Penetration Testing Cost for UK Banks, Wealth and Pensions Firms (2026)

A penetration test for a UK bank, building society, wealth manager or pension provider typically costs £8,800 to £56,000 in the UK market. The low end is a single member or client portal. The high end is a trading or investment platform with its APIs and perimeter. The price is the number of testing days multiplied by a day rate of £1,100 to £1,400.

What does a penetration test cost for a financial services firm?

Most deposit-taking, wealth and pensions firms fall into one of four scopes, typically costing between £8,800 and £56,000 in the UK market. What you pay depends on how many customer-facing systems are tested and how complex each one is, because that sets the number of testing days. The table shows the typical range for each scope.

Scope	What is tested	Days	Typical UK cost
Wealth or pension member portal	A multi-role portal where members or clients see balances, documents and transactions	8 to 12 days	£8,800 to £16,800
Loan origination and broker portal	An application and decisioning platform used by customers and by mortgage brokers, plus the APIs behind it	14 to 21 days	£15,400 to £29,400
Online banking, web and mobile	The online banking web application and the iOS and Android apps with payment and biometric features	16 to 22 days	£17,600 to £30,800
Trading or investment platform	A multi-tenant platform with complex authorisation, its order and market-data APIs, and the internet-facing perimeter	28 to 40 days	£30,800 to £56,000

These are market ranges, worked out from typical engagement lengths and UK day rates of £1,100 to £1,400. They are a guide for budgeting. The pricing page shows the engagement lengths for each type of test, and the quote form gives an exact fixed price for your scope.

What drives the price?

The number of testing days drives the price, and the scope drives the number of days. For a retail financial services firm the day count is set mainly by how many customer journeys exist and how many types of user move money or see money. Five things move it.

• Customer journeys. Logging in, viewing a portfolio, changing bank details, making a transfer and applying for a loan are separate paths. Each one is tested for broken authorisation and business-logic flaws.
• User roles. A client, an adviser acting for several clients, a mortgage broker and a back-office user each have different rights. The boundaries between them take the most time.
• Channels. A mobile app adds device-side checks such as certificate pinning, local storage and biometrics on top of the web test. See mobile application penetration testing.
• APIs. Order, payment, market-data and broker interfaces are tested in their own right. See API penetration testing.
• Cloud estate. AWS, Azure or Google Cloud accounts that host the platform add configuration review time when they are in scope.

Tester grade is not a pricing factor, and neither is the size of the firm being tested or of the testing company. Two quotes for the same scope should differ mainly in the number of days. If one quote is much lower, compare the day counts first.

What is included, and what costs extra?

A quote should cover scoping, testing, the report, a walkthrough of the findings and a retest. Ask every company you approach to confirm each of those in writing, because retests and out of hours work are the two items that most often appear later as extra charges.

With EJN Labs, the quote is a fixed price for a defined scope. It includes:

• Testing by UK-based, CREST-certified testers.
• Findings in a client portal as they are confirmed, each with a CVSS score.
• The report on the last day of testing, and a walkthrough call.
• Free retests until findings are resolved.
• Out of hours slots, with no out-of-hours, callout, cancellation or rescheduling fees.

What changes the price is a change of scope: a platform added after the quote, extra user roles, or a mobile app that was not in the original list. If the scope grows, you get a new fixed price before any extra work starts.

How do you get a quote, and what will you be asked?

Send the list of systems you want tested and say who has asked for the evidence. A testing company needs a few facts about each system to count the days. Having them ready is the fastest way to get a firm price, and it makes quotes from different companies comparable.

1. Which platforms are in scope: online banking, investment or trading, client or member portals, loan origination, broker portals.
2. For each platform, the user roles, and whether advisers or brokers act on behalf of customers.
3. Whether there are iOS and Android apps, and whether they hold biometric or payment features.
4. For APIs, roughly how many endpoints, which are partner-facing, and whether a specification is available.
5. Whether testing will be on a pre-production copy or on production with restricted scope.
6. Who asked for the test and the exact wording: your board, your compliance team, an auditor, a partner bank or an insurer.

Financial services organisations can use a CREST-accredited company or a CBEST provider, depending on what their requirement states. EJN Labs is CREST-accredited. If the document that triggered the request names an accreditation, say so when you ask for the quote.

Does the FCA set the scope or the price?

No. The FCA does not name a penetration test, so you choose the scope. SYSC 15A says a firm must carry out scenario testing to assess its ability to remain within its impact tolerance, and the FCA’s policy statement PS21/3 says firms had to be able to do so by 31 March 2025 at the latest. Many firms scope their test around the systems behind their important business services. Our guide to penetration testing under FCA operational resilience covers the rule in full.

How EJN Labs approaches pricing for financial services firms

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated financial services penetration testing service. We scope each system by what it does and who uses it, count the days, and give you one fixed price for the defined scope.

We test online banking, investment and trading platforms, wealth client portals, pension member portals, loan origination and mortgage broker portals, along with the mobile apps, APIs, cloud accounts and external perimeter around them. Critical findings reach your client portal as they are confirmed, so your team can start fixing while testing continues.

Testing is safe by default on production, with no denial of service. Retests are free until findings are resolved, so the price you agree covers the evidence that issues were fixed as well as the evidence that they were found.

Frequently Asked Questions

How much does a penetration test cost for a financial services firm?

Typically £8,800 to £56,000 in the UK market. A wealth or pension member portal of 8 to 12 days is £8,800 to £16,800. Online banking on web and mobile at 16 to 22 days is £17,600 to £30,800. A trading or investment platform of 28 to 40 days is £30,800 to £56,000. These ranges use UK day rates of £1,100 to £1,400.

Why does online banking cost more than a client portal?

Because it adds mobile apps to the web application. The apps are tested on the device for pinning, local storage and biometrics, as well as for the backend they talk to. A client portal is typically 8 to 12 days. Online banking on web and mobile is typically 16 to 22 days.

Is a retest included in the price?

It depends on the company, so ask for it in writing. With EJN Labs, retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees. The quote is a fixed price for a defined scope.

Does the FCA tell me how much testing to buy?

No. The FCA’s operational resilience rules call for scenario testing of important business services, and they do not name a penetration test or a number of days. You set the scope. The sensible first scope is usually the customer-facing systems behind your important business services.

How long does a penetration test take for a financial services firm?

Between 8 and 40 testing days for the scopes in the table above. A member portal is typically 8 to 12 days, online banking on web and mobile is 16 to 22 days, and a trading or investment platform is 28 to 40 days. EJN Labs delivers the report on the last day of testing.

Get a fixed price for your platforms

Tell us which platforms are in scope and who has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Best Penetration Testing Companies for UK Financial Services, financial services penetration testing, penetration testing cost in the UK, web application penetration testing cost and penetration testing under FCA operational resilience.