The verdict in three sentences
For a decentralised financial system (SFD), the regulated microfinance category in the WAEMU, preparing a funding round, the website is read by funders as a governance indicator: security, transparency and compliance must be visible. A budget of FCFA 4,000,000 to 9,000,000 over 10 weeks covers a secure bilingual site, a credit simulator, a branch map and an independent penetration test. Compliance with Senegal's Law 2008-12 on personal data, with a filing at the CDP (the data protection authority), is non-negotiable as soon as a form collects prospect data.
The security and compliance scope expected in 2026
An SFD's public website does not process banking transactions, but it collects credit requests, phone numbers and sometimes ID documents. That is what sets the bar. Amounts in FCFA excl. tax (EUR 1 = FCFA 655.957).
| Requirement | What it covers | Indicative 2026 cost (FCFA) |
|---|---|---|
| Security headers (CSP, HSTS, X-Frame-Options) | Protection against script injection and clickjacking | Included in development |
| EV or OV SSL certificate | Verified identity of the institution | 250,000 to 450,000 per year |
| Web application firewall (WAF) and anti-DDoS | Attack filtering, availability | 300,000 to 900,000 per year |
| Independent penetration test | Vulnerability report before launch | 1,500,000 |
| Law 2008-12 compliance and CDP filing | Consent, purposes, retention, rights | 400,000 to 800,000 |
| SFD regulatory notices | Licence, number, published rates and terms | Included in content |
| Encrypted backups and logging | Restore, access traceability | 150,000 to 400,000 per year |
Funders and impact investors, including Singapore-based funds active in African microfinance, also check transparency: annual reports, audited financial statements, social performance indicators and client protection policy should be downloadable as PDFs.
Budget and timeline by site level
| Level | Content | Budget (FCFA excl. tax) | Timeline |
|---|---|---|---|
| Essential | 15 pages FR/EN, branches on a map, secure form | 4,000,000 to 5,500,000 | 8 weeks |
| Standard | + credit simulator, funder document area | 5,500,000 to 7,000,000 | 10 weeks |
| Advanced | + online credit pre-application, instalment payment via Wave and Orange Money | 7,000,000 to 9,000,000 | 12 weeks |
| Penetration test | External audit and re-test after fixes | 1,500,000 | 2 weeks |
| Secure maintenance | Updates, monitoring, 24/7 supervision | 150,000 to 350,000 per month | 12 months |
| Managed hosting | Servers in a compliant zone, CDN | 50,000 to 150,000 per month | 12 months |
The credit simulator must display the annual effective rate and stay below the usury ceiling applicable in the WAEMU. A simulator showing a monthly payment without the effective rate is a negative signal for the banking commission and for funders alike.
The 10-week retroplanning
| Weeks | Step | Deliverable |
|---|---|---|
| W1 to W2 | Scoping, risk analysis, data mapping | Scoping note, processing register |
| W2 to W4 | UX and design, branch and simulator pages | Approved mock-ups |
| W4 to W8 | Secure development, content integration | Site in staging |
| W7 | Filing with the CDP | Acknowledgement of receipt |
| W8 to W9 | Penetration test and fixes | Report and re-test |
| W10 | Go-live, training, supervision | Acceptance sign-off |
Mini case study
Mr Ndiaye, CEO of a Senegalese SFD with 14 branches and 38,000 members, is preparing a FCFA 1.5 billion raise (about EUR 2.3 million) from international funders, including an Asia-based impact fund. His current site has no valid certificate and shows 2022 rates. He picks the Standard level at FCFA 6,400,000, plus the FCFA 1,500,000 penetration test, for FCFA 7,900,000 in total (about EUR 12,000). The test reveals 3 critical vulnerabilities, fixed before launch. The simulator generates 220 credit pre-applications in the first quarter, 30% of which convert with an average outstanding of FCFA 650,000, about FCFA 42,900,000 of new portfolio. The investment represents 0.5% of the amount raised, an order of magnitude funders consider consistent with serious governance.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Is an SFD's website subject to BCEAO regulation?
The public site is not licensed as such, but it must reflect the SFD's obligations: displayed licence, rate conditions, effective rate and client protection. Online payment or credit services fall under the BCEAO framework for digital financial services.
Does the site need to be filed with the CDP?
Yes as soon as it collects personal data via a form or simulator. Plan FCFA 400,000 to 800,000 for legal and technical support, and 4 to 8 weeks of processing, to anticipate at scoping.
Is a FCFA 1,500,000 penetration test essential?
For an SFD raising funds, yes. Funders often request proof of a security audit, and a single client data leak costs far more in reputation and sanctions.
Can instalments be collected via Wave or Orange Money on the site?
Yes at the Advanced level, with a budget of FCFA 7,000,000 to 9,000,000. Confirmation webhooks and reconciliation with the SFD's information system must be tested before opening.
How much does maintaining a microfinance website cost?
Between FCFA 150,000 and 350,000 per month (about EUR 230 to 535), depending on the supervision level. The plan covers security updates, vulnerability monitoring and encrypted backups.
Let's scope your project. Share your fundraising calendar and current site: we price the security scope, the budget in FCFA and a 10-week timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
