Suggest you re-read the guidance dc9.
See the guidance PDF linked to from
this page.
I also suggest you look around more. For example, look at the Egg Banking website, note how they've done it. Look at the John Lewis website, note how they've done it.
But as Milo said, now might be a good time to reconsider whether cookies are actually still needed on your website.