INVESTIGATION BY AGENT ELIASCASE FILE 09 / 11 OCTOBER 2026
PAYMENTS, SETTLEMENT & ENFORCEMENT / 10 OCTOBER 2026
No money? Follow the payment.
The label changes. The value and control remain.
Real value funds the account. The operator controls the credit and the return. A Steam restriction can trap the participant’s inventory while the outside service keeps its website, payment routes and internal ledger.
The platform decides when the transaction counts. It recognises the transfer, applies its pricing and credit rules, and controls release. The counterparties are consumers operating inside its system. A direct skin transfer does not give them control over settlement.
01 / C2C UNDER CENTRALISED CONTROL
The item goes directly. The decision goes through the platform.
This diagram separates the payment record, the platform’s ledger and the Steam transfer. It shows the control relationship described by the reviewed payment and trading policies. [K10][K11]
Delivery between users is one layer. Platform accounting and identity checks govern the commercial result.
“P2P” describesWhere the item travels.
The C2C service decidesHow the trade is recognised and settled.
THE 2018 ARCHITECTURE CHANGE
29 March 2018. Valve applied a seven-day cooldown to traded CS:GO items, and the operators that had held skins in inventory bots moved to P2P/C2C delivery between users — Empire dates its own bot-to-P2P transition to 2018. That architecture change made every enforcement question a question about accounts rather than inventories.
Empire’s rules specify coin holds, early-credit tiers, escalating failed-trade fees and reversal penalties. Its extension keeps the Steam credential available for the platform’s checks.
CSGORoll’s payment help lists cards, bank transfers, cryptocurrency, gift cards and skins. Kinguin lists gift cards for both operators. These routes bring different counterparties and records into the transaction. [K11][K12][K13]
The August 2026 terms deny cash redemption for ordinary Coins and provide for cryptocurrency redemption of eligible Roll Chips. The current FAQ also distinguishes the two. The operator’s own terms include a route from eligible Chips to cryptocurrency. A blanket impression that no real value can leave the service is incompatible with that published route. [K02][K10]
CSGOFAST / LABEL AND FUNDING
“No real-world monetary value.”
The Responsible Play Policy applies that label to digital items and Credits. The marketplace separately sells Fast Coin gift cards for conventional currency. The terminology does not erase the acquisition cost, the redemption conditions or the operator’s control over account access. [K07][K13]
Redemption restrictions do not make the business money-free
The customer pays to acquire usable value; the operator records it in internal units and controls how it can be spent or released. A restriction on cash redemption limits the customer’s claim. It does not erase the purchase price, the value of the deposited skin or the surrounding payment relationship.
The transaction is C2C inside a central service. Two platform users may transfer the item directly through Steam. Pricing rules, credit recognition, verification and release remain functions of the commercial platform. “P2P” describes the delivery route while leaving that settlement authority out of the picture. [K10]Read the control analysis ↗
TWO DISTINCT EVENTS
Purchase a code. Redeem platform credit.
Stage
Record to identify
Where the dispute attaches
1. Gift-card purchase
Marketplace order, named seller, receipt, payment recipient and funding method.
Delivery, validity and description of the purchased code; the seller and payment route matter.
2. Code redemption
Code use, receiving platform account and credit entry.
Whether the operator credited the account and honoured its redemption terms.
3. Later withdrawal / KYC
Document request, hold reason, applicable terms and account history.
The operator’s decision. A successful code delivery is a different event from a later refusal to release value.
The reviewed Kinguin listings display CSGORoll.com and CSGOFAST as seller names. Kinguin’s legal notice describes its marketplace role and seller responsibility. Identify the legal seller from the actual order. [K12][K13][K35]
PAYMENT RECORD → PLATFORM LEDGER
Identify the merchant actually paid.
A card or bank entry can identify a merchant, payment intermediary and transaction reference. Those records should be matched to the platform credit and the legal entity that receives payment. CSGORoll lists these methods; their availability can vary by location. [K11]
A payment provider’s verification of its own merchant and the operator’s demand for a player’s passport are separate processing activities. The operator should identify the legal or contractual requirement behind the player-level request.
EXTERNAL TRANSFER → INTERNAL CREDIT
The transfer settles on another system. The balance is recognised by the platform.
A crypto transaction supplies a transaction ID and addresses. A Steam transfer supplies a trade record. The platform then applies its crediting and release rules. This continues the centralised settlement model documented in the main investigation ↗.
The operator holds the deposit addresses and any custodian or processor arrangement behind them: publish which entity controls each address, who holds the keys and where payouts settle. The author’s working attribution — that the deposit addresses are more likely operator-controlled than exchange-held — is the open lead those records close. No deposit-address ownership attribution or test payment was performed in this review. The code-audit appendix separately examines Steam session and trade-access mechanisms ↗.
CHARGEBACKS & VOUCHERS
The remedy becomes fragmented.
PayPal’s US Purchase Protection excludes cash-equivalent products such as gift cards and activities with an entry fee and prize. It separately recognises that card-issuer dispute rights can be broader. [K14]
A voucher divides the dispute between the purchase of a code and the operator’s later treatment of the redeemed balance. If the seller delivered a valid code, a later withdrawal hold concerns a different service and a different counterparty — the separation is the design: the payment settles with the marketplace’s recipient, never with the operator’s legal entity, and no dispute through that recipient restores the severed settlement. The purchase and the loss sit with different businesses by arrangement; each should account for the part it controls, and the operator remains the party that imposed the hold.
PAYPAL & MERCHANT APPROVAL
A payment logo is not an approval record.
PayPal’s gambling rules require merchant approval and permitted jurisdictions, and address relevant intermediary activity too. A gift-card listing or a PayPal option at a marketplace does not disclose the operator’s own merchant approval or settlement agreement. [K15]
Identify the checkout recipient, legal seller, merchant arrangement and redemption chain. Follow the same payment into the operator’s credited balance and its later withdrawal decision. Each business should account for the part it controls.
The outgoing payment deserves scrutiny too.
A bank or exchange can assess gambling-related funds, unusual patterns and counterparty risk under its own AML obligations. FATF’s approach is risk-based: source, destination, activity and context matter. A platform’s internal verification badge cannot establish how the recipient institution will classify a later transfer. [K25]
The reciprocal question remains: what independently verifiable records establish the operator’s identity, source of payments, regulated status and handling of customer data?
THE STEAM WALLET / FUNDING AND PLAYER IDENTITY
Money can arrive without the player’s own card.
A TF2 key is a useful example of the connection: the official Mann Co. Supply Crate Key listing allows trading and Market sale; Market proceeds credit Wallet. The external payment and the Steam balance are separate steps.
AGE / THE MISSING LINK
The payer and player can differ.
Digital gifts, existing retail cards and eligible item-sale proceeds separate the original funding event from the person spending the balance. The age check must be identified at the paid outcome.
2026 / THE RETAIL CHANGE
Card stocks are being run down.
Valve’s current Wallet FAQ ends retail restocking and expects stocks to be exhausted by the end of 2026. Existing cards remain redeemable, subject to local law. That changes new supply; it does not erase the historical route.
Restrictions require a reviewable reason. The expanded chapter places Valve’s chargeback rules beside August 2026 AmEx user reports and asks for the actual payment event, evidence and correction process. Read the policy and incident record ↗
The reported cases carry concrete elements: the card owners are real, the transactions were canceled or failed, and the accounts were locked anyway. The user is then asked to produce a bank statement for a charge that never completed — an impossible demand — while template support repeats the policy instead of correcting the classification. Read the full incident record ↗
THE PROTECTION GAP / MARKET, WALLET & GIFTS
A protected trade does not cover every loss.
Valve’s fraud narrative needs a route-by-route account. The company administers the item record, the Market transaction and the Wallet ledger; the remedy changes between them.
Where the public remedy changes
Route
Published control or remedy
Record needed
Protected CS2 item trade
Seven-day reversal returns original items; the initiating account receives a 30-day trade and Market cooldown.
Trade IDs, item lineage, reversal eligibility and outcome.
Completed Community Market transaction
No equivalent user cancellation or refund mechanism in the Market FAQ. The scam FAQ separately acknowledges that some transactions may be cancelled for fraud.
Listings, counterparties, authorisation evidence, intervention decision and fees.
Steam Wallet → gift purchase
Market proceeds can fund gifts. Gifting and activation remain subject to product and regional restrictions.
Linked Wallet entries, gift order, recipient, restriction checks and any refund.
Steam’s own scam FAQ describes buying a low-value item at a high price as a way to transfer value, often with fraudulent funds. This makes the listing and Wallet trail relevant to theft investigations even when no protected skin trade is involved.
DOCUMENTED SPENDING ROUTE
Wallet value can become a gift.
The Market FAQ allows proceeds to pay for Steam gifts. The policy connects Market value to an onward purchase. Follow the same balance through the gift order, receiving account and any later resale to account for the victim’s complete loss.
FOLLOW ONE LOSS THROUGH THE WHOLE SYSTEM
Does the theft review connect the records?
01 / INVENTORYUnauthorised item sale
02 / MARKETAbnormal low-value purchase
03 / WALLETValue spent on a game gift
04 / OUTSIDE SALEOnward gift resale
The investigator identifies this combined route, including Russia-facing resale demand. Valve’s policies document the component transactions; a joined case requires their linked records. The enforcement question is whether the review follows the complete loss, including the final recipient and any restitution.
THE ACCOUNTABILITY QUESTION
What happens when the loss stays inside Steam’s own market and payment system? Publish prevention, detection, reversal and restitution outcomes for this route, including which fees were retained or reversed. The number of account locks does not establish the value returned to victims.
CASE TRAILThe investigator’s Russia-facing gift-resale lead+
The investigator follows unauthorised skin sales, Wallet depletion through overpriced low-value listings and onward game-gift resale, including Russia-facing demand. Trace each step through the relevant account and transaction records: sale, balance, purchase, recipient and resale.
Valve holds the item, Market, Wallet and gift-order records needed to join the route. It should identify the receiving accounts, the applicable product-region rules, the fees and the final recovery decision. The investigation calls for that full transaction trail and a remedy that follows the value through the system.
MTS Payment publicly offers ruble-funded Steam top-ups for Russian accounts. Its FAQ explicitly discusses delayed or failed credits for accounts in Crimea, “LNR” and “DNR”—the provider’s own labels. The territorial question is present in the service’s published offer.
The linked card-transfer terms identify Murmansk Settlement Bank LLC as the settlement centre. Those terms apply to that card service; the page also offers other payment options.
Which checks follow the value into Steam? Match the payer, service, settlement intermediaries and Wallet credit. Disclose the territorial rules applied at each step, who receives the revenue and how rejected or disputed payments are handled.
SOURCE SCOPEWhat the public offer establishes+
This is a documented commercial offer and provider statement; no test payment was made. The arrangement behind ruble-funded credits to Crimea, “LNR” and “DNR” accounts, the sanctions screening applied at each step and the turnover of successful credits are records held by Valve, MTS Payment and Murmansk Settlement Bank LLC: publish them.
03 / A BAN COUNT AND A BUSINESS
One million accounts. Which part of the system stopped?
The P2P trading model puts item delivery into participants’ Steam inventories. Account-level enforcement can therefore reach the people supplying those items while the operator’s ledger, funding routes and game rules sit elsewhere. Follow the loss in the main investigation ↗
WHAT AN ACCOUNT RESTRICTION REACHESIllustrative P2P model
THE PARTICIPANT / ON STEAM
The item is here.
Trade access available
Valve controls the account’s permission to deliver the inventory.
ITEM DELIVERY
THE OPERATOR / A SEPARATE TARGET
The business is broader.
Internal balances and pricing
Outside money or crypto
Website and settlement rules
Follow enforcement into the operator’s ledger, funding routes and payment relationships. Record which capability was interrupted, for how long and whether the business continued through replacement accounts.
Before the illustrated restriction: the holder can supply an item through Steam. The outside service maintains its own ledger and settlement rules.
CSGOFAST / COUNTER TRANSCRIPTION SUPPLIED TO THE INVESTIGATION[K33]
Users10,712,351
Online
1,272
Cases opened today
22,362
Games played today
1,236
The labels and figures are preserved as supplied on 10 October 2026. The site’s definition, counting period, uniqueness and Steam-account linkage of “Users” were not disclosed by this counter.
An account total does not show which operators were stopped
Valve’s March 2026 statement reports over one million Steam accounts locked across gambling, fraud and theft. It does not divide the total between ordinary participants, automated accounts, custodial inventories and operators. The number therefore cannot establish who bore the losses or how many gambling businesses lost the ability to operate. [K31]
CSGOFast’s separate 10.7-million “Users” counter does not fill that gap. Its composition, counting period and overlap with Steam’s locked accounts are undisclosed. The supplied counter above is an exhibit of operator continuation: on 10 October 2026 CSGOFast still displayed 10,712,351 “Users”, 22,362 cases opened that day and 1,236 games played that day, beside a live website and gift-card listings. The definitions, counting periods and overlap that would turn these totals into a measured account of what the locks stopped are Valve’s and CSGOFast’s to publish.
Compare the displayed counter with the one-million benchmark
10,712,351 ÷ 1,000,000 = 10.712351. CSGOFast’s displayed “Users” counter is 10.71 times the one-million benchmark. Valve’s published figure is more than one million locked Steam accounts across gambling, fraud and theft. On the review date, Fast still displayed 22,362 cases opened and 1,236 games played that day. The business continued operating beside the enforcement announcement. Valve holds the locked-account classification; CSGOFast holds its user definition and activity records. Publish both to show whose access was removed and which business capability was stopped.
One million is a number about players
One million is a number about players. The number of gambling operators Valve has publicly documented stopping — the figure the Washington State Gambling Commission asked for in 2016 and the New York Attorney General asks for now — is zero. Not small. Zero published. [K31][K32]
Valve announced action against gambling sites’ use of Steam. [K32]
2025
CSGOFast in regulator records
Australian and Dutch actions identify the service under Gamusoft LP. [K17][K24]
2026
The brand remains online
Public service pages, policies and gift-card listings remain available on the review date. [K34][K13]
This sequence gives Valve concrete checkpoints for an enforcement account: the named business, the announced restriction, the later operator and the technical route that returned. Explain what changed at each point and who was responsible for it.
STEAM ACCOUNT RESTRICTION
Inventory access
Items and trade permissions on the affected account
≠
OPERATOR DISRUPTION
Business access
Payment acceptance, ledger, website and integrations
A trapped user inventory is not a dismantled gambling business.
An immobilised Steam inventory is a concrete restriction on its holder. It does not itself remove a casino’s crypto receipts, shut down its website or erase its internal accounting. The business impact is measured through lost payment access, rejected settlement, disabled integrations and the resulting financial records — records the operators and their payment providers hold and should publish.
For a service associated with young audiences, the youth-protection question belongs in that review too: who can enter, how is age checked, and what action reaches the operator rather than simply locking another participant’s inventory? ACMA’s CSGORoll finding explicitly identifies the youth-market concern. [K16]
THE TEST OF ENFORCEMENT
Count the operators that lost the ability to do business. Then disclose which users lost access to items, why, and what review or recovery was available. Those outcomes explain more than an undifferentiated account total.
AUTHOR’S COLLECTED INVENTORY / THREE PLATFORMS
The skins carry a price. The inventory adds up.
The supplied snapshot puts a dollar measure beside the operators’ internal units. Each priced group is valued at its supplied minimum marketplace asking price, multiplied by the number of listings. Empire, Roll and Fast together account for 186,127 priced listings and $19,283,716.61 in this collection.
22,169 platform–item groups · 186,127 listings · 3 platforms
CSGOEmpire
$7,741,028.63
CSGORoll
$5,964,749.78
CSGOFast
$5,577,938.20
Collected listings valued at the supplied minimum asking prices
Platform
Item groups
Priced listings
Total USD
CSGOEmpire
13,843
120,323
$7,741,028.63
CSGORoll
6,573
56,590
$5,964,749.78
CSGOFast
1,753
9,214
$5,577,938.20
The raw Empire export contains 122,674 listings across 14,351 item names. The priced file covers 120,323 of those listings; all per-name counts match the raw export. The remaining 2,351 listings across 508 names remain in the raw file and a separate unpriced export. They contribute no invented zero-price valuation to the total.
READ THE MEASURE
Listings × Min Ask USD = Total USD. These are the supplied minimum-ask values for the collected inventory. The CSVs preserve the listing snapshot and its prices; this is an inventory valuation, with the operator’s balances and turnover covered elsewhere in this investigation.
The original Empire export retains every listing and its Coins value. The priced export supplies the USD comparison shown here. Both source files are available in full below; the manifest records the counts, calculation and original file hashes.
Read every priced item.
Showing the 25 largest item groups by supplied USD valuation.
Public payment descriptions, operator policies, listings and regulatory records were reviewed on 10 October 2026. No test purchase, deposit or withdrawal was made. The CSGOFast counter is explicitly identified as a user-supplied transcription. The two counters are preserved as supplied; the definitions, counting periods and overlap that would join them are undisclosed by Valve and CSGOFast and are demanded of both above.
Dates, entities and jurisdictions stay attached to each record. The source register identifies retrieval dates and historical announcements. The requested transaction record joins payment-provider approval, custody, balance release and the effect of the restriction on the user and operator.
Primary documents are linked below. K33 separately records the investigator-supplied counter transcription and the definitions CSGOFast has not disclosed.
Investigator-supplied transcription of the operator’s public counter, supplied 10 October 2026. The counter’s definition, counting period, uniqueness and Steam-account linkage are undisclosed by CSGOFast.