Accessibility · Banking

European Accessibility Act: what changes for online banking services

By Mehdi Najeddine, VOID ([TO PROVIDE: Mehdi Najeddine's exact title, founder or co-founder and director, to be confirmed by management]). Published on 26 September 2026. Facts checked on 26 September 2026. About 14 minutes to read.

Since 28 June 2025, the European Accessibility Act has required banking services provided to consumers in the European Union to be accessible: websites, apps, identification, electronic signatures, payment and information. ATMs and payment terminals are covered too. The reference technical standard is still EN 301 549 v3.2.1, based on WCAG 2.1 Level AA. Its version 4.1.1, published in September 2026, moves to WCAG 2.2. Here is what the text requires from a bank, who enforces it in France, what the penalties are, and where to start.

Five key points

Date: since 28 June 2025, with a transition period until 28 June 2030.
Services: credit, investment, payment, payment accounts, electronic money.
Standard: EN 301 549 v3.2.1 (WCAG 2.1); v4.1.1 (WCAG 2.2) awaits citation in the Official Journal of the EU.
Enforcement in France: the ACPR, the AMF and the Banque de France.
First step: map the services in scope, then audit critical journeys against WCAG 2.2 AA.

The EAA in brief

A 2019 directive, applicable since 28 June 2025

Directive (EU) 2019/882 of 17 April 2019, known as the European Accessibility Act, harmonises accessibility requirements for certain products and services sold in the Union. Member states had to transpose it by 28 June 2022 and apply their measures from 28 June 2025 (Article 31).

Products covered: consumer computers and operating systems, payment terminals, ATMs and other self-service terminals, communication devices, e-readers.
Services covered: electronic communications, access to audiovisual media, parts of passenger transport, consumer banking services, e-books and e-commerce.

Not to be confused with the 2016 directive

Directive (EU) 2016/2102 covers public sector websites and apps; the EAA covers products and services on the market. The 28 June 2025 deadline belongs to the EAA.

Which banking services are covered

Consumer banking services

Article 3 of the directive defines consumer banking services as the provision to consumers of:

credit agreements (Directives 2008/48/EC and 2014/17/EU);
certain investment services (Directive 2014/65/EU);
payment services (Directive (EU) 2015/2366);
payment account services (Directive 2014/92/EU);
electronic money (Directive 2009/110/EC).

Only services provided to consumers are covered. [TO PROVIDE: legal validation of this reading, especially for offers aimed at both individuals and businesses]

Channels

The obligation covers the website, the app, online journeys, and information and documents given to the customer. ATMs and payment terminals are products covered by Article 2.

Exemptions and deadlines

Microenterprises providing services: exempt (Article 4(5)).
Fundamental alteration or disproportionate burden: to be assessed and documented (Article 14).
Services provided with products already in use before 28 June 2025: until 28 June 2030; earlier contracts: until they expire, five years at most (Article 32).
Self-service terminals already in service: until the end of their economically useful life, 20 years at most, if the member state allows it (Article 32). [TO PROVIDE: period chosen by France, confirmed by a lawyer]

Banking-specific requirements

Identification, electronic signatures, security and payment

Annex I, Section IV, point (e) requires banks to provide identification methods, electronic signatures, security and payment services that are perceivable, operable, understandable and robust: the four WCAG principles. This covers strong customer authentication, one-time codes, biometrics, online contract signing and 3-D Secure.

Understandable information, no higher than level B2

The same point adds an unusual requirement: information must be understandable without exceeding level B2 of the Common European Framework of Reference for Languages. It applies to pricing terms, error messages and security notifications. In France, the order of 9 October 2023 (in French) repeats both requirements in its Article 9.

Informing customers about accessibility (Annex V)

The service provider includes, in its general terms and conditions or an equivalent document, information explaining how the service meets the requirements:

a general description of the service in accessible formats;
the explanations needed to understand how it works;
how the service meets the requirements of Annex I.

Expected form in France: [TO PROVIDE: legal validation of the form and location of this information]

The technical standard: EN 301 549, WCAG 2.1 and WCAG 2.2

v3.2.1 remains the reference

The directive leaves technical detail to standards. For digital services, that standard is EN 301 549. As of 26 September 2026, its version 3.2.1 (2021), based on WCAG 2.1 Level AA, remains the reference, according to AccessibleEU, the resource centre set up by the European Commission. The standard goes beyond WCAG: closed functionality (clause 5), hardware (clause 8), interoperability with assistive technologies (clause 11), documentation and support services (clause 12), relay services (clause 13).

v4.1.1, September 2026

Published in early September 2026, v4.1.1 moves to WCAG 2.2 and adds a mapping to the EAA requirements. It will only give a presumption of conformity once it is cited in the Official Journal of the EU (AccessibleEU, 7 September 2026). Our advice: audit against WCAG 2.2 AA now, since content that conforms to WCAG 2.2 also conforms to WCAG 2.1, according to the W3C.

In France: RGAA 4.1.2 today, RGAA 5 expected by the end of 2026

The RGAA, the evaluation method for organisations covered by Article 47 of the 2005 law, is based on WCAG 2.1 in version 4.1.2. RGAA 5 (in French) will include WCAG 2.2. Statements made before it is published will remain valid for 18 months, within a limit of 3 years.

Accessibility standards as of 26 September 2026

Standard	Version in force	Announced change
WCAG (W3C)	2.2, W3C Recommendation since 5 October 2023	Approved as ISO/IEC 40500:2025 in October 2025
EN 301 549	v3.2.1 (2021), based on WCAG 2.1	v4.1.1 published in September 2026 (WCAG 2.2), citation in the Official Journal pending
RGAA (France)	4.1.2, based on WCAG 2.1	RGAA 5 expected by the end of 2026 (WCAG 2.2, mobile, office documents)

Enforcement in France

France is the market we cover most closely. Each member state designates its own enforcement authorities and penalties, so check the transposing measures of every country where you serve consumers.

The texts

The EAA is transposed by Article 16 of law 2023-171 of 9 March 2023, decree 2023-931 of 9 October 2023 and the order of 9 October 2023 (all in French). The law added these obligations to the French Monetary and Financial Code.

Authorities for banking and finance

Under Article 16 of the law, the ACPR (prudential supervision authority) and the AMF (financial markets authority) check that information is understandable. The Banque de France checks identification methods, electronic signatures, and security and payment services. [TO PROVIDE: legal validation of how roles are split between the ACPR, the AMF and the Banque de France]

Penalties

Decree 2023-931 created Article R. 451-4 of the French Consumer Code: failure to meet the requirements is punishable by a fifth-class fine, up to 1,500 euros, or 3,000 euros for a repeat offence (Article 131-13 of the Criminal Code). For a legal entity, the maximum is multiplied by five (Article 131-41 of the Criminal Code): 7,500 euros per offence, 15,000 euros for a repeat offence. These fines cover the requirements that come from the EAA. Article 47 of the 2005 law has its own penalty regime, described below. [TO PROVIDE: dated legal validation of the amounts and of any administrative penalties specific to banking]

Large companies: Article 47 and the multi-year plan

Separately from the EAA, Article 47 of the law of 11 February 2005 requires public bodies and companies whose turnover in France exceeds a threshold set by decree to publish an accessibility statement and a multi-year accessibility plan, broken down into annual action plans. Decree 2019-768 sets that threshold at 250 million euros; it was amended by decree 2026-816 of 24 August 2026.

Since ordinance 2023-859 of 6 September 2023, Arcom, the French audiovisual and digital communication regulator, enforces these obligations (Article 47-1 of the law, in French). For a company above the threshold, a large bank included, the checks cover the publication duties: accessibility statement, multi-year plan, current annual action plan, a notice on the home page and a way to report a problem (Arcom, in French). The penalty can reach 25,000 euros. The 50,000 euro ceiling applies to failing the accessibility obligation itself, which binds public bodies and entities running a public service. If the breach continues six months after a penalty, a new penalty can be imposed. [TO PROVIDE: legal validation of the threshold and penalties applicable after decree 2026-816]

Non-EU banks, including Moroccan banks: when the EAA applies

Subsidiaries and branches established in the Union

A subsidiary or branch established in a member state and serving consumers falls within the scope of the directive like any European provider, including an entity focused on Moroccans living abroad. [TO PROVIDE: list of European subsidiaries of Moroccan banks to cite, or keep a generic wording]

Online services provided from Morocco to EU residents

This is the hardest case. The answer depends on the legal set-up: licensing, cross-border provision, marketing targeted at EU residents. It calls for a case-by-case analysis. [TO PROVIDE: legal analysis of services provided from Morocco to EU residents]

Combining the Bank Al-Maghrib charter and the EAA

In Morocco, the March 2023 interbank charter commits banks to audit their digital services against WCAG 2.1. In Europe, the EAA points to EN 301 549. A well-documented WCAG 2.2 AA audit feeds the progress report sent to Bank Al-Maghrib and the web and mobile part of the European compliance file; the standard's requirements beyond WCAG are handled separately. See our page on banking accessibility in Morocco and the Bank Al-Maghrib charter.

Six journeys to test first

For each journey: what blocks users, the WCAG 2.2 criteria involved, and the typical fix.

Onboarding and KYC

What blocks: unlabelled fields, errors shown by colour alone, upload that does not work with a keyboard, video selfie with no alternative. Criteria: 1.3.5, 1.4.1, 3.3.1, 3.3.2, 3.3.7. Fix: visible labels, text errors attached to the field, autocomplete, an alternative to video.

Strong authentication and 3-D Secure

What blocks: codes that cannot be pasted, countdowns that are too short, visual puzzles, biometrics with no other method. Criteria: 2.2.1, 3.3.8. Fix: pasting and autofill of the code, an extendable time limit, a second method. The 3-D Secure page often comes from a third party: include it in the audit and the contract.

Adding a payee and making a transfer

What blocks: IBAN re-entered, confirmations not announced, a field hidden by a sticky banner when it receives focus. Criteria: 2.4.11, 3.3.7, 4.1.3. Fix: reuse data already entered, announce status messages, reserve space for fixed elements.

Online credit and simulators

What blocks: sliders that only work by dragging, results updated without announcement, jargon. Criteria: 2.5.7, 2.5.8, 4.1.3 and the B2 level of Annex I. Fix: an input field alongside the slider, an announced result, plain-language texts.

Statements, contracts and PDF documents

What blocks: scanned or untagged PDFs, tables without headers. Criteria: 1.1.1, 1.3.1, 1.3.2. Fix: generate tagged PDFs at the source, or offer an HTML version of statements.

ATMs and payment terminals

What blocks: timed steps, no audio output, keypads without tactile markers. References: WCAG2ICT for software, EN 301 549 for software and hardware. Fix: longer time limits, audio guidance, a smartphone relay.

Where to start

Map
The banking products, platforms and third parties in scope (3-D Secure, electronic signature, KYC).
Output: a map of services in scope.
Audit
A sample of critical journeys, against WCAG 2.2 AA.
Output: a conformance rate per journey.
Prioritise
By journey and severity, starting with whatever stops a customer from completing a transaction.
Output: a costed remediation plan.
Fix
In code and content, starting with shared components.
Output: fixed journeys.
Inform
Publish accessibility information in the general terms and conditions or an equivalent document (Annex V).
Output: up-to-date customer information.
Monitor continuously
Automated tests in continuous integration, manual tests at each major release.
Output: conformance that holds over time.

An overlay does not replace these steps

In April 2025, the US Federal Trade Commission required the vendor accessiBe to pay 1 million dollars over WCAG compliance claims it found false or unsupported (FTC press release). In May 2023, the EDF and the IAAP stated that these tools do not make a website compliant with European legislation (joint statement).

For banks, fintechs and payment institutions in France, VOID carries out the audit and the fixes from Morocco, nearshore, with communication and deliverables in French: RGAA, WCAG 2.2 and EAA accessibility audit and nearshore outsourcing in Morocco.

Frequently asked questions

Since when has the European Accessibility Act applied?

Since 28 June 2025. A transition period runs until 28 June 2030 for services provided with products already in use before that date; contracts agreed before 28 June 2025 may run until they expire, for five years at most.

Which banking services does the EAA cover?

Banking services provided to consumers: credit, certain investment services, payment, payment accounts and electronic money (Article 3). ATMs and payment terminals are covered as products.

Does the EAA require WCAG 2.1 or WCAG 2.2?

Neither directly: the directive sets requirements and the European standard EN 301 549 turns them into criteria. Its reference version, v3.2.1, is based on WCAG 2.1 AA; v4.1.1 (September 2026) moves to WCAG 2.2 and awaits citation in the Official Journal of the EU. A WCAG 2.2 AA audit covers the WCAG-based requirements of both versions (clause 9 and its equivalents for documents and software). It does not cover the parts of the standard that go beyond WCAG: closed functionality (clause 5), hardware (clause 8), interoperability with assistive technologies and user preferences (clause 11), documentation and support services (clause 12), relay services (clause 13). These matter for ATMs and apps.

Who enforces the EAA for banks in France, and what are the penalties?

Under Article 16 of French law 2023-171, the ACPR and the AMF check that information is understandable, and the Banque de France checks identification methods, electronic signatures, security and payment services. Decree 2023-931 makes non-compliance punishable by a fifth-class fine: up to 7,500 euros for a legal entity, 15,000 euros for a repeat offence. Article 47 of the 2005 law has its own regime, enforced by Arcom: up to 25,000 euros for a large company that does not publish its accessibility statement or its multi-year plan. Enforcement authorities differ in each member state. [TO PROVIDE: dated legal validation of the authorities and amounts]

Does a bank established outside the EU have to comply with the EAA?

Its subsidiary or branch established in the Union and serving consumers does. For services provided directly from a third country, the answer depends on the legal set-up. [TO PROVIDE: legal analysis of services provided from Morocco]

Do ATMs already installed have to be replaced?

Not necessarily. Member states may let self-service terminals used before 28 June 2025 stay in service until the end of their economically useful life, 20 years at most. Machines placed on the market after that date must comply. [TO PROVIDE: period chosen by France, confirmed by a lawyer]

Do we need to publish an accessibility statement?

The EAA requires information on the accessibility of the service in the terms and conditions or an equivalent document (Annex V). The accessibility statement in the RGAA sense comes from Article 47 of the French law of 11 February 2005. A large bank in France may be subject to both.

Are small businesses exempt?

Microenterprises providing services (fewer than 10 persons, turnover or balance sheet total of 2 million euros at most) are exempt. SMEs are not, but they can invoke a disproportionate burden, to be documented (Article 14).

About this article

Written by Mehdi Najeddine, VOID ([TO PROVIDE: Mehdi Najeddine's exact title, founder or co-founder and director, to be confirmed by management]). He has more than 20 years of experience in web development and high-traffic platform architecture.

Accessibility review: [TO PROVIDE: named accessibility expert and certification]
Legal review: [TO PROVIDE: lawyer who reviewed the article, if VOID agrees to name them]

This article describes the regulatory framework for information purposes. It is not legal advice. For more on the criteria themselves, read our practical WCAG guide.

Official sources cited

Get your banking journeys audited

A WCAG 2.2 AA audit of your critical journeys, a remediation plan, then fixes by the same team. To talk it through, contact us.

See the audit offer Banks in Morocco: the Bank Al-Maghrib charter