This sounds problematic:

1) mongoDB does not offer the guarantees required by a bank.

2) Application developers using mongoDB rarely protect themselves against NoSQL injections. Most of them are unsuspecting that they even exist.

e.g.: What is your user id? {$ne: null}... whoops, now every user record is returned.

3) They better make sure they use the Decimal128 type for their currency fields, and make sure that the value is not being casted to float on the client. e.g.: on a JS client, every number is a float.

Unless they've taken the necessary precautions this is a disaster waiting to happen. Hopefully other banks do not do the same.