Regulations that apply
- EAA — Annex I, Section IIIEU
Specific banking obligations: ATM, online banking, mobile banking.
- PSD2EU
Strong customer authentication that must remain accessible.
- Section 508US federal
Required for federal credit unions and any contractor.
The accessibility risks specific to Banking & Financial Services
- Session timeouts without warning2.2.1
Banks set short timeouts; without 2.2.1 timeout warnings, users with cognitive disabilities lose work mid-transfer.
- Inaccessible OTP and 2FA flows2.1.1, 4.1.2
Auto-advancing 6-digit OTP fields and biometric prompts often skip keyboard and screen reader support.
- Statement PDFs that are scanned images1.1.1, 1.3.1
Account statements delivered as scanned PDFs are unreadable by screen readers.
Banking & Financial Services risks in Certvo scan data
Banking & Financial Services risks map to 2.2.1, 2.1.1, 4.1.2, 1.1.1, 1.3.1. Failure rates below cover all 1,569 sites in the Certvo Web Accessibility Report 2026 (not split by industry).
- WCAG 2.2.1 Timing AdjustableLevel A
0.1% of sites failed it (#16 of 16).
- WCAG 2.1.1 KeyboardLevel A
6.7% of sites failed it (#7 of 16).
- WCAG 4.1.2 Name, Role, ValueLevel A
67.0% of sites failed it (#1 of 16).
- WCAG 1.1.1 Non-text ContentLevel A
29.9% of sites failed it (#4 of 16).
- WCAG 1.3.1 Info and RelationshipsLevel A
22.4% of sites failed it (#5 of 16).
A short remediation checklist
- Audit login flows including 2FA paths
- Test session timeout warnings with assistive tech
- Verify statement PDFs are tagged and text-based
- Review every error message for inline + announced status
Scan your homepage plus one Banking & Financial Services task flow to see which of the criteria above fail on your own site.
Frequently asked questions
Does PSD2 conflict with accessibility?
It does not have to. Strong customer authentication can be implemented accessibly using passkeys, properly-labeled OTP fields, and accessible biometric prompts.