Revolut · Governance finding · severity 1 of 5
A proposed class action filed in Cook County, Illinois, in December 2023 alleges that Revolut breaks Illinois' Biometric Information Privacy Act (BIPA) in its sign-up process. According to Banking Dive and Finextra, applicants submit a photo of their ID and a selfie, and facial recognition software checks that they show the same person. The suit claims Revolut collects and stores this biometric data without the written consent BIPA requires, does not disclose third-party involvement, and has no public policy on how long the data is kept or when it is destroyed. Biometric Update reported that Revolut uses Onfido for these checks. Revolut declined to comment. No outcome has been reported as of October 2026.
Record last reviewed Oct 21, 2026 · Markdown
Date
Dec 2023 · disclosed Jan 3, 2024
Institution
Country
United States
AI system
Facial recognition matching a selfie to an ID photo during account sign-up · vendor: Onfido (per Biometric Update)
AI?
Machine-learning system (inferred from the record)
The sources describe a machine-learning model; nobody on the record labelled it AI.
Category
Status
Court filing
Severity
1 of 5
Impact
The proposed class is Illinois residents who went through Revolut's selfie identity check; plaintiff's counsel estimated at least 10,000 Illinois users. No data breach or financial loss is alleged.
What happened?
In December 2023 a Revolut customer filed a proposed class action against Revolut in the Circuit Court of Cook County, Illinois, under the Biometric Information Privacy Act. According to Finextra, applicants for a Revolut account submit photographs of their ID and a selfie, and "facial recognition software is then used to ensure the two images are the same person." Biometric Update reported that Revolut uses face biometrics from Onfido for these know-your-customer checks.[1][2][3]
The complaint alleges that Revolut collects and stores users' biometric data without the written consent BIPA requires. It also alleges that Revolut does not disclose third parties' part in the verification process, and has no public policy on how long it keeps biometric data, why, and how and when it is destroyed. It seeks a declaration that Revolut's conduct violates BIPA, an order stopping the collection, and statutory damages of $1,000 per negligent and $5,000 per reckless violation over the preceding five years.[1][2]
Plaintiff's counsel told Banking Dive he "would not be surprised if IL accounts for at least 10K users." Biometric Update noted that Revolut's US arm is registered in Delaware and based in New York with no Illinois offices, so jurisdiction could be contested.[1][3]
When did it happen?
- Dec 2023
A proposed BIPA class action against Revolut is filed in the Circuit Court of Cook County, Illinois.[1]
- Jan 3, 2024
The suit is first reported; Biometric Update notes that Revolut uses Onfido face biometrics for KYC.[3]
- Jan 10, 2024
Banking Dive and Finextra report the case; Revolut declines to comment.[1][2]
What was the impact?
- Customers: The proposed class is Illinois residents who went through Revolut's selfie identity check; plaintiff's counsel estimated at least 10,000 Illinois users. No data breach or financial loss is alleged.[1]
Severity 1 of 5: Contained: privacy-law allegations by a single proposed class with no finding, no reported data exposure and no customer losses; no outcome has been reported.
How did Revolut respond?
A Revolut spokesperson declined to comment on the lawsuit, according to Banking Dive. No later public statement was found as of 2026-10-21 in a web search of news coverage of the case.[1]
What was the outcome, and did regulators act?
No outcome has been reported. As of 21 October 2026 we found no ruling, settlement or dismissal in news coverage, and no federal docket for the case on CourtListener; the Cook County docket (2023CH09951) could not be checked online. No regulator has acted.[1]
Why is Revolut being sued in Illinois?
A proposed class action filed in Cook County in December 2023 alleges that Revolut's sign-up check, which uses facial recognition to match a selfie to an ID photo, collects biometric data without the written consent, disclosures and public retention policy required by Illinois' Biometric Information Privacy Act.
Did Revolut lose customer data or money?
No breach or financial loss is alleged. The suit concerns how biometric data is collected, disclosed and retained, and seeks statutory damages of $1,000 per negligent and $5,000 per reckless violation, plus an order stopping the collection. No court has found a violation.
Is Revolut's identity check AI?
The reporting describes facial recognition software comparing a selfie with an ID photo, which Biometric Update says is supplied by Onfido. That is machine-learning-based face matching, but neither Revolut nor the court record calls it AI, so the AI link here is inferred from the record.
What happened to the Revolut BIPA case?
No outcome had been reported as of October 2026. Revolut declined to comment when the suit was filed, and we found no later ruling, settlement or dismissal in news coverage or federal dockets. The Cook County docket could not be checked online.
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning