The verdict in three sentences
For the public website of a bank in Dubai (around 300 pages in Arabic and English, sometimes a third language), a realistic 2026 budget sits between 1,000,000 and 2,000,000 AED excluding VAT (about 270,000 to 545,000 USD), for a 9 to 12 month project. The most underestimated item is not design but security and regulatory compliance: pentest, WAF, hosting and content traceability often take 20 to 25 % of the budget. A well-run RFP weights method and banking references at least as heavily as price.
Budget breakdown: where 1 to 2 million AED goes
A bank website is not a standard corporate site. It combines regulated content (fees, terms, key fact statements), interactive tools (loan calculators, branch and ATM locator) and strict availability requirements. Here is a typical split seen on RFPs of this scope in 2026.
| Work package | Content | Share of budget | Range excl. VAT |
|---|---|---|---|
| Discovery and UX | Business workshops, 300-page sitemap, wireframes, user testing | 10 to 12 % | 100,000 to 240,000 AED |
| UI design and design system | Digital brand, components, Arabic RTL accessibility | 10 to 13 % | 100,000 to 260,000 AED |
| Front-end and CMS build | Headless CMS, approval workflow, templates, 2 to 3 languages | 28 to 32 % | 280,000 to 640,000 AED |
| Interactive tools | Mortgage, auto, personal loan and savings calculators, branch locator | 10 to 12 % | 100,000 to 240,000 AED |
| Security and compliance | External pentest, WAF, hardening, CBUAE and PDPL review | 12 to 15 % | 120,000 to 300,000 AED |
| Content migration | Page migration, translation, regulatory documents | 8 to 10 % | 80,000 to 200,000 AED |
| 12-month support (TMA) | Corrective and evolutive maintenance, on-call, SLA | 10 to 12 % | 100,000 to 240,000 AED |
These are 2026 order-of-magnitude figures for a vendor able to deliver a banking website. A bid at 500,000 AED for this scope almost always leaves out security or support, which then returns as a change request.
Security requirements to write into the RFP
The public site does not host online banking, but it remains a prime target: defacement, phishing through cloning, injection in loan application forms. The RFP must make these requirements measurable so bids can be compared.
| Requirement | Expected level in 2026 | Indicative cost excl. VAT |
|---|---|---|
| External pentest before go-live | Grey box, OWASP Top 10 report, retest included | 55,000 to 110,000 AED |
| WAF and DDoS protection | Managed rules, rate limiting on forms | 25,000 to 70,000 AED per year |
| Security headers | Strict CSP, HSTS, no unapproved third-party script | Included in the build |
| Logging and traceability | Publication history, who changed which fee and when | 20,000 to 45,000 AED |
| Hosting and availability | 99.9 %, daily backups, documented DR plan, UAE data residency | 45,000 to 130,000 AED per year |
| Data protection | Cookie consent, forms compliant with UAE PDPL | 12,000 to 30,000 AED |
Also require a security assurance plan signed by the vendor and the right for your IT security team to commission its own audit. Banks that imposed a retest after fixes cut the number of remaining medium vulnerabilities at launch by half.
Scoring grid and required references
A grid that over-weights price produces projects that drift. On successful banking RFPs, the weighting looks like this: understanding and method 30 %, references and team 25 %, security 20 %, price 25 %. Require at least two references for financial or regulated websites delivered since 2023, with a reachable contact, and CVs for key roles (project lead, lead developer, security expert). Set milestones: discovery 6 to 8 weeks, design 8 weeks, build 16 to 20 weeks, testing and pentest 6 weeks, migration and cut-over 4 weeks.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Layla, head of communications at a retail bank in Dubai, receives three bids: 850,000, 1,350,000 and 1,850,000 AED excluding VAT. The cheapest bid prices neither the pentest nor support. Adding them (90,000 AED pentest, 180,000 AED support, 80,000 AED annual hosting) brings it to 1,200,000 AED. The mid bid includes everything and scores 82/100 against 74/100 for the first, thanks to two verified banking references. Layla picks the 1,350,000 AED bid: the real gap is only 150,000 AED, or 12.5 %, for a far lower risk of overrun.
FAQ
How long does a bank website RFP take?
Allow 8 to 12 weeks from publication to award: 4 weeks for responses, 2 to 3 weeks of analysis and pitches, then negotiation. The project itself then runs 9 to 12 months for 300 pages.
Does a bank need a headless CMS?
It is recommended: separating the back office from the public site shrinks the attack surface and supports a 3-level approval workflow (editor, compliance, management). The extra cost versus a monolithic CMS is around 10 to 15 %.
Does Arabic and English bilingualism cost much more?
Arabic requires an RTL layout tested on every template, adding 8 to 12 % to development. Translating 300 pages alone costs 60,000 to 120,000 AED depending on the volume of regulatory documents.
What should support cover?
At minimum: security fixes within 72 hours, CMS updates, 10 to 15 days of enhancements per year and on-call cover during campaigns. Budget 10 to 12 % of the build cost per year.
Can we reuse existing loan calculators?
Yes if their formulas are documented and approved by risk management. Otherwise, plan 20,000 to 45,000 AED per calculator for rebuild, testing and indicative rate disclaimers.
Let's scope your project. Send us your RFP or sitemap and we will price each package (design, build, security, support) with a milestone plan over 9 to 12 months. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
