HTTPS is mandatory of course. But there are a lot more of security options. I can provide you some basics:
You should implement HSTS (Http Strict Transport Security) to force clients to use your HTTPS connection.
You didn't specified what is your back-end technology (Java, PHP, etc). You should update your server to the latest versions to avoid known exploits. For example in case of PHP, old versions have a lot of possible exploits.
You should configure your perimetral firewalls to avoid DoS (Denial of Service) attacks as we'll see later, but you can avoid some very basic and known DoS attacks like for example Slow Loris only hardening your server configuration.
Disable banners and server signatures as much as possible in order to try to make harder identification of your software and version (O.S., web server technology, etc).
Is your backend injection proof? You must be pretty sure about filtering and sanitizing "dangerous" chars to avoid XSS, SQL injection and other possible attacks. This is one of the more important points.
CSRF attacks must be avoided. You should perform a correct session handling with some kind of mechanism (usually session hashes, tokens or similar) to prevent this.
WAF (Web Application Firewall) is a good option to try to filter a lot of attacks against your site. Anyway, this must be a complement of secure coding. Never the security must depend only on this element.
IDS/IPS (Intrusion Detection System/Intrusion Prevention System) are mandatory (in my opinion) if you are managing sensible information like bank accounting data. You must be able to detect/prevent attacks.
There are more... but as a start is enough I think. :)