How to build an app like Revolut: licences, launch order and one ledger

A super app is several regulated businesses behind one sign-up. The licence behind each product in the EU, UK and UAE, the order to launch them, one ledger, the Consumer Duty and app review.

· Head of IT
· 9 min read
A phone showing balances across accounts, crypto and stocks, with a rose payment card, a violet glass bitcoin coin, a gold euro coin and grid and exchange blocks

An app like Revolut looks like one product: one sign-up, one home screen, one total. In law it is several regulated businesses, and most products need their own licence or a licensed partner.

The registers show it: the Bank of Lithuania lists Revolut Bank UAB with a banking licence and Revolut Securities Europe UAB with a financial brokerage firm licence. The EU markets authority's interim register of crypto firms lists Revolut Digital Assets (Europe) Ltd as a crypto-asset service provider (CASP) authorised in Cyprus. In the UK, the Financial Conduct Authority (FCA) lists Revolut Ltd as an e-money institution also registered for crypto, and Revolut Bank UK Ltd and Revolut Trading Ltd as separately authorised firms.

This guide is general information, not legal advice: the details depend on your services and your market, so confirm them with a lawyer and the regulator before you apply.

What a super app bundles

The customer:

  1. signs up once, with an ID scan, a selfie and sanctions screening;

  2. holds money in several currencies and pays by card or phone;

  3. exchanges currencies at a rate shown before confirming;

  4. buys crypto, or part of a share, from the same balance;

  5. moves spare money into savings.

The operator sees a different regulated partner and pot of money behind each product: e-money safeguarded at a bank, card payments through a card issuer, crypto in custody wallets, shares held by a broker, savings at a bank or in a fund. One customer in the backoffice; the money in several legal places.

The licence behind each product

Accounts and cards. A balance customers top up and spend later is e-money, which in practice only e-money institutions and banks may issue (E-Money Directive, Article 10; UK Electronic Money Regulations, regulation 63). Currency exchange comes with the payment licence: the Payment Services Directive lists foreign exchange among a payment institution's ancillary services (Article 18(1)(a)), as the UK does for e-money institutions (regulation 32). In the UAE, the Central Bank licenses stored value, retail payments and currency exchange, with banks deemed licensed for the first two (Federal Decree-Law No. (6) of 2025, Article 61). Cards come from a licensed issuer, often a BIN sponsor; the EU, UK and UAE guides cover partner routes.

Crypto. MiCA, the EU's crypto-asset regulation, requires CASP authorisation, or a notification by an already licensed firm (Article 59; MiCA checklist). UK crypto firms register with the FCA before trading; FCA authorisation under a new regime is expected from 25 October 2027 (FCA; FCA registration guide). In Dubai, outside the Dubai International Financial Centre (DIFC), crypto firms need a licence from VARA, the emirate's virtual assets regulator; elsewhere onshore, the federal Capital Market Authority (CMA) licenses virtual asset activities (Federal Decree-Law No. (33) of 2025, Article 3). Financial free zones have their own regulators, such as the FSRA in Abu Dhabi Global Market (UAE crypto licence guide).

Shares and funds. EU investment services need authorisation under MiFID II, the Markets in Financial Instruments Directive (Article 5), and fund units, money market funds included, are financial instruments (Annex I, Section C). A partner broker can hold the licence while you act as its tied agent, under its responsibility (EU brokerage guide). UK stockbrokers and investment platforms need FCA authorisation. Onshore in the UAE, brokerage, custody and promotion need a CMA licence, and the same law also reaches firms targeting UAE clients from abroad (Articles 2 and 3).

Savings. Only banks may take deposits (Capital Requirements Directive, Article 9); a UK bank needs authorisation from the Prudential Regulation Authority (PRA), and in the UAE taking deposits is licensed under the same Article 61. E-money may earn no interest or other benefit tied to how long it is held (E-Money Directive, Article 12; UK regulation 45). Savings sit at a partner bank, with deposits protected up to €100,000 per depositor in the EU (Deposit Guarantee Schemes Directive, Article 6) and £120,000 per person per bank in the UK since 1 December 2025, up from £85,000 (Financial Services Compensation Scheme, FSCS; PRA PS24/25). Or they sit in a money market fund, whose marketing in the EU must say it is not guaranteed, differs from a deposit and can lose value (Money Market Funds Regulation, Article 36).

E-money is protected mainly by safeguarding, which keeps customer money apart from the firm's own (how that differs from deposit protection). The FSCS does not pay out if a UK e-money firm itself fails (FCA), though it covers eligible customers if the bank holding the safeguarded funds fails (PRA PS2/23), as the EU will from 11 May 2028 (Directive (EU) 2026/804).

In short:

Product

EU

UK

UAE, onshore

Accounts and cards

E-money institution or bank

E-money institution or bank

Central Bank licence, or a bank

Currency exchange

Ancillary to a payment or e-money licence

Ancillary to a payment or e-money licence

Central Bank licence

Crypto

CASP authorisation under MiCA

FCA registration, then authorisation

VARA in Dubai, the CMA elsewhere

Shares and funds

Investment firm under MiFID II

FCA-authorised investment firm

CMA licence

Savings

A bank, or a fund through an investment firm

A bank, or a fund through an investment firm

A bank

A sensible launch order

  1. Accounts, cards and currency exchange first, on a partner's licence: customers use them daily, and they fund everything else.

  2. Crypto or shares next, one at a time, each with its own partner, onboarding questions and risk warnings.

  3. Savings last: they need a bank or a fund partner, and careful wording.

Choose your first licence of your own with the next in mind: under MiCA, Article 60, a bank can add crypto services, and an investment firm those matching its licence, by notifying its regulator at least 40 working days ahead; an e-money institution may only hold and transfer the e-money tokens it issues.

One customer record and one ledger

One customer record. The customer is verified once, but each licensed firm behind the app answers for its own checks: it may rely on another regulated firm's, but stays responsible (Anti-Money Laundering Directive, Article 25; AML Regulation, Article 48, from 10 July 2027). UK rules say the same (Money Laundering Regulations, regulation 39). Keep one record per customer, with every check, document and decision, that each partner can see.

One ledger. One double-entry ledger can carry every balance, fiat and crypto. Underneath, the pots above belong to different firms under different rules. Give each legal entity and each protected pot its own accounts, reconcile each against its bank, broker or blockchain, and never net one against another. Since 7 May 2026, the FCA's client asset rules have required UK e-money firms to reconcile safeguarded funds at least once each reconciliation day (CASS 15.8.19R).

The FCA Consumer Duty for UK products

The Consumer Duty, the standard of care firms owe retail customers, covers e-money and payment institutions too (PRIN 3.1.1AR). It has applied since 31 July 2023 (PS22/9) and will cover regulated crypto activities under the new regime (PS26/13).

Firms must act in good faith, avoid causing foreseeable harm, and enable and support customers to pursue their financial objectives (PRIN 2A.2). Three places matter in a super app:

  • Bundles and cross-selling. Each component and the whole package must give fair value (FG22/5, paragraph 7.17), and the same guidance warns about cross-selling to customers a product may not suit.

  • Leaving. Switching, cancelling or closing must face no unreasonable barriers, such as disproportionately longer waits than for buying (PRIN 2A.6.2R and 2A.6.4G).

  • Nudges. Exploiting emotions or behavioural biases to create demand is not acting in good faith (PRIN 2A.2.3G).

On a partner's licence, the partner is the regulated firm: in the payments example of the FCA's CP26/23, it stays responsible for outcomes delivered through an unregulated distributor, so expect its Duty requirements in your contract. Published on 29 June 2026, the consultation also proposes taking non-UK customers out of scope and folding the board's yearly Duty review (PRIN 2A.8.4R) into its other reporting; final rules are due in the first quarter of 2027.

App store review

Apple's App Review Guidelines, last updated on 8 June 2026, want banking, financial services and crypto exchange apps submitted by the legal entity providing the service (5.1.1(ix)), and trading, investing and money management apps by a financial institution licensed where the app is offered (3.2.1(viii)). Apps from a commercialised template must be submitted by the provider of the content (4.2.6): the app goes out under your developer account, not your vendor's.

Google Play expects financial apps from an organisation account and a Financial features declaration. For crypto exchanges and custodial wallets, the developer itself must be a MiCA-authorised CASP in the EU, registered with the FCA in the UK, or licensed by VARA, the Dubai Financial Services Authority or the FSRA in the UAE. If a partner holds your crypto licence, settle how the app will be listed first.

What drives the cost

  • Products and markets at launch. Each adds a licence or a partner, and its checks on your company.

  • Licences of your own, with their capital and people.

  • The card programme and its approvals.

  • Reconciliation and reporting, growing with every pot of money.

  • Compliance staff: a money laundering reporting officer, monitoring and complaints handling.

Common mistakes

  • Paying interest on e-money, or calling it savings.

  • One protection message for e-money, deposits, funds and crypto.

  • Publishing under the vendor's developer account.

  • Assuming marketing needs no licence. In the UAE, arranging, promoting and marketing licensed activities is a licensed activity itself (Article 61(1)(h)).

What this means for your platform

Our white-label super app is assembled from modules already in production, from accounts and cards to custody, portfolios, identity checks and a double-entry ledger. One customer profile serves every product, and one ledger holds fiat and crypto, reconciled daily against banks, processors and blockchains. You choose which products to launch with; the rest can be added later without a rebuild, once their licence or partner is in place. Connectors already reach partners such as ClearBank for accounts, Marqeta for cards, Fireblocks for custody and Alpaca for shares, and the same modules connect to licences of your own; we help you get the contracts. The ready platform goes live in about 30 days, a custom build in 2 to 3 months, with 100% of the source code and no licence fee or revenue share.

For a single product, start from the white-label banking app, crypto card app or stock exchange platform; anything else can be assembled from the same modules.

Sources

Checked on 7 October 2026.

Written by

Paynoramic's Head of IT

Head of IT

Head of IT at Paynoramic, responsible for the module library every platform is built from. Has worked on payment, banking and workforce platforms for companies including American Express, Teya and Indeed Flex, and for a global card issuer-processor. Writes about what a fintech or crypto launch needs beyond the software: licensing, certification and the real cost.

Keep reading

All insights

Building something like this?

Tell us the idea and we will show you the platform it maps to.

Start your project