Bank of England Probes Revolut's Breakneck Product Machine

By Daniel Rao

For a decade, Revolut's superpower was speed. Small teams, given a target and left alone, shipped product after product — currency exchange, crypto trading, savings, subscriptions, share dealing — faster than any traditional bank could hold a committee meeting about them. It built Europe's most valuable startup. Now that same speed is the subject of a formal regulatory investigation, and the timing is, by any measure, exquisite. The Bank of England ordered a review of Revolut's product-approval process in the very month it finally handed the company its full UK banking licence — and then, this week, Revolut launched its first loans.

According to the Financial Times, reporting on Tuesday 27 October, the Bank of England's Prudential Regulation Authority (PRA) issued a section 166 order against Revolut earlier this year, around the time the company received its long-awaited full UK banking licence in March. The order requires the company to appoint expert advisers to examine its internal systems and controls, with a focus on the risks created by the pace at which it launches new financial products. Both Revolut and the Bank of England declined to comment when approached by PYMNTS, which carried the FT's reporting.

That silence is worth noting, because a section 166 order is not a parking ticket. It is one of the sharper tools in a British regulator's drawer, and it arrives at a moment when Revolut is finally doing the thing it spent five years fighting for: becoming a real bank, in its home market, with deposits, lending and all the scrutiny that comes with them.

Photo: Canary Wharf, London, where Revolut is headquartered and where HSBC and other high-street banks are based. This is a file photo of London's banking district, not a photograph of Revolut's offices or of the regulatory review. Credit: Gordon Joly, via Wikimedia Commons (CC BY-SA 3.0).

What the Bank of England actually ordered

A section 166 order, known in the industry as a "skilled person" review, compels a regulated firm to hire outside experts — typically a firm of accountants or lawyers — to investigate a specific area of its business and report back with recommendations. It is an evidence-gathering exercise, not a punishment. But it is not routine either: the regulator chooses the question, the firm pays for the answer, and if the review turns up rule breaches, the PRA can follow it with enforcement action, including fines.

What exactly the PRA asked the reviewers to look at has not been made public. The FT's reporting, citing people familiar with the matter, says the order was designed to test the strength of Revolut's internal systems as it launches products at speed. Neither the firm conducting the review nor the products in scope have been named in the reporting so far, and no finding of any breach has been reported. That distinction matters and we will keep it in view throughout: a review is not a verdict.

The order reportedly landed around March 2026, when the PRA lifted the restrictions on Revolut's banking licence. Revolut Bank UK Ltd launched on 11 March 2026, after completing the mobilisation phase that followed its restricted licence in July 2024, and began rolling out banking services gradually to its 13 million UK customers at the time. The licence had been a five-year pursuit — Revolut first applied in 2021 — and its final stages were repeatedly delayed over regulators' concerns about whether the company's risk controls could keep up with its growth. In October 2025, the FT reported that British authorities had put the full licence on hold for exactly that reason.

So the sequence, as reported, is striking: the licence was held up over risk controls, then granted, and at roughly the same moment the regulator commissioned an independent examination of the product-approval controls. To a regulator, that is consistency. To Revolut, it must feel like being handed the keys and the inspection notice in the same envelope.

Why "self-guided missiles" worry a regulator

The cultural detail at the heart of this story is one phrase. The FT notes that chief executive Nik Storonsky tells his teams to act like "self-guided missiles" — small, semi-autonomous units that develop and launch products with little central oversight. It is a vivid management philosophy, and for years it worked brilliantly as a growth strategy. Revolut credits its "new bets" programme — small teams building products semi-autonomously — with a portfolio that now includes 11 products each generating more than £100 million in revenue in 2025, according to FStech's account of the FT's reporting.

But a bank is not a software company, and that is the whole tension. A missed bug in a messaging app is an embarrassment; a missed control in a lending product is a mis-sold loan, a breached limit, or a compliance failure affecting millions of customers. Regulators do not object to speed in the abstract. They object to speed without a paper trail — without evidence that someone senior, independent of the team that built the product, asked the awkward questions before launch: what happens if this goes wrong, who bears the loss, and does the board understand the risk?

We compared the FT's account as carried by PYMNTS, FStech, Dealroom and KuCoin, and all four agree on the core facts: the section 166 order, its timing around the March licence, its focus on product-approval speed, and the possibility of enforcement if failures are found. Where they differ is only in emphasis — which is reassuring, because a story resting on unnamed sources deserves exactly that kind of cross-checking before it is repeated as fact.

This is the second regulator to ask the same question

What elevates this from a routine supervisory matter to a genuinely significant story is that the PRA is not the first regulator to go here. Last year, the European Central Bank temporarily curbed Revolut's ability to launch new products in the European Economic Area after identifying what it called "deficiencies" in the company's product-approval processes, and ordered an independent review of the risk, compliance and legal functions behind new product launches in Europe. The ECB's action applied to Revolut Bank UAB, the group's European entity, and its board was informed in July 2025.

Revolut's response to the European matter, given to WealthBriefing, was measured: "We are in continuous and constructive dialogue with our regulators, including the European Central Bank, as part of our normal course of operations as a fully licensed bank." The company added that it is "committed to the highest standards of governance and risk management" and regularly strengthens its internal controls. That is the kind of sentence companies issue when they cannot say more — and, to be fair, it is also the kind of sentence that is often true.

Still, step back and look at the pattern. Two of the world's most important financial regulators, on two separate tracks, have now independently questioned the same thing: whether the controls governing Revolut's product launches keep pace with its launch speed. That is no longer a story about one supervisor's quirk. It is a story about the defining tension of the fintech era — a company built to move like a startup now being supervised like the bank it has become.

The timing could hardly be worse — or more revealing

The review reportedly began just as Revolut's UK bank started life, and it is still the backdrop as the company fires its starting gun on lending. On Monday 26 October, Revolut began offering unsecured personal loans in Britain — from £2,000 to £25,000 — alongside a partnership with asset manager Carne that will let clients invest in privately held technology companies. We covered the loan launch in detail in our report on Revolut's £25,000 loans and its bid to storm Britain's banks; what the PRA story adds is the other half of that picture. Loans are the first product the hard-won licence unlocks, and they are precisely the kind of product — credit decisions, affordability checks, arrears handling — where approval controls matter most.

Revolut's UK chief Francesca Carlesi has described London as the obvious home for that ambition, saying on the company's blog: "London and the UK has proven to be a country that's very stable, a great combination of talent, capital, and technology. It was obvious." She added that "this combination, the new headquarters plus the banking licence, has elevated where Revolut sits within the overall financial services environment." That elevation is exactly what the PRA review now tests.

The commercial stakes are enormous. Revolut now counts more than 80 million customers worldwide, according to the FT, and is valued at $115 billion — a figure that prices in a future in which it becomes its customers' main bank, not just their travel-money app. Its 2025 results, reported alongside the probe, show revenue of $6.0 billion, up 46 per cent on the previous year, and pre-tax profit up 57 per cent to $2.3 billion. It aims to operate in 70 countries by 2030, up from 40 today. None of that is threatened by a review. All of it is shaped by what the review concludes.

There is also a transatlantic dimension worth watching. Revolut received preliminary approval for a national banking licence in the United States in September 2026, and Storonsky has said that if the company lists its shares, it would favour a primary listing in America. US regulators will read the PRA's review closely. A clean bill of health would smooth that path; a finding of systemic approval failures would complicate it.

What happens next — and what it means for customers

For Revolut's customers, the honest answer is: very little, for now. A section 166 review does not freeze products, does not touch deposits, and does not imply that anything you hold with Revolut is unsafe. Its practical weight will depend entirely on what the skilled persons find. If they find controls that are adequate but need tightening, the outcome will be a remediation plan and life goes on. If they find failures, the PRA can move to enforcement — and that is when fines, restrictions or mandated changes enter the picture.

The more interesting question is what it does to Revolut's launch cadence. If the review recommends stronger gates — mandatory independent sign-off, board-level assessment of capital and liquidity impact before launch, better-staffed approval teams — then the "self-guided missile" model gets a guidance system fitted, and launches slow down. That would be a cultural change as much as a procedural one, and it would land hardest on exactly the products Revolut is pushing now: lending, credit cards, and the private-markets investing it announced this week.

Watch, too, for what is not said. If months pass with no announcement, that most likely means the review is proceeding quietly and finding nothing dramatic. If Revolut suddenly announces a strengthened product-governance framework or a senior risk hire, read it as the review's shadow. Regulators rarely need to shout when the supervised firm starts moving on its own.

It is also worth placing this in the wider British banking week. The incumbents Revolut is hunting are themselves being reshaped by technology: Barclays is cutting 5,000 jobs, including the developers building its AI systems, as it tries to slim down and automate. And the fragility of the infrastructure everyone now depends on was laid bare days ago, when a Google Cloud outage knocked out bank cards, courts and NHS-linked services across London. British finance is being rebuilt in real time — by fintechs, by AI, and by the cloud — and the regulators are racing to keep the rulebook attached to the machine.

Our read: speed was the pitch. Now it is the problem.

Here is where we plant our flag. Revolut earned its valuation by refusing to behave like a bank, and the PRA's review is, in effect, the bill for that refusal coming due. That is not a criticism of the company so much as a description of its moment: every fintech that grows up eventually meets the regulator that asks it to prove, in documents rather than demos, that it knows what it is doing. Revolut's meeting has arrived, and it has arrived twice — in Frankfurt and in London.

None of this makes Revolut a bad bank. Its results are genuinely strong, its licence was genuinely hard-won, and a review that finds nothing would be the best possible advertisement for its controls. But the "self-guided missiles" era, as a management philosophy, is over whether Storonsky likes it or not. A company with 80 million customers and a banking licence cannot launch products on the honour system. The question the PRA is really asking is not whether Revolut moves fast — it does, and that is its genius — but whether anyone is steering. The answer to that question will decide how fast Revolut is allowed to move from here, and the whole fintech industry will be reading it.

Sources: Financial Times reporting via PYMNTS (27 October 2026); FStech; Dealroom News; KuCoin News; WealthBriefingAsia; The Irish Times via EL7.AI. Quotes attributed to named speakers and outlets in the body. The section 166 order and its scope are as reported by the FT, citing unnamed sources; neither Revolut nor the Bank of England has commented publicly.

Daniel Rao covers AI, cybersecurity and US tech policy for TechPulse USA. He writes about the intersection of artificial intelligence and national security.