Revolut could give you 100 reasons why it’s ‘the future of money’ if you believe its marketing hype, but is this fintech a safe pair of hands for your savings?
Co-founded in 2015 by its chief executive Nikolay Storonsky, a former City trader, and chief technology officer Vladyslav Yatsenko, Revolut started life as a prepaid card focused on cheap currency exchange.
Today, it boasts over eight million UK current account customers and has declared its intention to become a financial ‘super app’. You can already use it to buy cryptocurrency, invest in stocks and even book holiday tours.
But it’s also drawn attention for the wrong reasons this year, led by Which? issuing an account takeover warning in March and publishing exclusive data on fraud complaints a month later.
Revolut usually gets lumped in with other digital banking brands, like Starling and Monzo, but there’s a crucial difference – it’s an electronic money institution (EMI), not a bank.
Why doesn’t Revolut have a banking licence?
A UK banking licence came easily enough for its rivals. Starling and Monzo got theirs in 2016 and 2017, respectively, within little more than a year of their applications.
Revolut has been left dangling for more than three years, despite claiming to be ‘in the advanced stages’ of its application in its 2021 annual report.
Without a banking licence, it can’t offer credit products or hold customer deposits – two of the most profitable revenue streams for banks – though this didn’t stop Revolut recording its first full year of profitability in 2021.
Perhaps more importantly, a banking licence also builds trust and Revolut may struggle to convince the wider public to use it as their primary account without one.
It does hold a banking licence in Europe (granted by the Bank of Lithuania) which works as a passport allowing it to offer full banking services, but a UK licence has proved elusive.
There’s speculation as to why it has been denied one for so long, but it’s fair to say its reputation has taken a beating.
In 2019, a BBC investigation revealed that an ex-employee had approached the Financial Conduct Authority (FCA) with concerns about its anti-money laundering processes in 2016. Only a few months later, a Telegraph report alleged that Revolut had switched off an automated system designed to block suspicious transactions, on the same day that a Wired article accused it of having a toxic work culture.
It later attracted media coverage for missing deadlines to file its financial accounts and for IT issues preventing its independent auditor from analysing these accounts.
- July 2015 – Revolut founded in London
- December 2018 – granted ‘specialised’ banking licence by Bank of Lithuania to accept deposits and offer loans to European customers (but not investments)
- April 2019 – BBC says whistleblower raised anti-money laundering concerns in 2016
- February 2019 – Telegraph alleges automated system designed to block suspicious transactions was switched off and Wired cites toxic work environment
- September 2020 – Which? slams Revolut for failing fraud victims
- January 2021 – applies for UK banking licence
- December 2021 – granted full EU banking licence
- March 2022 – Bank of Lithuania fines Revolut group €200k for breaches related to prevention of money laundering
- September 2022 – misses deadline for filing accounts
- March 2023 – auditor raises concerns over accuracy of £477m in revenue due to IT issues
- September 2023 – misses deadline for filing accounts
- October 2023 – FT says Revolut ‘in talks’ with regulator about alleged failures to stop transfers of £1.7m from suspicious accounts though Revolut claims only £500k
- March 2024 – Which? issues warning about Revolut account takeover fraud
- April 2024 – Which? reveals Revolut fraud complaints outstrip all banks
Are Revolut customers happy?
Every year, Which? surveys thousands of customers to find out how satisfied they are with the financial firms they use.
Revolut users are largely positive. It’s never had a customer score below 70%, a rating based on overall satisfaction with the brand and how likely users are to recommend that brand to a friend. And while its customer service star rating fell from four to three stars in our last survey, it was awarded a five-star rating for its application process and a four-star rating for its mobile app.
But this isn’t enough to be endorsed by Which?.
We can only recommend providers with both excellent service and appropriate consumer protections – Revolut customers don’t benefit from the Financial Services Compensation Scheme (this protects your cash up to £85,000 if a regulated firm goes bust) or bank transfer fraud protection under the Contingent Reimbursement Model (CRM) Code.
Revolut won’t be eligible to become a Which? Recommended Provider until it finally has that coveted UK banking licence and can offer customers these important safety nets.
- Find out more: best banks for 2024, rated by thousands of customers
Does Revolut treat fraud victims unfairly?
More pressing is a growing unease about the way it treats fraud victims.
Which? was first to sound the alarm about a spate of account takeover attacks on Revolut business customers. Not one of the victims we spoke to was reimbursed despite having their accounts drained in minutes. We then published data from the Financial Ombudsman Service (FOS) that revealed Revolut fraud complaints in 2023 outstripped all banks.
This isn’t the first time Which? has criticised Revolut for its fraud-handling practices. In September 2020, we spoke to eight victims who had called the same fake Revolut helpline advertised on Google.
Four of the people who came to us for help said that they were first convinced by the impersonators to transfer money from their main bank accounts to Revolut.
Despite failing to spot highly unusual transactions and the use of remote access software to access their accounts on devices being controlled by fraudsters, Revolut initially refused to refund them.
We told victims to stand their ground and it eventually reviewed its APP procedures, offering full refunds in all but one fraud case Which? shared.
Which? banking expert Chiara Cavaglieri
‘I’ve long had a nagging feeling about how often I speak to fraud victims who are tricked into moving money from their high street bank accounts to Revolut first, rather than directly to the fraudsters’ accounts.
The obvious question is…why?
Could it be that criminals think an e-money firm like Revolut is less likely to spot and stop dodgy transfers? Perhaps they prefer to shift money away from bigger banks that are more likely to block transfers to cryptocurrency exchanges, international accounts and other less traceable systems?
Either way, criminal gangs can’t be allowed to abuse our banking systems at will and victims targeted by slick scams shouldn’t be expected to pay the price when they do.’
What about other e-money firms?
Revolut isn’t the only electronic money institution (EMI) that has come under scrutiny when it comes to fraud.
Data published by the Payment Systems Regulator (PSR) reveals that many newer and smaller payment firms receive disproportionately higher rates of cash from authorised push payment (APP) fraud than larger, more established banks.
Receiving accounts can include money mules (those who let criminals use their account for money laundering) or accounts that have been taken over by a fraudster.
The two firms that received the most fraudulent payments in 2022 – Clear Junction and BCB Payments – both offer account services to other financial institutions and regulated companies (not to individual consumers).
Others, such as PrePay Technologies (the e-money firm behind brands such as Monese), Revolut and Wise, do provide services to personal customers directly and all three were far more exposed than even the worst of the big banks (Metro Bank and TSB).
Payment Systems Regulator data showing the top 20 receivers of fraud by absolute value in the UK in 2022, per million pounds of transactions. For example, for every £1 million received at Clear Junction, £10,335 of it was APP fraud.
Is my money safer with a bank?
Strictly speaking, the term ‘bank’ should never be attributed to Revolut in the UK, despite the prevalence of catchy monikers like ‘neobank’ and ‘challenger bank’ applied liberally to any fintech.
Banks are subject to more stringent capital requirements and generally face more intensive regulatory supervision. But what are the other key differences between an EMI and a bank?
What does it mean if my money is ‘safeguarded’?
Safeguarding means EMIs must either: ring-fence funds from customers with an authorised credit institution such as a bank; invest them in low-risk, liquid assets held with an authorised custodian; or ensure that funds are covered by an insurance policy or comparable guarantee.
So if your money is ring-fenced, in an account or assets that Revolut can’t touch, is there any reason to think of it as a riskier home for your money?
The short answer is yes.
In 2021, the FCA issued a public letter to EMIs asking them to write to their customers to ‘make it clear how their money is protected’ due to concerns that many firms were failing to adequately disclose the differences.
For bank customers, the FSCS is an independent statutory organisation that protects up to £85,000 per institution if it were to go bust. Though where multiple banks share a banking licence (eg Halifax and Lloyds Bank), they are treated as one.
If an EMI goes out of business, it could take much longer for you to get your money back and you may not get it all back, as you may incur administrative costs deducted by the administrator or liquidator.
- Find out more: how are your savings protected?
Does e-money have weaker consumer protections?
Many of the most significant consumer protections are enshrined in the Payment Services Regulations (PSRs) and both banks and EMIs follow these.
The PSRs establish your rights to a refund in cases of unauthorised transactions and place legal requirements on payment providers to use strong customer authentication to reduce the risk of fraud.
Both EMIs and banks must also implement the new Consumer Duty, aimed at raising the standard of care for all customers across financial services.
However, it’s only since August 2019 that certain FCA rules have applied to e-money firms (its Principles for Businesses and chapter two of its Conduct of Business sourcebook) meaning that they could be fined for failures related to safeguarding deposits and combating financial crime.
It’s also worth noting that well-established codes of practice don’t always apply to EMIs. For example, the Banking Protocol – where bank staff are trained to contact the police if they think a customer is being scammed – only applies to banks and building societies.
- Find out more: what is strong customer authentication?
What does Revolut say?
A Revolut spokesperson told Which?:
‘Revolut takes fraud and the industry-wide risk of customers being coerced by organised criminals, incredibly seriously. We have robust protections in place for our millions of customers and analyse over half a billion transactions a month.
‘Our security features include AI models, over 4,000 trained anti-financial crime professionals as well as experienced data scientists. We are also constantly building on our existing protections, recently announcing the launch of Wealth Protection, a new biometric identification feature designed to prevent thieves from accessing customer savings within the Revolut app.
‘In 2023, we cut the number of fraudulent transactions in the UK through Revolut by over 20%, in addition to preventing over £475m of potential fraud losses to our customers globally. This, despite more than a million new customers joining Revolut every month.’
Revolut also wanted to address some of its historical controversies.
On the 2019 reports of money laundering failures by the BBC and the Telegraph, it referred to trial of a new sanctions screening system in July 2018 but stated explicitly that ‘at no point did Revolut stop checking transactions for sanctions compliance. Nor was there any failure in our sanctions screening procedures.’
On accusations that it had a toxic work culture in 2019, it explained that the firm has grown to employ 10,000 globally and was certified a ‘Great Place to Work’ across eight of its markets, including the UK.
It said the €200k fine by the Bank of Lithuania in 2022 related to a ‘small number of Brexit-related procedural discrepancies’ in its internal processes, which have since been fixed.
Revolut has now returned to a regular reporting schedule for filing its accounts, having fixed the issues that caused delays for the past two years. Its auditor has confirmed that its 2022 financial statements ‘give a true and fair view’.
On the more recent FT report related to transfers of £1.7m from suspicious accounts, Revolut added: ‘As a global financial institution, we work closely with regulators around the world, ensuring that we maintain strong governance and compliance practices across our business.’
So should you avoid using Revolut?
Customers seem happy with its service overall – indeed some are almost evangelical – but here at Which?, we can’t recommend putting significant sums in a Revolut account.
We want it to have a better handle on fraud prevention and to treat customers who lose their savings to sophisticated scammers fairly.
Revolut says it treats each fraud case individually but common themes emerge when we talk to victims. They tell us they feel ignored and that they’ve lost faith they can rely on its support, even in cases where fraudsters have managed to fool Revolut.
Eye-catching features and a snazzy app are no use if your provider lets you down when you need it most.
