The verdict in three sentences
For a money transfer fintech in London, a penetration test is first a document to hand over: the FCA, sponsor banks and payment partners expect a recent, structured report followed by a retest. A web and mobile test against OWASP ASVS level 2 costs 8,000 to 25,000 GBP for 5 to 10 days of testing, depending on the number of apps, APIs and user roles. Kolonell supports application hardening and remediation within a range of 2.5 to 15M+ FCFA (3,810 to 22,870+ EUR) depending on complexity, with the rest quoted on request.
Why the report has become unavoidable
Authorised payment and e-money institutions must meet the FCA's operational resilience rules and the security requirements of the Payment Services Regulations, including an annual operational and security risk assessment. UK GDPR adds its own obligations. In practice, every new banking or aggregation partnership triggers a security questionnaire asking for the date and outcome of the last independent penetration test, often by a CREST-accredited firm.
| Test format | Scope | Duration | Indicative 2026 cost | Typical use |
|---|---|---|---|---|
| Automated vulnerability scan | Exposed surface | 1 to 2 days | 1,000 to 3,000 GBP | Monthly hygiene, not enough for partners |
| Black-box web test | Site and back office | 3 to 5 days | 5,000 to 8,000 GBP | First baseline |
| Grey-box web + API, ASVS level 2 | Web, API, 3 roles | 5 to 7 days | 8,000 to 14,000 GBP | Sponsor bank due diligence |
| Web + Android/iOS + API | Customer and agent apps | 7 to 10 days | 14,000 to 25,000 GBP | Authorisation, fundraising |
| Targeted source code review | Payment and authentication modules | 4 to 8 days | 6,000 to 15,000 GBP | Complements the pentest |
| Retest after remediation | Reported findings | 1 to 2 days | 1,500 to 3,000 GBP | Closes the report |
Deliverables of an acceptable report
A report that satisfies a bank's risk committee contains specific items. Without them, it gets sent back and the partnership slips by 2 to 3 months.
| Deliverable | Expected content | Why it matters |
|---|---|---|
| Executive summary | 2 pages, overall risk level, top 5 findings | Read by leadership and the partner |
| Scope and methodology | URLs, app versions, test accounts, ASVS or MASVS standard | Proves the test covered the real product |
| Finding sheets | CVSS 3.1 or 4.0 score, proof of exploitation, business impact | Enables prioritisation |
| Remediation plan | Fix, owner, deadline: critical within 7 days, high within 30 days | Required by banks |
| Retest report | Status of each finding after the fix | Closes the file |
| Tester attestation | Dates, signatory, independence, accreditation | Attached to regulatory and partner files |
On a transfer app, the most frequent findings in 2026 remain broken access control on the API (viewing another customer's balance by changing an ID), no rate limiting on PIN or OTP attempts, secrets embedded in the Android app and weak validation of payment partner webhooks.
Mini case study
Priya, CTO of a London transfer fintech, is preparing a partnership with a bank that would bring 5M GBP of monthly volume at a 0.8% take rate, so 40,000 GBP of revenue a month. The web, mobile and API test costs her 18,000 GBP, the retest 2,500 GBP and 3 weeks of fixes by her team, about 15,000 GBP of internal time. Total: 35,500 GBP. Each month of delay costs 40,000 GBP: the audit pays back in under one month of volume, and it will serve the next two partners for 12 months.
FAQ
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
How often should a penetration test be repeated?
At least once a year, and after every major change such as a new API or payment method. Partner banks usually reject reports older than 12 months.
Black box or grey box: which to choose?
Grey box, with test accounts for each role, covers access control better in 5 to 7 days. Black box alone often misses 30 to 50% of the business logic.
Can we test in production?
It is possible with an agreed window and dedicated accounts, but an identical staging environment is preferable. It avoids any impact on live transactions.
How long do we have to fix the findings?
Common practice sets 7 days for critical, 30 days for high and 90 days for medium findings. The retest then takes 1 to 2 days.
Is a penetration test enough for compliance?
No, it complements a security policy, access management and logging. It remains the most requested item in partner questionnaires.
Let's scope your project. Describe your web and mobile apps, APIs and your deadline: we price preparation, remediation and retest support, within a range of 2.5 to 15M+ FCFA (3,810 to 22,870+ EUR) depending on complexity. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
