The DOJ has removed all it was proposing so we won't see a law/reg to follow with specific guidance but that won't remove the risk or litigation or reputation if the bank hasn't followed at least the minimum guidance of web accessibility.
If a vendor is managing your website, I would ask how often it is updated. Those updates, each of them, needs to comply with the standards the bank selects for ADA compliance. You can't, as a raw example, add a graphic in January and add the ALT-tags in December to make it usable by a screen reader. So if the charge is annual for the work done throughout the year, that seems logical. But it should not be catch-up work. Do as you go.
Personally, I believe every vendor should be doing this. Otherwise it's like buying a car, but if you want working headlights, that's extra. ADA compliance should be built in and changes should incorporate ADA requirements as you go. There may be levels of compliance the bank opts for, but those are internal decisions or levels the vendor offers. Some ADA compliance is really basic, some more difficult. If a bank waits to retrofit a site, it will be more costly than doing it as you go.
_________________________
AndyZ CRCM
My opinions are not necessarily my employers.
R+R-R=R+R
Rules and Regs minus Relationships equals Resentment and Rebellion. John Maxwell