Digital Audit - Revolut

Domain: Digital - Digital / Technology Entity scope: Revolut Group Holdings Ltd / Revolut Ltd (London) - standalone fintech/neobank (no parent group). Revolut-corporate’s OWN technology is in scope. Vendor-domicile rule applies: Israeli-founded-but-US-domiciled vendors (Snyk - Boston; Wiz - NY/Google, Tel Aviv engineering) are flagged carefully, not scored as clear Israeli-domiciled relationships; only genuinely Israeli-domiciled vendors counted in scope. Compiled: 2026-06-24 Method: Live web search only

Enterprise Technology Stack & Vendor Relationships

Revolut runs a cloud-native, multi-vendor stack centred on Google Cloud as primary infrastructure, with a multi-year strategic partnership integrating Google’s Gemini models into fraud detection.¹ For KYC/identity verification, Revolut has documented partnerships with Fourthline (Amsterdam, Netherlands), GBG (Chester, UK), and Entrust (Minneapolis, US) - none Israeli-domiciled.²³⁴

For application/open-source security Revolut uses Snyk (HQ Boston, US) to meet PCI standards.⁵ Snyk is Israeli-founded (2015; co-founders Guy Podjarny - ex-IDF Unit 8200 - and Danny Grander - ex-IDF R&D cyber) but is legally US-domiciled (Boston HQ), so it does not meet the Israeli-domicile criterion; flagged.⁶ For cloud-security posture management Revolut uses Wiz (HQ New York; acquired by Google, completed March 2026), which is Israeli-founded (2020) with engineering substantially based in Tel Aviv but US-registered (now a Google subsidiary) - flagged as a borderline Israeli-origin vendor whose legal domicile is US/Google.⁷⁸⁹

No public evidence identified of Revolut using Riskified (Tel Aviv), BioCatch (Tel Aviv), AU10TIX (Israeli-domiciled), Forter (NY-HQ, Israeli-founded), Identiq, or ThreatMetrix as named vendors.

Surveillance, Biometrics & Retail Technology

Revolut’s KYC biometric/identity vendors (Fourthline, GBG, Entrust) are Netherlands-, UK-, and US-domiciled respectively; no public evidence identified of Revolut procuring behavioural biometrics from Israeli-domiciled vendors such as BioCatch (Tel Aviv) or AU10TIX at any point in its documented stack.²³⁴ Revolut’s fraud detection runs largely in-house (its PRAGMA model, see AI) with Google Gemini integrated at platform level, and an internal staff compliance-monitoring system (“Karma”) has no identified Israeli-vendor connection.¹¹⁰ Revolut’s September 2022 social-engineering data breach (~50,150 customers) was notified to Lithuania’s data-protection authority, with no Israeli-domiciled vendor involvement identified.¹¹

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Revolut is cloud-native on Google Cloud (US/global), with a 2025 multi-year strategic partnership powering its global infrastructure including Gemini-based fraud detection.¹⁹ For AI training/inference it uses Nebius (European AI infrastructure, formerly Yandex Cloud) across 200+ NVIDIA H100 GPUs - not Israeli-domiciled.¹² No public evidence identified of Revolut using Israeli sovereign cloud, Israeli government-affiliated cloud, or data-residency arrangements in Israel for its core banking stack.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of Revolut holding contracts with Israeli defence or intelligence entities, the IDF, or Israeli government agencies in a technology-supply capacity. The IDF-veteran founding backgrounds of Snyk’s and Wiz’s founders are noted, but both are US-domiciled commercial vendors supplying standard application-security and cloud-security tooling to Revolut; no residual operational tie between their commercial products and Israeli military/intelligence infrastructure was identified.⁶⁸ No public evidence identified of Revolut using NSO Group, Cellebrite, or other Israeli surveillance-technology vendors.

AI, Algorithmic & Autonomous Systems

Revolut developed an in-house family of foundation models, PRAGMA, pre-trained on ~40 billion banking events / 207 billion tokens from ~25 million users across 111 countries, powering credit scoring, fraud detection, and lifetime-value prediction on 200+ NVIDIA H100 GPUs via Nebius.¹²¹³ It also integrates Google Gemini for fraud detection, has deployed a GPT-5-powered FinCrime compliance agent, and reports ~30% reduction in certain fraud losses since February 2024 via ML anomaly detection.¹¹⁴¹⁵ None of these AI systems was identified as procured from or dependent on Israeli-domiciled AI vendors.

Technology Ecosystem & R&D Footprint

Israel presence - market-entry/operational, not an R&D hub. Revolut entered the Israeli market in 2023, received a Bank of Israel identification code (August 2024) to participate in Israel’s payment system as a non-bank payment-services provider, and in 2025 received an Israeli payment-institution licence (alongside Rapyd, Airwallex, and Mesh Payments).¹⁶¹⁷ It is in discussions with the Bank of Israel for a “lean bank” licence and has hired local operations leadership (including Uri Nathan, former CEO of the Israeli neobank Pepper).¹⁸¹⁹ No public evidence identified of a Revolut engineering R&D centre, software-development hub, or technology office in Israel - the documented Israel footprint is commercial/operational (market expansion, regulatory engagement, local operations hiring), not R&D. Revolut’s primary engineering centres are in the UK, Lithuania, Poland, India, and Singapore.

Civil Society Scrutiny & Regulatory History

Revolut’s documented regulatory history is AML/data-focused: a 2025 €3.5 million AML fine from Lithuania’s central bank for transaction-monitoring weaknesses; the self-reported 2022 data breach to Lithuania’s data-protection authority; and prior UK FCA concerns about risk controls that delayed (but did not prevent) its UK banking licence.²⁰¹¹²¹ No public evidence identified of civil-society organisations raising concerns specifically about Revolut’s use of Israeli surveillance technology or Israeli data-sharing arrangements; Revolut’s Israel expansion has been covered as a market-entry story in fintech trade press (boycott/political coverage is addressed in Political).¹⁷¹⁸

End Notes