The verdict in three sentences
For an FCA-regulated firm, the website is both a sales channel and a regulatory and cybersecurity exposure surface. A serious project in London costs 70,000 to 170,000 EUR (about 60,000 to 145,000 GBP), plus 17,000 to 45,000 EUR for a penetration test before launch. The three non-negotiable workstreams are fair and clear financial promotions (FCA status, representative APR), UK GDPR compliance with the ICO and technical hardening against phishing.
Mandatory or expected disclosures and content
The CEO of a credit firm with 40,000 customers often gets the same question from the board: what are we exposed to with the current website? The answer is a precise inventory, to be signed off by compliance.
| Element | Basis or expectation | Where to display it |
|---|---|---|
| FCA firm reference number and authorisation status | FCA Handbook, General Provisions | Footer and About page |
| Registered office and company number | Companies Act disclosure | Footer |
| Representative APR with a representative example | Consumer Credit sourcebook (CONC) financial promotion rules | Every credit product page and ad |
| Terms, fees and charges | Consumer Duty, price and value outcome | Downloadable, dated page |
| Complaints procedure and Financial Ombudsman Service | DISP rules | Dedicated page and form |
| Privacy notice, purposes, retention periods | UK GDPR, Data Protection Act 2018 | Footer link and every form |
| Fraud warning ("we will never ask for your password") | Phishing and APP fraud prevention | Banner and security page |
A loan calculator is an excellent sales tool, provided it shows the representative APR including fees, not a simple nominal rate. It is one of the points most frequently flagged in financial promotion reviews.
Budget for a regulated firm website in London in 2026
| Item | Corporate website | Website + branches + calculator | Website + secure customer portal |
|---|---|---|---|
| Design, build, integration | 35,000 EUR | 46,000 EUR | 57,000 EUR |
| Compliant product pages and copywriting | 10,000 EUR | 15,000 EUR | 17,000 EUR |
| Branch or service-point locator | Basic, included | 9,000 EUR | 11,000 EUR |
| Credit calculator with representative APR | Not included | 14,000 EUR | 17,000 EUR |
| Customer portal (balance, requests) | Not included | Not included | 51,000 EUR |
| Secure hosting, WAF, backups (year 1) | 7,000 EUR | 10,000 EUR | 17,000 EUR |
| Total excl. pen test | about 70,000 EUR | about 94,000 EUR | about 170,000 EUR |
| Timeline | 8 to 10 weeks | 10 to 14 weeks | 16 to 22 weeks |
The customer portal puts the project in another category: it connects to core banking systems, requires strong customer authentication and a deeper audit. Many firms start with the corporate site and calculator, then add the portal in phase 2.
Security and personal data: the technical checklist
| Measure | Purpose | Indicative 2026 cost |
|---|---|---|
| HTTPS everywhere, HSTS, TLS 1.2 minimum | Encryption and anti-interception | Included |
| CSP, X-Frame-Options, Referrer-Policy headers | Block script injection and clickjacking | Included if planned from day one |
| Web application firewall (WAF) and DDoS protection | Withstand automated attacks | 350 to 1,400 EUR per month |
| Forms with bot protection and encrypted attachments | Protect credit applications | 2,300 to 5,700 EUR |
| Lookalike domain monitoring (typosquatting) | Detect fake sites | 1,700 to 4,600 EUR per year |
| ICO registration, DPIA and records of processing | UK GDPR compliance | 3,400 to 9,000 EUR of advisory support |
| Penetration test before launch | Validate the whole stack | 17,000 to 45,000 EUR |
The data processed by a credit firm (identity, income, credit history) is sensitive. The ICO expects a data protection fee registration, a documented lawful basis, clear information to customers and proportionate security measures. Any hosting outside the UK requires documented transfer safeguards.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
David, CEO of a London credit firm with 40,000 customers and 22 partner points, picks the website, locator and calculator package at 94,000 EUR, plus a 23,000 EUR penetration test, a total of 117,000 EUR. The calculator and pre-application form generate 120 qualified applications per month. With a 30% funding rate, an average loan of 1,400 EUR and a net yield of 12% over the year, each loan brings about 168 EUR. The 36 extra loans per month represent roughly 6,000 EUR of income per month, so the project pays back in about 20 months, faster once the portal reduces call centre volume.
FAQ
Must the FCA approve the website before launch?
There is no systematic pre-approval, but every financial promotion must be approved by an authorised person and remain fair, clear and not misleading. Have compliance sign off each product page before go-live.
Can the website be hosted outside the UK?
Yes for a corporate site, provided transfers are covered by adequacy regulations or appropriate safeguards. For a customer portal, UK or EU hosting is usually preferable.
What does annual maintenance cost?
Allow 20,000 to 45,000 EUR per year for corrective maintenance, security updates, WAF and monitoring. A lighter retest every 12 months is recommended.
How do we fight fake sites impersonating our brand?
Register the main domain variants (.co.uk, .com, with and without hyphen) for 15 to 45 EUR each per year, and enable monitoring. Publish an official channels page listing your phone numbers.
Can repayments by Open Banking or card be integrated?
Yes, through a payment provider API with automatic reconciliation in the loan management system. Allow 28,000 to 57,000 EUR depending on the available connector.
Let's scope your project. Compliant, hardened website for a regulated firm, from 70,000 to 170,000 EUR excl. pen test, delivered in 8 to 22 weeks depending on scope. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
