Got funds on your Revolut card? If you do, you may wish to know what do the firm\u2019s recent accounting problems say about the safety of\u00a0 its clients\u2019 money. Read on to discover some alarming holes in the UK financial regulator\u2019s safeguarding regime.<\/p>\n
Revolut\u2019s qualified accounts<\/strong><\/p>\n Last week payment card giant Revolut published its 2021 accounts three months late<\/a>, likely as a result of wrangling between the fintech firm and its auditor, BDO Hamlyn.<\/p>\n In the end, BDO raised a red flag by qualifying the accounts. The auditor said it could not satisfy itself concerning the “completeness and occurrence of revenue” totalling \u00a3477m\u2014three quarters of Revolut\u2019s reported income for the year.<\/p>\n Explaining its decision, BDO said in its auditor\u2019s report that it had not been able to find reliable documentary evidence of these revenue streams outside of Revolut\u2019s own IT system.<\/p>\n Like other financial technology (“fintech”) firms, Revolut\u2019s dramatic growth path seems to have hit the buffers in the last couple of years.<\/p>\n In 2021 its last external fundraising<\/a> valued the firm at $33bn, up from $5.5bn just a year earlier.<\/a> This made the digital payments firm the UK\u2019s most valuable private tech company of all time.<\/p>\n But since then, fintech valuations have slid, including Revolut’s. Last week, the UK\u2019s Daily Telegraph reported that one investor, US venture firm Triplepoint, had cut its internal valuation of Revolut by 15 percent<\/a>.<\/p>\n Most press headlines in recent days have focused on Revolut\u2019s revenue problems, profitability and market valuation. But another important question remains uncovered. Are its users\u2019 funds safe?<\/p>\n e-money safeguarding<\/strong><\/p>\n Revolut is an electronic money institution (EMI), a category of financial firm covered by a different set of rules to banks.<\/p>\n As an EMI, Revolut cannot reuse client deposits, for example as the foundation for a lending business. Instead, it has to earn its income from fees and commissions, such as the interchange fees<\/a> paid on debit card transactions.<\/p>\n EMI clients are far less protected<\/p><\/blockquote>\n There\u2019s another big difference between EMIs and banks: EMI clients are far less protected if the firm they use gets into trouble.<\/p>\n Depositors at a UK bank are protected by government insurance\u2014called the Financial Services Compensation Scheme, or \u2018FSCS\u2019\u2014up to a maximum of \u00a385,000 per institution. If your bank goes bust, the government should refund your deposit within seven days.<\/p>\n But payment firms and EMIs offer no such guarantee<\/a>.<\/p>\n To mitigate the risk that clients lose money, the UK\u2019s Financial Conduct Authority (FCA) requires EMIs and payment service providers (PSPs) to follow a so-called \u201csafeguarding\u201d policy. This means that they have to keep their own money separate from client money or protect client funds with an insurance policy.<\/p>\n In 2020, following the dramatic collapse of German payments giant Wirecard after a massive fraud<\/a>, the FCA beefed up its safeguarding rules<\/a>.<\/p>\n Wirecard\u2019s failure had caused a number of payment cards that were clients of Wirecard’s UK subsidiary to stop working<\/a>. To unblock the cards, the FCA swiftly reversed an earlier decision<\/a> to freeze the activities of that UK Wirecard entity.<\/p>\n Under the new, 2020 safeguarding rules, said the FCA, e-money and payment firms would have to undertake a number of extra steps to ensure that customer funds are kept separate from those of the service provider.<\/p>\n In particular, the FCA said, firms should be able to identify what relevant client funds the firm holds, \u2018at any time and without delay\u2019.<\/p>\n 57 percent did not have adequate wind-down plans<\/p><\/blockquote>\n But fintech\u00a0firms\u2019 practices have in the past fallen short of this goal.<\/p>\n In a 2021 webinar, FCA executive Peter Charles said<\/a> that spot checks conducted by the regulator on a sample of payments firms and EMIs had shown that 57 percent did not have adequate wind-down plans, which would enable insolvency practitioners to identify quickly where customer funds are held and how to return them.<\/p>\n And if a payment firm or EMI were to fail, any costs of administration would be paid by customers from their safeguarded funds, the FCA confirmed.<\/p>\n In the 2020 failure of an EMI called Supercapital, which provided FX and international payments services, the insolvency firm deducted 10.5 percent of clients\u2019 e-money balances to cover the costs of administration, while clients had to wait several months to get the remaining 89.5 percent of their funds back.<\/p>\n Revolut\u2019s revenues a safeguarding problem?<\/strong><\/p>\n In the auditor\u2019s report that was published last week, BDO said it hadn\u2019t been able to establish with sufficient certainty that Revolut\u2019s reported revenues actually existed.<\/p>\n Shouldn\u2019t this raise concerns over the payment firm\u2019s safeguarding practices?<\/p>\n Not necessarily, said an auditor I interviewed for this article, who requested anonymity.<\/p>\n \u201cThere\u2019s no obvious link to say that just because there\u2019s a potential limitation about a company\u2019s revenues, there\u2019s also a concern about safeguarded funds,\u201d said the auditor.<\/p>\n Revolut\u2019s own auditor, BDO, would likely have checked debtor balances and cash positions before signing the accounts, this person said. Plus, he added, Revolut\u2019s 31 December 2021 balance sheet does distinguish the firm\u2019s own cash from restricted funds held on behalf of customers.<\/p>\n But BDO\u2019s report of inadequate revenue accounting at Revolut doesn\u2019t inspire confidence that the firm had a real-time check on its own and its customers\u2019 balances.<\/p>\n \u201cNormally for a fintech, revenue numbers would be passed in real time or as a batch into an accounting platform,\u201d said a former Fintech CEO, who also requested anonymity.<\/p>\n shouldn\u2019t fintechs be able to keep funds properly segregated?<\/p><\/blockquote>\n \u201cThat needs to be done at a fairly atomised level. My understanding is that at Revolut there was just a single number aggregating all fund movements into the accounting ledger,\u201d said the ex-CEO.<\/p>\n \u201cThe problem they then had was confirming that number against transactions,\u201d he said.<\/p>\n If these practices had occurred, they would indeed create a risk of company and client funds getting mixed up, the ex-CEO said.<\/p>\n But shouldn\u2019t fintechs be able to keep funds properly segregated during the working day? After all, they are supposed to be better at technology than banks and traditional financial firms, who usually reconcile funds only once a day.<\/p>\n According to regulatory consultant Bovill<\/a>, the answer to that question should be yes. Real-time reconciliations of client and internal funds \u201ccan work in the more agile and technologically developed infrastructure payment service providers and EMIs operate in\u201d, says Bovill.<\/p>\n The ex-CEO I spoke to said that, indeed, at his previous firm he had been able to view a second-by-second summary of his company\u2019s balance sheet.<\/p>\n No transparency on safeguarding audit<\/strong><\/p>\n There are other ways of checking how well Revolut was looking after its clients\u2019 money. An obvious one would be to read the firm\u2019s safeguarding audit, a separate form of financial report that\u2019s been mandatory for EMIs and larger payment firms since 2020.<\/p>\n \u201cWe expect the firm to arrange specific annual audits of its compliance with the safeguarding requirements under the Payment Services Regulations\/Electronic Money Regulations, if it is required to arrange an audit of its annual accounts under the Companies Act 2006,\u201d the FCA wrote in 2020<\/a>.<\/p>\n But this rule has not been enforced\u2014and, amazingly, there is no mechanism for enforcing it.<\/p>\n \u201cThere\u2019s not even a requirement for the safeguarding audit to be reported to the FCA,\u201d the auditor I interviewed told me.<\/p>\n And even if it exists, the safeguarding audit is not made public.<\/p>\n I asked the FCA how many safeguarding audits it had received in the last two years, how many firms received clean audits in each year, why it didn\u2019t require safeguarding audits to be published and what it did in the case of firms not meeting the safeguarding standards. The regulator didn\u2019t reply.<\/p>\n I asked Revolut when its latest safeguarding audit had been conducted and by whom. I also asked if I could see the audit, but the firm didn\u2019t reply.<\/p>\n Revolut also failed to answer other questions.\u00a0I had asked it what changes it was making to its internal controls in order to give its auditor the necessary comfort over revenues. I asked it at which banks its client funds were held. And I asked Revolut whether it had submitted a \u201cSUP15\u201d notification form to the FCA<\/a> in connection with the qualification in its audited annual accounts (firms receiving a qualification in their accounts are supposed to do so).<\/p>\n I contacted BDO to ask a straightforward question: does it conduct Revolut\u2019s safeguarding audit, as well as its financial audit? It didn’t respond either.<\/p>\n It\u2019s quite possible that communications on safeguarding have been going on behind the scenes between Revolut, its auditor and the regulator.<\/p>\n \u201cVery few firms have an absolutely clean bill of health on safeguarding\u201d<\/p><\/blockquote>\n \u201cIf a firm can\u2019t reconcile its safeguarded funds there is an indication that the firm should self-notify this to the FCA,\u201d the auditor I interviewed told me.<\/p>\n \u201cAnd if our safeguarding audit opinion of a firm contains exceptional findings that we think need to be brought to the attention of the regulator, we will send a copy to the FCA. But we are aware of firms out there that have kicked the can down the road and not done a safeguarding audit.\u201d<\/p>\n There are other apparent causes for concern.<\/p>\n \u201cVery few firms have an absolutely clean bill of health on safeguarding,\u201d said another fintech consultant, who also requested anonymity.<\/p>\n Reckoning ahead for fintechs<\/strong><\/p>\n According to payments veteran Grant Halverson, there\u2019s a reckoning ahead for fintech firms that have expanded too much, too fast and are now contending with rising interest rates and a tougher compliance burden.<\/p>\n \u201cRevolut is very aggressive and is following the Facebook playbook: \u2018Rules don\u2019t apply to us, we\u2019re going to break everything and just bust through\u2019,\u201d Halverson told me.<\/p>\n \u201cRules don\u2019t apply to us, we\u2019re going to break everything and just bust through\u201d<\/p><\/blockquote>\n \u201cThat only takes you so far\u2014until the regulators pop up.\u201d<\/p>\n \u201cRevolut\u2019s cash burn is still high, with the firm getting two external loans, rather than going back to venture capital investors,\u201d Halverson said, referring to the absence of an external funding round since 2021.<\/p>\n Private equity and venture capital-backed firms are loath to do a \u2018down round\u2019 (a fundraising at a lower valuation than the last one) because it can ruin the prospects of an eventual flotation on the public equity market.<\/p>\n There\u2019s another, more fundamental problem facing Revolut, Halverson went on.<\/p>\n \u201cUnless you can get a banking licence, how can you broaden out your revenue stream?\u201d he queried.<\/p>\n Mikko Salovaara, Revolut\u2019s chief financial officer, told the Guardian last week<\/a> that the company was on the brink of getting a banking licence from the UK regulators.<\/p>\n \u201cI think we\u2019re at the very last stages. Really at the finish line,\u201d he said.<\/p>\n But the company\u2019s CEO said the same thing six months ago<\/a>. And ten months before that<\/a>.<\/p>\n Becoming a UK bank would undoubtedly relieve Revolut of a major headache. It would give the firm access to the UK deposit insurance scheme and remove all concerns over the safety of client funds\u2014at least for smaller depositors.<\/p>\n Can BDO’s qualification of Revolut’s accounts have helped its licence application? It\u2019s hard to see it as a positive.<\/p>\n But while Revolut remains an EMI, the UK\u2019s shaky safeguarding regime cannot reassure those holding funds with the firm.<\/p>\n ***UPDATE***<\/em><\/p>\n Revolut contacted me after the publication of this article to point out that its auditor had said in its report that it had been able to verify 100 percent of clients\u2019 cash balances held with third parties as at year-end, as well as 99.99 percent of Revolut\u2019s own cash balances at the same date.<\/em><\/p>\n Revolut said it had \u201cremediated the limited functionality in its IT systems\u201d (which had resulted in the auditor\u2019s qualified opinion on revenues) during 2021.<\/em><\/p>\n In response to my question on where its clients\u2019 cash was held, Revolut referred to a blog it had written on safeguarding but declined to give banks\u2019 names. Revolut also declined to comment on whether and when it had conducted a safeguarding audit and whether it had submitted a SUP15 form to the regulator in connection with its qualified accounts. However, it said it had been in regular conduct with the FCA ahead of the publication of its accounts.<\/em><\/p>\n Sign up here<\/a> for the New Money Review newsletter<\/em><\/p>\n Click here<\/a> for a full list of episodes of the New Money Review podcast: the future of money in 30 minutes<\/em><\/p>\n Related content from New Money Review<\/em><\/span><\/p>\n Pay attention to payments<\/a><\/p>\n