Regulations that apply
Banking & Financial Services sits at the intersection of general digital-accessibility law and sector-specific obligations. The most relevant items to track:
- EAA — Annex I, Section IIIEU
Specific banking obligations: ATM, online banking, mobile banking.
- PSD2EU
Strong customer authentication that must remain accessible.
- Section 508US federal
Required for federal credit unions and any contractor.
The accessibility risks specific to Banking & Financial Services
Every industry has its own failure pattern. The combination below is what audits, complaints, and lawsuits in this sector keep returning to. Fixing them clears the most-cited issues without touching every page.
- Session timeouts without warning2.2.1
Banks set short timeouts; without 2.2.1 timeout warnings, users with cognitive disabilities lose work mid-transfer.
- Inaccessible OTP and 2FA flows2.1.1, 4.1.2
Auto-advancing 6-digit OTP fields and biometric prompts often skip keyboard and screen reader support.
- Statement PDFs that are scanned images1.1.1, 1.3.1
Account statements delivered as scanned PDFs are unreadable by screen readers.
A short remediation checklist
Most Banking & Financial Services teams do not need a 200-item audit before they fix anything. They need an ordered list of the highest-impact moves. Start with these and re-audit after each pass.
- Audit login flows including 2FA paths
- Test session timeout warnings with assistive tech
- Verify statement PDFs are tagged and text-based
- Review every error message for inline + announced status
Run a free Certvo scan against your homepage and one task-flow URL (login, checkout, booking). It pinpoints which of the issues above apply to you, and how often.
Scoping an audit for Banking & Financial Services
Banking & Financial Services carries 3 distinct obligations to satisfy — EAA — Annex I, Section III, PSD2, Section 508 — spanning EU and US federal. An auditor prices the work by how many of those regimes are in scope and how many distinct task flows carry them, not by page count.
The 3 failure patterns above map to 2.2.1, 2.1.1, 4.1.2, 1.1.1, 1.3.1. Every one of those is machine-detectable, which means a scan can clear them before an auditor starts charging by the hour. What remains for manual review is the judgement work: whether session timeouts without warning actually functions end to end for a screen-reader user.
- Scan first, audit second
Clearing the 3 automated patterns above shortens the manual pass to the flows that need a person.
- Scope by template, not by page
A site with thousands of pages usually has fewer than twenty distinct templates. Price the templates.
- Re-test after remediation
The conformance claim rests on the re-test, not the first report.
- Evidence for EU
Keep dated scan history — it is what turns a conformance claim into something a regulator accepts.
Frequently asked questions
Does PSD2 conflict with accessibility?
It does not have to. Strong customer authentication can be implemented accessibly using passkeys, properly-labeled OTP fields, and accessible biometric prompts.