Loading...
Banking is an essential service, and its digital front door now sits under binding accessibility law on both sides of the Atlantic: the European Accessibility Act applies to consumer banking since June 2025, the UK's Consumer Duty and Equality Act reach digital journeys, and US banks remain steady ADA lawsuit targets. Here is what applies to you and how to close the gap.
the date European Accessibility Act obligations began applying to consumer banking services offered to consumers in the EU
US adults lives with a disability (28.7% per CDC data), and banking is an essential service nobody can simply opt out of
of the roughly 5,000 US federal and state digital accessibility lawsuits reported for 2025 targeted banking and finance: a small share of volume, but high-stakes defendants
of the top million homepages had detectable WCAG failures in the 2026 WebAIM Million, and financial sites are not exempt from the pattern
One in four US adults lives with a disability, 28.7% per CDC data on our disability statistics research, and disabled customers control significant spending power. Unlike most sectors, banking is not optional: everyone needs to receive wages, pay bills, check balances, and move money. When an online banking flow is inaccessible, the customer cannot simply shop elsewhere in the moment; they are locked out of their own funds. That is why exclusion in financial services carries outsized human impact and outsized regulatory attention.
The stakes compound because financial tasks are private by nature. A customer who cannot read their own statement, complete a transfer, or pass a login flow independently must hand control of their finances to someone else. Accessibility here is not a nice-to-have UX polish; it is the difference between financial independence and financial dependence for a quarter of the adult population, and it is precisely the kind of harm that anticipatory duties in UK law and service obligations in EU law are written to prevent.
The industry also has no room for complacency about its baseline. The 2026 WebAIM Million found detectable WCAG failures on 95.9% of the top million homepages, and financial sites are not exempt from the pattern; see our State of Accessibility research for the full picture. The business case follows the compliance case: accessible self-service journeys reduce call-center load, raise digital adoption, and keep an essential-service brand out of headlines it does not want.
Financial institutions typically operate under several regimes at once. For the European framework, start with our European Accessibility Act guide and the EN 301 549 standard; US litigation trends live on our lawsuit tracker.
The EAA explicitly covers consumer banking services, and it also captures payment terminals and ATMs as self-service terminals. Obligations apply since 28 June 2025 for services provided to consumers in the EU, so any bank, insurer, or fintech serving EU consumers is already inside the enforcement window. Enforcement runs through national regulators: in Ireland, S.I. No. 636/2023 designates the Central Bank of Ireland as the regulator for the accessibility of consumer banking services, and Irish penalties are criminal, with fines of up to EUR 60,000 and/or up to 18 months imprisonment on indictment. Conformity is demonstrated against EN 301 549, the European standard that incorporates WCAG.
The Equality Act 2010 imposes an anticipatory reasonable-adjustments duty on service providers, meaning firms must plan for disabled customers in advance rather than react to individual complaints. On top of that, the FCA Consumer Duty, in force since July 2023, requires firms to deliver good outcomes for retail customers, including customers in vulnerable circumstances. A login flow a blind customer cannot complete, or a statement a screen reader cannot parse, is hard to square with either obligation: digital accessibility sits squarely inside both regimes.
Banks and credit unions are regular defendants in ADA Title III website lawsuits. Banking and finance made up about 1.2% of the roughly 5,000 combined federal and state digital accessibility lawsuits reported for 2025, per UsableNet-derived data on our lawsuit tracker. That is a small share of overall volume, but the defendants are high stakes: financial institutions hold sensitive customer relationships, operate under regulator scrutiny, and cannot easily argue their websites are peripheral to the services they provide.
Accessibility obligations do not stop at the website. The EAA treats payment terminals and ATMs as self-service terminals, which means the hardware and its interface fall under the same regime as the digital channels. Terminals already in use before the 2025 application date benefit from a transition period that can run up to 20 years, but new deployments must comply, so procurement decisions made today determine your exposure for the life of the fleet.
Deep dives: the EAA in Ireland, where the Central Bank regulates banking accessibility, and our UK accessibility law guide covering the Equality Act and the Consumer Duty.
Financial services audits surface the same categories again and again. Each links to the relevant WCAG success criterion.
Banking runs the heaviest authentication of any consumer service, and every layer can exclude. WCAG 2.2 added 3.3.8 Accessible Authentication precisely because memorizing passwords and transcribing one-time codes under time pressure are cognitive-function tests that many users cannot pass. Support paste in code fields, allow password managers, and never rely on memory alone. CAPTCHAs add a second wall: a visual puzzle with no accessible alternative locks blind customers out of their own accounts at the front door.
Security timeouts are standard in banking, but a timeout that cannot be extended logs out screen reader and magnification users before they finish a transfer or a loan application. WCAG 2.2.1 requires that users be warned before time expires and given a simple way to extend it. Pair the warning with an accessible dialog that keyboard and screen reader users can actually reach, and preserve entered data across a re-authentication so the customer does not start from zero.
Account opening, loan applications, payee setup, and transfers are long, high-consequence forms. Fields without programmatic labels, placeholder text doing a label's job, required indicators conveyed only by color, and error messages that never reach assistive technology all stall customers at the exact moments that generate support calls and abandonment. Because the same form templates power dozens of journeys, fixing labels and validation at the component level pays off across the whole product.
A transaction history is a data table: dates, descriptions, debits, credits, balances. When it is built from styled divs, or from a table element without proper header cells, a screen reader reads an undifferentiated stream of numbers with no way to tell a debit from a balance. Real table markup with column headers, captions, and sensible sort controls turns the same data back into something a customer can audit independently.
Monthly statements, policy documents, and confirmations are overwhelmingly delivered as PDFs, and untagged PDFs have no structure a screen reader can navigate. A blind customer who cannot privately read their own statement must hand their finances to a sighted helper, which is exactly the kind of dignity and privacy harm accessibility law exists to prevent. Fix the statement templates in the generating system so every document inherits the tagging, and prefer accessible HTML delivery where you can.
Fintech visual language leans on thin type, light gray on white, and subtle balance displays. It photographs well and fails real users: account balances, interest rates, and due dates rendered below the 4.5:1 contrast minimum are illegible to customers with low vision, older customers, and anyone on a phone in daylight. Contrast is one of the cheapest failures to fix and one of the most common findings in financial audits.
Fix-it guides: accessible forms, form validation, data tables, PDF accessibility, cognitive accessibility, and mobile accessibility.
With EAA obligations already in force for consumer banking, the sequence below is built for closing the gap fast and documenting progress as you go.
Work out which regimes bind you: serving EU consumers triggers the EAA (in force since 28 June 2025, enforced nationally, in Ireland by the Central Bank); UK operations sit under the Equality Act 2010 and the FCA Consumer Duty; US operations face ADA Title III litigation risk. Then inventory every customer-facing digital property: public site, online banking, mobile apps, statement delivery, onboarding flows, and self-service terminals.
Audit onboarding, login and 2FA, payments and transfers, statement retrieval, and support as continuous journeys, combining automated scans with manual screen reader and keyboard testing. Authentication and payments deserve priority: they gate everything else, and they are where timeouts, CAPTCHAs, and cognitive load concentrate.
Remediate shared components first: the design system's form fields, the session-timeout dialog, the 2FA flow, and the statement templates in the document-generation system. A fix at the template level flows into every product that uses it; a page-by-page approach in banking never catches up with release velocity.
Core banking platforms, mobile app frameworks, payment widgets, and chat tools are mostly vendor-built, but the legal obligation to the customer stays with you. Require WCAG 2.2 AA conformance and a current ACR/VPAT in contracts and renewals, test vendor releases yourself, and document remediation commitments with dates.
Adopt an accessibility policy, train product and content teams, publish an accessibility statement with a monitored contact channel, and schedule recurring audits. Under the EAA, documented conformity is part of the obligation itself, and in every regime a dated, evidenced remediation program is the strongest position to hold when a regulator or plaintiff comes asking.
Asking vendors for accessibility documentation? Our VPAT and ACR guide explains what to request and how to read it, and our sample audit report shows what a full audit deliverable looks like.
Test balances, rates, and UI text against the 4.5:1 minimum before design ships.
Run a free automated scan of your public pages to see where you stand today.
Every criterion, including Accessible Authentication, the one written for login flows.
Online banking, app, and document audits mapped to EAA, UK, and ADA obligations.
If you provide consumer banking services to consumers in the EU, yes. The EAA explicitly lists consumer banking services among the covered services, and its obligations apply since 28 June 2025. Enforcement is national: in Ireland, S.I. No. 636/2023 designates the Central Bank of Ireland as the regulator for consumer banking services accessibility, and the Irish penalties are criminal, with fines of up to EUR 60,000 and/or up to 18 months imprisonment on indictment. Other member states have their own designated regulators and penalty regimes.
The Consumer Duty, in force since July 2023, requires firms to deliver good outcomes for retail customers, and it pays particular attention to customers in vulnerable circumstances, which includes many disabled customers. A digital journey a disabled customer cannot complete is a poor outcome by definition, so accessibility is one of the clearest ways the Duty translates into concrete product requirements. It sits alongside the Equality Act 2010, which already imposes an anticipatory duty to make reasonable adjustments rather than waiting for a complaint.
Target WCAG 2.2 Level AA. For the EAA, conformity is demonstrated against EN 301 549, the European standard that incorporates WCAG, so building to WCAG 2.2 AA positions you for European enforcement while also addressing the criteria US courts and UK regulators look to in practice. WCAG 2.2 matters specifically for banking because it added Accessible Authentication, which targets exactly the login and 2FA patterns financial services rely on.
Both. The EAA covers consumer banking services however they are delivered, which includes mobile apps, and WCAG applies to mobile interfaces as well as websites. In practice the mobile app is often the primary channel for retail customers, so an accessible website with an inaccessible app still leaves the service inaccessible. Audit the app's native screens, its embedded web views, and the hand-offs between them.
The recurring set: authentication and 2FA flows that demand memorization or transcription under time pressure, session timeouts that log users out before assistive technology users can finish, unlabeled form fields in applications and transfers, transaction tables without proper headers, statements delivered as untagged PDFs that screen readers cannot read, low-contrast text from fintech design trends, and CAPTCHAs with no accessible alternative. Each maps to a specific WCAG success criterion, which makes them auditable and fixable.
Yes. The EAA covers payment terminals and ATMs as self-service terminals, so the accessibility regime extends to hardware interfaces, not just websites and apps. Terminals already in service before the 2025 application date benefit from a transition period that can run up to 20 years, but newly deployed terminals must comply, which makes accessibility a procurement requirement for every fleet refresh from now on.
Banks and credit unions are regular defendants in ADA Title III website lawsuits, and courts have repeatedly allowed such claims to proceed against financial institutions. Banking and finance accounted for about 1.2% of the roughly 5,000 combined federal and state digital accessibility lawsuits reported for 2025, a small slice of volume but one where defendants have deep pockets, regulated reputations, and essential-service customer relationships. Waiting for a demand letter is the most expensive way to find out.
We audit online banking, mobile apps, authentication flows, and statement pipelines against WCAG 2.2 AA and EN 301 549, and deliver a remediation plan you can show a regulator.