Revolut Faces BoE Section 166 Review Over Product Approval Controls
The Bank of England's Prudential Regulation Authority has issued a Section 166 skilled-person review against Revolut, ordering the bank to bring in independent experts to assess the robustness of its product approval processes. The order reportedly dates to around spring 2026 and puts one of Europe's largest digital banks under direct supervisory scrutiny just months after it obtained a full UK banking licence in March of the same year. For accounting firms, auditors, and CFOs who service or benchmark against digital banking entities, a Section 166 is not a routine inspection. It is a formal supervisory tool with real downstream consequences for financial statements, product strategy, and AML governance.
What a Section 166 Order Actually Means
Under the Financial Services and Markets Act 2000, the PRA and the FCA can instruct a regulated firm to appoint a "skilled person" to conduct a report on specific aspects of its business. The regulator sets the scope, the firm pays the cost, and the resulting report goes directly to the supervisor. Unlike a voluntary internal audit, the firm has no ability to suppress or edit the findings before they reach the PRA.
Why the PRA Reached for This Power
The trigger is Revolut's approach to new financial products. CEO Nik Storonsky has publicly described employees as "self-guided missiles," a phrase that implies a degree of autonomous product development that sits uncomfortably with the PRA's expectations around documented governance and senior-manager accountability under the Senior Managers and Certification Regime. The review will assess whether product-launch practices comply with applicable law and PRA rules, including those covering consumer duty, credit risk, and operational resilience.
Timing and the New Banking Licence
Revolut secured its UK banking licence in March 2026, enabling it to offer personal loans from £2,000 to £25,000 and placing it on a path toward mortgages and credit cards. The PRA issuing a Section 166 order in the same year as a licence grant is uncommon. It signals that supervisors had pre-existing concerns they wanted addressed quickly once Revolut moved into the full regulated banking perimeter. For accounting teams, the costs of the skilled-person review cannot be deferred or capitalised; they must be expensed as incurred, and depending on materiality, may require specific disclosure.
A Pattern of Regulatory Pressure Across Jurisdictions
The BoE order does not sit in isolation. It forms part of a broader regulatory pattern affecting Revolut across multiple jurisdictions, each of which carries its own accounting and disclosure implications.
ECB Restriction on New Products
In 2025, the European Central Bank temporarily restricted Revolut's European branch from releasing new products, citing concerns in part over the speed of its product approval processes. That restriction foreshadows the PRA's current concerns and suggests that governance weaknesses identified in the eurozone context were not fully resolved before the UK supervisor acted. Firms using Revolut's European infrastructure for business banking or treasury services should verify whether any product restrictions remain in force and how that affects contractual obligations.
Italian Regulatory Fine
Revolut was fined €11.5 million (approximately $12.8 million) by Italian authorities for spreading misleading information about its investment products and for employing aggressive and misleading marketing methods. For financial statement preparers at entities with Revolut-related exposures, this fine is a factual reference point when assessing whether similar conduct-risk provisions are adequately reflected in their own clients' or counterparties' accounts.
Data Breaches and Operational Failures
Revolut also experienced several customer data breaches in September, connected to a social engineering attack on its third-party US broker DriveWealth. Additionally, a Google Cloud power outage temporarily halted a range of Revolut's services. Both events are relevant to operational-risk assessments and, where a firm holds material balances or processes payments through Revolut, may warrant a review of business-continuity provisions and third-party risk disclosures under IFRS 7 and IFRS 17 (or FRS 102 equivalents).
Accounting and Audit Implications for B2B Practitioners
When a newly licensed bank faces a Section 166 review alongside pending regulatory actions in multiple jurisdictions, the accounting consequences radiate outward. Practitioners serving digital finance clients need to be alert to several specific areas.
Provisions and Contingent Liabilities
Under IAS 37, a provision is recognised when a present obligation exists, an outflow of resources is probable, and a reliable estimate can be made. Revolut's legal and regulatory exposure, across the Italian fine, the Section 166 costs, and any future PRA enforcement action, needs to be evaluated at each reporting date. Where the probability of outflow is possible but not probable, disclosure as a contingent liability is required. Auditors of entities with Revolut as a banking partner or counterparty may also need to assess whether credit risk disclosures under IFRS 7 require updating.
Going-Concern and Viability Considerations
A Section 166 review does not automatically threaten a firm's viability. Revolut remains a large and well-capitalised entity. However, if the skilled-person report results in product restrictions, forced wind-downs of loan books, or capital add-ons, those outcomes could affect the firm's forward earnings profile materially. Auditors of business clients that depend on Revolut for payment processing, lending facilities, or treasury management should flag this as a risk factor in their audit planning.
Product-Approval Governance as an Internal Control
For CFOs and compliance officers at other UK-licensed or EU-regulated digital banks and fintech lenders, this case is a live reminder that product-approval governance is itself an internal control. Where that control is weak or undocumented, supervisors can and will act. Firms that rely on crypto bookkeeping software or digital asset accounting software to manage multi-product ledgers should ensure those systems capture product-level cost and revenue data in a way that can support a regulatory review, not just a financial audit.
What Comes Next and What Firms Should Do Now
The skilled-person review process typically takes several months. Once complete, the PRA will receive the report and may take further supervisory action, require remediation, or, if satisfied, close the matter. Revolut has reportedly moved quickly to engage with the process, which is consistent with a firm trying to protect its newly granted banking licence.
Practical Steps for Accounting and Compliance Teams
Firms that work with or advise digital banking clients should take the following steps now rather than waiting for a regulator to raise the question. First, review whether product-governance documentation for any client in the digital finance space meets the PRA's or FCA's Senior Managers and Certification Regime requirements, with clear audit trails from product concept to launch. Second, check whether provisions for regulatory and legal risk are calibrated to current fact patterns rather than legacy estimates. Third, assess third-party risk: the DriveWealth incident shows that operational failures at a sub-custodian or broker can cascade into a client's own compliance and reputational exposure. Fourth, verify that any crypto bookkeeping software or digital asset accounting software used by clients is capable of producing product-level, entity-level, and jurisdiction-level reporting that a skilled person could interrogate without manual reconstruction. Finally, review the AML and licensing enforcement tracker for digital asset firms and consider how regulators are tightening fund safeguarding rules at licensed crypto entities in parallel with actions like this one.
Frequently Asked Questions
What is a Section 166 skilled-person review?
It is a formal supervisory power under the Financial Services and Markets Act 2000 that allows the PRA or FCA to require a regulated firm to commission an independent expert report on a specified aspect of its business. The firm pays for the review and the regulator receives the findings directly. It is a step up from routine supervision and often precedes further enforcement action, though it does not automatically result in a fine or sanction.
Does the Section 166 order mean Revolut broke the law?
Not necessarily. The review is designed to assess whether Revolut's product approval processes comply with applicable rules, not to confirm a breach. However, if the skilled person's report identifies legal or regulatory violations, the PRA can use those findings to support further action, including financial penalties, licence conditions, or restrictions on business activities.
How should auditors treat the review costs in a client's financial statements?
The costs of hiring the skilled person are an operating expense for Revolut and must be recognised in the period incurred under both IFRS and UK GAAP. They cannot be capitalised. If the total is material, disclosure in the notes explaining the nature and estimated quantum of the cost would be expected. Auditors of counterparties or business partners should also assess whether credit or operational risk disclosures need updating in light of this development.
What does the ECB's 2025 product restriction tell us about the current BoE action?
It suggests that concerns about the pace and governance of Revolut's product development were identified at the European level before the UK supervisor acted. The fact that similar concerns arose independently in two major jurisdictions indicates a structural governance issue rather than a one-off incident, which is likely to make the PRA's review more searching.
What should a CFO at a firm banking with Revolut do right now?
Review the terms of any credit facilities, payment processing agreements, or treasury arrangements with Revolut to understand what happens if the bank faces product restrictions or capital add-ons. Assess whether alternative banking arrangements are needed as a contingency. Update third-party risk disclosures if material balances are held at Revolut. Finally, ensure that your own crypto bookkeeping software or digital asset accounting software can produce an accurate, auditable record of all transactions processed through Revolut, independent of the bank's own reporting infrastructure.
Source: Protos