DAREX Tier: Tier A — Limited Regulatory Exposure

Note: the DAREX tier classification only applies to Unlimit Crypto Ltd. Read more on DAREX here.

A global fintech ecosystem formerly known as CardPay and Unlimint. The group specializes in high-volume merchant acquiring, Banking-as-a-Service (BaaS), and crypto on/off-ramps. While fully regulated in the UK and Cyprus, the company historically services high-risk verticals (gaming, crypto, forex) and has undergone multiple rebrands in recent years.

R42 Risk Signal

• Traffic Light: 🟡 ORANGE (CAUTION)

• Confidence Grade: High (A)

• Rationale: The Amber rating reflects the entity’s exposure to high-risk sectors (crypto, gambling) and its frequent rebranding (CardPay $\to$ Unlimint $\to$ Unlimit), which often complicates due diligence. While they hold valid EMI and CASP licenses in reputable jurisdictions (UK/Cyprus), their historic association with high-risk merchant processing warrants enhanced scrutiny for prospective partners.

Key Data Table

Operational Overview

Unlimit operates as a “borderless” payment processor. Their core business is Merchant Acquiring, processing payments for Visa, Mastercard, and UnionPay.

• Unlimit Crypto: Provides “on-ramp” (fiat-to-crypto) and “off-ramp” services, functioning as a bridge between traditional banking and DeFi/Web3 platforms.

• BaaS: Offers white-label card issuance and IBAN accounts to other fintechs.

• High-Risk Focus: actively markets to industries often de-risked by Tier-1 banks, including gaming, betting, and FX brokers.

Regulatory Framework

• Cyprus (EU Hub):

  • Unlimit EU Ltd: Authorized by the Central Bank of Cyprus (CBC) as an Electronic Money Institution (License No. 115.1.3.7). Passported to all EEA states.

  • Unlimit Crypto Ltd: Registered with CySEC as a Crypto Asset Service Provider (CASP).

• United Kingdom:

  • Unlimit UK Ltd: Authorized by the FCA as an Electronic Money Institution (Ref No. 978706).

• Other: Entities in Mexico, Singapore, and Brazil are locally registered for payment processing.

Ownership & Executives

• Kirill Evstratov (CEO/Founder): The central figure behind the group. He is a veteran in the payments industry who established the original CardPay brand.

• Management: The leadership team operates primarily out of London and Limassol, with a mix of banking veterans and tech/crypto specialists.

Corporate Structure

The group utilizes a segmented structure to ring-fence liabilities and regulatory permissions:

• Parent/Holdings: Likely structured through Cyprus holding companies (common for this region).

• Operational Arms:

  • Unlimit EU Ltd: Holds the primary EU passporting rights.

  • Unlimit UK Ltd: Ring-fenced for the post-Brexit UK market.

  • Unlimit Crypto Ltd: Separated entity specifically for digital asset compliance under MiCA.

Technical Footprint

• Stack: Uses a proprietary API for payments and BaaS.

• Infrastructure: Heavy reliance on Cloudflare for CDN/Security and AWS (implied).

• Integration: Offers SDKs for mobile (iOS/Android) and plugins for major e-commerce platforms (Magento, WooCommerce).

Merchant/Customer Footprint

• Target Markets: eCommerce, Crypto Exchanges, Online Gaming/Gambling, Travel.

• Client Profile: Often serves mid-to-high risk merchants who require multi-currency processing and higher acceptance rates for cross-border traffic.

• Geography: Strong presence in LATAM (Brazil/Mexico), Europe, and APAC.

Enforcement/Litigation History

• CardPay Legacy: Under its previous name “CardPay,” the entity was frequently flagged by compliance watchdogs and investigative blogs (e.g., FinTelegram) for processing payments for unregulated brokers and binary options platforms.

• Recent Status: No active public enforcement actions or fines from the FCA or Central Bank of Cyprus were found for “Unlimit EU” or “Unlimit UK” in the current period (2024-2026). The rebrand appears to have coincided with a pivot toward cleaner, albeit still high-risk, regulated verticals.

Red Flags

• 🚩 Rapid Rebranding: Changing from CardPay $\to$ Unlimint $\to$ Unlimit within a short window can be a tactic to shed negative SEO or legacy compliance baggage.

• 🚩 Complex Structure: The separation of “Crypto” services into a new entity (Unlimit Crypto Ltd) effective July 1, 2025, requires users to sign new terms, potentially shifting liability.

• 🚩 Jurisdiction: Cyprus is a standard fintech hub but historically associated with lower regulatory friction for high-risk finance compared to France or Germany.

Merchant Due-Diligence Checklist

• [ ] Verify License Scope: Ensure your contract is with the specific entity holding the license (e.g., Unlimit EU Ltd), not a shell marketing entity.

• [ ] Check Reserve Requirements: High-risk processors often demand a “Rolling Reserve” (e.g., 10% held for 180 days). Clarify these terms upfront.

• [ ] Clarify Crypto Liability: If using the crypto on-ramp, verify who holds custody of the assets during transit.

• [ ] UBO Verification: Confirm if the UBO (Kirill Evstratov) has any personal sanctions or adverse media exposure in your specific jurisdiction.

Evidence Box

• FCA Register – Unlimit UK Ltd

• Central Bank of Cyprus Register

• Unlimit Crypto Legal Notice

• Unlimit Complaint Policy

Update Log

• Profile Created: February 25, 2026

• Last Regulatory Check: February 25, 2026 (Clean on FCA/CBC active fines lists).

Whistle42 Call to Action

Have you encountered frozen funds, opaque fees, or compliance breaches with Unlimit? Securely submit your evidence via the whistleblower platform Whistle42. Your anonymity is guaranteed via our encrypted drop-box. Help us keep the fintech ecosystem transparent.