European Accessibility Act (EAA) and WCAG testing requirements
The European Accessibility Act, Directive (EU) 2019/882, requires consumer banking and e-commerce services provided to EU consumers after 28 June 2025 to be accessible to people with disabilities. EAA testing verifies login, payment, and onboarding flows against EN 301 549 and WCAG 2.2 Level AA. FintechAssuranceLabs delivers a WCAG 2.2 AA audit report with screen reader test results.
- Jurisdiction
- EU (Directive (EU) 2019/882, applied by Member States from 28 June 2025); harmonised standard EN 301 549
- Primary source
- eur-lex.europa.eu
Engineering interpretation of testing requirements, not compliance advice.
What the European Accessibility Act requires of banking and payment services
Directive (EU) 2019/882 (checked on 2026-09-16), the European Accessibility Act, applies to services provided to consumers after 28 June 2025 (Article 2(2)). Member States apply their national measures from that date (Article 31(2)) and set the penalties (Article 30). Two service categories matter for fintech:
- Consumer banking services (Article 2(2)(d), defined in Article 3(28)). Consumer credit and mortgage credit agreements, listed MiFID II investment services, PSD2 payment services, payment account services, and electronic money.
- E-commerce services (Article 2(2)(f), defined in Article 3(30)). Services provided at a distance through websites and mobile apps to conclude a consumer contract.
A service provider is anyone who provides a service on the Union market or offers it to consumers in the Union (Article 3(4)). Microenterprises providing services are exempt (Article 4(5)). The requirements that change test scope sit in Annex I:
- Section III(c). Websites, related online applications, and mobile apps are perceivable, operable, understandable, and robust.
- Section IV(e)(i). Identification methods, electronic signatures, security, and payment services in consumer banking are perceivable, operable, understandable, and robust.
- Section IV(e)(ii). Consumer banking information does not exceed level B2 (upper intermediate) of the Common European Framework of Reference for Languages.
- Section IV(g)(ii) and (iii). E-commerce identification, security, and payment functions meet the same four principles.
- Article 13 and Annex V. The provider publishes accessibility information in its general terms and conditions, keeps the service in conformity through changes, and reports non-conformity to the competent national authorities.
- Article 14. A provider that claims a disproportionate burden documents the assessment, keeps the results for five years, and renews the assessment at least every five years.
- Article 32(1). Products lawfully used to provide a service before 28 June 2025 may stay in use until 28 June 2030.
The Directive names no technical standard. Article 15(1) presumes conformity for services that meet harmonised standards cited in the Official Journal. ETSI EN 301 549 V3.2.1 (2021-03) applies the WCAG 2.1 Level AA conformance requirements to web pages (clause 9.6) and was cited for the public sector Web Accessibility Directive by Implementing Decision (EU) 2021/1339. EN 301 549 V4.1.1 (2026-09) was prepared for the EAA, aligns clauses 9 to 11 with WCAG 2.2, and maps its clauses to the Directive in Annex ZB. Its foreword states that the presumption applies once it is cited in the Official Journal; the Commission's AccessibleEU centre reported on 7 September 2026 that it was not yet cited. Clause 11 covers non-web software such as mobile apps, and clause 11.0 Note 3 assigns web views inside an app to clause 11.
In the US, the Department of Justice web accessibility guidance of 18 March 2022 applies the ADA to the web services of public accommodations and names WCAG as helpful guidance, with no detailed technical standard.
What EAA accessibility testing verifies
| Requirement | What we test | Evidence produced |
|---|---|---|
| WCAG 2.2 SC 2.2.1 Timing Adjustable (EN 301 549 clauses 9.2.2.1 and 11.2.2.1) | A warning before session expiry, at least 20 seconds to extend with one action, and at least ten extensions on transfer and onboarding forms | Timeout test log per flow with the warning time and each extension result |
| WCAG 2.2 SC 3.3.8 Accessible Authentication (Minimum) | Password manager autofill, paste into password and one-time code fields, and a login path without a puzzle CAPTCHA | Authentication test results per login and step-up method |
| WCAG 2.2 SC 3.3.7 Redundant Entry | Payee name, IBAN, and address fields that the same payment or onboarding process asks for twice | Redundant entry check per process step |
| WCAG 2.2 SC 3.3.4 Error Prevention (Legal, Financial, Data) | A review, confirm, and correct step before a transfer, a credit agreement signature, or a trade order | Confirmation step test result per transaction type |
| WCAG 2.2 SC 3.3.1 Error Identification | IBAN, amount, and date validation errors described in text and announced by the screen reader | Screen reader test results for payment and onboarding flows |
| WCAG 2.2 SC 2.1.1 Keyboard | Payment, card control, and consent flows operated with a keyboard only, including date pickers and custom dropdowns | Keyboard path record with each blocked step |
| WCAG 2.2 SC 1.4.3 Contrast (Minimum) | A 4.5:1 ratio for fee, balance, and error text and 3:1 for large text | Contrast measurement table per screen in the WCAG 2.2 AA audit report |
| WCAG 2.2 SC 4.1.2 Name, Role, Value | Name, role, and state of custom controls such as an amount keypad, a card freeze toggle, and an account switcher with VoiceOver, TalkBack, and NVDA | Screen reader output transcript per custom control |
| WCAG 2.2 conformance requirement 5.2.3 Complete Processes (EN 301 549 clause 9.6) | Every step from product selection to a third-party payment page or 3-D Secure challenge screen | Process step inventory with the conformance result per step |
| EN 301 549 clause 5.3 Biometrics | A non-biometric method for login and payment approval | Authentication alternatives matrix per platform |
PSD2 SCA ends online account access after 5 minutes of inactivity. In our engineering reading, a warning with a one-action extension satisfies SC 2.2.1 without breaking that limit, because the extension action is payer activity.
Artifacts an authority or partner bank requests
Member State authorities check services and follow up complaints under Article 23. Authorities and partner banks in due diligence typically request:
- the accessibility information in the general terms and conditions under Annex V: a general description of the service in accessible formats and a description of how the service meets each Annex I requirement (Article 13(2));
- the information needed to demonstrate conformity on a reasoned request (Article 13(5)): the audit report mapped to EN 301 549 clauses, with the tested pages, app versions, and assistive technology versions;
- the EN 301 549 and WCAG versions used for the evaluation, because Article 13(3) requires providers to take changes in harmonised standards into account;
- regression evidence that each release keeps conformity (Article 13(3));
- corrective action records for each non-conformity and the notification to the competent national authorities (Article 13(4));
- the documented disproportionate burden or fundamental alteration assessment, if the provider relies on one, with the renewal date (Article 14(3) and 14(5));
- the list of products that stay in use under the transitional period to 28 June 2030 (Article 32(1)).
Common EAA and WCAG findings in banking and payment apps
- Silent logout on the transfer form. The session ends after inactivity without a warning, and the payee details the user entered are lost. The defect breaks SC 2.2.1.
- Partial password challenge. The login asks for the 1st, 3rd, and 5th characters of the password, so a password manager cannot fill the field. W3C's Understanding document for SC 3.3.8 treats this format as a failure unless another method is available.
- Split one-time code fields. Six single-digit inputs accept only one digit on paste and block autofill. The defect breaks SC 3.3.8.
- IBAN typed twice. The confirmation step asks the user to type the IBAN from step one again, with no security reason recorded. The defect breaks SC 3.3.7.
- Card freeze toggle without state. VoiceOver announces "button" with no name and no on or off state. The defect breaks SC 4.1.2 and EN 301 549 clause 11.4.1.2.
- Amount error shown as a red border only. An amount over the daily limit changes the field border and gives no text. The defect breaks SC 3.3.1.
- Keyboard trap in the payment iframe. Focus enters a hosted card form or a 3-D Secure challenge frame and cannot leave with the keyboard. The defect breaks SC 2.1.2, and under conformance requirement 5.2.3 no page of that checkout process conforms.
- Face ID as the only approval method. Payment approval offers no PIN or passcode path. The defect breaks EN 301 549 clause 5.3.
- Web view audited against web rules. The audit report maps an in-app web view checkout to clause 9, while clause 11.0 Note 3 assigns web views to clause 11.
- No accessibility information in the terms. The general terms and conditions do not describe how the service meets Annex I. The gap breaks Article 13(2) and Annex V.
How we cover EAA and WCAG testing
Accessibility testing delivers the WCAG 2.2 AA audit report mapped to EN 301 549 clauses, screen reader test results for payment and onboarding flows, a prioritised remediation list, and a retest report after fixes.
Mobile app testing runs the clause 11 checks on iOS and Android. The device and OS coverage matrix records the VoiceOver and TalkBack versions, and the release regression suite for the app stores repeats the accessibility cases on each release as Article 13(3) evidence.
We test accessibility for consumer banking and payment products: neobanks, consumer lending, trading and wealthtech apps, remittance, and family banking. For e-commerce services we test buy now pay later checkouts, insurance sold online, and the hosted payment pages that payment acquirers place inside merchant checkouts.
Related
Segments
Questions
What is the European Accessibility Act?
Who does the EAA apply to?
What is EN 301 549?
Is WCAG 2.2 a legal requirement?
Scope your testing
Send FintechAssuranceLabs your product, segment, money flows, and the standards that need evidence, and get a proposed test scope with its deliverables.
Scope your testing