ED raids Safexpay, Decentro, others in online investment fraud probe
22 Jun 2026, 12:45 PMAs part of the investigation, ED has frozen 129 bank accounts containing balances of Rs 18.4 crore.
The Directorate of Enforcement (ED) has conducted search operations at eight locations across Mumbai, Thane, Bengaluru and Gurugram in connection with a case of online investment fraud and money laundering investigation.
The premises covered during the search are Payx Digital Payment Pvt Ltd, Smoothpe Digital Pvt Ltd, Kinsen Business Solution Pvt Ltd, Safexpay Technologies Pvt Ltd (now Touras Tech Global Pvt Ltd), Gyan Kuber Ltd and Decentro Tech Pvt Ltd.
Both Payx Digital and Gyan Kuber have common directors.
The searches were carried out on June 1 and June 4, 2026 by ED Kolkata zonal office under the provisions of the Prevention of Money Laundering Act (PMLA), 2002.
As part of the investigation, ED has frozen 129 bank accounts containing balances of Rs 18.4 crore.
ED said various incriminating documents and digital evidence were seized which are under detailed examination. Further some lockers have also been frozen during the search.
The investigation was initiated on the basis of the multiple FIRs registered at the Cyber Crime Police Station, Bidhannagar Police Commissionerate, West Bengal regarding fake investment through cyber fraud.
The probe agency said victims were lured via social media platforms and WhatsApp groups (e.g., Stock Frontline C4, Vanguard C7, etc.) to invest using apps like CHC-SES, ALICE, ESCORTS etc., on the pretext of high returns from IPOs and stock markets investments.
Upon investment by the gullible investors, the apps showed high returns, but when the investors attempted withdrawal, victims were asked to pay more based on demands on account of tax.
As a result, many investors were duped by various accused persons.
The agency said investigation under the PMLA, 2002 revealed that proceeds of crime generated from cyber fraud were routed and layered through a network of mule entities, charitable trust accounts and payment gateway companies.
The transaction pattern indicates receipt of funds from suspected mule accounts, inter-layering of funds through multiple entities, and transfer of large amounts among payment gateways, suggesting concealment and laundering of proceeds of crime, ED added.
Investigation has further established common directors, common business premises, financial linkages and fund transfers among several of these entities.
Further investigation is under progress, the agency said.
Recently, the Bengaluru-based Decentro -- which holds a payment aggregator licence (both online and offline) from the RBI -- came under the scanner of the Hyderabad unit of the Directorate General of GST Intelligence (DGGI). The Y-Combinator and InfoEdge-backed firm was among the three fintech firms, which was raided in March, as part of wider investigation into suspected GST violations tied to a high-value online betting case.
On the other hand, Safexpay, owned by Ravi Gupta, has come under the ED scanner multiple times in recent years. In April, the agency was probing the company for its alleged involvement in facilitating the laundering of thousands of crores in proceeds of crime connected to the Rs 2,200-crore HPZ Token cryptocurrency scam.
Safexpay's application for payment aggregator licence was returned by the RBI in 2021. However, Touras India Pvt Ltd -- part of the same entity -- seems to have applied for the PA licence; and its application shows 'under process' on the RBI site.



