N26 is a Berlin-founded, fully licensed German bank operating entirely through a mobile app, with over 7 million customers across Europe. Founded in 2013, it holds a full German banking license - not a payments institution license or an e-money license - which means it operates under the regulatory obligations of a traditional bank while running on a mobile-native architecture. That combination defines the security surface: a regulated financial institution moving money for millions of users through APIs, mobile clients, and cloud infrastructure, with no physical branch layer to absorb risk.
The platform spans retail bank accounts, virtual Mastercards, ECB-linked savings products, stock and ETF trading, and crypto trading currently being added to the stack. Each product expansion - payments, brokerage, crypto - adds new attack surfaces and compliance perimeters. The threat model is correspondingly broad: account takeover, payment fraud, API abuse, insider risk, and the regulatory exposure that comes with handling customer funds under German and EU banking law. At over 1,600 employees across 90+ nationalities, the internal identity and access management challenge alone is substantial.
Security work at a licensed neobank like N26 operates at the intersection of traditional financial-sector requirements - think PSD2, DORA, BaFin oversight - and the engineering velocity of a mobile-first product organization. Relevant domains typically include application security for iOS and Android clients, infrastructure and cloud security, fraud and transaction monitoring, identity verification, and penetration testing across a financial-grade API surface. The addition of crypto trading and expanded investment products signals continued platform complexity through the near term.
N26 is headquartered in Berlin and operates across European markets. Its workforce spans more than 90 nationalities, reflecting both its pan-European customer base and the geographic distribution of its engineering and operations teams.