The verdict in three sentences
For a bank, the corporate website is a regulated asset: published financial information, data protection and an annual security audit, which puts the 2026 budget between EUR 180,000 and 450,000. The items that make the difference are not visual: penetration testing (EUR 12,000 to 25,000), CSP and WAF, a compliance approval workflow and editorially sound multilingual versions, including right-to-left languages where relevant. Plan 5 to 8 months and a 99.9% SLA, meaning under 8 h 46 min of downtime a year.
Where the budget goes
A bank website combines corporate communication, investor relations, careers, branch network and press. Compliance adds a cross-cutting layer: every published page commits the bank before the FCA and PRA, the market for a listed bank, and its customers.
| Item | Indicative budget 2026 (EUR) | Comment |
|---|---|---|
| Scoping, UX and design system | 30,000 to 65,000 | Workshops with comms, compliance, IT |
| Development and headless CMS with workflow | 65,000 to 160,000 | Editor, legal, compliance, publisher roles |
| Additional language versions (incl. RTL) | 18,000 to 45,000 | Native RTL layout, legal review |
| Investor area and regulated disclosures | 22,000 to 60,000 | Financial statements, announcements, timestamped archives |
| Security: CSP, WAF, hardening | 15,000 to 36,000 | Configuration and documentation |
| Pre-launch penetration test | 12,000 to 25,000 | Report, fixes, retest |
| Accessibility, performance and QA | 11,000 to 30,000 | Tests on slow networks and low-end devices |
| Hosting and 99.9% SLA (year 1) | 13,000 to 33,000 | 24/7 monitoring, backups, DR plan |
The compliance requirements that shape the project
Data protection. UK GDPR and the ICO govern forms (contact, complaints, applications). Every data collection must be documented, minimised and secured.
Regulated information. Financial statements, annual report, announcements: timestamped publication, accessible archives, no silent edits. The CMS must keep version history.
Security. Strict CSP headers, HSTS, a WAF in front of the site, monitored dependencies, annual penetration test. The bank's security audit now includes the public website.
Approval workflow. No content goes live without dual approval, business then compliance, with a record of who approved what and when.
| Requirement | Implementation | Annual recurring cost (EUR) |
|---|---|---|
| 99.9% SLA | Redundant hosting, CDN, monitoring | 13,000 to 33,000 |
| Annual penetration test | Independent provider | 12,000 to 25,000 |
| WAF and DDoS protection | Managed service | 4,500 to 11,000 |
| Compliance workflow | CMS licences and support | 6,000 to 15,000 |
| Security monitoring and updates | Monthly maintenance | 18,000 to 44,000 |
| Updating translated content | Translation and review | 4,500 to 11,000 |
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
A 5 to 8 month schedule
Month 1: scoping, mapping regulated content, IT requirements. Month 2: UX, multilingual design system. Months 3 to 5: development, workflow, language versions. Month 6: QA, penetration test, fixes, retest. Months 7 and 8 if needed: archive migration and final compliance sign-off. The timeline depends mostly on the approval committee's availability.
Mini case study
David, head of communications at a mid-sized bank in London, weighs two options. Option A at EUR 205,000 leaves out the compliance workflow: every publication goes through email, about 6 hours of coordination for 40 publications a month, or 240 hours. At a EUR 70 loaded hourly cost, that is EUR 16,800 a month. Option B at EUR 265,000 includes the workflow and cuts coordination to 1 hour per publication. The EUR 60,000 difference pays back in under 5 months, with a usable audit trail as a bonus.
FAQ
Why such a gap between EUR 180,000 and 450,000? It depends on scope: number of languages, investor area, integrations (calculators, branch locator, careers) and SLA level. A simple bilingual corporate site stays near the low end.
Is a penetration test mandatory? It is strongly expected by the annual security audit. Count EUR 12,000 to 25,000, carried out by an independent provider before launch and then every year.
Can a language version be a simple machine translation? No. For a bank, every wording carries legal weight; plan professional translation and legal review, EUR 18,000 to 45,000 at launch.
What does a 99.9% SLA guarantee? At most about 8 h 46 min of downtime a year, with contractual penalties beyond that. Require 24/7 monitoring and a tested recovery plan.
Can we reuse our current CMS? Only if it handles dual approval, version history and RTL. Otherwise, migrating to a headless CMS is cheaper over 3 years.
Let's scope your project. Describe your scope, languages and compliance requirements, and we will price the site, penetration test and SLA with a 5 to 8 month schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
