Revolut’s UK Banking Licence Snag: New Risk Rules for Fintechs

The Financial Times reports that Revolut’s bid for a full UK banking licence is being held up because the Prudential Regulation Authority (PRA) wants stronger assurance that the company’s group-wide risk management can scale with its rapid international expansion—covering AML/CFT, IT/operational resilience, capital planning and group transparency.

The PRA’s new line of inquiry focuses on whether Revolut’s centralised risk frameworks are adequate to manage its rapid international growth and its 65 million-strong global customer base. This case is rapidly becoming the new benchmark for EMI risk compliance and a crucial case study for any fintech with international ambitions.

The New Regulatory Focus: Global Consistency, Local Adaptation

Revolut has been operating in the UK under an EMI licence and is currently in a restricted “mobilisation phase” for its banking licence, allowing it to take limited deposits. The ultimate goal is a full licence, which would unlock the ability to offer regulated lending (like loans and credit cards) and provide fully insured deposits under the Financial Services Compensation Scheme (FSCS).

However, the PRA has now put the brakes on this final step, demanding more information on several key global functions:

Global AML Systems: Can the company’s anti-money laundering and financial crime controls effectively monitor transactions across dozens of countries simultaneously?
IT Infrastructure: Is the core technology stack robust and secure enough to support a global, cross-border banking group?
Capital Adequacy: How does capital flow within the group, and are the mechanisms sufficient to protect the UK entity from risks originating elsewhere?
Group Structure & Transparency: This appears to be the central issue. Regulators are demanding a crystal-clear understanding of the relationship between the UK-licenced entity and its parent company, as well as its other international subsidiaries (like its EU-licenced entity in Lithuania).

The PRA is no longer content to regulate a siloed UK entity. It is now assessing the total risk profile of the global group, demanding a framework that is both globally consistent and locally compliant.

Why This Matters: The UK as a Global Bellwether

The UK’s regulatory stance is a bellwether for global financial regulation. The PRA’s tough new standard for a cross-border EMI/bank licence will undoubtedly influence regulatory attitudes worldwide. For fintechs, underestimating this new depth of scrutiny presents clear and present dangers:

Prolonged Licence Delays: Revolut first applied for its licence in 2021. This extended timeline is becoming the new normal, freezing strategic plans.
Spiralling Costs: Every month of delay adds significant legal, advisory, and remediation costs, draining resources that could be spent on growth.
Missed Market Windows: While an applicant is stalled in regulatory negotiations, more agile or better-prepared competitors can capture critical market share.

The message is clear: the old fintech mantra of “launch fast and patch later” is definitively dead when it comes to banking.

Strategic Next Steps for Fintech and EMI Leaders

Revolut’s experience provides a critical roadmap for other financial technology firms. Any company seeking a UK banking licence—or any other Tier-1 licence—must now proactively address these global concerns.

Conduct a Global Risk Self-Audit: Before you even submit an application, rigorously assess your global risk and compliance frameworks. Can you demonstrate to the PRA, with data, that your AML, IT, and capital management systems are integrated, scalable, and effective across all your markets?
Prioritise Group Governance Transparency: Map your entire corporate structure. Be prepared to explain every inter-company transaction, data-sharing agreement, and risk-sharing mechanism. Ambiguity is your worst enemy.
Update Your Licensing Strategy: Re-engage with legal and regulatory counsel. Does a “UK-first” strategy still make sense, or should you pursue parallel licences to de-risk your expansion?
Consider “Plan B” Jurisdictions: The high bar in the UK may mean that securing licences in other key markets (such as within the EU or Singapore) should be considered as part of a diversified, strategic regulatory footprint.

Ultimately, the Revolut case demonstrates that regulatory approval is no longer just a technical, “check-the-box” exercise. It is a profound test of a firm’s maturity, transparency, and its ability to manage the complex risks of a global financial operation.