What? It's not like app makers are implementing touchID this on their own. Developers are currently using the LocalAuthentication framework from Apple that lets iOS do the recognition and verification. It's
literally a "ask iOS for verification and if verification success do something or else do something else" program. Apple can switch the verification method on the backend and it would still be very similar code (if not the exact same code) for the developers to implement.
As for the legal side of things, I'm sure Apple has made sure faceID isn't contractually problematic with all the new features they've been implementing with iOS 11. Considering the fact that iris scanners have higher accuracy rates and near-nonexistent false matches compared to fingerprint, I would say financial institutions would welcome the change.