Sector guide · Financial services
BFSG for banking and financial services
Consumer banking services are named in the BFSG directly, and the obligations reach further here than almost anywhere else: the web banking, the app, the identification flow, the statements you generate as PDFs, and the terminals.
- Named explicitly in § 1 BFSG
- Covers web, app, documents and terminals
- PDF statements are in scope too
What counts as a banking service here
The scope is drawn around the service to the consumer, not the channel. If a private customer can do it, it is covered wherever they do it.
- Account opening, including the video or eID identification step
- Online banking and the mobile app — both, not whichever one you consider primary
- Transfers, standing orders, card management and the strong-authentication step
- Consumer credit, payment services and investment services aimed at private customers
- The statements and contract documents you generate — a PDF nobody can read with a screen reader fails the same standard
Sector guide · Financial services
Where banking fails
-
Session timeouts nobody can extend
A security timeout that logs people out mid-transfer with a two-second warning fails 2.2.1. The fix is a warning with an extend action, not a longer timeout.
-
Authentication that blocks password managers
Blocking paste into a PIN or password field, or requiring a transcribed code with no alternative, is exactly what 3.3.8 was written about.
-
PDF statements with no tags
Generated statements are usually untagged, so reading order is whatever the layout engine produced and the tables read as loose numbers.
-
Status messages that never announce
“Transfer sent” appears visually and is never announced. In banking, a silent confirmation is not a nicety — the customer does not know whether their money moved.
Criteria to check first
Weighted for a banking journey rather than a brochure site. Each links to a plain-language page on that criterion: what it asks for, how it fails in practice, and how far an automated check can get.
Where to start
-
Start with onboarding
Account opening is the journey with the most custom components and the most legal weight. If a person cannot open an account, nothing downstream matters.
-
Treat documents as part of the product
Statements, contracts and schedules are generated by a template you control. Fixing the template fixes every document it will ever produce.
-
Get the manual results recorded
Much of what matters in banking — timeouts, authentication alternatives, error recovery — no scanner can decide. Record who tested it, how, and when, because that is the first thing an auditor asks.
-
Separate the app from the web
They are two products under the law and they fail differently. A clean web banking report says nothing about the app.
Questions banks ask
Does the BFSG apply to our business banking?
The BFSG covers services to consumers. Pure business banking is outside it — but the boundary is thinner than it looks, because sole traders are often consumers for parts of a product, and the same front end usually serves both. Most banks find it cheaper to treat the shared components as in scope.
Are ATMs and terminals covered?
Yes. Self-service terminals — ATMs, payment terminals, statement printers — are listed as products in the BFSG, with their own requirements. They are a separate assessment from the web and app, and not something an automated web scan says anything about.
Written to be useful, not to be legal advice. It reflects our reading of the BFSG and EN 301 549 as of 2026-09-13; for a binding assessment of your obligations, ask a lawyer.
See what this finds on your site
Send a URL. We scan up to 100 pages, run the agent protocol on one key journey and send you the report — free, once, no strings.