● RISK ANALYSIS · 2026

Is Revolut safe in 2026?

Independent risk analysis — regulatory status, custody architecture, history, and our honest verdict.

Reviewed by Stephan Kulik · Last updated: 2026-10-29 · How we rank

Our Verdict: Revolut Is Safe With Caveats

Revolut crypto is reasonably safe for small-to-medium holdings used as a convenience layer for buying, selling, and spending — but it is NOT insured the way bank deposits are. Custody at regulated entities (Revolut Ltd UK, Revolut Bank UAB EU). Crypto balances NOT FDIC/FSCS-protected. For holdings you can't afford to lose, withdraw to self-custody. We score it 8.5/10.

Revolut Regulatory Status

Revolut Bank UAB — Full EU Banking Licence

Revolut Bank UAB holds a full banking licence in Lithuania — covering EU operations. Lithuanian deposit guarantee protects EU EUR cash deposits up to €100,000 per depositor. Banking licence is materially stronger than e-money authorisation.

Source ↗

UK Banking Licence (2024-2026)

Revolut received its UK banking licence with restrictions from the PRA in July 2024, entering the standard 'mobilisation' stage, and has since completed authorisation — Revolut Bank UK Ltd is fully licensed and regulated by the PRA and FCA (confirmed by Revolut, March 2026). Before this, UK operations ran under e-money regulation without FSCS depositor protection.

Source ↗

MiCA CASP Licence — CySEC, Cyprus (Oct 2025)

Revolut's EEA crypto services run through Revolut Digital Assets Europe Ltd (RDAEL), licensed by the Cyprus Securities and Exchange Commission (licence No. 001/2025) as a crypto-asset service provider under MiCA — passportable across all 30 EEA markets. EU customers' crypto services are migrating to RDAEL. Note the CASP is the Cyprus entity, not Revolut Bank UAB (which holds the Lithuanian banking licence).

Source ↗

Institutional Sub-Custodians (Fireblocks, Coinbase, Copper)

For crypto, Revolut uses institutional sub-custodians — historically Fireblocks, Coinbase Custody, and Copper depending on jurisdiction and asset. When you hold crypto in Revolut, you hold a claim against Revolut, which in turn holds assets at a sub-custodian. Multi-layer counterparty structure.

What Happened With Revolut?

2015 Founding: Revolut founded in London as a digital fintech for international fee-free transfers. Crypto buying added in 2017 — among the first mainstream consumer fintechs to integrate crypto.

December 2018 — Lithuanian Licences: Revolut was granted a specialised bank licence by the ECB on the Bank of Lithuania's proposal in December 2018 (alongside an e-money institution licence) — upgraded to a full banking licence in December 2021 (valid from 2021-12-13 per the Bank of Lithuania register). Materially upgraded customer protection vs the earlier e-money structure. Source ↗

September 2022 — Customer-Data Breach: Revolut reported a personal-data breach to Lithuania's State Data Protection Inspectorate, which opened an investigation. According to preliminary data, access to a Revolut database was obtained through social engineering. The data of about 50,150 customers worldwide (20,687 in the EEA) — such as names, addresses, email addresses, phone numbers, account details and part of the payment-card data (card numbers were masked, according to Revolut) — could have been affected. Revolut told affected customers by email that the funds in their accounts were not at risk. The notice does not mention crypto and does not say which Revolut products the affected customers used. Source ↗

2024-2026 UK Banking Licence: Revolut received its UK banking licence with restrictions in July 2024 and completed authorisation — fully licensed as of early 2026. UK customer fiat protection upgraded to FSCS coverage as the bank rolls out. Source ↗

September 2026 — Data Supplied on Fraudulent Requests: Italy's Interior Ministry told parliament on 18 September 2026 that Revolut had notified the national cybersecurity agency of a possible incident on 12 September and confirmed on 15 September that it had provided the data of 680 customers, eight of them Italian, and had informed the customers involved. Revolut reported that a certified-email (PEC) address linked to the Reggio Calabria prefecture had been compromised; the record describes the requests for customer information as fraudulent. It does not say which Revolut products the 680 customers used, or whether any of them held crypto. Source ↗

September 2026 — DriveWealth Data Incident: DriveWealth, the US broker-dealer that provides execution and clearing for Revolut's US-stocks service, told Revolut that an unauthorised party had accessed customer data held on DriveWealth's systems. Revolut says its own systems, app infrastructure and core databases were not accessed. In the UK, the EEA and Australia, customer details went to DriveWealth only under an older direct-brokerage setup used during specific past periods; customers on Revolut's current setup there were not affected, because their personal details are never shared with DriveWealth. Affected customers were told by email from both DriveWealth and Revolut. Source ↗

Key Risk Factors

Crypto Not FDIC/FSCS-Insured

moderate

EU EUR cash benefits from Lithuanian deposit guarantee (€100k). UK GBP under FSCS following 2025 licence completion. Crypto balances are EXCLUDED from all these schemes. For crypto held at Revolut, you are a general creditor in insolvency.

Account Freeze Risk

moderate

Like all regulated fintechs, Revolut freezes accounts for AML reviews, suspicious-activity reports, KYC issues, or court orders. Freeze blocks BOTH fiat AND crypto. Resolution typically takes days to weeks. Recurring complaint across the user base.

Multi-Layer Custody Counterparty

moderate

Revolut uses institutional sub-custodians (Fireblocks/Coinbase/Copper). When you hold crypto in Revolut, you have a claim against Revolut → which has a claim against the sub-custodian → which holds the actual asset. Each layer adds counterparty risk vs direct self-custody.

Personal-Data Exposure and Scam Contact

moderate

Revolut customer data has been exposed more than once (see the history above). Leaked names, email addresses and phone numbers can be used for phishing calls, texts and emails, whether or not any account was accessed. Revolut says it will never ask for your passcode, one-time passwords, password or card details, and will never tell you to move money to another account for safekeeping — treat any such request as a scam and report it in the app.

Not Optimal for Large Holdings

low

Revolut is convenience-optimized, not vault-optimized. For amounts you can't afford to lose to custody failure, freeze, or insolvency, withdraw to a self-custody wallet you control (Ledger, Trezor).

Frequently Asked Questions

Is Revolut crypto safe? +

For most users in supported jurisdictions, Revolut crypto offers a reasonable safety baseline: custody is held via regulated entities (Revolut Ltd in UK, Revolut Bank UAB in Lithuania/EU), the consumer relationship operates under e-money or banking authorisations depending on market, and crypto is typically held with institutional custodians. However, crypto held at Revolut is NOT covered by FSCS or FDIC deposit-protection schemes in the way cash is — if Revolut or its sub-custodian fails, recovery depends on insolvency proceedings. Safety is therefore 'regulator-supervised custody' not 'insured deposits'.

Is Revolut FDIC or FSCS insured for crypto? +

No. FDIC (US) and FSCS (UK) protect cash deposits held at regulated banks, not crypto. Revolut Bank UAB cash balances in the EU are covered by the Lithuanian deposit guarantee up to €100,000; UK fiat balances held under Revolut Ltd are now FSCS-protected following 2025 banking licence completion. Crypto balances are excluded from all these schemes.

Has Revolut ever had a crypto incident? +

The incidents on record are customer-data incidents: a 2022 social-engineering breach of a Revolut database (about 50,150 customers potentially affected), Revolut's September 2026 confirmation that it had supplied the data of 680 customers in response to fraudulent requests, and a September 2026 breach at DriveWealth, the US broker behind Revolut's US-stocks service. None of the primary sources cited above reports crypto keys or crypto balances being accessed, and none says which Revolut products the affected customers used. Treat personal-data exposure and crypto custody as separate risks: the main risk from the first is phishing calls and messages. Revolut has also faced regulator scrutiny in multiple markets over anti-money-laundering controls; see our review for the full record.

Can Revolut freeze your crypto? +

Yes. Like all regulated fintechs, Revolut can freeze accounts pending AML checks, for suspicious-activity reports, or on court order. This has happened enough times in user reports to be a real risk — not specific to crypto but affecting crypto balances when it happens.

Should I use Revolut for large crypto holdings? +

No. Revolut is suitable for convenience (integrating crypto into everyday banking + spending) but not for large holdings. For amounts you are not willing to lose to custodian failure, freeze, or insolvency, withdraw to a self-custody wallet you control (hardware wallet like Ledger or Trezor). Revolut, like any custodial platform, is a convenience trade-off, not a vault.

Read the Full Revolut Review

Score breakdown, fees, pros and cons — all in one place.

Revolut Review 2026 →

Related safety reviews

Is Bakkt safe in 2026? Is Liv safe in 2026? Is Mercury safe in 2026?