A2Z Fintech
00:46:05 · Zubin Vandrevala, Aman Narain
[00:46:05] S1: Yeah. The the side projects. Right? Musk has rockets, tunnels, brain implants. Swarovski has venture funds run by an algorithm and a stated interest in health tech. [00:46:16] S0: And then there's the pay. Last November, Tesla shareholders approved a package worth up to $8,000,000,000,000 in 12 tranches, if Tesla reaches, of course, dollars 8,500,000,000,000 in market value. Revolut's board, as reported, has been modeling Storonsky's next package on Musk's and on Renee Haas at ARM. On top of the 40 at 200,000,000,000, a further award if Revolut holds 500. [00:46:46] S1: You know, and I'll defend it the way Tesla's board did. Right? A hurdle that high cost stakeholders, nothing unless it's cleared. And if it's cleared, then they're all four times richer. Right? It's the cheapest option a board can ride. [00:47:00] S0: Unless it changes how he drives. A 500,000,000,000 target rewards exactly the expansion we just spent ten minutes on. The package and the empire are essentially the same bet. [00:47:12] S1: And here's the parallel that almost is too neat. Right? In 1999, Musk tried to build exactly this. X.com, one app for all your money. And his co founders pushed him out while he was flying to his honeymoon, and the company became PayPal. Right? We've talked about this in PayPal episodes, but a bunch of other times as well. [00:47:31] S0: Yeah. So Musk tried to build the Everything Bank and got fired from it and went off to build cars and rockets. Storonsky is building the Everything Bank.
00:47:31 · Aman Narain, Zubin Vandrevala
[00:47:31] S0: Yeah. So Musk tried to build the Everything Bank and got fired from it and went off to build cars and rockets. Storonsky is building the Everything Bank. [00:47:41] S1: And I guess here's where the comparison breaks, right, which is the interesting bit. Must bet the companies on physics, rockets that might blow up on the pad. Storonsky refuses to bet his own credit. [00:47:54] S0: One takes the risk everyone can see, the other removes it, and both keep the risks that left them in place. [00:48:01] S1: He'd keep that line for the end. Now let's prosecute him. [00:48:06] S0: The case against in full. You defend. [00:48:09] S1: Alright. Alright. Alright. Gladly. He's easier to defend than you think and harder to defend than he thinks. [00:48:16] S0: Let's start with his own words. Storonsky had said Citigroup and the big banks grew by buying other banks and ended up with systems that don't talk to each other. And the irony is hard to miss because if one bank has been exposed for weak controls during breakneck expansion, it's been revolute. [00:48:35] S1: Yeah. And the defense stipulates the irony. Right? The systems that don't talk to each other is a city problem. Controls that can't be kept up is a revenue problem. Right? Different disease, and his is maybe curable.
00:48:35 · Zubin Vandrevala, Aman Narain
[00:48:35] S1: Yeah. And the defense stipulates the irony. Right? The systems that don't talk to each other is a city problem. Controls that can't be kept up is a revenue problem. Right? Different disease, and his is maybe curable. [00:48:50] S0: Count one, fines and frees. An anti money laundering fine last year from the Lithuanian regulator as we understand it. €11,500,000 from the Italian Competition Authority in April for misleading marketing of crypto and investment products. Two rungs of this ladder, and and one nobody saw. In July 2025, the ECB and the Bank of Lithuania confidentially barred new retail products across Europe until an independent review was done. Nobody outside knew for nearly a year. [00:49:24] S1: Aman, in those same six months, a full UK license, a French license, and this month, a conditional yes for American regulators. You don't get three yeses in six months from supervisors who think you're out of control. [00:49:38] S0: Yeah. You get the yeses with the highest capital ad on... The ECB said yes and then charged him for having said no in secret. [00:49:47] S1: That's a regulator saying, we're watching, not stop. And whether that freeze has been lifted, nobody has said publicly. I guess an open question. [00:49:55] S0: So let's go to card number two. And it's this month. Between eleventh and thirteenth of September, someone used a genuine Italian government email domain to send Revolut emergency data requests. The channel built for imminent threats so a compliance officer can answer the police in minutes. Nobody called Rome.
00:49:55 · Aman Narain, Zubin Vandrevala
[00:49:55] S0: So let's go to card number two. And it's this month. Between eleventh and thirteenth of September, someone used a genuine Italian government email domain to send Revolut emergency data requests. The channel built for imminent threats so a compliance officer can answer the police in minutes. Nobody called Rome. [00:50:16] S1: Out went full KYC files on about, what, six eighty to 700 wealthy and crypto clients. Passports, driver's license, bank statements, verified selfies, your own face holding your own password, and then telegrams, screenshots, $3,000,000 ransom demand, and a 10,000 Bitcoin claim nobody has verified. [00:50:40] S0: The ICO and CNIL opened inquiries on the fourteenth, and within days, he was giving interviews in Paris in the suit that we just described, describing a model with effectively zero risk. [00:50:53] S1: Which is the sentence I'll defend because it's been misread all week. Zero risk was always a credit claim. 6% lent out, 60% in cash. It was never an operational claim. And the software held. Someone followed a procedure from a real government address. That's the manual layer, the one he said he was automating. [00:51:17] S0: And he didn't cancel. [00:51:18] S1: Right. He didn't cancel. Right? He didn't send a spokesman. He walked up the stairs, passed the broken lift, and took questions. [00:51:25] S0: 700 people's faces on Telegram holding their own passports. A bank that took risks out of its balance sheet, its hiring, and its investing routed what was left through a compliance officer's inbox.
00:51:25 · Aman Narain, Zubin Vandrevala
[00:51:25] S0: 700 people's faces on Telegram holding their own passports. A bank that took risks out of its balance sheet, its hiring, and its investing routed what was left through a compliance officer's inbox. [00:51:38] S1: And the fix is more Storonsky, not less. Right? Automate the callback, make the machine ring roam before a human can hit send. And in fairness to him, Revolut says it checked with the agencies itself, blocked the address, told the regulator, and that its systems and the customers' funds were untouched. The FCA says it's engaging with [00:51:58] S0: it. And I'd still call it the story of the month because it's the second time in four years, September 2022, about 50,000 customers. Details were taken by social engineering. September 2026, a fake government request. Different doors, same wall. A person persuaded to hand over something over. [00:52:18] S1: Yeah. So two breaches through, know, I guess, both through people, neither through code. And your friend's caveat just came true. Right? An order of magnitude faster than banking. So as long as they don't screw it up, I guess. [00:52:31] S0: The suit says grown up. The breach says there's plenty of growing up still to do. [00:52:36] S1: And the irony writes itself. Right? The same year his AI assistant learned to freeze your card in a sentence, a human handed over your passport because an email looked official.
00:52:36 · Zubin Vandrevala, Aman Narain
[00:52:36] S1: And the irony writes itself. Right? The same year his AI assistant learned to freeze your card in a sentence, a human handed over your passport because an email looked official. [00:52:48] S0: You know, and and, Zubin, there's a postscript to this, and and it's breaking as we record this. It seems like there's a second breach in the same month. This one with DriveWealth, the American broker that used to handle US share trading for Revolut customers. Social engineering again, notice a pattern, on the fourth and fifth of September this month. Names, contact, addresses, employment details, partial account numbers, no passwords, no cards, no identity documents, but thousands of Irish customers amongst those affected. [00:53:21] S1: And and and and he'll say it correctly. This is... Wasn't really Revolut. Right? There was a partner on historical records from before he changed the trading. [00:53:30] S0: That's correct. But it won't matter. Probably. The more regulated you are, and as he realizes, the less anyone cares whose server it was. A bank owns its supply chain. That's what a license, I guess, means. [00:53:46] S1: So the transition from fintech to regular bank isn't a straight road. Right? It's a chicane. And the fastest car in the field is no use if it can't take corners. Right? Like, he needs the best brakes in the world and, I guess, the best steering.