The verdict in three sentences
Rebuilding the institutional website of a bank in London takes 5 to 9 months end to end in 2026, for a budget of roughly GBP 50,000 to 150,000 (about EUR 58,000 to 175,000). The item plans almost always underestimate is compliance sign-off, which alone takes 4 to 8 weeks across legal, risk and financial promotions review. With EN, FR and AR versions for an international client base, penetration tests at GBP 5,000 to 12,000 and UK GDPR obligations supervised by the ICO, a credible plan is built backwards from the target launch date.
The typical plan, phase by phase
A bank does not move at the pace of a small business: every deliverable goes through several committees. The plan below includes those approval loops, which explain most of the gap between an agency's schedule and reality.
| Phase | Duration | Internal sign-off required | Deliverable |
|---|---|---|---|
| Scoping and supplier selection | 4 to 6 weeks | Procurement, IT | Signed contract |
| Workshops, site map, specifications | 3 to 5 weeks | Communications, business lines | Approved specifications |
| UX and UI design, Arabic RTL included | 4 to 6 weeks | Executive committee, brand | Approved designs |
| Development and CMS integration | 8 to 12 weeks | IT, security | Staging site |
| Content and translation EN, FR, AR | 6 to 8 weeks (in parallel) | Communications, legal | Approved content |
| Compliance sign-off | 4 to 8 weeks | Legal, compliance, risk | Compliance approval |
| Penetration tests and fixes | 3 to 5 weeks | CISO | Closed pentest report |
| Acceptance, launch, hypercare | 3 to 4 weeks | IT, communications | Live site |
By overlapping content with development, the critical path drops to about 22 weeks at best and 38 weeks when committees slip.
What lengthens or shortens the timeline
| Factor | Effect on timeline | Effect on budget (2026 order of magnitude) |
|---|---|---|
| Arabic RTL designed from the first mock-ups | Neutral | + 10 to 15% |
| Arabic added afterwards | + 4 to 6 weeks | + 20 to 30% |
| Loan or savings calculators | + 3 to 5 weeks | GBP 7,000 to 17,000 |
| Investor relations section | + 2 to 4 weeks | GBP 5,000 to 12,000 |
| External penetration tests | + 3 to 5 weeks | GBP 5,000 to 12,000 |
| Single approval committee with delegated authority | - 3 to 5 weeks | None |
| Content written before development | - 4 to 6 weeks | None |
UK GDPR, the ICO and financial promotions: what to anticipate
Every form that collects personal data (appointment booking, loan enquiry, complaint) requires a lawful basis, a compliant privacy notice, a data protection impact assessment where the processing is high risk, and proper cookie consent. Product pages must also pass financial promotions review under FCA rules and the Consumer Duty. Allow 3 to 6 weeks to complete the DPIA and privacy documentation in parallel with development, and do not fix the launch date before compliance has seen final copy.
Mini case study
Nadia, communications director of an international bank in London (illustrative persona), wants the new site live for the June annual general meeting. The agency proposes 20 weeks. Adding the 6 weeks of compliance sign-off seen on the previous project, 4 weeks of pentesting and 4 weeks of committee buffer, Nadia gets 34 weeks: the project must start in October, not January. She secures a single committee with delegated authority, saving 4 weeks, and has content written before development, saving 5 more. Final plan: 25 weeks, budget GBP 98,000 including GBP 8,000 of pentesting, with launch held 3 weeks ahead of the AGM.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
How long does it take to rebuild a bank's website?
Between 5 and 9 months end to end in 2026, supplier selection included. Three-month plans almost always forget compliance sign-off and penetration testing, which add 7 to 13 weeks.
What budget should a trilingual bank website in London plan?
Expect GBP 50,000 to 150,000 depending on calculators, the investor section and content volume. Penetration tests add GBP 5,000 to 12,000.
Does the Arabic version lengthen the project much?
Designed from the first mock-ups, it costs 10 to 15% more without lengthening the plan. Added afterwards, it forces a rework of templates for RTL, 4 to 6 weeks and a 20 to 30% surcharge.
What data protection steps apply to a bank's website?
Each personal data processing activity needs a lawful basis and a compliant privacy notice under UK GDPR, with a DPIA where risk is high. Allow 3 to 6 weeks and start as soon as specifications are approved.
Are penetration tests essential?
For a bank, yes in practice: IT and the CISO require them before any public-facing release. An external test of 5 to 10 days costs GBP 5,000 to 12,000, fixes not included.
Let's scope your project. We help you build a realistic backwards plan and price the EN, FR and AR versions, penetration testing and compliance, with a clear indicative budget. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
