€3.5m Revolut fine shows why AML can’t be a one-off check
Jaye Hackett
When Revolut was fined €3.5 million last week by the Bank of Lithuania, it was for failures in monitoring customer relationships and transactions; core elements of anti-money laundering (AML) compliance.
Compliance is complicated, but the failures here were avoidable.
A fast-moving fintech opened accounts at pace, grew rapidly, and didn’t keep its controls in step. It’s part of a growing trend: neobanks and other new entrants prioritising speed over scrutiny, onboarding quickly without laying the foundations for proper ongoing due diligence.
Regulators are starting to push back.
We saw it in October, too, when we analysed Starling Bank’s £29 million FCA fine after falling short on key AML processes. They screened too slowly, missed key sanctions lists, and didn’t document risk-based decisions. When they eventually reran their customer base against the full UK sanctions list, they triggered 48,000 alerts in one go.
They reflect a broader problem regulators are now acting on.
AML is moving from reactive to real-time
It used be enough to verify a customer at onboarding and maybe check a sanctions lists monthly or quarterly. That’s not enough now.
Regulators expect financial institutions to:
- monitor risk profiles continuously
- detect changes in status as they happen
- keep clear, auditable records of how risks are handled
That’s hard to do manually, especially as customer numbers grow. But the expectation is clear: controls must scale with the business.
How some firms are staying ahead
We’re solving this problem for regulated firms with Alerts, our continuous due diligence product.
With Alerts switched on, every verified customer is checked daily against more than 270 global data sources, covering sanctions lists, politically exposed persons, debarred Companies House directors, and more. If a new match is found:
- It’s flagged immediately in their dashboard
- A small data payload sends the alert straight to their internal system
Firms have told us that false positives are a big headache, so we use a best-in-class matching algorithm, along with customisations like a sensitivity slider you can drag to fit your risk appetite and use case, along with filtering out irrelevant data sources.
It’s a lightweight step, but one that helps firms stay compliant as they scale—and ready to answer when the regulator calls.
Don’t wait for the fine
Revolut and Starling didn’t ignore compliance. But they outgrew their systems before those systems were ready.
That’s the real lesson: what worked at 10,000 customers likely won’t work at 100,000. And the longer you delay, the harder it gets to put things right without disruption.
Alerts helps risk and compliance teams close that gap. It’s easy to enable. It fits around your workflows. And it means fewer surprises when scrutiny arrives.
Learn more about Alerts, or book a demo with our co-founder, Chloe.
