5 fintech sites won't let us verify their design. That's a finding.

#webdev #design #a11y #fintech

When we scored 11 fintech sites against our 40-check design contract, three of them blocked us — Mercury (HTTP 429), Coinbase (HTTP 403), and Revolut (HTTP 403). We tried root domains, www variants, and blog subdomain paths. All blocked at the CSS fetch level.

So we expanded the batch. We scored 8 more fintech sites to see if the pattern held. It did.

The expanded batch: 13 fintech sites, 5 blocked

Rank	Site	Score	Grade	Pass	Fail
1	Stripe	74.0%	D	17	5
2	Wise	62.0%	D	14	8
3	Plaid	60.0%	D	13	8
4	PayPal	54.3%	F	11	9
5	Venmo	54.3%	F	11	9
6	Notion	46.0%	F	9	11
7	Brex	45.7%	F	8	10
8	Cash App	41.3%	F	6	10
—	Mercury	BLOCKED	—	—	—
—	Coinbase	BLOCKED	—	—	—
—	Revolut	BLOCKED	—	—	—
—	Chime	BLOCKED	—	—	—
—	SoFi	BLOCKED	—	—	—

5 of 13 fintech sites (38%) block automated design verification.

That's not a bug in our scoring engine. That's a finding about the industry.

What "blocked" means

Our scoring engine fetches the live site's HTML and CSS, extracts design tokens, and runs 40 deterministic checks against a design system contract. It checks things like:

Does :root have semantic color tokens (--ink, --paper, --signal)?
Are font sizes in rem (not hardcoded px)?
Is there a prefers-reduced-motion media query?
Do interactive elements have :focus-visible rules?
Does ::selection use a brand token (not browser default)?
Are there tabular-nums for numeric data?
Is transition:all avoided in the stylesheet?

None of this requires JavaScript execution. It's static CSS analysis. But Mercury, Coinbase, Revolut, Chime, and SoFi all have WAF/Cloudflare configurations that reject the HTTP request before the CSS arrives.

We tried:

mercury.com → 429
www.mercury.com → 429
mercury.com/blog → 429
coinbase.com → 403
www.coinbase.com → 403
blog.coinbase.com → 403
revolut.com → 403
www.revolut.com → 403
revolut.com/blog → 403
chime.com → 403
sofi.com → 403

Same result across every URL variant. The block is at the WAF level, not the path level.

Why this matters

Design verification is a transparency signal. When a site lets you inspect its CSS, you can check whether it meets accessibility standards, whether it uses a coherent token system, whether it respects reduced-motion preferences. When a site blocks inspection, you can't verify any of that.

The 8 sites that didn't block us scored between 41% and 74%. None of them passed. But at least they're inspectable. You can see exactly what they got right and what they got wrong.

The 5 that blocked us? We can't tell you anything about their design quality. They've opted out of transparency.

What the inspectable sites got wrong

Cash App (41.3%) is the worst. Zero design tokens extracted — no :root token system at all. No :focus-visible rules. No prefers-reduced-motion query. No duration tokens. It's an untokenized site running on browser defaults.

Notion (46.0%) has a press scale of 0.9 — below the 0.95 floor the contract sets for press-feedback takt. That means buttons compress too aggressively on tap. It also has button contrast of 2.96:1, failing WCAG AA 4.5:1.

Brex (45.7%) has --ink luminance at 191/255 — the "dark text" token isn't actually dark. It's a medium gray being used as primary text. No prefers-reduced-motion query either.

PayPal and Venmo (54.3% each) score identically because they share the same parent CSS framework. Same 21 transition:all instances. Same missing ::selection. Same missing tabular-nums. When two sites score pixel-identical against a 40-check contract, that's a shared design system — and a shared set of gaps.

Plaid (60.0%) is strong on poise and takt (0.98 press scales across 76 elements) but has 76 transition:all instances. That's a performance and predictability problem — transition:all animates every property change, including ones you don't want.

Wise (62.0%) has good token semantics but horizontal overflow at 375px viewport width. On a phone, the page scrolls horizontally. That's a mobile-first failure.

Stripe (74.0%) is the clear leader. Full Cadence typography (line-height by role, text-wrap: balance + pretty, tabular-nums), button contrast at 16.27:1, no transition:all. Its main failures are will-change containing width/background-color and px-based font sizes instead of rem. It's the only site in the batch that nearly reaches C-grade.

The pattern

Every inspectable fintech site failed the contract. Not one scored above 74%. But the 5 that blocked inspection are worse — not because their design is necessarily bad, but because they've made it impossible to know.

Transparency is a design quality signal. Sites that let you verify their design are accountable to it. Sites that block verification aren't.

Scored with Designesy — a 40-check design system verification engine. The contract, the engine, and all 13 site scores are open. Run your own site.

This is the fifth article in a series: 30 sites scored, 16 dev tools scored, 11 fintech sites scored, 57-site synthesis.