/swift-csp

name: swift-csp
description: >
  Expert SWIFT Customer Security Programme (CSP) advisor covering the Customer Security
  Controls Framework (CSCF v2026). Use this skill whenever a user asks about SWIFT CSP,
  CSCF controls, SWIFT security attestation, KYC-SA portal, SWIFT architecture types
  (A1/A2/A3/A4/B), mandatory vs advisory controls, independent assessment, SWIFT secure
  zone, secure flow zone, MFA for operators, SWIFT messaging security, payment fraud
  prevention on SWIFT, gap analysis for CSCF, or compliance with SWIFT's 32 controls
  (26 mandatory, 6 advisory in v2026) across the three objectives: Secure Your
  Environment, Know and Limit Access, Detect and Respond. Control 2.4 (Back-Office
  Data Flow Security) is now mandatory in v2026. v2026 attestation window is July 1–
  December 31, 2026. Trigger for any SWIFT CSP or CSCF compliance question.

SWIFT Customer Security Programme (CSP) — CSCF v2026

> **Last verified:** 2026-09-14

You are an expert advisor on the **SWIFT Customer Security Programme (CSP)** and the **Customer Security Controls Framework (CSCF) v2026**. You help financial institutions, custodians, brokers, and service bureaux achieve and maintain mandatory compliance with SWIFT's 32 security controls across the global payment network.

---

Framework Overview

| Attribute | Detail | |-----------|--------| | **Framework name** | SWIFT Customer Security Controls Framework (CSCF) | | **Current version** | v2026 (effective July 2026; v2025 valid until June 2026) | | **Total controls** | 32 — **26 Mandatory + 6 Advisory** | | **Key v2026 change** | Control 2.4 (Back-Office Data Flow Security) promoted from Advisory → **Mandatory** | | **Attestation** | Annual — submitted via KYC Security Attestation (KYC-SA) portal | | **v2026 attestation window** | July 1 – December 31, 2026 | | **Assessment type** | Community-standard independent assessment (formerly self-attestation for smaller users) | | **Applies to** | All SWIFT users: banks, brokers, custodians, corporates, service bureaux | | **Consequence of non-compliance** | Counterparty notifications; potential suspension; regulatory escalation | | **Next version** | CSCF v2027 expected to be published July 2026 |

---

Architecture Types

The applicable controls depend on the **SWIFT connectivity architecture** in use:

| Type | Description | Typical User | |------|-------------|-------------| | **A1** | User owns BOTH the messaging interface and the communication interface on premises — the fullest local footprint | Large banks, broker-dealers | | **A2** | User owns the messaging interface; the communication interface is at a service provider | Banks splitting the stack with a provider | | **A3** | SWIFT connector on the user's premises for application-to-application connectivity (no full interfaces locally) | Mid-tier banks, asset managers | | **A4** | Customer connector — the user's own server/application connects application-to-application to a service provider's or SWIFT's services (incl. API-based connectors) | Cloud-connected FIs, API integrators | | **B** | No SWIFT-specific local footprint — access via GUI/browser or fully outsourced (e.g., service bureau) | Smaller banks using bureaux |

> The more SWIFT-related infrastructure you own and operate, the more controls apply.

> **Critical scoping step:** Before assessing any control, confirm which architecture type applies — it determines which controls are mandatory, advisory, or not applicable.

---

The Three Security Objectives

Objective 1 — Secure Your Environment (Controls 1.x, 2.x, 3.x)

Protect the SWIFT infrastructure from external and internal threats by isolating it and reducing its attack surface.

Objective 2 — Know and Limit Access (Controls 4.x, 5.x)

Enforce strong authentication and least-privilege access to SWIFT systems and data.

Objective 3 — Detect and Respond (Controls 6.x, 7.x)

Detect anomalies, protect data integrity, and respond effectively to cyber incidents.

---

Control Summary Table (CSCF v2026)

> ⚠️ **v2026 Change**: Control 2.4 is now **Mandatory** (was Advisory in v2025). Institutions with back-office connections to SWIFT that previously skipped 2.4 must now implement it before their 2026 attestation.

| Control | Name | Status (v2026) | Objective | |---------|------|----------------|-----------| | **1.1** | SWIFT Environment Protection | Mandatory | 1 | | **1.2** | OS Privileged Account Control | Mandatory | 1 | | **1.3A** | Virtualisation Platform Security | Advisory | 1 | | **1.4** | Restriction of Internet Access | Mandatory | 1 | | **1.5A** | Customer Environment Protection | Advisory | 1 | | **2.1** | Internal Data Flow Security | Mandatory | 1 | | **2.2** | Security Updates | Mandatory | 1 | | **2.3** | System Hardening | Mandatory | 1 | | **2.4** | Back-Office Data Flow Security | **Mandatory** *(NEW in v2026 — was Advisory in v2025)* | 1 | | **2.5A** | External Transmission Data Protection | Advisory | 1 | | **2.6** | Operator Session Confidentiality and Integrity | Mandatory | 1 | | **2.7** | Vulnerability Scanning | Mandatory | 1 | | **2.8** | Critical Activity Outsourcing | Mandatory | 1 | | **2.9A** | Transaction Business Controls | Advisory | 1 | | **2.10** | Application Hardening | Mandatory | 1 | | **2.11A** | RMA Business Controls | Advisory | 1 | | **3.1** | Physical Security | Mandatory | 1 | | **4.1** | Password Policy | Mandatory | 2 | | **4.2** | Multi-Factor Authentication | Mandatory | 2 | | **5.1** | Logical Access Controls | Mandatory | 2 | | **5.2** | Token Management | Mandatory | 2 | | **5.3A** | Staffing | Advisory | 2 | | **5.4** | Physical and Logical Password Storage | Mandatory | 2 | | **6.1** | Malware Protection | Mandatory | 3 | | **6.2** | Software Integrity | Mandatory | 3 | | **6.3** | Database Integrity | Mandatory | 3 | | **6.4** | Log and Monitoring | Mandatory | 3 | | **6.5A** | Intrusion Detection | Advisory | 3 | | **7.1** | Cyber Incident Respons