Self-Guided Missiles: What the ECB Saw in Revolut's Growth

When the Bank of Lithuania granted Revolut a European banking licence in 2018, the decision was read as a vote of confidence in a new kind of institution: fast, digital and unburdened by the legacy systems that slow incumbents down. Eight years later, Revolut now serves more than 75 million customers and lifted pre-tax profit by 57 per cent to £1.7bn on revenue of £4.5bn last year, and is sounding out investors on a share sale that values it at $115bn, a figure that, the Financial Times reported, would rank it among Europe's most valuable banks by market value, ahead of Barclays and BNP Paribas. Yet behind that ascent, the European Central Bank (ECB) had quietly concluded that the institution it supervises was approving new products faster than it could safely govern them.

The Financial Times reported on 10 June 2026 that the ECB had restricted Revolut's European arm from launching new products across the European Economic Area (EEA) until it remedied what the supervisor called deficiencies in its approval process. The intervention dated to July 2025 and had never been disclosed. It is not the penalty that matters here. It is what the penalty was for.

Speed was the strategy, not the side effect

Revolut's growth was never accidental. Nik Storonsky, the co-founder and chief executive, has long modelled the firm on a technology company rather than a bank, describing staff as self-guided missiles empowered to develop and ship products with limited oversight. That philosophy built a super-app spanning payments, trading, crypto and lending, and it built it at a pace no incumbent could match. The metaphor is revealing. A self-guided missile is fast, autonomous and difficult to recall once launched.

In a consumer technology business, that autonomy is an asset. In a licensed bank, it is a supervisory problem. The boundary between a start-up operating style and a banking supervisory expectation is precisely where the ECB located the failure. Product launch velocity had outrun the approval discipline that the supervisor expects from a regulated institution. The issue was not that any single product was unsound. It was that the mechanism for deciding whether a product was sound could not keep pace with the rate at which products were being conceived.

The ECB did not object to innovation; it objected to the absence of control

The shape of the ECB's response is instructive. According to the Financial Times, the supervisor did not simply pause launches. It ordered an independent review of Revolut's risk, compliance and legal functions, instructed the firm to strengthen the staffing, skills and independence of its product-approval teams, and required that future launches obtain sign-off from in-house experts alongside a board assessment of their impact on group capital and liquidity. Tougher limits were placed on the European arm's activity outside the EEA, blocking new customer onboarding and acquisitions in those markets. The FT noted that it was unclear whether all the restrictions remained in force, and Revolut has introduced products in Europe since.

Read together, these measures describe a single concern. The ECB was not questioning whether Revolut could innovate. It was questioning whether Revolut could demonstrate, before launch rather than after, that someone with the authority to say no had genuinely assessed the risk. This is the distinction between control existence and control effectiveness. The committee existed. Whether it functioned was another question. A product-approval committee that exists on the organisation chart is not the same as one that functions with sufficient independence, expertise and seniority to constrain the business. The supervisor wanted the second, and concluded it was looking at the first.

Direct supervision changes what is being judged

The structure of Revolut's European business explains why the intervention carried such weight. Its banking operations run through a Lithuanian entity that the European Central Bank supervises directly as a significant institution, jointly with the Bank of Lithuania, rather than as a less significant institution left to national oversight. That distinction is not cosmetic. Significant institutions sit inside the Single Supervisory Mechanism's most intensive tier, monitored by joint supervisory teams and held to the governance standards applied to the largest banks in the eurozone.

The Lithuanian licence, secured in 2018, allows Revolut to passport banking services across much of the European Union from a single authorisation. That structure delivered reach quickly. It also placed the firm inside an architecture where product expansion is judged not by customer uptake but by risk governance. The larger Revolut grew, the less persuasive the start-up framing became. A bank with tens of millions of depositors, consumer lending ambitions and investment products is no longer assessed as a fintech experimenting at the edges. It is assessed against the expectations applied to institutions that hold deposits and extend credit across borders. The capital signal that followed should be read in that light.

A capital signal sat beneath the headline

The product restrictions did not arrive in isolation. The ECB had already raised the Pillar 2 capital requirement on Revolut's Lithuanian entity to 4.5 per cent for 2026, the highest among the banks it directly supervises, as reported by the Financial Times. Pillar 2 requirements are calibrated to risks that the standard capital framework does not fully capture, including weaknesses in governance and internal controls. A supervisor that imposes the steepest such add-on across its directly supervised population is making a quantitative statement about qualitative risk.

The signal compounds. Lithuania's central bank fined Revolut €3.5m in April 2025 over anti-money laundering control shortcomings, and Italy's market regulator fined the firm €11.5m in April 2026 over misleading information on investment products, a penalty Revolut is appealing. One fine is an incident. A capital add-on, a product freeze and two conduct penalties across overlapping periods describe a pattern that supervisors notice. The through-line is not misconduct in the ordinary sense. It is the recurring sense that the firm's control framework has not matured at the same rate as its balance sheet.

Crypto is where the tension is sharpest

Nowhere is the speed-versus-control question more acute than in crypto-assets, and the timing of the ECB's action underlines the point. Revolut has positioned itself as an early mover under the European Union's Markets in Crypto-Assets regulation (MiCA), holding a crypto-asset service provider licence obtained in Cyprus that permits custody and trading activity across the bloc. The firm has signalled ambitions to extend its Revolut X exchange across further EU markets, and it is preparing to offer stablecoin access to customers in the United States following its application for a national bank charter. The ambition is broad. The perimeter beneath it is new.

MiCA was designed precisely to impose a comprehensive regulatory perimeter on an asset class that previously operated largely outside one. A firm that expands aggressively into crypto-asset services while a prudential supervisor is questioning the adequacy of its product-approval machinery occupies an uncomfortable position. The two regimes meet at the same control function. Reporting on the ECB's restrictions noted that the measures did not specifically target any digital-asset product, which is itself telling. The supervisor's concern was not a particular token or service. It was the system that decides whether any new product, crypto or otherwise, has been properly assessed before it reaches customers. The newest perimeter is the least forgiving.

Revolut is not the first fintech to be slowed down

The Revolut episode has a clear precedent, and it is instructive. In 2021, Germany's financial regulator BaFin capped the number of new customers that the neobank N26 could onboard, initially at 50,000 a month against the roughly 170,000 it had been adding, citing inadequate anti-money laundering controls. The cap remained in place for two and a half years. N26 has said it spent more than €100m on compliance staff and systems before BaFin lifted the restriction in June 2024, and its co-founder told the Financial Times that the indirect cost, in suppressed valuation and forgone growth, ran far higher. The bill ran into the billions.

The N26 case demonstrates how supervisors now treat growth itself as a lever. By tying onboarding volume to compliance performance, BaFin made the bank's expansion contingent on the maturity of its controls. The bank could operate; it could not scale. It also demonstrates that supervisory scrutiny rarely ends with a single intervention. Following a special audit, BaFin imposed further measures on N26 in late 2025, including higher capital requirements and a halt to new mortgage lending in the Netherlands. Once supervisory confidence is shaken, regulators tend to return until they see structural change rather than isolated fixes.

The licence is not the destination; it is the obligation

There is an irony in the timing. Revolut secured a full UK banking licence in March 2026 after years of friction with the Prudential Regulation Authority, and has applied for a national bank charter in the United States. These are presented, understandably, as milestones. Yet a banking licence is not a reward for past growth. It is a standing commitment to a governance standard, renewed with every product the institution launches.

The ECB episode demonstrates what that commitment costs in practice. The same cultural traits that allow a fintech to win customers, an appetite for speed and a tolerance for autonomous decision-making, become liabilities the moment the institution holds deposits under a banking licence. UK supervisors voiced the same concern, worrying whether Revolut had the controls to sustain its rapid growth before ultimately granting the licence. The licence does not resolve that tension. It formalises it. Each new jurisdiction Revolut enters multiplies the number of supervisors entitled to ask whether control has kept pace with ambition.

Implications for firms

The Revolut case is not solely about Revolut. It is a template for how supervisors across Europe are likely to treat the governance of fast-growth regulated firms. Three lessons follow for any institution scaling at speed under a licence.

First, the approval process is itself a regulated artefact. Supervisors increasingly examine not only the products a firm launches but the machinery by which it decides to launch them. A firm should be able to evidence who assessed a new product, what authority they held to decline it, and how capital and liquidity impacts were weighed before, not after, the launch decision. Second, cultural language carries supervisory consequence. A phrase intended to inspire engineers can, in a regulatory file, read as evidence that oversight is treated as optional. Boards should understand that the narratives they celebrate internally may be the narratives a supervisor cites. Third, capital add-ons and growth caps are leading indicators, and planning should treat them as such. A rising Pillar 2 requirement is rarely the first concern a supervisor holds; it is often the formalisation of concerns expressed less visibly beforehand. Capital and liquidity models should incorporate supervisory shock scenarios, and growth forecasts should assume the possibility of an onboarding or product restriction rather than treat uninterrupted expansion as the baseline. The firms that plan for the brake do not get thrown through the windscreen when it is applied.

Conclusion

A self-guided missile reaches its target quickly because nothing intervenes between launch and impact. That is its strength and, in a regulated bank, its defect. The ECB's intervention at Revolut was not a verdict on whether the firm can build remarkable products. It plainly can. It was a verdict on whether anyone inside the institution had the standing to intervene between conception and launch, and the supervisor concluded that, for a period, no one reliably did. Growth can be engineered through speed. Trust cannot. The discipline that a banking licence demands is the willingness to slow down precisely when the business most wants to accelerate, and to build the institutional capacity to say no before the missile has already left the rail.

Are you confident that your firm could evidence, today, exactly who had the authority to halt your last product launch and what they assessed before it went live?

If that answer is not immediate, let's talk. Contact us.

At OpusDatum, we help regulated firms build product-governance and control frameworks that can withstand supervisory scrutiny as they scale, translating supervisory expectations into approval processes that function in practice rather than merely on paper.