EFRI Case Note | Banking Circle S.A., German Branch (BIC SXPYDEHH, bank code 20220800) | EFRI case files 2018–2026 | 12 November 2026
This Case Note sets out what EFRI’s case files and public records show. They do not establish knowledge of, or participation in, the reported frauds by Banking Circle, Saxo Payments, PPRO or any person named. Victim identities and private individual recipients are withheld. Company names are reproduced as entered in the payment records and do not imply culpability.
Victim money in EFRI’s case files has reached the same German bank identifier, SXPYDEHH, in two fraud waves eight years apart. In 2018, deposits for the binary-options and CFD platform 24option went to a collection account of PPRO Financial Ltd under a BIC then associated with Saxo Payments A/S. In June and July 2026, an Austrian investor paid €29,000 to IBANs bearing the names of two German companies and the same German bank code, 20220800. That identifier now belongs to Banking Circle S.A. – German Branch in Munich, part of the banking business that developed from Saxo Payments.
The people around that payment infrastructure also overlap. In February 2016, chats in the Lenhoff criminal file recorded expectations of bank introductions through Payvision’s founders, including an introduction to “SAXO Bank”. In January 2018, ING, led by Ralph Hamers, announced its acquisition of a majority stake in Payvision. In September that year, ING paid €775 million to settle a Dutch criminal investigation into serious anti-money-laundering failures. In April 2024, Dutch prosecutors fined two former Payvision directors for structural AML violations. Since 20 April 2026, Hamers has chaired the Group Board of Banking Circle Group.
Those connections warrant scrutiny, with a clear distinction between documented payment flows, conversations about proposed arrangements and findings by courts or prosecutors. This note builds on EFRI’s analyses of Banking Circle’s virtual-IBAN model, its 2022–2025 accounts, the FINOM/Triventa pass-through and the Kraken victim-named IBAN case.
1. The 2026 case: €29,000 to Banking Circle IBANs
An Austrian consumer reported an online investment fraud using the name Swissfx Capital. The bank transfer records and police report held by EFRI document more than €84,000 in authorised credit transfers between May and October 2026. Three transfers, totalling €29,000, went to IBANs containing German bank code 20220800:
| Execution | Payee as entered | Receiving institution identified from IBAN | Amount |
|---|---|---|---|
| June 2026 | Recaster Software GmbH | Banking Circle – German Branch (20220800) | €5,000 |
| June 2026 | Recaster Software GmbH | Banking Circle – German Branch (20220800) | €10,000 |
| July 2026 | talVaro GmbH | Banking Circle – German Branch (20220800) | €14,000 |
| Total to Banking Circle IBANs | €29,000 | ||
This was just over one third of the reported loss. A further €55,000 went to accounts at other German banks in September and October 2026. The Bundesbank’s bank-code file assigns 20220800 to Banking Circle – German Branch, Munich, BIC SXPYDEHHXXX. The identifier establishes the receiving institution; it does not establish the contractual account structure behind each IBAN.
The transfer orders record the payee-verification result “Übereinstimmung des Empfängernamens”: the name entered matched the name returned for the IBAN. Euro-area payment service providers have been required to offer Verification of Payee since 9 October 2025 for covered euro credit transfers. A positive match confirms consistency with the name registered for an IBAN. It does not identify who actually controls the account, prove the legitimacy of the stated investment or establish whether the IBAN is direct or virtual.
EFRI makes no allegation against Recaster Software GmbH or talVaro GmbH. Their identities may themselves have been misused. The receiving-side questions remain: Were these direct accounts or virtual IBANs assigned through a Banking Circle client? Who onboarded the account users, and what due-diligence records were retained? What did transaction monitoring show when €29,000 arrived from an Austrian consumer within approximately four weeks?
On its fraud-information page, Banking Circle says it can identify the client linked to a virtual IBAN, forward a case to that client and cooperate with the authorities. It also says that it cannot access end-customer transaction details or issue refunds directly. Those statements make identification of the relevant client a practical starting point for tracing the funds.
The new file follows two other receiving-side cases documented by EFRI. In the FINOM/Triventa case, a German investor’s 2025 payments passed through a FINOM account and a Banking Circle sweep structure, documented in part by Banking Circle’s own GDPR Article 15 response. In the Kraken case, an Austrian consumer paid €60,749 in May and June 2026 to German-format Banking Circle IBANs displayed as his own fiat funding details; the name check returned a match.
2. The 2018 trail: 24option deposits under the same BIC
EFRI holds a bank statement extract for a German couple who paid into 24option in 2018. It lists 22 SEPA credit transfers between 8 March and 30 October 2018, totalling €41,250, to PPRO Financial Ltd, IBAN DE41 2022 0800 0000 0116 54, BIC SXPYDEHH. The references contain “RODELER LIMITED” and a giropay transaction code. Rodeler Limited was the Cypriot operator of 24option.
Earlier payments in February 2018 went to a PPRO account at UniCredit/HypoVereinsbank, BIC HYVEDEMM448. From March, the records show the PPRO collection account under SXPYDEHH. A public BIC-directory entry retains the historical name “SAXO PAYMENTS A/S”, while the current BIC entry identifies Banking Circle S.A. – German Branch in Munich. The identifier supplies a concrete link between the historical payment records and the present receiving-bank infrastructure.
The corporate history supports that lineage. EQT’s announcement of 9 July 2018 described an agreement to acquire Saxo Payments Banking Circle from Saxo Bank and minority owners, and traced its founding to 2013. Banking Circle’s own 27 February 2020 banking-licence announcement states that EQT, the founders and co-investors acquired the business in September 2018. It also confirms receipt of the Luxembourg banking licence from the CSSF in February 2020. The 2018 deposits therefore span a change of ownership; a continuing BIC should not be confused with unchanged ownership, legal entity or management.
PPRO publicly announced its Banking Circle partnership on 20 December 2018, describing real-time settlement through Banking Circle accounts. The victim payments held by EFRI predate that announcement by up to nine months. They document use of the collection account before the public partnership announcement.
PPRO had also used Deutsche Handelsbank. In its earlier report on Deutsche Handelsbank’s exit from payment services, EFRI described its 2020 criminal complaint, which named PPRO among the payment intermediaries, and the subsequent €1 million fine concerning the bank’s deficient AML organisation.
3. 24option: the scheme behind the deposits
Rodeler’s customer correspondence in EFRI’s files identifies Rodeler Limited, Limassol, under CySEC licence CIF 207/13, and its German sales operation, Rodeler DE GmbH in Cologne. Page three of 24option’s “General Fees” document, updated on 26 January 2018, names Acapture (Payvision Group), PPRO Group (PaymentIQ), Wirecard Card Solutions Ltd, eMerchantPay, Credorax, Paysafe/Neteller and SafeCharge as payment providers.
The provider list documents the payment network presented by 24option itself. It does not demonstrate that every provider processed every victim payment, or that any listed provider knew of fraud. The bank statements supply the separate evidence for the PPRO collection route described above.
The criminal history is relevant to the underlying platform. FinTelegram reported arrests of two former boiler-room managers in December 2021. SRF’s investigation of 3 July 2024 reported that two former 24option employees had been convicted of commercial fraud by the Cologne Regional Court in 2023. According to SRF, which had seen the judgment, customers were deceived about the risk of loss. SRF also reported that Cologne prosecutors were investigating dozens of other suspects; those allegations remained subject to the presumption of innocence. These findings concerning employees do not amount to findings against the payment providers.
4. 2016–2017: Lenhoff, Payvision and “SAXO”
Uwe Lenhoff, the German online-gambling entrepreneur behind Veltyco, was arrested in January 2019 on suspicion of involvement in a cybercrime organisation operating fraudulent trading platforms. He died in custody in July 2020 before trial. EFRI’s case files document Payvision’s processing relationship with Lenhoff-linked platforms. The Saarbrücken criminal file includes forensic extracts of Skype conversations between Lenhoff and Hans Dahlgren.
8 February 2016. Lenhoff wrote: “I spoke with Rudolf today and he will send us 2 banks.” EFRI identifies “Rudolf” as Rudolf Booker, Payvision’s founder and then chief executive.
11 February 2016. Dahlgren first reported that he had contacted “Cheng” without hearing back about bank accounts. Later that day, he wrote that Cheng would provide “an introduction to SAXO Bank.” EFRI identifies “Cheng” as Payvision co-founder Cheng Liem Li.
23 March 2017. Dahlgren discussed having “SAXO” with “Hithcliff” (the spelling in the extract) and switching the merchant identifiers, or MIDs, for binary options. The proposed benefit was same-day settlement because it would be “all internal (SAXO to SAXO) so no more banks bitching…”.
The 2017 arrangement was not implemented, according to EFRI’s information. The wording “SAXO Bank” or “SAXO” alone does not conclusively identify a legal entity. The settlement context is consistent with a reference to the Saxo Payments infrastructure, but that is an inference, not proof that the named bank or any employee agreed to the proposal. The extracts do not show that Saxo or Banking Circle staff knew of these conversations.
What the chats document is the participants’ expectation that Payvision’s founders could facilitate bank introductions, and their interest in settlement arrangements that they believed would be faster and attract fewer objections. The 2018 PPRO/24option records establish a separate payment route. They do not prove that the unimplemented Lenhoff proposal later went ahead.
Payvision’s own AML history is documented independently. On 5 April 2024, the Dutch Public Prosecution Service announced penalty orders of €150,000 and €180,000 against two former Payvision directors for de facto leadership of structural breaches of the Dutch AML Act, the Wwft. It found inadequate customer due diligence from 2016 to April 2020. These were out-of-court criminal penalty orders, not convictions following a trial. The official announcement did not name the directors; MT/Sprout identified them as Rudolf Booker and Cheng Li.
The period identified by prosecutors overlaps the 2018 document naming Acapture, part of Payvision Group, among 24option’s providers. EFRI identifies those same two founders in the earlier Lenhoff chats. That is a documented overlap of people and periods; it does not establish that the Dutch penalty orders concerned these particular victim payments or the proposed “SAXO” arrangement.
5. Ralph Hamers: from ING and Payvision to Banking Circle
On 29 January 2018, ING announced that it would acquire 75% of Payvision at a total valuation of €360 million. The €360 million was the valuation of the whole business, not the stated price of the 75% stake. Ralph Hamers, ING’s chief executive from 2013 to 2020, endorsed the acquisition; Rudolf Booker welcomed the partnership in the same announcement.
On 4 September 2018, Dutch prosecutors announced that ING had paid €775 million to settle a criminal investigation into serious AML failures and culpable money laundering at ING Netherlands during 2010–2016. The total comprised a €675 million fine and €100 million in disgorgement. This was the bank’s settlement, not a personal fine imposed on Hamers.
The subsequent proceedings against Hamers must be stated in full. Following a complaint seeking prosecution, the Hague Court of Appeal ordered his prosecution on 9 December 2020. After further investigation, prosecutors sought to discontinue the case. On 3 December 2025, the court permitted discontinuation, ECLI:NL:GHDHA:2025:2436. Hamers was not tried or found guilty. The court’s decision expressly addressed the prospects of a conviction on the available evidence and applicable law.
On 13 April 2026, Banking Circle Group announced Hamers’ appointment as Chairman of its Group Board, effective 20 April 2026. This is a group-level role: it should not be described as chairmanship of the licensed bank’s own board without separate evidence. The group includes Banking Circle S.A. The new victim payments described in this note began after that appointment, a chronological fact that does not establish Hamers’ involvement in individual accounts or transactions.
6. Why the infrastructure matters now: scale, virtual IBANs and crypto
Banking Circle S.A. is a Luxembourg credit institution supervised by the CSSF, operating through branches including Germany. It describes itself as a business-to-business bank. In its public explanation of its role, it reports more than €1.5 trillion in annual payment value for over 850 regulated financial institutions and says it does not provide accounts to private individuals.
Its contact page for law-enforcement enquiries explains that it supplies (virtual) IBANs to clients who assign them to their own customers, with whom Banking Circle says it has no business relationship. That describes a layered model in which the bank’s identifier can appear in a victim’s transfer records while another institution maintains the end-customer relationship. It does not establish that every IBAN discussed in this note uses that model.
Three developments make the allocation of responsibilities particularly important. First, Banking Circle IBANs can serve as funding details for crypto platforms. In EFRI’s Kraken case, the displayed beneficiary was the victim himself. The beneficiary name therefore did not, by itself, tell the sending bank that the payment was funding a crypto account.
Second, the bank now connects fiat and stablecoins. Its 2024 annual accounts record the launch of EURI on 26 August 2024, a euro e-money token under MiCA. Banking Circle’s April 2026 stablecoin-settlement announcement states that it received a CSSF crypto-asset service provider licence on 15 April 2026 and describes integration of fiat with USDC, USDG and EURI through its core platform. These services are not evidence of fraud. They extend the range of money movements for which clear monitoring and tracing responsibilities matter.
Third, EFRI’s analysis of Banking Circle’s accounts traces off-balance-sheet fiduciary operations from nil in 2022 to €1.24 billion in 2023, €6.075 billion in 2024 and €5.376 billion in 2025. The published figures do not provide an allocation to the victim cases discussed here. They should not be read as fraud-related balances.
The bank’s scale also matters when evaluating these files. Recurrence in payment trails alone does not demonstrate ineffective controls: a very large payment institution will appear in many transactions, including payments later reported as fraudulent. Neither the continuing BIC nor a board appointment proves continuity of particular compliance decisions. The questions require account-level evidence, fraud-notice records and the relevant institutions’ responses.
Our assessment
The Swissfx Capital file adds a new set of payment records to a longer history. In 2018, the route ran through PPRO’s collection account for 24option. In 2025 and 2026, other files involved payment and crypto intermediaries, company-named IBANs and IBANs displayed in a victim’s own name. Banking Circle’s predecessor identifier and current infrastructure connect those payment trails. They do not, on their own, establish the bank’s knowledge of fraud or civil or criminal liability.
A successful name check does not resolve the central question: who controlled the destination and what happened to the money? If a virtual-IBAN arrangement is involved, identifying the bank behind the identifier is only the first step. The regulated client, the end-user record and the onward transfer must also be traced. In the new case, whether that additional client layer existed remains to be established.
The personal connections raise a governance question rather than proving misconduct. ING acquired Payvision under Hamers’ leadership. Two former Payvision directors later received criminal penalty orders for inadequate AML controls. EFRI identifies the same founders in earlier chats about potential bank introductions, including “SAXO Bank”. Hamers now chairs the group that includes the bank developed from Saxo Payments. What enhanced oversight of high-risk PSP and crypto clients has the group put in place, and how is that oversight tested against actual fraud reports?
For victims, the practical obstacle is identifying the institution and account user responsible for each stage. A bank code is visible; the contractual chain often is not. Banking Circle’s published position explains its own understanding of that chain. It does not, by itself, settle the legal duties of each participant or the facts of an individual case.
EFRI calls for three concrete measures. Disclosure sufficient to trace the funds: the receiving bank should identify its direct client and the relevant account structure to law enforcement, and to victims or their representatives where legally permitted, subject to data-protection safeguards. Recorded handling of fraud notices: institutions should log notices, preserve evidence and document recall, blocking and escalation decisions; continued crediting after substantiated notice should be examined in any liability assessment. A supervisory thematic review: the CSSF and BaFin should examine virtual-IBAN programmes serving high-risk PSP and crypto clients, including the allocation of responsibilities when fiat-to-stablecoin services form part of the chain.
Victims who paid to IBANs containing German bank code 20220800, or to Banking Circle virtual IBANs, can register their case with EFRI. Consistent payment records and a quantified victim group would provide a basis for assessing coordinated recovery options. The evidence needs to follow the money beyond the bank identifier.
Payment data are taken from victims’ bank records held by EFRI. The chat extracts come from the Saarbrücken criminal file concerning Uwe Lenhoff. Public-source links are included at the relevant statements above. This note makes no allegation of criminal conduct by Banking Circle, Saxo Payments, PPRO or any person named beyond the expressly attributed findings and proceedings described.
