
Mark Donohue, Managing Director iSky, Global
A banking app earns its place in a customer’s daily life by helping them understand their money, complete tasks confidently and stay in control. The most useful improvements often address familiar needs: recognising a transaction, replacing a card, managing a payment or preventing an avoidable fee.
Our Q3 2026 iSky analysis of the world’s top 20 banking apps puts those needs at the centre of their development. BBVA in Spain leads the ranking with a Voice of Customer (VoC) score of 84.6, followed closely by Australia’s Westpac at 84.5 and the UK’s Revolut at 84.1. Beyond the ranking, the findings offer practical lessons about where banks should focus their digital investment.
Watch the webinar on demand to discover the top 20 apps.
The analysis assesses 84 functional benchmarks across nine groups, using two scoring methods. The Utility score measures confirmed availability, with each benchmark counted equally. The VoC score weights the same capabilities according to customer importance, using a framework informed by a global survey of over 5,000 respondents.
That distinction matters. Two apps can offer the same number of capabilities yet achieve different customer-weighted scores because they support different needs. The framework also avoids treating the size of a bank’s product catalogue as the defining measure of digital strength.
These are measures of functionality, rather than customer satisfaction or usability. The ranking covers personal iPhone apps audited between June and September 2026. A strong score establishes broad coverage of important capabilities; understanding how well those capabilities work requires examining the journeys themselves.
All top 20 apps provide balances, transaction details and digital documents. Nineteen support transaction search, sorting or filtering. However, only 14 have the ability to identify interest earned.
Even where availability is widespread, banks can make everyday tasks more useful. A recognisable merchant name and meaningful transaction details help customers understand a purchase. Search filters should answer practical questions about when, where and how much they spent. The NAB and Monzo receipt examples illustrate how item-level information can add context beyond the transaction total.
Documents deserve similar attention. Statements, proof of balance and account-ownership records serve different purposes. Giving customers the right output, for a useful date range, reduces the work required to reuse information their bank already holds.
Debit card management carries almost 20% of the overall customer-importance weight, making it the largest functional group in the benchmark. All top 20 apps confirm card freezing or blocking, lost or stolen card cancellation, and independent replacement ordering. More precise controls are less consistent: 18 confirm card limits, 16 offer payment-type or category controls, and just seven confirm management of card-linked funding accounts.
These differences show why feature counts need context. Revolut, Monzo, Jago and Westpac each confirm ten of the eleven card benchmarks. However, their weighted results differ because the missing capability carries a different importance weight.
The practical lesson is to consider the full card lifecycle. Customers need to understand which funds a card uses, what a control changes and how they can regain access after an interruption.
Nineteen of the apps confirm fee visibility before payment execution. Yet only 15 confirm a payment receipt or notification, with a further result unconfirmed.
The payment experience should support customers throughout the task. Recognisable payees and reusable details can simplify preparation. Clear review screens help customers check their decisions. Useful confirmation provides evidence of what happened and makes the next step understandable.
Ongoing payment relationships also need attention. Only ten of the 20 apps confirm visibility of merchants with access to deduct payments from a card or account. Showing those relationships is valuable, but any associated controls must explain their scope. Blocking a payment method does not necessarily cancel the underlying subscription or contract.
Security functionality varies considerably across the leading apps. Sixteen confirm login or interaction history, while 12 confirm management of access on remote devices or apps. Eleven confirm non-card payment limits.
These findings concern customer-facing controls, rather than the strength of a bank’s underlying cybersecurity. They highlight an opportunity to make protection easier to understand and act upon.
A useful security journey explains what a setting does, when it applies and how to change it. During suspected compromise, customers also need an obvious emergency action and a supported recovery route. Westpac’s SafeBlock example illustrates how an intervention can connect customers with further risk-management guidance.
Savings goals are confirmed in 18 apps and automated savings rules in 17. Only five confirm rules that move money to help avoid debt or fees.
This gap points to a practical opportunity: connecting financial information with actions customers can configure and oversee. Useful automation needs clear triggers, understandable conditions and visible results, alongside a straightforward way to amend or stop it.
The weighting reinforces the importance of selecting useful capabilities. Bank of America scores above Revolut for customer-weighted financial management despite covering fewer benchmarks in that group.
For banks planning improvements, the findings provide a clear starting point: identify important missing capabilities, examine the effort within existing journeys and protect useful functionality through redesigns. The strongest digital propositions are built through consistent attention to the tasks customers need to complete and the capabilities they value most. For customers, the benefit is practical: less uncertainty about their money and more ability to handle everyday banking within the app itself.
Watch our webinar on demand here to discover the top 20 apps and further insights about what sets the leaders apart.

Mark Donohue
Managing Director iSky, Global
Mark Donohue is Managing Director of iSky at RFI Global, working with clients globally on data-led financial services intelligence.
View full profileTop-performing banking apps help customers complete everyday banking tasks with confidence, control and clarity. The world’s highest-ranked apps combine strong functionality across payments, card management, security and financial management, while focusing on the capabilities customers value most.
RFI Global analysis suggests banks should prioritise capabilities based on their importance to customers rather than the number of features. Two apps may offer a similar number of features, but the app that supports higher-priority customer needs is likely to deliver greater customer value.
Card management, payments, security controls, transaction visibility and financial management tools are among the most important areas of digital banking. Customers place particular value on experiences that help them understand their money, stay in control and complete tasks efficiently.
Improving customer experience often means reducing friction in common journeys. Clear transaction information, intuitive payment experiences, effective card controls, transparent security settings and useful financial management tools can all help customers complete tasks more confidently.
The strongest digital propositions are built through consistent attention to customer priorities. The world’s leading banking apps demonstrate the importance of closing capability gaps, improving high-frequency journeys, giving customers greater control and ensuring digital investments deliver meaningful customer value.
| Cookie | Duration | Description |
|---|---|---|
| __cf_bm | 1 hour | This cookie, set by Cloudflare, is used to support Cloudflare Bot Management. |
| __hssc | 1 hour | HubSpot sets this cookie to keep track of sessions and to determine if HubSpot should increment the session number and timestamps in the __hstc cookie. |
| __hssrc | session | This cookie is set by Hubspot whenever it changes the session cookie. The __hssrc cookie set to 1 indicates that the user has restarted the browser, and if the cookie does not exist, it is assumed to be a new session. |
| AWSALBCORS | 7 days | Amazon Web Services set this cookie for load balancing. |
| AWSALBTG | 7 days | Amazon Web Services set this cookie for load balancing. |
| AWSALBTGCORS | 7 days | Amazon Web Services set this cookie for load balancing. |
| cookielawinfo-checkbox-advertisement | 1 year | Set by the GDPR Cookie Consent plugin, this cookie records the user consent for the cookies in the "Advertisement" category. |
| cookielawinfo-checkbox-analytics | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics". |
| cookielawinfo-checkbox-functional | 11 months | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
| cookielawinfo-checkbox-necessary | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
| cookielawinfo-checkbox-others | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other. |
| cookielawinfo-checkbox-performance | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
| CookieLawInfoConsent | 1 year | CookieYes sets this cookie to record the default button state of the corresponding category and the status of CCPA. It works only in coordination with the primary cookie. |
| elementor | never | The website's WordPress theme uses this cookie. It allows the website owner to implement or change the website's content in real-time. |
| rc::a | never | This cookie is set by the Google recaptcha service to identify bots to protect the website against malicious spam attacks. |
| rc::c | session | This cookie is set by the Google recaptcha service to identify bots to protect the website against malicious spam attacks. |
| viewed_cookie_policy | 11 months | The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data. |
| wpEmojiSettingsSupports | session | WordPress sets this cookie when a user interacts with emojis on a WordPress site. It helps determine if the user's browser can display emojis properly. |
| XSRF-TOKEN | 2 hours | This cookie enhances visitor browsing security by preventing cross-site request forgery. |
| Cookie | Duration | Description |
|---|---|---|
| AWSALB | 7 days | AWSALB is an application load balancer cookie set by Amazon Web Services to map the session to the target. |
| AWSALBTG | 7 days | Amazon Web Services set this cookie for load balancing. |
| AWSALBTGCORS | 7 days | Amazon Web Services set this cookie for load balancing. |
| Cookie | Duration | Description |
|---|---|---|
| __hstc | 6 months | Hubspot set this main cookie for tracking visitors. It contains the domain, initial timestamp (first visit), last timestamp (last visit), current timestamp (this visit), and session number (increments for each subsequent session). |
| _ga | 1 year 1 month 4 days | Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors. |
| _ga_* | 1 year 1 month 4 days | Google Analytics sets this cookie to store and count page views. |
| hubspotutk | 6 months | HubSpot sets this cookie to keep track of the visitors to the website. This cookie is passed to HubSpot on form submission and used when deduplicating contacts. |
| wmc | 1 year 1 month 4 days | Workable sets this cookie to assign a unique visitor ID for statistical purposes. |
| Cookie | Duration | Description |
|---|---|---|
| _cfuvid | session | Description is currently not available. |