The European Accessibility Act for banking and fintech apps

01What's covered

The Act covers consumer banking services, which includes payment services, credit agreements, and e-money. If consumers in the EU use your app or website to open an account, pay, borrow, or manage their money, assume you're in scope, even if your company is based outside the EU. Microenterprises that provide services are exempt, as long as they have fewer than 10 people and an annual turnover or balance sheet of no more than €2 million.

02The banking-specific requirements

Annex I, Section IV, point (e) adds two requirements for consumer banking services:

• Identification methods, electronic signatures, security, and payment services have to be perceivable, operable, understandable, and robust.
• Information has to be understandable, without exceeding level B2 (upper intermediate) of the Council of Europe's Common European Framework of Reference for Languages.

These come on top of Section III, which every service has to meet, including websites and mobile apps that are perceivable, operable, understandable, and robust. In practice, that means WCAG 2.2 AA.

03Strong customer authentication

Under PSD2, strong customer authentication combines at least two of three kinds of element: something only the user knows, like a PIN, something only they have, like their phone, and something they are, like a fingerprint. The Act asks that whatever combination you use is accessible.

Right now, a lot of banking apps rely on one method, usually an app on a smartphone with a biometric check. That works for a lot of people and locks out others: someone who can't use a fingerprint reader, someone who can't read a one-time code before it expires, or someone without a smartphone. Offer more than one way to authenticate, give people enough time to complete each step, and make sure every step works with a screen reader.

04What the Payment Services Regulation adds

The EU's new Payment Services Regulation, which will sit alongside PSD3, goes further. In the compromise text agreed in April 2026, Article 88 asks payment providers to give every customer at least one way to authenticate that fits their situation, free of charge, including people with disabilities, older people, and people with low digital skills. It also says authentication can't depend only on owning a smartphone, unless the customer agreed to a mobile-only service.

As of 23 October 2026, the regulation was still waiting for its final adoption and publication, and it applies 21 months after it enters into force. So the article number and wording could still change. It's a good reason to design for more than one authentication method now.

05Writing at level B2

B2 is upper intermediate. In practice, it means short sentences, common words, and explaining financial terms where they first appear. "Annual percentage rate of charge" can stay, as long as the next line says what it means for the person reading it.

The places this matters most are the ones people act on: loan terms, fees, error messages during a payment, and anything they have to agree to.

06Where to start

1. Test sign-up, log-in, authentication, and payment confirmation by hand with a keyboard and a screen reader, on web and mobile.
2. Check that there's more than one way to complete strong customer authentication.
3. Rewrite the copy on those flows to level B2.
4. Publish your accessibility information, as Article 13 requires.

Our Accessibility Audit tests up to five key journeys by hand against WCAG 2.2 AA in two weeks, from €2,500, and includes a draft accessibility statement.