Audit log

Every state-changing event for Revolut: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-13 12:35:14Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 446,704,279

   sig

   3tAVa3xPNv7q…qwHzD7FUcopyexplorer ↗

   hash

   E3sDpTasgARM…fY7geGiqcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (20663 B) ▸

   {"actor":"system:backfill","investigation_id":"260c60e0-0d1f-41de-aca6-259e3dd14f2a","kind":"publish","page_slug":"revolut","published_at":"2026-09-13T12:35:14.354Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Revolut","sections":[{"content":"In September 2026, Revolut confirmed that customer data — including full names, dates of birth, addresses, phone numbers, passport and driver's license copies, identity-verification selfies, IBANs, account statements, and complete transaction histories including Bitcoin activity — had been disclosed to an unauthorized third party. The attacker submitted a fraudulent data request that appeared to originate from a legitimate government agency's email domain and passed SPF, DKIM, and DMARC authentication checks, leading Revolut to treat it as a genuine law-enforcement or regulatory request. A Revolut spokesperson described the episode as 'a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information,' stating that a 'limited' number of customers were affected, that the email address had been blocked, and that the impersonated agency, law enforcement, and regulators had been notified. Revolut said its systems and customer funds were not affected and that passwords, card PINs, and cryptocurrency private keys were not exposed. The company declined to disclose the number of affected customers, their geographic location, or which government agency's domain was impersonated. Blockchain investigator ZachXBT publicized the breach and said it appeared to target high-net-worth users, raising concerns about so-called 'wrench attacks' — physical coercion of individuals whose crypto wealth has been linked to a real-world identity or address.","heading":"September 2026 Data Breach: Bitcoin Histories and KYC Data Exposed via Fake Government Request","severity":"high","sources":[{"credibility":2,"name":"The Block: Revolut says customer KYC, Bitcoin transaction data exposed after fake request from gov't domain","type":"news_article","url":"https://www.theblock.co/news/business/2026-09-12-revolut-says-customer-kyc-bitcoin-transaction-data-exposed-after-fake-request-from-govt-domain-414516"},{"credibility":2,"name":"CoinDesk: Bitcoin activity, passports exposed after Revolut falls for fake government request","type":"news_article","url":"https://www.coindesk.com/tech/2026/09/12/bitcoin-activity-passports-exposed-after-revolut-falls-for-fake-government-request"},{"credibility":2,"name":"Decrypt: Revolut Leaks Passports, Bitcoin Transaction Histories to Fake Government Request","type":"news_article","url":"https://decrypt.co/378114/revolut-passports-bitcoin-activity-data-breach"},{"credibility":2,"name":"Security Affairs: Revolut Exposed KYC Data After Fraudulent Government Email Passed Security Checks","type":"news_article","url":"https://securityaffairs.com/198922/data-breach/revolut-exposed-kyc-data-after-fraudulent-government-email-passed-security-checks.html"}]},{"content":"On 8 April 2025, the Bank of Lithuania, which supervises Revolut's EU banking entity (Revolut Bank UAB), fined the company €3.5 million following a scheduled inspection. Regulators found that Revolut had failed to adequately monitor certain business relationships and transactions and did not always correctly identify suspicious financial activity by clients, though the inspection did not identify confirmed instances of money laundering. This was described as the largest AML-related penalty ever imposed by Lithuania's central bank. Revolut reportedly sought an administrative agreement with the regulator in response to the findings. The fine represented roughly 0.38% of the annual revenue of Revolut's parent European entity, well below the statutory maximum of 10% allowed under Lithuanian AML law.","heading":"Lithuania AML Fine (2025)","severity":"medium","sources":[{"credibility":1,"name":"Irish Times: Revolut fined €3.5m by over money laundering control failures","type":"news_article","url":"https://www.irishtimes.com/business/2025/04/08/revolut-fined-35m-by-over-money-laundering-control-failures/"},{"credibility":2,"name":"Paperjam: Revolut agrees to €3.5m fine over AML shortcomings in Lithuania","type":"news_article","url":"https://en.paperjam.lu/article/revolut-agrees-to-eu3-5m-fine-over-aml-shortcomings-in-lithuania"},{"credibility":2,"name":"FinTech Futures: Revolut fined by Lithuania's central bank for violations of money laundering prevention requirements","type":"news_article","url":"https://www.fintechfutures.com/regulatory-actions/revolut-fined-by-lithuanias-central-bank"}]},{"content":"In 2023, the UK's Financial Conduct Authority (FCA) and National Crime Agency (NCA) examined whether Revolut had improperly allowed payments out of accounts that the NCA had flagged as suspicious for potential links to money laundering or other financial crime. Sources cited by the Financial Times alleged that up to £1.7 million was released from flagged accounts between July and August of that year, while Revolut told the FCA that only around £500,000 had been released — a discrepancy that drew further scrutiny. No enforcement outcome or penalty tied specifically to this episode has been independently verified in subsequent reporting; it is presented here as an alleged, disputed account pending any formal regulatory conclusion.","heading":"UK FCA/NCA Scrutiny Over Payouts From Flagged Accounts (2023)","severity":"medium","sources":[{"credibility":2,"name":"AML Intelligence: FCA and NCA probe how Revolut paid out up to £1.7M from flagged accounts over summer","type":"news_article","url":"https://www.amlintelligence.com/2023/09/news-fca-and-nca-probe-how-revolut-paid-out-up-to-1-7m-from-flagged-accounts-over-summer/"},{"credibility":2,"name":"FStech: FCA investigating Revolut over transactions from 'suspicious' accounts","type":"news_article","url":"https://www.fstech.co.uk/fst/FCA_Investigating_Revolut_Over_Transactions_From_Suspicious_Accounts.php"}]},{"content":"A BBC Panorama investigation, using Freedom of Information requests to Action Fraud, found that Revolut was named in nearly 10,000 fraud complaints over a one-year period — more than any other major UK bank, roughly 2,000 more than Barclays and more than double the complaints against fintech rival Monzo over the same period. The investigation also reported that one Revolut customer had £165,000 stolen from a business account after being tricked into authorizing payments to fraudulent accounts, and noted that Revolut lacked a dedicated telephone fraud helpline, offering only in-app chat support at the time. Consumer group Which? has separately and repeatedly reported that Revolut records the highest number of fraud and scam complaints escalated to the UK's Financial Ombudsman Service among banks it tracks. These figures concern Revolut's broader payments business rather than its crypto product specifically, but are relevant to assessing the platform's overall fraud-control posture, which is also implicated in crypto-related social-engineering scams that use Revolut accounts as a payment rail.","heading":"Fraud Complaint Volume (UK)","severity":"medium","sources":[{"credibility":1,"name":"UKTN: Revolut 'named in more fraud complaints than any major UK bank', investigation finds","type":"news_article","url":"https://www.uktech.news/news/revolut-named-in-more-fraud-complaints-than-any-major-uk-bank-investigation-finds-20241014"},{"credibility":2,"name":"Which?: Revolut still the worst UK firm for fraud complaints, warns Which?","type":"news_article","url":"https://www.which.co.uk/news/article/revolut-still-the-worst-uk-firm-for-fraud-complaints-warns-which-axqr43W94wLn"},{"credibility":2,"name":"Yahoo Finance UK: Revolut named in more fraud complaints than any major UK bank, report finds","type":"news_article","url":"https://uk.finance.yahoo.com/news/revolut-named-more-fraud-complaints-112820922.html"}]},{"content":"Revolut has repeatedly suspended crypto services in specific jurisdictions with short notice as local regulation shifted, leaving customers to liquidate or transfer holdings on tight deadlines. In the United States, Revolut told customers in mid-2023 it would stop accepting new crypto buy orders as of September 2 and would disable all access to its crypto platform by October 3, 2023, automatically liquidating any remaining customer holdings at market price, citing 'the evolving regulatory environment' in the US. In Hungary, following the country's move to impose criminal penalties (up to eight years' imprisonment) for unlicensed crypto activity, Revolut withdrew crypto services from Hungarian customers, setting a deadline of 18 December 2025 for users to sell or transfer their holdings before balances would be automatically liquidated and accounts closed; some staking balances were force-unstaked on 10 December 2025. While these actions were framed by Revolut as compliance measures rather than misconduct, they illustrate a recurring pattern in which Revolut customers' access to and control over crypto holdings can be abruptly curtailed by unilateral company decisions tied to regulatory risk in a given market.","heading":"Abrupt Crypto Service Withdrawals in Response to Regulatory Change (US, Hungary)","severity":"medium","sources":[{"credibility":2,"name":"Benzinga: Revolut pulls plug on crypto trading in US, blames changing regulatory climate","type":"news_article","url":"https://www.benzinga.com/markets/cryptocurrency/23/08/33573644/revolut-pulls-plug-on-crypto-trading-in-us-blames-changing-regulatory-climate"},{"credibility":1,"name":"Fortune: Revolut US market withdrawal amid regulatory uncertainty","type":"news_article","url":"https://fortune.com/crypto/2023/08/04/revolut-us-market-withdrawal-regulatory-uncertainty"},{"credibility":2,"name":"Budapest Business Journal: Revolut to Withdraw Crypto Services From Hungary","type":"news_article","url":"https://bbj.hu/business/tech/fintech/revolut-to-withdraw-crypto-services-from-hungary/"},{"credibility":1,"name":"Revolut Help Center: Crypto services stopping in Hungary","type":"official","url":"https://help.revolut.com/en-HU/help/crypto/question-crypto-hungary-pausing-services-retail/"}]},{"content":"Revolut's crypto operations are not unlicensed or clandestine. Revolut's crypto entity, Revolut Digital Assets Europe Ltd, holds a Crypto-Asset Service Provider (CASP) license (License No. 001/2025) from the Cyprus Securities and Exchange Commission under the EU's Markets in Crypto-Assets (MiCA) regulation, granted around October 23, 2025, allowing regulated crypto services across the European Economic Area. Revolut also issues a euro-denominated stablecoin, EURR, under this regulatory framework, and separately holds UK and EU banking licenses. This regulatory footprint distinguishes Revolut from unregulated offshore crypto platforms, though licensing does not preclude the AML, fraud-complaint, and data-security issues documented elsewhere in this report.","heading":"Regulatory Standing and Licensing (Mitigating Factor)","severity":"low","sources":[{"credibility":2,"name":"CoinDesk: Revolut Secures MiCA License in Cyprus, Expanding Regulated Crypto Services Across Europe","type":"news_article","url":"https://www.coindesk.com/policy/2025/10/23/revolut-secures-mica-license-in-cyprus-expanding-regulated-crypto-services-across-europe"},{"credibility":2,"name":"The Block: Revolut, Blockchain.com and Bitcoin app Relai score MiCA licenses with Plasma likely to follow","type":"news_article","url":"https://www.theblock.co/amp/post/375940/revolut-blockchain-com-and-bitcoin-app-relai-score-mica-licenses-with-plasma-likely-to-follow"}]}],"sources_used":[{"credibility":2,"name":"The Block: Revolut says customer KYC, Bitcoin transaction data exposed after fake request from gov't domain","type":"news_article","url":"https://www.theblock.co/news/business/2026-09-12-revolut-says-customer-kyc-bitcoin-transaction-data-exposed-after-fake-request-from-govt-domain-414516"},{"credibility":2,"name":"CoinDesk: Bitcoin activity, passports exposed after Revolut falls for fake government request","type":"news_article","url":"https://www.coindesk.com/tech/2026/09/12/bitcoin-activity-passports-exposed-after-revolut-falls-for-fake-government-request"},{"credibility":2,"name":"Decrypt: Revolut Leaks Passports, Bitcoin Transaction Histories to Fake Government Request","type":"news_article","url":"https://decrypt.co/378114/revolut-passports-bitcoin-activity-data-breach"},{"credibility":2,"name":"Security Affairs: Revolut Exposed KYC Data After Fraudulent Government Email Passed Security Checks","type":"news_article","url":"https://securityaffairs.com/198922/data-breach/revolut-exposed-kyc-data-after-fraudulent-government-email-passed-security-checks.html"},{"credibility":1,"name":"Irish Times: Revolut fined €3.5m by over money laundering control failures","type":"news_article","url":"https://www.irishtimes.com/business/2025/04/08/revolut-fined-35m-by-over-money-laundering-control-failures/"},{"credibility":2,"name":"Paperjam: Revolut agrees to €3.5m fine over AML shortcomings in Lithuania","type":"news_article","url":"https://en.paperjam.lu/article/revolut-agrees-to-eu3-5m-fine-over-aml-shortcomings-in-lithuania"},{"credibility":2,"name":"FinTech Futures: Revolut fined by Lithuania's central bank","type":"news_article","url":"https://www.fintechfutures.com/regulatory-actions/revolut-fined-by-lithuanias-central-bank"},{"credibility":2,"name":"AML Intelligence: FCA and NCA probe how Revolut paid out up to £1.7M from flagged accounts over summer","type":"news_article","url":"https://www.amlintelligence.com/2023/09/news-fca-and-nca-probe-how-revolut-paid-out-up-to-1-7m-from-flagged-accounts-over-summer/"},{"credibility":2,"name":"FStech: FCA investigating Revolut over transactions from 'suspicious' accounts","type":"news_article","url":"https://www.fstech.co.uk/fst/FCA_Investigating_Revolut_Over_Transactions_From_Suspicious_Accounts.php"},{"credibility":1,"name":"UKTN: Revolut 'named in more fraud complaints than any major UK bank', investigation finds","type":"news_article","url":"https://www.uktech.news/news/revolut-named-in-more-fraud-complaints-than-any-major-uk-bank-investigation-finds-20241014"},{"credibility":2,"name":"Which?: Revolut still the worst UK firm for fraud complaints, warns Which?","type":"news_article","url":"https://www.which.co.uk/news/article/revolut-still-the-worst-uk-firm-for-fraud-complaints-warns-which-axqr43W94wLn"},{"credibility":2,"name":"Yahoo Finance UK: Revolut named in more fraud complaints than any major UK bank, report finds","type":"news_article","url":"https://uk.finance.yahoo.com/news/revolut-named-more-fraud-complaints-112820922.html"},{"credibility":2,"name":"Benzinga: Revolut pulls plug on crypto trading in US, blames changing regulatory climate","type":"news_article","url":"https://www.benzinga.com/markets/cryptocurrency/23/08/33573644/revolut-pulls-plug-on-crypto-trading-in-us-blames-changing-regulatory-climate"},{"credibility":1,"name":"Fortune: Revolut US market withdrawal amid regulatory uncertainty","type":"news_article","url":"https://fortune.com/crypto/2023/08/04/revolut-us-market-withdrawal-regulatory-uncertainty"},{"credibility":2,"name":"Budapest Business Journal: Revolut to Withdraw Crypto Services From Hungary","type":"news_article","url":"https://bbj.hu/business/tech/fintech/revolut-to-withdraw-crypto-services-from-hungary/"},{"credibility":1,"name":"Revolut Help Center: Crypto services stopping in Hungary","type":"official","url":"https://help.revolut.com/en-HU/help/crypto/question-crypto-hungary-pausing-services-retail/"},{"credibility":2,"name":"CoinDesk: Revolut Secures MiCA License in Cyprus, Expanding Regulated Crypto Services Across Europe","type":"news_article","url":"https://www.coindesk.com/policy/2025/10/23/revolut-secures-mica-license-in-cyprus-expanding-regulated-crypto-services-across-europe"},{"credibility":2,"name":"The Block: Revolut, Blockchain.com and Bitcoin app Relai score MiCA licenses with Plasma likely to follow","type":"news_article","url":"https://www.theblock.co/amp/post/375940/revolut-blockchain-com-and-bitcoin-app-relai-score-mica-licenses-with-plasma-likely-to-follow"},{"credibility":2,"name":"Cryptonomist: Revolut Euro Stablecoin Launch Expands in Europe","type":"news_article","url":"https://en.cryptonomist.ch/2026/08/26/revolut-euro-stablecoin-launch/"}],"summary":"Revolut is a UK-headquartered fintech and licensed neobank offering crypto trading, custody, and a euro stablecoin (EURR) to millions of customers across Europe and the UK, operating its crypto arm under a Cyprus MiCA license. While Revolut holds real regulatory licenses and has expanded its crypto product line significantly through 2026, it carries a documented risk profile: a 2025 anti-money-laundering fine in Lithuania, prior UK regulatory scrutiny over suspicious-account payouts, an outsized share of UK fraud complaints relative to peer banks, a September 2026 data breach that exposed customers' Bitcoin transaction histories and KYC documents via a spoofed government request, and abrupt crypto-service shutdowns in some jurisdictions (Hungary, the US) driven by regulatory change.","timeline":[{"date":"2023-08","event":"Revolut announces it will wind down crypto services for US customers, citing regulatory uncertainty; buy orders end September 2 and platform access is disabled by October 3, 2023 with holdings liquidated automatically.","source":"Benzinga / Fortune","source_url":"https://www.benzinga.com/markets/cryptocurrency/23/08/33573644/revolut-pulls-plug-on-crypto-trading-in-us-blames-changing-regulatory-climate"},{"date":"2023-09","event":"UK FCA and NCA reported to be examining whether Revolut improperly allowed up to £1.7 million to be paid out of accounts flagged as suspicious by the NCA.","source":"AML Intelligence","source_url":"https://www.amlintelligence.com/2023/09/news-fca-and-nca-probe-how-revolut-paid-out-up-to-1-7m-from-flagged-accounts-over-summer/"},{"date":"2025-04-08","date_evidence":"The Bank of Lithuania announced on 8 April 2025 a €3.5 million fine against Revolut Bank UAB following a scheduled inspection.","event":"Bank of Lithuania fines Revolut Bank UAB €3.5 million for AML monitoring deficiencies — the largest such penalty in Lithuanian history.","source":"Irish Times","source_url":"https://www.irishtimes.com/business/2025/04/08/revolut-fined-35m-by-over-money-laundering-control-failures/"},{"date":"2025-10-23","date_evidence":"Revolut got formal approval in Cyprus on October 23, 2025.","event":"Revolut's crypto arm receives a MiCA Crypto-Asset Service Provider license from Cyprus's CySEC, enabling regulated crypto services across the EEA.","source":"CoinDesk","source_url":"https://www.coindesk.com/policy/2025/10-23/revolut-secures-mica-license-in-cyprus-expanding-regulated-crypto-services-across-europe"},{"date":"2025-12","date_original":"2025-12-18","event":"Deadline for Hungarian Revolut customers to sell or withdraw crypto holdings as Revolut exits the Hungarian crypto market amid new criminal penalties for unlicensed crypto services in Hungary.","source":"Budapest Business Journal","source_url":"https://bbj.hu/business/tech/fintech/revolut-to-withdraw-crypto-services-from-hungary/"},{"date":"2026-08","event":"Revolut expands its EURR euro stablecoin rollout to eligible users in Denmark, Poland, and Portugal under its MiCA authorization.","source":"Cryptonomist","source_url":"https://en.cryptonomist.ch/2026/08/26/revolut-euro-stablecoin-launch/"},{"date":"2026-09","date_original":"2026-09-11","event":"Some affected Revolut customers reportedly begin receiving breach-notification communications, according to subsequent reporting.","source":"The Block","source_url":"https://www.theblock.co/news/business/2026-09-12-revolut-says-customer-kyc-bitcoin-transaction-data-exposed-after-fake-request-from-govt-domain-414516"},{"date":"2026-09","date_original":"2026-09-12","event":"Revolut confirms a data breach in which customer KYC documents and Bitcoin transaction histories were disclosed to an attacker who impersonated a government agency's email domain; blockchain investigator ZachXBT publicizes the incident and warns of 'wrench attack' risk to affected high-net-worth users.","source":"The Block / CoinDesk / Decrypt","source_url":"https://www.theblock.co/news/business/2026-09-12-revolut-says-customer-kyc-bitcoin-transaction-data-exposed-after-fake-request-from-govt-domain-414516"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 663eb33c-ca87-4700-a2fa-d5c6e7a7d701copy