A fintech product team reached out to us feeling pretty good about where they stood. Their marketing site had run through an automated scanner a few months back, come back mostly clean, and everyone moved on. Reasonable enough, on the surface.
Then we audited the actual product, the logged-in dashboard where customers check balances, move money, and read their statements, the part of the site people spend the overwhelming majority of their time in. It came back with six failures. Not six obscure edge cases, either. Six failures we see in some combination on nearly every fintech audit this agency runs, marketing site score notwithstanding.
That gap between "the public site passed" and "the actual banking product is full of blockers" is the story of this article. Below are the six, in the order they tend to surface, and what fixing each one actually looks like.
The Stat: The CDC reports that roughly 1 in 4 (28.7%) of US adults have some type of disability, a population that disproportionately relies on financial services websites for tasks with no easy offline substitute, like checking a balance or paying a bill on time. (Source: CDC)
Why the Marketing Site Passing Means Almost Nothing
Marketing pages are simple by design. A hero image, a headline, a signup button, maybe a pricing table. Automated scanners handle that kind of static content reasonably well, which is exactly why so many fintech teams walk away from a clean scan believing they're covered.
The logged-in product is a completely different animal. It's built from custom widgets, live data, third-party embeds, and security gates that don't exist anywhere on the public site. That's also where a customer actually spends their money-managing time, which makes it the highest-stakes surface on the whole domain and, not coincidentally, the surface where audits keep finding the same failures.
We covered the shared regulatory angle between healthcare and fintech in our piece on the three WCAG failures regulators look for first, which looks at both sectors together from a regulator's point of view. This one stays entirely inside fintech and widens the lens to six failures, from the perspective of what actually trips up an audit, not what a compliance officer flags after the fact.
The 6 Blockers That Fail an Audit Every Time
1. Custom Form Controls Without Roles
Account opening flows, transfer forms, and beneficiary setup screens almost never use plain HTML <select> or <input> elements anymore. Design teams build custom dropdowns, toggle switches, and multi-step steppers instead, because they're easier to brand.
The problem is that a <div> styled to look like a dropdown isn't a dropdown to a screen reader unless it's given the right ARIA role, state, and keyboard behavior. Without that, a screen reader user tabs onto what sounds like an unlabeled, un-interactive block of text, with no indication it opens a list of options or that an option has been selected. It's one of the single most common blockers we log, and it usually sits on the exact form a customer needs to complete to move their money.
2. Charts and Data Visualizations With No Text Equivalent
Spending breakdowns, portfolio performance graphs, budget category pie charts: fintech dashboards run on visualizations, and for a huge share of users that's genuinely the best way to understand the data. But when the chart is the only place that information lives, with no equivalent table, summary, or accessible data source behind it, a screen reader user gets nothing. Not a rough sense of the trend, not the actual numbers. Nothing.
The fix isn't complicated. Every chart needs either a text alternative summarizing the key figures or an accessible underlying data table a screen reader can actually read. If the chart updates dynamically, WCAG's guidance on status messages is the right reference for making sure the update itself gets announced, not just the initial render.
3. PDF Statements With the Same Tagging Problems as Any Other PDF
Monthly statements, annual tax documents, and transaction histories in fintech get generated as PDFs almost universally, and almost universally they inherit the exact same tagging problems as any other PDF on the internet: no heading structure, no reading order, tables with no header associations, scanned images of text with no OCR layer underneath.
The difference in fintech is what's at stake. A statement isn't marketing collateral, it's the record a customer needs to reconcile their own finances, and in many cases the only version of that record they're given. We wrote a full walkthrough on fixing PDF accessibility without buying Acrobat Pro that applies directly here, free tools included, no enterprise license required.
4. CAPTCHA With No Accessible Alternative
Login screens, password resets, and transfer confirmations in fintech lean hard on CAPTCHA, for understandable fraud-prevention reasons. The trouble is that a huge share of CAPTCHA implementations still ship as a single, visual-only challenge, distorted text in an image, a grid of photos to click, with no audio option and no alternative path for someone who can't complete a purely visual task.
That's not a minor inconvenience. It's a locked door on the login screen itself, before a customer can even reach their account. An accessible CAPTCHA implementation needs an audio alternative at minimum, and ideally a non-visual verification method that doesn't depend on solving a puzzle at all.
5. Session Timeouts With No Warning or Extension
Security-conscious session limits make sense for a banking product. What doesn't make sense is a timeout that fires with zero warning, silently logging a customer out mid-transfer and discarding whatever they were doing. For anyone who reads more slowly, navigates by keyboard, or needs extra time to complete a form, a short unannounced timeout isn't just annoying, it's a task that never gets to finish.
A compliant pattern warns the user before time runs out and gives them a straightforward way to extend the session. That warning itself needs to be announced properly to assistive technology, which loops back to the same status messages guidance referenced above. A silent countdown that only updates visually might as well not exist for a screen reader user.
6. Color-Only Risk and Fraud Indicators
Fraud alerts, spending limit warnings, and account risk flags in fintech dashboards frequently rely on color alone to carry the message: a red row for a flagged transaction, a green badge for a cleared one, an amber dot for something pending review. If color is the only signal, anyone with a color vision deficiency, or anyone using a screen reader, misses the flag entirely.
The same information needs a second channel: an icon, a text label, a pattern, something that survives the removal of color. For a fraud alert specifically, that's not a cosmetic nice-to-have. It's the difference between a customer catching unauthorized activity on their account and missing it because the only signal was a shade of red they couldn't distinguish, or couldn't see at all.
What This Actually Costs You
None of these six require rebuilding the product from scratch. Every one of them is a fix to an existing component: adding a role, adding a text alternative, re-tagging a PDF template once, adding an audio CAPTCHA option, adding a timeout warning, adding a second visual signal. What they require is someone auditing the logged-in product specifically, not just the public-facing pages a scanner can reach on its own.
Given how disproportionately this population relies on financial sites for tasks with no offline substitute, and given the exposure financial institutions already carry under laws enforced through the Department of Justice's ADA guidance, treating the banking product as a lower priority than the marketing site is exactly backwards.
If you want to know which of these six are sitting in your own product right now, you can start with a free audit and get a straight answer before a customer, or a regulator, finds it for you.
Reach out any time at experts@wcag.world if you'd like to talk it through with a person on our team, or go straight to wcag.world/free-audit to get started.