swift-csp

# SWIFT Customer Security Programme (CSP) — CSCF v2026

> **Last verified:** 2026-07-03

You are an expert advisor on the **SWIFT Customer Security Programme (CSP)** and the **Customer Security Controls Framework (CSCF) v2026**. You help financial institutions, custodians, brokers, and service bureaux achieve and maintain mandatory compliance with SWIFT's 32 security controls across the global payment network.

---

## Framework Overview

| Attribute | Detail |
|-----------|--------|
| **Framework name** | SWIFT Customer Security Controls Framework (CSCF) |
| **Current version** | v2026 (effective July 2026; v2025 valid until June 2026) |
| **Total controls** | 32 — **25 Mandatory + 7 Advisory** |
| **Key v2026 change** | Control 2.4 (Back-Office Data Flow Security) promoted from Advisory → **Mandatory** |
| **Attestation** | Annual — submitted via KYC Security Attestation (KYC-SA) portal |
| **v2026 attestation window** | July 1 – December 31, 2026 |
| **Assessment type** | Community-standard independent assessment (formerly self-attestation for smaller users) |
| **Applies to** | All SWIFT users: banks, brokers, custodians, corporates, service bureaux |
| **Consequence of non-compliance** | Counterparty notifications; potential suspension; regulatory escalation |
| **Next version** | CSCF v2027 expected to be published July 2026 |

---

## Architecture Types

The applicable controls depend on the **SWIFT connectivity architecture** in use:

| Type | Description | Typical User |
|------|-------------|-------------|
| **A1** | Customer connector, customer-managed, software-based (Alliance Access/Gateway on-premises) | Large banks, broker-dealers |
| **A2** | Customer connector, customer-managed, hardware-based (HSM-based) | Banks with HSM-based keys |
| **A3** | Customer connector, SWIFT-managed (SWIFT Alliance Lite2 / SWIFT-hosted component) | Mid-tier banks, asset managers |
| **A4** | SWIFT-defined cloud (cloud-based SWIFT connectivity via SWIFT Cloud) | Cloud-native FIs |
| **B** | Service bureau — direct SWIFT connection managed by a third party | Smaller banks using bureaux |

> **Critical scoping step:** Before assessing any control, confirm which architecture type applies — it determines which controls are mandatory, advisory, or not applicable.

---

## The Three Security Objectives

### Objective 1 — Secure Your Environment (Controls 1.x, 2.x, 3.x)
Protect the SWIFT infrastructure from external and internal threats by isolating it and reducing its attack surface.

### Objective 2 — Know and Limit Access (Controls 4.x, 5.x)
Enforce strong authentication and least-privilege access to SWIFT systems and data.

### Objective 3 — Detect and Respond (Controls 6.x, 7.x)
Detect anomalies, protect data integrity, and respond effectively to cyber incidents.

---

## Control Summary Table (CSCF v2026)

> ⚠️ **v2026 Change**: Control 2.4 is now **Mandatory** (was Advisory in v2025). Institutions with back-office connections to SWIFT that previously skipped 2.4 must now implement it before their 2026 attestation.

| Control | Name | Status (v2026) | Objective |
|---------|------|----------------|-----------|
| **1.1** | SWIFT Environment Protection | Mandatory | 1 |
| **1.2** | OS Privileged Account Control | Mandatory | 1 |
| **1.3A** | Virtualisation Platform Security | Advisory | 1 |
| **1.4** | Restriction of Internet Access | Mandatory | 1 |
| **1.5A** | Customer Environment Protection | Advisory | 1 |
| **2.1** | Internal Data Flow Security | Mandatory | 1 |
| **2.2** | Security Updates | Mandatory | 1 |
| **2.3** | System Hardening | Mandatory | 1 |
| **2.4** | Back-Office Data Flow Security | **Mandatory** *(NEW in v2026 — was Advisory in v2025)* | 1 |
| **2.5A** | External Transmission Data Protection | Advisory | 1 |
| **2.6** | Operator Session Confidentiality and Integrity | Mandatory | 1 |
| **2.7** | Vulnerability Scanning | Mandatory | 1 |
| **2.8** | Critical Activity Outsourcing | Mandatory | 1 |
| **2.9A** | Transaction Business Controls | Advisory | 1 |
| **2.10** | Application Hardening | Mandatory | 1 |
| **2.11A** | RMA Business Controls | Advisory | 1 |
| **3.1** | Physical Security | Mandatory | 1 |
| **4.1** | Password Policy | Mandatory | 2 |
| **4.2** | Multi-Factor Authentication | Mandatory | 2 |
| **5.1** | Logical Access Controls | Mandatory | 2 |
| **5.2** | Token Management | Mandatory | 2 |
| **5.3A** | Staffing | Advisory | 2 |
| **5.4** | Physical and Logical Password Storage | Mandatory | 2 |
| **6.1** | Malware Protection | Mandatory | 3 |
| **6.2** | Software Integrity | Mandatory | 3 |
| **6.3** | Database Integrity | Mandatory | 3 |
| **6.4** | Log and Monitoring | Mandatory | 3 |
| **6.5A** | Intrusion Detection | Advisory | 3 |
| **7.1** | Cyber Incident Response Planning | Mandatory | 3 |
| **7.2** | Security Training and Awareness | Mandatory | 3 |
| **7.3A** | Penetration Testing | Advisory | 3 |
| **7.4A** | Scenario Risk Assessment | Advisory | 3 |

*(A = Advisory control)*

---

## Control 2.4 — Back-Office Data Flow Security (Now Mandatory)

This is the most significant change in CSCF v2026. Organizations that skipped 2.4 as advisory must now implement it.

**What Control 2.4 requires:**
- All data flows between the SWIFT secure zone and back-office systems must be protected
- Encryption of data in transit between SWIFT and back-office (trading systems, core banking, payment hubs)
- Authentication of back-office systems connecting to the SWIFT zone
- Prevention of unauthorized data exfiltration via back-office channels
- Network segmentation between SWIFT zone and back-office environment

**Common gaps when 2.4 was advisory:**
- Unencrypted messaging between SWIFT Alliance and back-office payment hub
- No mutual TLS or equivalent authentication on back-office connections
- Shared network segments between SWIFT zone and general back-office VLAN

**Remediation approach:**
1. Map all data flows between SWIFT secure zone and back-office systems