Financial Services Website Design: What the 50 Biggest US Banks Ship, and Where Drupal Fits

Good financial services website design comes down to three jobs: meet the disclosure rules, earn trust in the first few seconds, and get people to the thing they came for, which is usually logging in, opening an account or finding a branch. Everything else on a bank homepage is secondary.

To see how the biggest players handle those jobs, we checked the homepages of the 50 largest US banks. The most useful finding is a deadline: a new FDIC rule changes what the official sign looks like and where it goes, and compliance is required by 1 April 2027. Five months out, a little over half of the big-bank homepages we could read already show it. Below is what they ship, what the rule asks of your design team, where credit unions differ, and where Drupal fits next to Adobe Experience Manager and Sitecore.

What we checked, and how

We took the Federal Reserve’s list of large commercial banks, with data as of 30 June 2026, and listed the homepages of the 50 largest. Morgan Stanley Private Bank (rank 17) shares a website with Morgan Stanley Bank (rank 11), so Barclays Bank Delaware, rank 51, completes the 50.

On 2 November 2026 we fetched each homepage as plain HTML, the way a simple crawler sees it, and searched the code for platform fingerprints and for the elements a bank homepage is expected to carry. Fourteen sites blocked the request or showed a bot check twice, including PNC, KeyBank, Huntington, Citizens, Regions and SoFi. We did not try to get past those checks, so they are recorded as not checked. That leaves 36 banks with a result.

One limit matters. Several big banks draw parts of their homepage with JavaScript after it loads; Bank of America’s sign-in box is built that way, and Citi’s homepage HTML holds almost no visible text. Our counts are what is in the page code as served, so treat each as a floor.

The new FDIC sign: a design requirement with a deadline

The FDIC’s final rule amending its official sign requirements was published in the Federal Register on 29 January 2026 (91 FR 3801). It took effect on 2 March 2026, and compliance is required by 1 April 2027, a date the FDIC repeated in FIL-22-2026 in May.

The new digital sign is the FDIC name plus the line “FDIC-Insured—Backed by the full faith and credit of the U.S. Government”, in navy blue or black. According to the FDIC’s questions and answers on the rule (last updated 13 May 2026), it has to appear in three places on a bank’s website or app:

1. The homepage, or the initial page of the website or app.
2. The login page.
3. The page where a consumer first starts opening a deposit account.

On those pages it belongs near the top and next to the bank’s name, or in the footer if it is clear and continuous. The 2026 rule dropped an earlier requirement to show it on every page where customers transact with their deposits. Pages mainly about non-deposit products, such as investments or insurance, need a separate non-deposit sign instead. For a design team, that means three templates to change, a header slot next to the logo, and a content rule that tells editors which sign a page needs.

Twenty of the 36 banks we could read already carry it. Fifteen have the sign’s exact wording in the page code, usually in a thin bar above the main navigation. Three use an image of the sign, and two load it as a component. First Citizens is the most interesting of those: its header loads a sign component served from fdic.gov itself, with the bank’s FDIC certificate number as an attribute.

The biggest banks are the slowest, at least in the HTML. Only 6 of the 17 checked banks in the top 25 show the sign, against 14 of the 19 ranked 26 to 51. None of the four largest (JPMorgan Chase, Bank of America, Citi and Wells Fargo) has it in its static homepage code. That may be partly our method: Bank of America’s page settings switch on an FDIC widget that loads with JavaScript, and Citi’s page is built almost entirely in the browser. But at that size a header change touches thousands of pages and several reviews.

The four wealth and custody homepages we could check (BNY, Morgan Stanley, State Street and Northern Trust) show no sign. They are corporate sites, not places to open a deposit account, so ask your compliance team which of your pages count before you redesign.

Bank website design: what the biggest homepages ship

Beyond the sign, the 36 homepages share a pattern any bank website design can borrow: tasks first, marketing second.

Finding a branch comes first. Twenty-six of the 36 link to a branch or ATM locator from the homepage. Only seven show a savings or CD rate with an APY, which suggests most big banks push rates on product pages and campaigns, not on the front door.

Disclosures are standard furniture. Twenty-five carry “Member FDIC” text and 20 the Equal Housing Lender notice. These usually sit in the footer and are easy to forget in a redesign, so put them in the footer template, not in page content.

Logging in is a homepage job. At least 15 put a login form in the homepage HTML, and more draw it with JavaScript. For a returning customer the homepage is a login page, which is also why the FDIC rule names both.

Access, language and apps are visible. Twenty-two link to an accessibility page, 12 offer an Español link and 16 link to the App Store or Google Play. Eleven show a “Your Privacy Choices” link, the opt-out link some state privacy laws expect.

Under the hood, OneTrust is the most common consent tool (15 of 36), and Adobe Launch (13) and Google Tag Manager (12) lead tag management. Seven homepages render through Next.js and two through Angular.

Credit union website design: the same jobs, a different rulebook

Credit union website design follows the same task logic: log in, join, find a branch or shared ATM, check rates. The disclosure rules differ, because deposits at federally insured credit unions are insured by the NCUA, not the FDIC. The FDIC’s 2026 digital sign does not apply to them.

Under NCUA rules (12 CFR Part 740), a federally insured credit union must show either the official advertising statement or the official NCUA sign on its advertisements and its main internet page, and it may resize the sign so it is legible there. That is the NCUA’s own summary in its guidance on the official NCUA sign (Letter 09-CU-21, page last updated May 2026). We found no NCUA equivalent of the FDIC’s new digital sign rule, with its login-page and account-opening placements. Even so, putting the NCUA statement in the header, on the login page and on the membership application is a sensible pattern to copy from the banks.

The other difference is membership. A credit union homepage has to explain eligibility, often by employer, location or association, before it can sell an account. A short “Can I join?” check near the top helps more than another rate banner.

Financial website design: a checklist

Whether you are a bank, credit union, lender or wealth manager, this is the checklist we use for any financial website design project.

1. Three tasks above the fold. Log in, open an account (or join), find a branch or ATM. Everything else can scroll.
2. A compliance slot in the header. One reusable component for the FDIC sign or the NCUA statement, placed next to the logo, on the homepage, login and account-opening templates.
3. Disclosures by template, not by page. Member FDIC, Equal Housing Lender, non-deposit product notices and rate footnotes should come from structured fields that editors pick, not text they paste.
4. Accessibility built in. An accessibility statement linked from every page, and components tested against WCAG 2.2 AA before launch.
5. Spanish, if your market needs it. Translate the core journeys, not just the homepage.
6. Privacy and consent. A consent tool, a “Your Privacy Choices” link where state law calls for one, and an owner for every tag.
7. Security process. Patch windows, dependency audits, two-factor login for editors and a review of every third-party script.

If you also handle health or insurance data, the same discipline applies with stricter rules. Our guide to HIPAA-compliant websites covers the overlap: forms, hosting agreements and tracking scripts.

Where Drupal fits in financial services

Adobe Experience Manager dominates the top of the market: it runs 20 of the 36 big-bank homepages we could read, about 56%. Sitecore runs three (First Horizon, BOK Financial and FNB) and WordPress two (Webster and Prosperity). One bank in the set runs Drupal: UMB Bank, whose homepage declares Drupal 10. Bloomreach, Optimizely, Kentico, Magnolia and Contentstack run one each, and five, including Bank of America and Wells Fargo, show no CMS we could identify.

To see where Drupal is used in finance, we coded every drupal.org case study tagged Banking and Financial from October 2024 to October 2026, 26 in all.

Banks are a small part of it. Three of the 26 are banks: Santander Uruguay, PSA Finance in France and BOSSA, the brokerage arm of a Polish bank. One is a US credit union, Dover Federal Credit Union. Insurers (6) and fintech or financial software firms (5) make up a bigger share, alongside a regulator, Canada’s OSFI, and ten others, such as a stock exchange, payroll firm Paychex and the credit union trade body America’s Credit Unions.

Integration and security lead the topics. Twelve of the 26 describe integrations, from CRM and ERP to video and AI services. Ten describe security or compliance, nine a migration and seven accessibility. Santander Uruguay rebuilt its institutional site in eight months in 2023, past 1,000 hours of work. BOSSA‘s IT and procurement teams asked for audit-friendly delivery with minimal custom code. OSFI moved off retired technology to Drupal 11 while meeting accessibility standards and Canada’s Official Languages Act. Dover FCU‘s redesign cites the stability and security a financial institution needs.

That points to where Drupal earns its place against AEM and Sitecore:

• Structured content for disclosures. Content types and fields make rates, footnotes and the right FDIC or non-deposit sign part of the page model, so editors can’t forget them.
• Several brands on one platform. A holding company with regional banks, a wealth arm and an insurer can run them as one codebase with separate sites. Three of the 26 case studies describe that set-up.
• A public security process. Drupal’s security team publishes advisories on a fixed schedule, which suits audit-minded IT. Our Drupal security best practices guide covers the operating side.
• Accessibility and languages in core. Accessible admin and front-end defaults, and multilingual sites without a paid add-on.
• No licence fee. AEM is licensed software. Our breakdown of Adobe Experience Manager cost shows what that means in practice, and our Acquia alternatives and Drupal hosting comparison cover the hosting side, where regulated firms usually want a provider with audit reports.

AEM and Sitecore still make sense for a bank already invested in the wider Adobe or Sitecore suite. Drupal fits a regional bank, credit union, insurer or fintech that wants enterprise structure without the licence.

Cost and timeline

A financial website is rarely a pure design job: compliance review, online-banking integrations and the migration of rate tables and disclosures all carry cost. Our guide to website redesign cost covers the design side, and our Drupal migration cost breakdown covers moving content and URLs. If the FDIC sign is your trigger, start now: five months is enough to change three templates, not to rebuild a site.

Methodology and data

Bank sample. The 50 largest US commercial banks by consolidated assets in the Federal Reserve’s large commercial banks release, data as of 30 June 2026, with one homepage each. Rank 17 shares a site with rank 11, so rank 51 was added. We used Northern Trust’s US homepage (the root redirected abroad), American Express’s banking landing page and prosperitybankusa.com.

Homepage checks. Plain HTTP requests on 2 November 2026, made from outside the US, static HTML only. Each failure was retried once with a different page on the same site. Fourteen were still blocked or served an error page and are recorded as not checked. Platform fingerprints: AEM’s /etc.clientlibs/ and /content/dam/ paths, Sitecore’s /-/media/ and Sitecore cloud hosts, Drupal’s generator tag and file paths, WordPress paths, Optimizely’s /globalassets/, and the asset hosts of other CMSs. We hand-checked every FDIC sign match and a sample of the other fields, and corrected false matches (for example, the word “securities” triggering a consent-tool pattern).

Drupal case studies. All 26 drupal.org case studies in the Banking and Financial sector published from October 2024 to October 2026, collected on 14 October 2026. Each was coded by hand for organisation type and the topics it describes. A case study describes a project when it was written; it is not proof of what a site runs today.

Data. Download the bank homepage survey (one row per bank, with the evidence for each field) as a CSV file, and the coded case studies as a second CSV. Both are free to reuse with attribution to Gspikes.

Planning a redesign before the FDIC deadline, or moving a bank, credit union or insurer off a licensed platform? Our Drupal development team builds structured, multi-brand sites, and our website design service handles the task-first layouts that financial sites need. For a second opinion on your current site, ask us for a free review.

Field Notes

Get the next one by email

Research on Drupal, WordPress and search. Measured, not guessed. New pieces straight to your inbox.

Company website

Email address Subscribe

Confirmed opt-in. One click to leave, any time.