The verdict in three sentences
A banking group institutional site typically costs 60,000 to 160,000 EUR excl. tax over 16 to 28 weeks, because half the budget goes to security, compliance and accessibility, not design. The non-negotiable requirements — strict CSP, security audit, WCAG 2.1 AA, GDPR, 99.9% SLA — turn a brochure project into an engineering project. Choosing an agency seasoned with large accounts costs more per hour but avoids the regulatory dead-ends that blow up generalist budgets.
Cost of compliance and security requirements
In banking, each requirement is a budget line in its own right, often audited by a third party. Here is a 2026 order of magnitude.
| Requirement | Scope | 2026 cost (EUR excl. tax) | Timeline |
|---|---|---|---|
| CSP & security headers | Strict Content-Security-Policy, HSTS, tests | 4,000 - 9,000 | 1-2 wks |
| Security audit / pentest | External intrusion test + remediation | 8,000 - 20,000 | 2-4 wks |
| WCAG 2.1 AA accessibility | Audit, fixes, conformance statement | 10,000 - 25,000 | 3-6 wks |
| GDPR compliance | Register, consent, DPO, notices | 5,000 - 12,000 | 2-3 wks |
| Content governance | Multi-level validation workflow (CMS) | 8,000 - 18,000 | 3-5 wks |
WCAG 2.1 AA accessibility is the heaviest line and often mandatory for a regulated actor: it requires an audit, page-by-page fixes and a published conformance statement.
SLA, uptime and operations
A banking site cannot go down. The service agreement (SLA) prices availability, recovery time and support — and these commitments carry a recurring cost.
| SLA level | Guaranteed uptime | Support | Annual cost (EUR excl. tax) |
|---|---|---|---|
| Standard | 99.5% | business hours | 12,000 - 20,000 |
| Enhanced | 99.9% | 24/7 on-call | 24,000 - 45,000 |
| Critical | 99.95% | 24/7 + monitoring | 45,000 - 80,000 |
| Recovery (RTO/RPO) | failover < 1 h | tested plan | incl. enhanced+ |
| Backups | daily encrypted | 90-day retention | included |
99.9% uptime allows about 8.8 hours of downtime per year; at 99.95% you drop below 4.4 hours. Each extra nine nearly doubles infrastructure and on-call cost.
Large-account specialist agency vs generalist
| Criterion | Generalist agency | Large-account agency |
|---|---|---|
| Day rate | 500 - 700 EUR | 800 - 1,200 EUR |
| Regulated-sector experience | low | strong |
| Built-in security audit | rarely | yes |
| Native WCAG accessibility | partial | yes, attested |
| Rework risk | high | controlled |
| Typical total budget | 55,000 EUR quoted | 110,000 EUR real |
The classic trap: a generalist quotes 55,000 EUR, then bills security audits, accessibility and remediation as change orders, ending up pricier than a specialist quoting 110,000 EUR all-in. On a regulated project, specialization is a risk reducer, not a luxury.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Helene, CIO of a regional banking group in Paris, must redesign the corporate site before a regulatory audit. Two quotes: a generalist at 58,000 EUR and a large-account agency at 112,000 EUR. The generalist prices neither the pentest nor WCAG compliance; added mid-project, they represent 34,000 EUR of change orders plus 3 months of delay. The generalist's real cost climbs to 92,000 EUR with a site delivered late for the audit. By choosing the specialist at 112,000 EUR delivered on time and AA-attested, Helene avoids the risk of penalties (up to tens of thousands of euros) and a blocking delay.
FAQ
Why does a banking site cost 3 to 5 times more than a brochure site?
Because half the budget funds security, compliance and accessibility, not design. CSP, pentest, WCAG 2.1 AA and GDPR are audited engineering packages, often mandatory for a regulated actor.
Is WCAG 2.1 AA accessibility really mandatory?
For actors subject to digital accessibility obligations, yes, with a published conformance statement. Non-compliance exposes you to penalties and reputational risk; budget 10,000 to 25,000 EUR to reach it properly.
What does a 99.9% SLA change concretely?
It guarantees under 9 hours of downtime per year, with 24/7 on-call and a tested recovery plan. It is a contractual commitment with penalties, billed 24,000 to 45,000 EUR/year.
Can the site be hosted on a public cloud?
Yes, on a compliant cloud with encryption, isolation and controlled data location. Data governance and GDPR outweigh the choice of provider.
How much lead time before a regulatory audit?
Expect a 16 to 28-week project, with 4 to 8 weeks dedicated to security and accessibility. Launching less than 6 months before an audit is risky.
Let's scope your project. Specify your compliance requirements (WCAG, GDPR, target SLA) and your audit deadline, and we'll frame a secured, attestable budget. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
