revolut australia banking licence

The Engineering Behind Revolut's Australian Banking Licence: A Platform Compliance Case Study

Revolut's Australian banking licence isn't just a regulatory checkbox-it's a proof of how modern fintech platforms must rebuild their core infrastructure to meet the strictest compliance and data sovereignty requirements on the planet. When the Australian Prudential Regulation Authority (APRA) granted Revolut a restricted banking licence in March 2025, it marked the culmination of years of engineering work that most users will never see. The licence, formally known as a restricted authorised deposit-taking institution (RADI) licence, allows Revolut to begin limited banking operations before scaling to a full licence. But what does this actually mean for the software systems that power the platform?

For senior engineers, this is a fascinating case study in how a global fintech must decompose its monolithic platform into region-specific microservices, implement hardened identity verification pipelines. And build real-time regulatory reporting that can withstand APRA's notoriously rigorous audits. The "revolut australia banking licence" isn't just a legal document-it's a technical specification that forces architectural decisions across every layer of the stack.

Why APRA Compliance Demands a Microservices Overhaul

APRA's prudential standards are among the most demanding globally, particularly CPS 234 (information security) and CPS 231 (outsourcing). For Revolut, this meant that its existing shared infrastructure-which serves multiple jurisdictions from a centralised stack-had to be refactored into isolated Australian tenancy. In production environments, we've seen similar transformations at other fintechs. And the engineering effort is staggering. Revolut likely had to spin up dedicated Kubernetes clusters in AWS Sydney (ap-southeast-2) with strict network policies enforcing data residency.

The core challenge is data sovereignty. Under Australian law, customer transaction data, personally identifiable information (PII), and even system logs cannot leave the country without explicit approval. Revolut's engineering team had to add data partitioning at the database level, likely using PostgreSQL logical replication with row-level security policies to ensure that Australian customer data never touches European or US instances. This isn't a simple configuration change-it requires rewriting query patterns, auditing every API endpoint for data leakage. And building continuous compliance monitoring into the CI/CD pipeline.

Furthermore, APRA requires that all critical systems have documented recovery time objectives (RTOs) and recovery point objectives (RPOs). Revolut's platform team had to instrument every service with structured logging and distributed tracing (likely using OpenTelemetry) to prove that failover mechanisms work under load. The licence application itself probably included hundreds of pages of architecture diagrams, threat models. And incident response playbooks.

Identity Verification at Scale: The Know Your Customer Pipeline

Australia's Anti-Money Laundering and Counter-Terrorism Financing Act (AML/CTF) requires enhanced due diligence for all account holders. Revolut's existing KYC pipeline, which uses a combination of optical character recognition (OCR), liveness detection, and document verification, had to be adapted to accept Australian driver's licences, passports. And the unique "100-point identity check" system. This is a non-trivial computer vision problem because Australian documents have distinct formats, holograms. And microprint patterns that differ from European IDs.

The engineering solution likely involves a specialised machine learning model fine-tuned on Australian identity documents. Revolut may have used a service like Onfido's document verification API or built custom models using TensorFlow Lite for on-device processing. The liveness detection component must also account for varying lighting conditions and device cameras across Australia's diverse population. In our experience, the false rejection rate for Australian documents can be higher than European ones due to the complexity of the holographic elements, requiring careful threshold tuning.

Beyond initial onboarding, Revolut must add ongoing transaction monitoring that flags suspicious patterns in real-time. This requires a stream processing pipeline-likely using Apache Kafka or Amazon Kinesis-that applies rule-based and ML-based anomaly detection. The "revolut australia banking licence" mandates that these systems be auditable, meaning every decision (accept, reject, escalate) must be logged with a full trace of the features and thresholds used.

Real-Time Regulatory Reporting: A Data Engineering Challenge

APRA requires monthly and quarterly statistical returns (known as the "APRA forms") that cover everything from capital adequacy to liquidity coverage ratios. For a fintech like Revolut. Which processes millions of micro-transactions, generating these reports is a data engineering nightmare. The platform must aggregate transaction data across multiple systems-payments, foreign exchange, crypto (where permitted). And savings-into a consistent schema that matches APRA's definitions.

The technical solution involves building a dedicated data warehouse (likely Snowflake or Amazon Redshift) with materialised views that run on a strict schedule. The reconciliation process must ensure that every cent is accounted for. Which means implementing double-entry accounting at the database level. Revolut likely uses a ledger-based architecture similar to what we've seen at other fintechs. Where each transaction creates immutable journal entries that can be traced back to the original event.

One particularly tricky area is the treatment of foreign exchange (FX) transactions. Revolut's core value proposition is low-cost currency conversion. But APRA requires that all FX exposures be reported with precise risk weights. The engineering team had to implement real-time FX rate feeds (likely from Bloomberg or Reuters via API) and calculate Value at Risk (VaR) models on every trade. This is computationally expensive, requiring either GPU-accelerated calculations or efficient Monte Carlo simulations in Rust or Go.

Cloud Infrastructure and Disaster Recovery: The AWS Australia Setup

APRA's CPS 231 standard on outsourcing requires that cloud providers be subject to the same security controls as the bank itself. Revolut's Australian infrastructure is almost certainly hosted in AWS's Sydney region, with a disaster recovery site in either Melbourne or Singapore (subject to data residency approvals). The engineering team had to design a multi-AZ deployment with automatic failover for all critical services, including the core banking ledger, payment processing, and KYC pipelines.

In production, this means using AWS Route 53 with health checks that monitor service endpoints every 30 seconds. The database layer likely uses Amazon Aurora Global Database. Which provides sub-second replication across regions. However, APRA requires that failover be tested at least annually, which means the team must run chaos engineering exercises-deliberately killing services and measuring recovery times. We've seen similar setups at other regulated fintechs where the SRE team uses tools like Gremlin or Chaos Mesh to simulate failures.

The security architecture includes AWS WAF for web application firewall rules, AWS Shield Advanced for DDoS protection. And AWS KMS for encryption key management. All data at rest must be encrypted using keys that are stored in a hardware security module (HSM) and rotated regularly. The "revolut australia banking licence" also requires that Revolut maintain an independent security audit, likely using the SANS Critical Security Controls as a baseline.

Payment Systems Integration: The New Payments Platform (NPP) Connection

To operate as a bank in Australia, Revolut must connect to the New Payments Platform (NPP), which enables real-time, 24/7 payments with the PayID addressing system. This requires building a direct integration with the NPP's API gateway. Which uses ISO 20022 messaging standards. The engineering challenge is that NPP transactions are irrevocable-once a payment is confirmed, it can't be reversed. This places extreme demands on the payment processing pipeline's reliability and idempotency.

Revolut's payment engine must handle the NPP's strict latency requirements: payments must be confirmed within 15 seconds. Or they risk being rejected. This means the entire payment flow-from user request to ledger update to NPP confirmation-must be optimised for sub-second response times. The team likely uses a combination of Redis for session caching, gRPC for inter-service communication. And a distributed transaction coordinator like Apache Camel or Temporal io.

Additionally, Revolut must support the Bulk Electronic Clearing System (BECS) for direct debits and payroll deposits. This is a batch processing system that runs on a daily schedule, requiring a completely different architectural pattern from the real-time NPP. The engineering team had to build a batch job scheduler that can handle millions of transactions while maintaining audit trails and error handling. Any failed BECS transaction must be retried with exponential backoff and logged for regulatory review.

Open Banking and Consumer Data Right Compliance

Australia's Consumer Data Right (CDR) requires that banks provide secure API access to customer data upon request. For Revolut, this means implementing the Consumer Data Standards specifications, which include OAuth 2. 0 - OpenID Connect, and FAPI (Financial-grade API) security profiles. The engineering effort is significant because the CDR mandates strict response time SLAs, data minimisation. And consent management.

The consent management system must allow customers to grant and revoke access to specific data categories (e g., transaction history, account balances) with fine-grained control. Revolut likely built this using a policy engine like Open Policy Agent (OPA). Which evaluates access requests against stored consent records. The API gateway must also enforce rate limiting and audit logging for every CDR request, as the regulator (the ACCC) conducts random audits to ensure compliance.

One technical nuance is that the CDR requires "data holders" (i. And e, banks) to provide a "product reference data" API that lists all available banking products. For Revolut, which has a constantly evolving product set (spending accounts - savings pots, crypto wallets, insurance), maintaining this API is a continuous integration challenge. The team must automate the generation of product metadata from the core banking system and validate it against the CDR schema before deployment.

The Engineering Roadmap: From Restricted to Full Licence

The restricted banking licence is a stepping stone. Revolut now has up to two years to meet the full licence conditions, which include maintaining a minimum capital adequacy ratio of 8%, implementing a complete risk management framework, and demonstrating profitability. For the engineering team, this means scaling the platform to handle a much larger customer base while maintaining the same compliance posture.

The key technical milestones likely include: migrating from a shared ledger to a dedicated Australian core banking system (possibly using a platform like Thought Machine or Mambu), implementing real-time fraud detection using graph databases (like Neo4j) to analyse transaction networks. And building a customer-facing dashboard for regulatory reporting. The team must also prepare for APRA's on-site inspections, which involve reviewing source code, deployment pipelines, and incident response logs.

One area that often surprises engineers is the requirement for "prudential reporting" that covers not just financial data but also operational risk metrics. This includes tracking system uptime, mean time to recovery (MTTR),, and and the number of security incidentsRevolut's SRE team must instrument every service with custom metrics and feed them into a reporting dashboard that APRA can access on demand. This is a non-trivial observability challenge, especially when dealing with legacy systems that may not expose the required telemetry.

FAQ: Common Questions About the Revolut Australia Banking Licence

1. What is the difference between a restricted and full banking licence in Australia?
A restricted licence (RADI) allows a new entrant to conduct limited banking activities-typically accepting deposits up to a cap and offering basic transaction accounts-while they build the operational infrastructure to meet full licence conditions. A full licence removes these restrictions and allows the institution to offer a full suite of banking products, including lending. The transition requires APRA approval and typically takes 12-24 months,?

2How does Revolut's Australian infrastructure differ from its European setup?
The Australian infrastructure must comply with strict data sovereignty laws, meaning all customer data must reside within Australia. This requires dedicated Kubernetes clusters, databases. And storage in AWS Sydney, with no cross-border data flows unless explicitly permitted. The European setup, governed by GDPR, allows for data processing across EU member states under standard contractual clauses. Australian compliance also demands enhanced AML/CTF controls specific to the 100-point identity verification system,?

3What programming languages and frameworks are likely used in Revolut's Australian platform?
Based on Revolut's public engineering blog posts and job listings, the core banking system is written in Kotlin and Java, using Spring Boot for microservices. The data pipeline likely uses Apache Kafka for stream processing and Python for ML models. Infrastructure is managed with Terraform and Kubernetes, with Helm charts for deployment. The KYC pipeline probably uses TensorFlow or PyTorch for computer vision models, with ONNX runtime for inference.

4. How does the Consumer Data Right (CDR) affect Revolut's API design?
The CDR mandates that Revolut expose APIs conforming to the Consumer Data Standards. Which use OAuth 2. 0 and FAPI security profiles. This means all API endpoints must support token-based authentication with consent management, response time SLAs under 1. 5 seconds for most queries, and complete audit logging. The API gateway must also add throttling and data minimisation rules to ensure only requested data fields are returned.

5. What happens if Revolut fails to meet APRA's conditions during the restricted licence period?
APRA has the authority to revoke the restricted licence or impose additional conditions, such as higher capital requirements or restrictions on customer onboarding. In extreme cases, APRA can appoint a statutory manager to oversee the institution's operations. Revolut must submit quarterly progress reports to APRA and undergo independent audits to demonstrate compliance. Failure to meet conditions could also trigger a public enforcement action, damaging the brand's reputation in the Australian market.

Conclusion: What This Means for Fintech Engineers

The "revolut australia banking licence" is more than a regulatory milestone-it's a blueprint for how any fintech can expand into heavily regulated markets. The engineering challenges are immense: data sovereignty, real-time compliance reporting, identity verification at scale. And integration with local payment systems. But the lessons are transferable. Every fintech that aspires to become a bank must eventually face these architectural decisions.

For engineers working on similar platforms, the key takeaways are: invest in infrastructure-as-code from day one, design for data partitioning and isolation before you need it. And build compliance monitoring into your CI/CD pipeline. The cost of retrofitting these capabilities is exponentially higher than building them in from the start. Revolut's journey shows that with disciplined engineering and a commitment to regulatory standards, even a digital-first challenger can earn the trust of a prudential regulator.

If you're building a fintech platform and need help navigating compliance-driven architecture, contact our team at Denver Mobile App Developer for a consultation on regulatory-ready infrastructure design.

What do you think?

Should APRA impose stricter technical requirements for cloud-based banking platforms,? Or is the current framework sufficient to ensure resilience?

How should fintechs balance the cost of compliance engineering against the need to ship features quickly in a competitive market?

Is the Consumer Data Right model exportable to other jurisdictions,? Or does Australia's unique regulatory environment make it a special case?