It is almost exactly 10 years since the 300,000 British customers lured into Icesave by high interest rates woke up to find that their £4bn in deposits had disappeared when parent company Landsbanki collapsed and the country’s entire financial system went into meltdown.

Iceland’s deposit protection scheme instantly fell over. How could it not? A tiny country with a population about the same as Brighton found itself as the guarantor for savers across Europe, with Dutch as well as British savers heavily invested in the Landsbanki accounts. Today, we’re told, it’s all different. Banks have been forced to raise more capital, supervision and solvency testing is much more robust, and the EU has set a €100,000 (£90,000) minimum deposit protection level for member states.

But let’s take a look at Lithuania, a country of 2.8 million people, where average wages are about a third of those in the UK. Its central bank, the Bank of Lithuania, is keenly promoting itself as a go-to hub for fintech (financial technology) companies.

Its own website – and this is the regulator, not a commercial bank – tries to entice new banks to obtain their EU licence in Lithuania, promising “smooth authorisation” and a “cooperative attitude”. Extraordinarily, it even promises “no regulatory sanctions for the first year of operations”. Why would any bank regulator want to make such a remarkable statement?

This would be of little interest to us if it concerned just Lithuania. But once a start-up obtains a banking licence from Lithuania, it can, under the EU’s “passporting” rules, operate anywhere across the union.

Last week, London-based Revolut, one of the fastest-growing smartphone-based banking services in the UK, announced it had obtained its European banking licence and will start accepting deposits as it “edges further towards its goal of becoming the Amazon of banking”. Revolut is based in London’s Canary Wharf, here so you might expect its licence would come from the nearby Bank of England. But no, the new licence is from the Bank of Lithuania.

Already Revolut has 3 million customers. That’s more people than the entire population of Lithuania – and it transacts more business every year than Lithuania’s entire GDP.

Revolut, in its press release, boasts that “the new banking licence will allow its customers to start depositing their salaries, which will be protected up to €100,000 under the European Deposit Insurance Scheme” (EDIS). The release makes no mention of Lithuania.

But the thing is, EDIS is just a proposal made by the EU in 2015. As a Europe-wide guarantee of deposits, it doesn’t yet exist. It is understood that some EU countries, led by Germany, have blocked its introduction, understandably concerned that they will be the backstop if other countries’ protection schemes fail.

Just last week, Reuters reported that at a meeting of EU finance ministers, “mistrust among eurozone countries is so great that they could not even agree on a roadmap for beginning political negotiations on EDIS”. Until (or if) EDIS is established, anyone who deposits money in a bank that operates under an EU licence must rely on the viability of the deposit protection scheme of the individual country that issued the licence. So Revolut customer deposits will be dependent on the Lithuanian scheme’s capacity to pay up. If it can’t, there is no formal mechanism for the EU to step in.

There is nothing to suggest that Revolut is under any financial pressure, and it is extremely unlikely to fail. But it’s always worth asking the question, given what happened in the great financial crash. Revolut assures me the Bank of Lithuania supervises banks in the same way as other central banks in the EU, and it is in the EU-wide “single supervisory mechanism” (SSM).

The Bank of Lithuania tells me that apart from the SSM there is also the new “single resolution mechanism” to wind down banks in a more orderly fashion than in 2007-08, and it says the EU is in the “final stages” of creating EDIS.

But as things stand, the EU has foolishly created a single market for banking, while failing to put in place a single mechanism for protecting savers. And don’t even ask why a UK-based bank is obtaining an EU passport weeks ahead of a possible no-deal UK withdrawal from the EU.

p.collinson@theguardian.com