Compliance / Swift CSCF
Get your annual Swift attestation right, with evidence behind it.
Every organization connected to the Swift network must attest each year to its compliance with the Customer Security Controls Framework (CSCF), the set of security controls at the center of the Swift Customer Security Programme (CSP). The attestation is submitted through the KYC Security Attestation application, and counterparties can ask to see it.
Attestations must be supported by an independent assessment. We help banks, credit unions, broker-dealers and corporates scope their Swift environment, close gaps against the current CSCF version and complete an independent assessment that holds up to scrutiny.
At a glance
- Set by
- Swift, for every user of its network
- Cycle
- Annual attestation by December 31, against a CSCF version updated every year
- Submission
- The KYC Security Attestation (KYC-SA) application
- Evidence
- An independent internal or external assessment
- Scope
- Set by your architecture type, A1 to A4 or B
Swift CSCF
Your architecture type decides your scope
The controls that apply depend on how you connect to Swift. The framework defines architecture types, from organizations that run their own messaging and communication interfaces to those that rely entirely on a service provider. Getting the architecture type right comes first, because it decides which mandatory and advisory controls you have to meet.
Swift updates the framework every year and sometimes promotes advisory controls to mandatory. A program that passed last year can fall short this year without anything changing on your side.
How we help
Scoping and architecture
Start from the right architecture type and a clear boundary.
- Architecture type determination
- Secure zone design and review
- Inventory of Swift components, operators and connections
- Service provider and service bureau dependencies
Gap assessment
Measure where you stand against this year's version.
- Assessment against the current CSCF version
- Review of mandatory and advisory controls
- Review of changes introduced in the new version
- Prioritized remediation plan
Remediation
Close the gaps before the attestation deadline.
- Secure zone segmentation
- Multi-factor authentication for operators
- Privileged account control and session security
- Logging, monitoring and transaction anomaly detection
- Vulnerability scanning and patching
- Backup and incident response planning
Independent assessment
The evidence your attestation depends on.
- Independent external assessment against the CSCF
- Testing of control design and operation
- Assessment report to support your KYC-SA attestation
- Support for internal audit teams performing internal assessments
Who submits the attestation
Your organization submits and signs its own attestation in the KYC-SA application. We prepare you and can perform the independent assessment. When we do, we keep that assessment separate from any remediation work we carried out for you.
The path
A typical Swift CSCF engagement
- 01
Scope
Confirm the architecture type and the secure zone boundary.
- 02
Assess
Compare current controls against this year's CSCF version.
- 03
Remediate
Close mandatory gaps first, then advisory ones.
- 04
Independent assessment
Test the controls and document the evidence.
- 05
Attest
Submit the attestation in KYC-SA before December 31.
Services that support this work
- Cyber Strategy, Risk & ComplianceRisk assessments, virtual CISO leadership and compliance readiness that hold up under scrutiny.
- Penetration Testing & Offensive SecurityPenetration testing, red teaming and adversary simulation that show what an attacker could actually reach.
- Identity & Data SecurityProtect identities, privileged access and the sensitive data they can reach.
- Managed Detection & ResponseSecurity monitoring, detection engineering and threat hunting focused on real threats rather than alert volume.
FAQ
Frequently asked questions
Who has to comply with the Swift CSCF?
Every organization that uses the Swift network, including banks, credit unions, broker-dealers, market infrastructures and corporates that connect directly or through a service bureau. The controls that apply depend on your architecture type.
Can our internal audit team do the independent assessment?
Yes, as long as the team is independent of the people who operate and secure the Swift environment, typically a second or third line function. Many organizations use an external assessor instead, or alternate between the two.
What happens if we do not attest or are not compliant?
Counterparties review attestation status as part of their own risk assessments, and Swift may report organizations that fail to attest to their supervisors. Weak attestation results can also make correspondent banking relationships harder to keep.
Find out where you stand on Swift CSCF.
A readiness review shows what an assessor would find today and what it will take to close the gaps.