Overview of the DriveWealth incident
Who is DriveWealth?
DriveWealth LLC is a licensed third-party US broker-dealer. They provide essential execution and clearing services specifically for Revolut's US investment service, ensuring your trades are processed smoothly.
When customers originally signed up for US investments, they entered into two agreements: one with the relevant Revolut trading entity and another with DriveWealth in the US. The information we needed to provide our trading services was shared with both parties.
This remains the current arrangement in the US. In the UK, the EEA, and Australia, this existed only during specific periods in the past, with dates varying by market. DriveWealth continues to retain historical account records in accordance with US financial regulations.
What happened during the incident and who's affected?
DriveWealth recently informed us that an unauthorised party accessed customer data held on its systems. Revolut’s own systems, app infrastructure, and core databases were not accessed or affected in any way. All Revolut customer funds and investments remain completely safe.
All affected Revolut customers have received two emails, one from DriveWealth and one from Revolut, confirming they were impacted and explaining the scope of the breach. If you haven't received these emails, it means you aren't affected (but check your spam folder).
DriveWealth sent an email to affected customers whose US stocks account is, or was, held with them. DriveWealth acts as an independent data controller in this context, and we can confirm this email was genuine.
How will I know if I'm affected?
DriveWealth is directly notifying affected customers by email. If you hold a US investment account and are impacted, you'll receive a communication from DriveWealth, plus a confirmation email from Revolut.
If you receive these notifications, we strongly recommend reading the email carefully. Visit the DriveWealth website for more context, or email accountsecurity@drivewealth.com with any questions about your specific data.
Under our current account setup in the UK, EEA, and Australia, individual customers' personal details are never shared with DriveWealth. That's why customers on this newer setup were not affected by this incident.
Why does DriveWealth have my information?
For accounts created under a direct Brokerage setup, customers entered into a direct relationship with DriveWealth and agreed to their T&Cs. This includes current US accounts and older UK, EEA, and Australian accounts.
US financial regulations require brokers holding these direct accounts to maintain accurate identity and trading records for compliance purposes. This is why DriveWealth retained your historical information on their systems.
As a partner, Revolut relies on DriveWealth's Brokerage infrastructure to give customers seamless access to shares listed on major US markets, including the New York Stock Exchange (NYSE) and the Nasdaq Stock Market (NASDAQ).