The Handover: A Fake Subpoena, a Real Archive, and What FATF Built
When Revolut emptied customer dossiers for a fabricated government inquiry, it wasn't a rogue slip—it was compliance operating exactly as mandated.
The confirmation was matter-of-fact and devastating in its implications. Fintech operator Revolut acknowledged this past week that it handed over comprehensive customer dossiers—passports, verification selfies, residential addresses, IBANs, and complete transaction histories, including Bitcoin transfers—in response to a fraudulent government demand. The attackers did not rely on exotic zero-day exploits, breached databases, or broken cryptography. The email came from a real government agency's domain, and Revolut complied because the rules told it to.
As human rights advocate Lyudmyla Kozlovska highlighted, the vulnerability lies not in a momentary lapse of employee vigilance, but in the statutory architecture of global financial surveillance. Under Financial Action Task Force standards transposed into American, European, and British statutes, every regulated institution is legally required to stockpile exhaustive dossiers on its users and deliver them immediately upon state request. Institutions face fines reaching into the millions for any delay, yet face zero penalties for surrendering too much. Crucially: Nobody is required to check whether the state behind the request is legitimate.
For years, civil liberties monitors documented how authoritarian regimes and state proxies wielded AML/CFT protocols against dissidents, journalists, and diaspora businesses in what Kozlovska terms transnational financial repression
. Now, those same dragnet mechanisms routinely trap everyday Bitcoiners and fintech users. Reflecting on the systemic machinery of passive corporate profiling, MetropleX of the GrapheneOS project remarked that daily surveillance creates behavioral reservoirs ripe for societal steering: The state is not God.
With European regulatory trilogues stripping out proposed AML privacy safeguards behind closed doors, Kozlovska issued an urgent summons across decentralized networks: Privacy has to be protected and normalised as a human right. Now, before it is too late.
— Source report · GrapheneOS perspective
