chircop.

Adrian and his partners in More Supermarkets, which included Ryan Schembri, who has since been charged with fraud, had taken out €2.8 million across four loans from Banif. In all the loans, property belonging to Agius, including a villa in Baħar iċ-Ċagħaq, is listed as collateral.

In March 2014, Adrian received a further €750,000 loan from Chircop, with the same villa also listed as collateral. 

Chircop was murdered a year and a half later on Adrian’s orders. The legal procurator told the court that Chircop was requesting to take over the villa at the time of his murder. 

Self-confessed collaborator Vince Muscat, who said he participated in reconnaissance before the murder, told the court that Adrian Agius was especially keen to have Chircop killed and would pull him [Muscat] aside and tell him “Cens, come on let’s get it over and done with.”

According to court experts’ testimony, the constitution of debt, a formal contract recognising the amount owed by Adrian Agius and two bills of exchange, signed by Schembri, were found locked in the drawer in Chircop’s office. 

The entire debt was waived in 2017, with his widow receiving a €165,000 payment with the help of Brian Cutajar, who purchased the property off Agius for €1.8 million in September 2017, a month before the murder of Caruana Galizia.

Data indicates that Adrian and Robert Agius regularly employed a constitution of debt, which is a formal, notarised document that acknowledges an existing debt between a debtor and a creditor. 

Unlike traditional lending facilities, it does not involve the same level of bank paperwork or due diligence checks, making it vulnerable to misuse.

The loans are often repaid and cancelled quickly, sometimes even within months. Certain legal instruments in Malta, such as the constitution of debt, are not obliged to be done in the presence of lawyers or notaries, so there is no one to verify whether the debt is real.

The Brian Cutajar Connection: Million euro loans and payments 

Brian Cutajar, part-owner of Regina Auto Dealer, is identified as participating in several Maksar deals and financing.

Over the course of more than a decade, he and his family provided loans and engaged in property deals that enabled the Maksar network to accumulate substantial wealth.

According to documents, the families bought and sold property together since at least 2005. However, they would later use private loans and property transfers to shuffle equity and funds.

Between 2010 and 2012, Brian Cutajar and his wife, Roseanne, issued five private loans to Ter-Nova Properties Limited, totalling almost €1.29 million. 

Some of the loans were paid back in full within a year or so, while the entire debt was settled by 2017, official property records show. Ter-Nova Properties Limited is owned by both Agius brothers and their mother via a holding company.

A Maltese court had also once rejected a warrant of prohibitory injunction that Cutajar, through Regina Auto Dealer, filed against the family over a “manu brevi loan” of €500,000 he claimed to have provided. That loan, unlike a constitution of debt, would not require filing and signing by a notary.

The case did not burn bridges between the two families. In 2017, the same year the Agius family settled their debt with the Cutajars, Brian Cutajar purchased the Baħar iċ-Ċagħaq villa for €1.8 million, and settled the €165,000 debt that Agius had eventually settled with Chircop’s widow, according to court testimonies.  

James Zammit: The  €1.29 million loan and other deals 

The financial relationship between the Agius family and James Zammit dates back over a decade and extends beyond the 2019 property purchase and the €1.29 million loan in 2020.

Transactions between the Agius brothers and Zammit date back to 2014, when Zammit provided around €335,000 worth of loans through separate companies.

In 2014, Zammit lent Adrian Agius €108,000, with an apartment in St. Paul’s Bay serving as collateral. Agius would sell the apartment one month later for €140,000 – and repay Zammit the same year.

Two months later, a separate firm controlled by Zammit lent Agius a further €230,000, with the Baħar iċ-Ċagħaq villa again being used as collateral. On the same day, Adrian Agius sold a 1,000 sqm piece of land in Naxxar, known as ta’ Xmajna, to Zammit’s company for the cut price of €20,000.

Zammit stated that the transaction involved a promise of sale he signed to acquire Agius’ Massiabelle Villa in Baħar iċ-Ċagħaq. He said that he had paid a €230,000 deposit and would pay the remaining €1.1 million within a year. He said that the deal fell through once he discovered significant loans on the property from Banif Bank and Carmel Chircop. 

Eventually, Zammit agreed to acquire the ta’ Xmajna land and several cars as settlement of the amount due.

Several transactions around the murder of Chircop in 2015 have raised investigators’ eyebrows.

In September 2015, BNF issued a €250,000 bank draft to Oyster Trust in the name of Pauline Agius, reportedly intended to settle a banking facility related to More Supermarkets. Instead, the cheque was deposited into James Zammit’s account.

The bank declined to comment on client transactions. Still, it reiterated that it “has always acted within its legal rights and in full compliance with all applicable legal and regulatory banking requirements.”

A few days after the deposit, Zammit withdrew €150,000 in “cash to be kept at home” – and in October, he transferred a further €128,000 to an account belonging to his company.

Zammit confirmed the transaction but said that one of his licensed business activities included cashing cheques issued by the Government. He said it involved withdrawing sizable cash amounts, especially during particular periods of the month, to offer this service.

The Malta Financial Services Authority declined to comment on the specifics, but said, “Should any issues or potential breaches arise during such examinations, appropriate regulatory and enforcement action is taken in accordance with our mandate.”

Investigators also flagged several payments Finance House plc issued for the legal services of Keith Borg understood by investigators to be on behalf of Robert Agius and/or Denise Agius in May 2022.

Zammit categorically denied that he had ever paid for any legal services for anyone other than for “myself, my companies, my wife and/or children. The payment here mentioned was for a personal matter.”

The police did not reply regarding the status of the investigation.

Hugo Chetcuti & the Vella Farm

One significant transaction within the Agius’ portfolio that raised eyebrows was a series of payments from Hugo Chetcuti, a businessman murdered in July 2018, or his company, All Round Entertainment Ltd. 

On 8th May 2014, Chetcuti handed the Agius brothers an €800,000 brevi-manu loan, with a farm in Magħtab, known as ‘Vella Farm’, listed as collateral. It was repaid with interest of 6% by the start of 2017. 

A few months later, on 10th October 2014, the Agius brothers sold the farm to Hugo Chetcuti’s company for €700,000. The brothers had acquired the property in 2008, months after the death of their father. 

That means Chetcuti transferred some €1.5 million to the Agius brothers over those few months. The deals happened while Robert was subject to the freezing order.

Chetcuti had various interests around the island, from nightclubs and strip clubs to restaurants. While his killer has been convicted, the motive was never established. His heirs and All Round Entertainment did not reply to reporters’ questions.

Cemil Önal was reportedly killed on the terrace of a hotel in the south of the Netherlands on the evening of Thursday 1st May.

Follow the Money said it had spoken on Monday to Önal, who said he expected an attack on his life. His lawyer told Follow the Money that they had reported the danger to Dutch authorities.

Önal had warned that his life was in danger, saying that the bribes the network paid to powerful individuals in Turkey and northern Cyprus made him a target.

Turkish prosecutors indicted Önal for allegedly establishing a criminal group for laundering money obtained from illegal betting. Önal feared he would be murdered if he returned to the country due to the information he had on powerful individuals. 

Authorities in Türkiye denied these allegations. Önal was released from prison in the Netherlands while his case was pending.

Since leaving prison, he has given media interviews, where he voiced allegations against “bureaucrats and politicians from Türkiye and some of their relatives”.

Önal spoke to OCCRP as part of an investigation which included Amphora Media and Times of Malta, which revealed a web of companies and websites within Falyalı’s network. Falyalı was murdered in February 2022. His associates allegedly ran an expansive illegal betting operation that generated at least €75 million per month, and had ties to Malta. 

According to Önal’s testimony, corporate documents and online records, Ulaş Utku Bozdoğan, founder and owner of the Kebab Factory chain, and Burak Başel, co-proprietor of the Food for Fit café, were allegedly connected to the network of Falyalı.

Bozdoğan and Başel played roles in the licensing of allegedly illegal gambling websites within the network. Together, they allegedly helped sustain and expand the network, using Malta’s regulatory environment to their advantage.

A government source confirmed that the authorities are investigating Falyalı’s links to Malta. Malta’s Police Force said it was “not in a position to confirm or otherwise such information”.

Bozdoğan and Başel denied the claims. 

“I have never met or had any dealings with Mr Cemil Önal and/or Halil Falyali and I can say that this information is false.” Bozdoğan said.

Turkish prosecutors indicted Önal for allegedly establishing a criminal group for laundering money obtained from illegal betting.

In January 2023, at Turkey’s request, Interpol issued a red notice, describing Önal as “one of the masterminds” of Falyalı’s murder. Önal denied the allegations.

Just ten months after Falyalı’s murder, authorities seized around €40 million in assets, with Turkey’s Interior Minister announcing a crackdown on the network. He even referenced Malta’s role in a press conference.

“Virtual betting, virtual gambling and crypto constitute the circulation of money in the world without any obstacles… From the Balkans to Malta and Cyprus, they are the places where [these groups] base themselves.”

In December last year, Turkish prosecutors issued a sweeping indictment against 250 people, including 35 alleged leaders of Falyalı’s network, including his widow Özge Taşker Falyalı. Reporters uncovered that Özge purchased a dozen luxury properties in Dubai worth around €58 million in the year after her husband’s death.

The indictment revealed that Falyalı allegedly opened a cryptocurrency wallet in Malta. Malta adopted an act in 2018, which provided a grace period to cryptocurrency operators of 12 months to apply for an appropriate licence.

Records and Onal’s first-hand account suggested Vigen Badalyan & his SoftConstruct provided illegal gambling services in Turkiye and were linked to the illegal gambling network of Falyalı.

• Reporters spoke to 182 victims of multi-million euro investment scams that earned over €230 million in four years.
• Two networks: One Israeli-European, the other Georgian targeted victims across the globe, including Malta.
• Malta-registered companies among payment service providers and banks that enabled operations. One recently terminated relationships with alleged scam operators.
• Three victims of various scams launched cases with Malta’s financial arbiter.

Updated with a statement from Payhound Limited

A Maltese-registered company was key in transferring funds extracted from victims of a massive investment scam targeting victims across dozens of countries, including Malta.

A collaborative investigation by Swedish Television (SVT), OCCRP and its media partners, including Amphora Media and the Times of Malta, has revealed unprecedented insight into how these extensive investment scam networks operate – and how chilling, professionalised, and far-reaching the industry has become.

Visit the project’s website

Reporters have contacted 166 victims of the two networks who say they’ve been scammed approx. €18 million by an Israeli-European network and a network in Georgia.

Financial records in the leak show that in four years, the two scam networks raked in a total of about €230 million from would-be investors.

People from every walk of life have fallen victim to these scams, which leads them to lose their savings and, in many cases, their mental health.

Victims include a Canadian crane operator living with a disability, a retired finance professor, a Swedish pensioner who needed money for dental procedures, and an Estonian lawyer who was targeted while in the hospital. 

Far from dingy ‘boiler rooms’, leaked data and communication obtained by OCCRP’s partner Swedish Television (SVT) shows that investment scam call centres are based in slick office buildings, including in countries in the European Union, with marketing firms, payment service providers and high street banks enabling their operations.

One of these providers was the Malta-registered OpenPayd – another is Payhound.

OpenPayd acknowledged its relationship with entities linked to the scheme. However, it said it terminated its relationship with them, “all for reasons related to their failures to maintain adequate controls”- and stressed that it did not deal with individuals and only serviced corporate clients. 

Update: After the publication of the articles, a representative of Payhound Limited contacted our partner, the Times of Malta, explaining that reporters’ questions were filtered into the recipient’s spam folder. The company added the following statement: “Payhound maintains the highest standards of compliance, adheres to industry best practice and has consistently met all applicable legal and regulatory requirements.”

How the scheme works

The scam centres see perpetrators pose as legitimate brokers and contact potential investors to encourage them to deposit funds on trading platforms such as Rivobanc and Stoxinvest. Most exist only as websites not linked to any corporate entity and are falsely located in financial centres like London and Zurich. 

Scammers gain access to vast amounts of personal information from their victims’ computers via remote access software called Anydesk, which they ask them to install, supposedly to help them with transactions. 

The software system they use can be manipulated to create illusory profits on traders’ initial investments, offering false claims about higher returns or blocked withdrawals — a technique to encourage them to send more.

The leaked records detail how “recovery agents” even contact existing victims, pretending to be from financial authorities. They promise to help recoup the money — for an upfront fee — only to scam them again.

In some cases, unsuspecting victims are convinced to transfer money to other victims, unwittingly aiding the scammers in layering and moving funds.

Leaked financial documents reveal Maltese-registered companies acting as crucial links in funnelling funds stolen from victims of the scams, with entities like OpenPayd acting as payment providers.

Victims were often led to believe that they were making payments to accounts they held at certain financial institutions that belonged to them when, in reality, they belonged to the scammers in question.

They argued that the financial institutions in question, like OpenPayd, failed to stop the payments while continuing to offer accounting facilities to the scheme’s beneficiaries.

Leaked spreadsheets, payroll data, and deposit databases show:

• Over 26,000 would-be investors from 34 countries were targeted, with the largest sums taken from Canada, Spain, Australia, the U.K., and South Africa.
• Between January 2021 and December 2024, this network received €230 million in payments.
• Only about 2% of deposits are ever returned, sometimes labelled as “loans” or “upselling”, to lure victims into investing more.

The impact is huge.

The OCCRP investigation revealed a disturbing snapshot of the emotional and financial harm inflicted by these networks.

Victims frequently express suicidal thoughts and describe being left penniless while scammers taunt them or subject them to verbal abuse, mocking them for “falling for” what is ultimately a well-coordinated fraud.

Malta’s fintech companies and neobanks play a role in transferring stolen funds.

Reporters found that scammers directed victims to open accounts with so-called neobanks – technology-driven banking companies that aim to disrupt the traditional banking sector.

The Malta-based OpenPayd Financial Services Malta Limited is not a traditional neobank – it does not target individuals. Its U.K. licence to provide e-money services was cancelled, but in Malta, it works as a financial institution licensed to offer e-money and payment services. 

Reporters found that numerous scam victims, many in Spain and the U.K., transferred large amounts to the account of CurrencyRock UAB, a Lithuania-based company trading as Insirex. 

Financial reports leaked from one of the scam centres show that payment service providers had separate tabs – CurrencyRock’s Insirex was one.

In some cases, OpenPayd did not execute transfers as intended but was indicated as the provider of choice for Insirex transfers. Leaked internal chats show the scam team exchanging instructions relating to Insirex transfers.

In filings to the Lithuanian registry, CurrencyRock claims to have only one employee, and its volume of paid taxes is low. However, the leak shows victims transferred thousands of euros at a time to the company, and in only three months, the company sent and received €2.5 million. Attempts to reach the declared owner by our Lithuanian partner, Siena, were unsuccessful.

From this account, held in OpenPayd, funds were transferred to a Malta-based Payhound Limited, which is licensed to provide nominee services and execute orders on behalf of clients. 

The term ‘nominee services’ means that the company is holding money or investment in someone else’s name, separating the nominee’s and client’s money – effectively obscuring ownership.

Payhound Limited did not reply to reporters’ questions about whether CurrencyRock held an account with them and what actions are taken when a client company is suspected of scamming victims.

Blue Whale Tech Inc., a Canadian company running the Cratos cryptocurrency exchange, was another company used in the scheme with an OpenPayd account. Responding to reporters’ questions, a representative of Cratos said, “our clients are 100% individual clients who wish to purchase and/or sell digital currencies” and denied working with scamming enterprises. OpenPayd’s representative said that Blue Whale Tech’s account was terminated in 2023, also for the failures to maintain adequate controls.

In its reply, OpenPayd stressed that it did not deal with individuals and only serviced corporate clients. 

“We have our own regulatory responsibilities to manage financial crime risks posed by Clients,” the company’s representative wrote. “We monitor all transactions to/from our Clients for fraud or other financial crime flags (e.g. sanction screening), including through a comprehensive Fraud Monitoring Programme designed to combat fraud from End Customers.”

Asked about the specific companies mentioned in the leak, OpenPayd representative wrote that Currency Rock and Blue Whale Tech Inc. “are no longer customers of OpenPayd. We terminated Blue Whale Tech Inc. […] in 2023 and CurrencyRock in 2024, all for reasons related to their failures to maintain adequate controls.”

Victims filed complaints against OpenPayd with Malta’s Financial Arbiter

In 2024 alone, three victims of various scams filed complaints before the Financial Arbiter in Malta after having studied the account numbers of their scammers and identifying OpenPayd as the service provider that opened these accounts. 

In all cases, OpenPayd argued against any obligations to the victims because they did not have a business relationship with them. Instead, OpenPayd only had a business relationship with the alleged scammers. 

In one case, which concerned Hasbix Analytics sro, OpenPayd declared to the Arbiter that the accused company had been added to OpenPayd’s Fraud Monitoring Programme. 

“Hasbix was seemingly left operating without suspension under a ‘60-day grace period’ permitted by OpenPayd before the relationship and account of Hasbix with OpenPayd was eventually ‘fully terminated on 29 May 2024’ after ‘a 60-day notice for Hasbix to cease operations and stop any transactions on the account, in line with OpenPayd’s terms and conditions’,” according to the case documents.

“If the Client fails to improve their management of fraud and/or reduce its fraud rates within a reasonable period of time, we terminate the relationship,” the representative added before specifying that relationships with 21 clients were terminated due to fraud-related reasons over the past three years and that its monitoring system identified 0.07% of transactions on their platform as fraudulent.

In all three cases, the Financial Arbiter concluded that the victims were ineligible to seek justice in Malta by not individually being the financial service provider’s customers. 

“I am concerned not only with the quantity but also with the quality of these fraud schemes,” Financial Arbiter Alfred Mifsud wrote in the institution’s newsletter. 

“Get-rich-quick schemes are invariably too good to be true. They are carefully laid out to tempt vulnerable consumers to try their luck with a small sum. Once inside the scheme, it gets progressively more difficult to extricate themselves out, and they are quite often convinced to continue paying into the false scheme until, finally, the truth is exposed, with hurtful results – both financial and psycho-social.”

However, the legal loophole that left OpenPayd without responsibility for facilitating payments demanded from victims by alleged scammers may eventually be closed. 

“The necessary changes to CAP 555 (Arbiter for Financial Services Act) will form part of Budget Measures Implementation Act,” financial arbiter Alfred Mifsud wrote in reply to the reporters’ questions, clarifying that “The aim is to render all victims of fraud as eligible customers of any licensed  financial services provider involved in the suspected fraudulent payment transaction.”

The arbiter added, “A decision on case no. 155/2024 should be issued shortly being a case which for particular circumstances was not blocked by ineligibility criteria and proceeded to be adjudicated on merits.”

If you have been a victim of this or similar scams, please reach out to julian@amphora.media or daiva@amphora.media. You can consult a handbook of scams by the eSkills Malta Foundation here, or contact the Victim Support Agency.