Strong security shouldn't lock out your own customers.
Sign-in, one-time codes, session timeouts, and PDF statements are where account holders with disabilities tend to get stuck. We test those flows with real assistive technology and fix them without weakening a single security control.
For a bank, the front door is the sign-in screen
Almost everything a customer does with a bank, credit union, insurer, or lender happens behind authentication. If someone can't sign in, nothing else on the site matters. Sign-in is also where security teams add the most friction: CAPTCHAs, one-time codes split across six boxes, device checks, and short session limits.
WCAG 2.2 added Success Criterion 3.3.8 Accessible Authentication (Minimum), Level AA, for exactly this situation. A step in a sign-in process can't depend on a cognitive function test, such as remembering a password or transcribing a code, unless there is an alternative or a mechanism to help, such as letting a password manager fill the field or allowing paste. Most fixes are small: an autocomplete attribute, one input instead of six, and no script that blocks paste.
Where banking journeys break
| Flow | What usually breaks | WCAG criteria |
|---|---|---|
| Sign-in and one-time codes | Paste blocked; six single-digit inputs with no group label; image CAPTCHAs with no alternative | SC 3.3.8 (new in 2.2), SC 1.1.1, SC 1.3.1 |
| Session timeouts | Sessions end with no warning, or the warning dialog can't be reached by keyboard and isn't announced | SC 2.2.1 |
| Transfers and bill pay | Payee pickers built from custom dropdowns; confirmation screens that don't announce success | SC 4.1.2, SC 4.1.3 |
| Account opening and loan applications | Long forms that ask for the same address twice; errors shown only in red; uploads with no instructions | SC 3.3.7 (new in 2.2), SC 3.3.1, SC 1.4.1 |
| Statements and notices | Untagged PDF statements whose tables a screen reader reads as one long line | SC 1.3.1 |
| Calculators | Results change on screen but aren't announced; sliders with no keyboard support or typed alternative | SC 4.1.3, SC 2.1.1 |
| Charts and spending insights | No text alternative or data table; categories told apart only by color; faint lines and bars | SC 1.1.1, SC 1.4.1, SC 1.4.11 |
The same security, without the barrier
A common one-time code pattern
- Six separate inputs, one digit each, with no group label
- A script that blocks paste
- The code expires silently and the form just fails
- An image CAPTCHA with no other option
An accessible pattern
- One input with
autocomplete="one-time-code"andinputmode="numeric" - Paste allowed, so password managers and SMS autofill work
- A clear expiry message and a Send a new code button
- Errors announced and tied to the field
Statements and disclosures inherit their template's problems
Monthly statements, tax forms, rate sheets, and disclosures are usually generated as PDFs. When the template that produces them isn't tagged, every document it produces inherits the problem, every month. Fixing the template once, so each statement comes out with real headings and data tables, is far less work than remediating documents one at a time.
We review a sample of generated documents against ISO 14289-1:2014 (PDF/UA-1), trace failures back to the template or generation tool, and work with your vendor or developers on the fix. For one-off documents such as rate sheets and fee schedules, we often recommend an HTML page instead, which also reads better on a phone.
The standards behind the work
No federal web accessibility regulation is written specifically for private banks, so most programs adopt WCAG 2.2 AA as the benchmark. Institutions serving EU consumers also have the European Accessibility Act, which covers consumer banking services.
success criteria were added in WCAG 2.2 compared with WCAG 2.1, and 4.1.1 Parsing was removed as obsolete
W3C Web Accessibility Initiative: What's New in WCAG 2.2is the date from which EU member states must apply the European Accessibility Act (Directive (EU) 2019/882), which covers products and services, including e-commerce, on the EU market
Directive (EU) 2019/882 of 17 April 2019 (European Accessibility Act), Article 31(2), EUR-Lexof U.S. adults (more than 1 in 4) reported a functional disability in 2022
CDC, Disability and Health Data Now (Disability and Health Data System, 2022 BRFSS)Questions from banks and credit unions
Will allowing paste into one-time code fields weaken our security?
Paste doesn't change what the code is or how long it stays valid; it only changes how the code gets into the field. Password managers and operating-system autofill already rely on it. We review proposed changes with your security team, and we never recommend removing a control, only making it usable.
Our online banking runs on a vendor platform. Can you still help?
Yes. Many banks and credit unions run digital banking on a vendor platform with limited customization. We test it, separate what you can change (content, configuration, and your own pages) from what only the vendor can change, and give you evidence to take to the vendor.
Do you test mobile banking apps?
Yes. Our mobile app audits test iOS with VoiceOver and Android with TalkBack, plus Switch Access and large text, on the flows your customers use most.
Does Kentucky's privacy law apply to banks?
The Kentucky Consumer Data Protection Act exempts financial institutions subject to the federal Gramm-Leach-Bliley Act. Affiliates and other businesses may be treated differently, so confirm with your counsel. Our Kentucky page summarizes the basics.
Keep reading
Tell us what your website needs to do.
Send a link and a sentence about your deadline. You will hear back from a person within one business day, usually with a short list of questions and a proposed scope.