Revolut

Revolut confirmed a data breach in which attackers impersonating a government agency via a spoofed official email address obtained sensitive KYC data on an undisclosed number of customers, described by a crypto security researcher as appearing targeted at high-net-worth users. Exposed data included full names, dates of birth, occupations, postal and email addresses, phone numbers, passport and driver's license images, facial verification selfies, IBANs, and full transaction histories including Bitcoin transactions. Revolut declined to name the government agency involved or specify affected markets, and did not explain why email domain authentication alone was sufficient to release such sensitive data. On September 14, 2026, the attackers began publicly leaking customer data and threatened to release more daily until paid, escalating from theft to extortion.

In mid-August 2026, Revolut circulated a proposal to shareholders to increase co-founder and CEO Nik Storonsky's personal borrowing limit against his roughly 29% stake (worth an estimated $33 billion at the company's $115 billion valuation) from $50 million to $250 million. The proposal, internally codenamed 'Project Shasta,' would also remove the existing requirement for board approval of larger share pledges, eliminate proportional limits on how much stock can be pledged as collateral, and expand the share classes eligible to be pledged. Storonsky is the only person at Revolut to whom the pledge provisions apply. Revolut said it 'routinely updates its articles' to reflect the company's growth; governance commentators noted the removal of board approval and proportional limits was the more significant change, particularly given Storonsky simultaneously serves as CEO.

On April 2, 2026, Italy's AGCM fined Revolut EUR 11.5M across three violations: EUR 5M for failing to disclose costs and limitations of 'commission-free' fractional share investments; EUR 5M for aggressive practices in suspending/blocking customer payment accounts; and EUR 1.5M for inadequate information during Lithuanian-to-Italian IBAN migration. Revolut stated it 'strongly disagrees' and plans to appeal.

Revolut's full UK banking license, conditionally granted in July 2024, was delayed well beyond the typical 12-month mobilization period. The PRA and FCA expressed concerns about risk management systems, anti-money laundering controls, and cross-border payments compliance across Revolut's 40 markets. UK customers remain without FSCS deposit protection (limited to £50,000 holdings). Co-founder Nik Storonsky admitted it was 'a mistake' to prioritize growth over licensing. Revolut also topped UK fraud complaint rankings for the second consecutive year.

Bank of Lithuania imposed €3.5 million fine, the largest ever from the Lithuanian regulator, after finding Revolut failed to adequately monitor customer relationships and transactions, 'not always properly identifying suspicious monetary operations or transactions.' The fine represented less than 0.5% of 2023 revenue. No confirmed money laundering was detected during investigation, but systematic monitoring deficiencies were identified.

Revolut was fined a record €3.5 million by Lithuania's central bank for failures in anti-money laundering processes. Regulatory authorities found the neobank failed to implement adequate controls to prevent money laundering. This was the highest AML-related fine ever issued in Lithuania. Revolut has faced persistent compliance and fraud concerns.

BBC Panorama investigation October 2024 found Revolut named in 10,000 fraud reports in 2023 - 2,000 more than Barclays and double Monzo. Payment Systems Regulator data showed for every £1M paid into Revolut accounts, £756 was from APP fraud - more than 10× the amount flowing through Barclays. Financial Ombudsman received 3,500 complaints about Revolut in 2023, more than any similar company. Notable case: customer lost £165K after criminals bypassed selfie verification, took 23 minutes to reach right department to freeze account, during which £67K more stolen. Former employee told BBC: 'Protecting Revolut from being used for financial crime always played second fiddle to the desire to launch new products.'

Multiple investigations and employee accounts document toxic work culture at Revolut, including 13-hour workdays, weekend work expectations, and high staff turnover. One employee reported: 'I left because I ended up having mental health problems... daily panic attacks... ended up in hospital.' The CEO's 'get shit done' culture has reportedly driven employees out. Company hired psychologists and created new teams to address culture.

Malicious actors exploited flaw in Revolut's payment systems stealing over $20 million in early 2022. Fault stemmed from discrepancies between US and European systems, causing funds to be erroneously refunded using Revolut's own money when transactions were declined. Problem first detected late 2021, but organized criminal groups leveraged loophole by encouraging individuals to make expensive purchases that would be declined. Total $23 million stolen, with some funds recovered.

Between founding and 2026, 28,400 employees left Revolut - more than double current workforce of 12,900. 50% of hires leave or are fired within 6 months, with average tenure around 6 months. CEO Nik Storonsky promotes 'evaluate people accurately, not kindly' philosophy. Office featured 'Get Sh*t Done' sign. 2019 Wired exposé found evidence of unpaid work, high staff turnover, employees working weekends to meet performance indicators. Employee reviews describe 'toxic culture,' unrealistic KPIs set by untrained managers, constant fear of not meeting targets.