PRA Issues Section 166 Notice to Revolut Over Product Pipeline Concerns

PRA Turns Its Skilled-Person Lens on Revolut's Product Pipeline

The Bank of England's Prudential Regulation Authority has issued a so-called Section 166 notice to Revolut, the London-headquartered neobank, according to reporting first attributed to the Financial Times and subsequently picked up by secondary outlets. The notice — a formal mechanism under the Financial Services and Markets Act that compels a regulated firm to commission an independent "skilled person" review — signals that the PRA has identified supervisory concerns serious enough to warrant structured, third-party investigation into the firm's internal processes.

The specific scope of the skilled-person review, the identity of the appointed reviewer, and the precise timeline for its completion have not been independently verified by Fin Desk. The underlying Financial Times article has not been reviewed directly, and details characterising the nature of the PRA's concerns should be treated with caution until primary source confirmation is available.

What a Section 166 Actually Means

A Section 166 notice is not, in itself, a finding of wrongdoing or a formal enforcement action. It is a supervisory tool — one the PRA and FCA deploy regularly across the financial industry — designed to give regulators an independent assessment of a firm's systems, controls or governance in an area of concern. The review is conducted at the firm's own expense by an external specialist approved by the regulator.

A Section 166 is the regulator saying: "We are not yet satisfied with what you have told us — show us the evidence, independently verified." It carries real weight precisely because it is not a fine or a public censure, but a compulsory audit that the firm cannot manage away.

The use of a skilled-person review does not predetermine the outcome. Firms have emerged from Section 166 processes with clean bills of health; others have faced follow-on supervisory action. The significance lies in the signal: the PRA has concluded that its normal supervisory dialogue with Revolut is insufficient to address the concern at hand.

Context: A Bank Licence Still Finding Its Feet

Revolut received its long-awaited UK banking licence from the PRA and FCA in July 2024, ending a three-year authorisation process that had drawn repeated scrutiny over the firm's financial controls, audit practices and organisational governance. The licence was granted with restrictions — a standard condition for newly authorised banks that limits the scale of deposit-taking until the regulator is satisfied the firm's infrastructure is sufficiently mature.

Operating as a fully licensed UK bank, rather than as an e-money institution, brings Revolut under the PRA's direct prudential supervision for the first time in a meaningful operational sense. That change in regulatory relationship substantially raises the bar for internal governance, risk management and product oversight. What was tolerable practice for a large e-money institution may not meet the expectations the PRA holds for a deposit-taking bank.

The Product Velocity Question

Revolut has built much of its commercial identity on its ability to launch new products and features at speed — a cadence more typical of a consumer technology company than a traditional lender. That velocity is both a competitive advantage and a governance challenge. Banks are expected to run structured new product approval processes that assess credit risk, operational risk, consumer harm potential and regulatory compliance before launch, not retrospectively.

Whether the PRA's skilled-person review specifically targets Revolut's new product approval framework cannot be confirmed from available sources. What is clear, editorially, is that the tension between a fintech's growth ambitions and a prudential regulator's expectation of methodical, documented risk governance is exactly the kind of fault line that Section 166 notices are designed to probe.

What Comes Next

The outcome of a skilled-person review is not automatically made public. The appointed reviewer reports to both the firm and the regulator; public disclosure depends on subsequent regulatory or enforcement action, or voluntary transparency from the firm. Revolut has not, at the time of writing, issued a public statement on the matter as reported by secondary outlets.

For the broader fintech sector, the development is a pointed reminder that a banking licence is not a destination — it is the beginning of a more demanding supervisory relationship. Firms that entered banking authorisation processes expecting a one-time compliance burden are now confronting what continuous prudential supervision actually looks like in practice.

Fin Desk will continue to track this story as primary source material becomes available.