The verdict in three sentences
A retail bank launching a mobile banking app must hand its regulator an audit report that covers the app, the APIs and the back office, not just the login screen. A serious mobile and API penetration test costs about 16,000 to 43,000 USD (our Casablanca benchmark: 150,000 to 400,000 MAD excl. tax) for 10 to 20 audit days, run against the OWASP MASVS and ASVS standards. Plan 15 to 40 days of developer fixes and a yearly audit from day one, otherwise the report stays a snapshot with no effect.
What the regulator and the CISO expect in 2026
Whether you report to the Central Bank of the UAE or to Bank Al-Maghrib in Morocco, the expectation is the same: a documented process with risk assessment, independent testing and a tracked remediation plan. For a mobile app, that means testing the Android and iOS binaries, local storage, client-server exchanges, exposed APIs and the business logic behind transfers.
| Scope tested | Standard | Typical audit days | Critical points |
|---|---|---|---|
| Android app | OWASP MASVS L2 + resilience | 3 to 5 | Root, obfuscation, token storage |
| iOS app | OWASP MASVS L2 + resilience | 3 to 5 | Jailbreak, keychain, certificate pinning |
| Mobile APIs | OWASP ASVS and API Security Top 10 | 3 to 6 | Object-level access control, rate limiting |
| Business logic (transfers, payees) | Fraud scenarios | 1 to 3 | OTP bypass, transaction replay |
| Back office and strong authentication | ASVS | 1 to 2 | Privilege escalation |
| Report, debrief, retest | ISO 27001 Annex A | 1 to 2 | Prioritized remediation plan |
A 5-day audit usually covers only one platform and a few APIs. For a bank, the credible minimum is around 10 days, and 15 to 20 days once there are two platforms, an open API and instant transfer flows.
What a mobile banking pentest costs
In the Moroccan market, 2026 day rates run from 8,000 to 20,000 MAD excl. tax per auditor day (roughly 850 to 2,150 USD) depending on seniority and certifications (OSCP, OSWE, GMOB). International firms in Dubai and Casablanca usually bill at the top of the range.
| Package | Days | Budget USD (order of magnitude 2026) | For whom |
|---|---|---|---|
| Flash audit, one platform | 5 to 7 | 6,500 to 13,000 | Minor update |
| Standard mobile and API audit | 10 to 12 | 16,000 to 24,000 | App launch |
| Full audit, two platforms, APIs, business logic | 15 to 20 | 27,000 to 43,000 | Retail bank, neobank |
| Retest after fixes | 2 to 4 | 2,700 to 6,500 | Sign-off before production |
| Yearly recurring audit | 8 to 12 | 13,000 to 21,500 | Ongoing compliance |
| Grey-box test with source code | +3 to 5 | +4,300 to 9,700 | In-house developed apps |
Method: from scoping to retest
A good banking penetration test follows five steps. Scoping fixes the perimeter, test accounts and pre-production testing windows. Static and dynamic binary analysis looks for hard-coded secrets, verbose logs and bypassable protections. APIs are tested object by object, because the most frequent flaw is still reaching another customer's account by changing an identifier. Fraud scenarios simulate an attacker who stole a phone or intercepted an SMS. Finally, the retest checks that every critical vulnerability is closed.
On the development side, fixes take 15 to 40 days depending on the architecture: certificate pinning, encrypted local storage, server-side access control, rate limiting, root and jailbreak detection. Those days must be booked in the plan before the first audit day.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Layla, CISO of a retail bank in Dubai, is preparing an Android and iOS launch with instant transfers. She picks a 16-day full audit at about 1,600 USD a day, or 25,600 USD, plus a 3-day retest at 4,800 USD. Fixes take 25 developer days at 650 USD a day, or 16,250 USD. The total budget reaches about 46,650 USD. On the other side, a single OTP bypass fraud across 200 accounts at 1,600 USD on average would cost 320,000 USD, before regulatory penalties and brand damage.
FAQ
Is a penetration test enough for the regulator?
It is a central piece, but regulators also expect a risk assessment and a tracked remediation plan. A report with no retest and no fix schedule is rarely judged sufficient.
What is the difference between MASVS L1 and L2?
L1 covers baseline requirements for any app. L2, expected for a bank, adds defense in depth, and the resilience option tests obfuscation, root detection and anti-tampering, which adds 2 to 4 audit days.
Should we test in production or pre-production?
In pre-production, with anonymized data and test accounts, in 90% of cases. A few configuration checks may target production within a window approved in writing.
How often should the audit be repeated?
At least once a year, and at every major change such as a new payment flow or an API opened to partners. A yearly audit usually costs 13,000 to 21,500 USD.
How many vulnerabilities are found on average?
On a first release, a serious audit often surfaces 15 to 30 findings, including 2 to 5 critical or high. The most frequent involve API access control and local token storage.
Let's scope your project. Describe your app, platforms and APIs: we help you frame the audit scope and price the fixes, with an indicative budget and remediation schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
