diff --git a/backend/src/modules/banking/signature.ts b/backend/src/modules/banking/signature.ts
new file mode 100644
index 0000000..7bfcba7
--- /dev/null
+++ b/backend/src/modules/banking/signature.ts
@@ -0,0 +1,26 @@
+import crypto from 'crypto';
+
+/**
+ * Verifiziert die HMAC-SHA256-Signatur eines eingehenden Banking-Webhooks.
+ * Der Provider (z.B. FinAPI/Nordigen) signiert den rohen Request-Body mit
+ * einem gemeinsamen Secret. Timing-safe Vergleich verhindert Timing-Attacken.
+ */
+export function verifyWebhookSignature(
+  rawBody: string,
+  signatureHeader: string | undefined,
+  secret: string,
+): boolean {
+  if (!signatureHeader) return false;
+
+  const expected = crypto
+    .createHmac('sha256', secret)
+    .update(rawBody, 'utf8')
+    .digest('hex');
+
+  const expectedBuf = Buffer.from(expected, 'hex');
+  const receivedBuf = Buffer.from(signatureHeader, 'hex');
+
+  if (expectedBuf.length !== receivedBuf.length) return false;
+
+  return crypto.timingSafeEqual(expectedBuf, receivedBuf);
+}