A2Z Fintech
00:48:35 · Zubin Vandrevala, Aman Narain
[00:48:35] S1: Yeah. And the defense stipulates the irony. Right? The systems that don't talk to each other is a city problem. Controls that can't be kept up is a revenue problem. Right? Different disease, and his is maybe curable. [00:48:50] S0: Count one, fines and frees. An anti money laundering fine last year from the Lithuanian regulator as we understand it. €11,500,000 from the Italian Competition Authority in April for misleading marketing of crypto and investment products. Two rungs of this ladder, and and one nobody saw. In July 2025, the ECB and the Bank of Lithuania confidentially barred new retail products across Europe until an independent review was done. Nobody outside knew for nearly a year. [00:49:24] S1: Aman, in those same six months, a full UK license, a French license, and this month, a conditional yes for American regulators. You don't get three yeses in six months from supervisors who think you're out of control. [00:49:38] S0: Yeah. You get the yeses with the highest capital ad on... The ECB said yes and then charged him for having said no in secret. [00:49:47] S1: That's a regulator saying, we're watching, not stop. And whether that freeze has been lifted, nobody has said publicly. I guess an open question. [00:49:55] S0: So let's go to card number two. And it's this month. Between eleventh and thirteenth of September, someone used a genuine Italian government email domain to send Revolut emergency data requests. The channel built for imminent threats so a compliance officer can answer the police in minutes. Nobody called Rome.
00:49:55 · Aman Narain, Zubin Vandrevala
[00:49:55] S0: So let's go to card number two. And it's this month. Between eleventh and thirteenth of September, someone used a genuine Italian government email domain to send Revolut emergency data requests. The channel built for imminent threats so a compliance officer can answer the police in minutes. Nobody called Rome. [00:50:16] S1: Out went full KYC files on about, what, six eighty to 700 wealthy and crypto clients. Passports, driver's license, bank statements, verified selfies, your own face holding your own password, and then telegrams, screenshots, $3,000,000 ransom demand, and a 10,000 Bitcoin claim nobody has verified. [00:50:40] S0: The ICO and CNIL opened inquiries on the fourteenth, and within days, he was giving interviews in Paris in the suit that we just described, describing a model with effectively zero risk. [00:50:53] S1: Which is the sentence I'll defend because it's been misread all week. Zero risk was always a credit claim. 6% lent out, 60% in cash. It was never an operational claim. And the software held. Someone followed a procedure from a real government address. That's the manual layer, the one he said he was automating. [00:51:17] S0: And he didn't cancel. [00:51:18] S1: Right. He didn't cancel. Right? He didn't send a spokesman. He walked up the stairs, passed the broken lift, and took questions. [00:51:25] S0: 700 people's faces on Telegram holding their own passports. A bank that took risks out of its balance sheet, its hiring, and its investing routed what was left through a compliance officer's inbox.
00:51:25 · Aman Narain, Zubin Vandrevala
[00:51:25] S0: 700 people's faces on Telegram holding their own passports. A bank that took risks out of its balance sheet, its hiring, and its investing routed what was left through a compliance officer's inbox. [00:51:38] S1: And the fix is more Storonsky, not less. Right? Automate the callback, make the machine ring roam before a human can hit send. And in fairness to him, Revolut says it checked with the agencies itself, blocked the address, told the regulator, and that its systems and the customers' funds were untouched. The FCA says it's engaging with [00:51:58] S0: it. And I'd still call it the story of the month because it's the second time in four years, September 2022, about 50,000 customers. Details were taken by social engineering. September 2026, a fake government request. Different doors, same wall. A person persuaded to hand over something over. [00:52:18] S1: Yeah. So two breaches through, know, I guess, both through people, neither through code. And your friend's caveat just came true. Right? An order of magnitude faster than banking. So as long as they don't screw it up, I guess. [00:52:31] S0: The suit says grown up. The breach says there's plenty of growing up still to do. [00:52:36] S1: And the irony writes itself. Right? The same year his AI assistant learned to freeze your card in a sentence, a human handed over your passport because an email looked official.
00:52:36 · Zubin Vandrevala, Aman Narain
[00:52:36] S1: And the irony writes itself. Right? The same year his AI assistant learned to freeze your card in a sentence, a human handed over your passport because an email looked official. [00:52:48] S0: You know, and and, Zubin, there's a postscript to this, and and it's breaking as we record this. It seems like there's a second breach in the same month. This one with DriveWealth, the American broker that used to handle US share trading for Revolut customers. Social engineering again, notice a pattern, on the fourth and fifth of September this month. Names, contact, addresses, employment details, partial account numbers, no passwords, no cards, no identity documents, but thousands of Irish customers amongst those affected. [00:53:21] S1: And and and and he'll say it correctly. This is... Wasn't really Revolut. Right? There was a partner on historical records from before he changed the trading. [00:53:30] S0: That's correct. But it won't matter. Probably. The more regulated you are, and as he realizes, the less anyone cares whose server it was. A bank owns its supply chain. That's what a license, I guess, means. [00:53:46] S1: So the transition from fintech to regular bank isn't a straight road. Right? It's a chicane. And the fastest car in the field is no use if it can't take corners. Right? Like, he needs the best brakes in the world and, I guess, the best steering.
00:53:46 · Zubin Vandrevala, Aman Narain
[00:53:46] S1: So the transition from fintech to regular bank isn't a straight road. Right? It's a chicane. And the fastest car in the field is no use if it can't take corners. Right? Like, he needs the best brakes in the world and, I guess, the best steering. [00:54:00] S0: You know, it it reminds me. Years ago, I was at a banker's lunch at the Hong Kong Jockey Club, and the speaker there was Jackie Stewart, the race car legend. I've forgotten everything else from that day. There was a lot of wine. But I'll never forget this. He says, brakes don't slow you down. They allow you to go faster. [00:54:20] S1: Hang on. Hang on. Hang on. Didn't Mario say that? [00:54:26] S0: This is this is also true. But, you know, being profound is forgetting your sources, I suppose. [00:54:31] S1: Alright. Alright. Okay. Okay. I'll it with you. One of you said it. It's still the right. [00:54:36] S0: It's obviously the American who was right. Yeah. But here's the whole point. Compliance isn't what slows Revolut down. Done properly, it's what lets it go faster. Right now, it's carrying racing speed into a corner it hasn't taken before. And let me then use this as a segue to count three. And he pleads to this himself, because it's the empire from two segments ago. A consumer bank in more than 100 countries, he has admitted, runs into sanctions. You cannot do a lot of things in many, many markets. And vetting customers, he admits, has been particularly challenging.
00:54:36 · Aman Narain, Zubin Vandrevala
[00:54:36] S0: It's obviously the American who was right. Yeah. But here's the whole point. Compliance isn't what slows Revolut down. Done properly, it's what lets it go faster. Right now, it's carrying racing speed into a corner it hasn't taken before. And let me then use this as a segue to count three. And he pleads to this himself, because it's the empire from two segments ago. A consumer bank in more than 100 countries, he has admitted, runs into sanctions. You cannot do a lot of things in many, many markets. And vetting customers, he admits, has been particularly challenging. [00:55:15] S1: And overcompliance also gets punished too. Right? Like November 2025, confirmed revived, froze the accounts of thousands of Russian citizens living legally in Europe on resident permits. Right? So people who couldn't reach their money, their own money for rent. [00:55:31] S0: And and the man at the top has his own Russian paperwork story. Nine days, 10/19/2022, Ukraine designates his father under presidential decree seven two six for running Gazprom Promgas. October 28, the son renounces his Russian citizenship. British since 2013. From that day, British only. [00:55:56] S1: Physicist born in Lviv, sanctioned by the country of his birth for running an engineering firm, the country he moved to. And nine days later, his son gives up the other passport.