You absolutely have a responsibility to maintain the confidentiality of financial records.
Depending on your country's laws and legal precedents (disclaimer: IANAL) it may be the case that you (as a company) could be prosecuted or sued for negligence in the case of a breach. I see that your profile says you're in the UK, so government organisations such as the ICO and FSA can get involved if a breach occurs and customers end up being defrauded because of it. They have a history of handing out hefty fines to companies who act irresponsibly with their customers' financial details. On top of this, individual customers can sue you separately, based on their individual losses.
Keep in mind that a breach that leaks a customer's personal information because of insufficient security measures automatically puts you in violation of the Data Protection Act 1988, which is something the ICO can prosecute you for.
In fact, your bank or card processor may require that you're PCI compliant in cases where you store financial credentials, so if that's the case then you may be in violation of the contract you have with them. In such a case they may revoke your services, fine you, or even sue you in court.
My advice is as follows:
- Look through your system and identify what information needs to be protected, and what the best method is to protect it. For passwords, you should be using a key-derivation algorithm such as PBKDF2 or bcrypt - not a hash like SHA1. For financial information such as account numbers and sort codes, you should be using a HSM, or at least symmetric encryption with an in-memory key. Can you outsource your credential storage and/or payment processing to a 3rd party provider? Build up a list of suggestions and expected development times, and prioritise them by severity. Be realistic - saying everything is critical will make your boss switch off.
- Go to your boss and explain that the current way your company is storing financial information is negligent and that your current security measures are insufficient. Explain why it's bad, what the appropriate legislation is around it (especially DPA 1998 and other ICO regulations) and the standards which most companies are expected to adhere to (PCI-DSS, ISO/IEC 27000, etc.). Make sure he fully recognizes the potential for severe financial (and potentially legal) penalties should you be breached.
- Get him to talk to an information security company that specialises in PCI-DSS or similar financial regulations. Often they'll give a free (or cheap) consultation to go over any concerns he has, and give him some advice. From there he can decide what the risks are. It may well be worth having a thorough penetration test done on your web-app, since it's storing financial details. This is an expense, but it's much cheaper than being sued.
- Take action based on the information you gain, and make sure you have the results vetted by a professional.
If, after all this, your boss still decides to ignore the serious security and privacy issues your web-app has, ask him to put in writing that you cannot and will not be held responsible for any legal issues related to data security breaches during your employment. If he refuses to do so, I highly recommend finding another job and reporting them to the ICO. It's not worth the potential legal problems.