UK Puts Off Revolut Bank Licence Over Control Risks

Revolut’s ambitions to become a fully licensed UK bank have been delayed as regulators look into whether its risk management is keeping pace with the company’s breakneck growth around the world. The Bank of England and its Prudential Regulation Authority are concentrating on the firm’s suitability to maintain strong controls over multiple jurisdictions, according to a Financial Times report, with particular reference to financial crime, operational resilience and governance.

The fintech is currently in the “mobilisation” phase of authorisation, a preparatory period that usually involves caps on customer deposits and product scope as supervisors test a bank’s systems. Revolut says it is engaged in constructive discussions with the PRA, and that given the scale and complexity of its business, the level of scrutiny amounts to an unusually tough inquiry.

Why a full UK banking licence matters for Revolut

With a full UK banking licence, Revolut would be capable of actually taking insured deposits, as well as operating at scale in regulated lending not limited by its current e-money permissions. Related to that, it would also bring customer balances under the Financial Services Compensation Scheme, the standard protection for deposits kept at British banks — a move likely to be important for users who prize deposit insurance.

Mobilisation is intended to span the period between authorisation and full-scale operations. New firms setting themselves up as banks must obtain clearance for capital, governance, risk and reporting controls to be removed before authorisation restrictions are lifted in a new framework from the PRA’s New Bank Start-up Unit. Given a platform with millions of users and dozens of product lines, that means not merely proving that policies exist at all but also demonstrating that they are effective under stress and at the kind of scale Google operates.

Why regulators prioritise controls over raw growth

Supervisors are not penalising growth as such, but want to know whether or not control maturity is keeping up with the pace and extent of expansion. That involves anti-money-laundering and sanctions screening, transaction monitoring, fraud detection, model risk management and the resilience of underlying systems that must remain stable as products are updated frequently.

The PRA’s tack is in keeping with a global push: fintechs that grow quickly are increasingly finding themselves needing to demonstrate enterprise-grade second-line and third-line defences, have boards independent of the firm and possessing deep risk experience, and have clear lines of accountability under the UK Senior Managers and Certification Regime. In practice, that could include more robust independent testing, greater granularity of MI to boards and tougher change governance lines before new products go live.

Revolut’s global expansion and current market footprint

Revolut has more than 65 million global customers and has been expanding into several markets outside of Europe including the US, Australia, Singapore, Brazil, India and the Middle East.

It already has a banking licence in the European Union, and plans to open in more Latin American and African markets.

Each expansion for a new country comes with more layers of regulatory expectation and technical specifications — localisation of know-your-customer, data residency, incident reporting and varying consumer-product disclosure rules. Other fast-growing fintechs have tested the limits of “move fast” in regulated finance — like Germany’s BaFin, which slapped a temporary growth ban on N26 over AML weaknesses — as well, illustrating how regulatory patience wears thin when compliance fails to keep pace with scale.

Financial strength, but governance questions remain

Revolut’s most recent annual report warned of strong top-line trends and a swing to muscular profitability, with some $1 billion in net profit on roughly $4 billion in revenues. Its Wealth business, which was emboldened by the launch of a dedicated crypto exchange, saw a significant rise in revenues that reflected an offensive to compete in higher-yielding products.

But profitability does not equal control effectiveness. The company has previously faced questions from auditors about certain areas of revenue recognition, and although that’s been resolved over time, it helps explain why regulators have been so insistent on verifiable, repeatable control performance. We reward banks as much for predictability as growth.

What mobilisation means for Revolut’s UK customers

For current users, day-to-day operations remain unchanged under the existing permissions. What a full licence does change is mostly about protections and product range: insured deposits, a deeper sleep at night for some larger balances, and an avenue under the regulator to provide mortgages, loans and other regulated credit. Until restrictions are lifted, Revolut cannot offer loans up to its caps nor use the full range of regulatory levers available to licensed banks.

From a risk point of view, customers should see the delay as a reflection of supervisory prudence rather than anything problematic. Regulators frequently prolong mobilisation because they demand additional proof that governance, risk, and compliance are practised within systems and culture — rather than simply recorded in policy binders.

The Future Will Judge The Road Ahead For Revolut And The UK

To release unconstrained authorisation, Revolut will no doubt have to show performance as end-to-end owner – perhaps with independent assurance over financial crime controls, stress testing and technology change. Occasionally, UK regulators use a “skilled person” review under the Financial Services and Markets Act to approve progress on remediation; that tool has become routine in complex growth stories.

The stakes go beyond one company. The UK likes to think of itself as a world-leading fintech hub, but legitimacy comes from balancing innovation and prudence. How this licensing plays out will indicate to the market that fast-growing digital players can win full banking status — so long as they can establish that controls are as scalable as their user growth.