SWIFT Customer Security Programme

Swift’s Customer Security Programme (CSP) is a mandatory initiative designed to help financial institutions protect their Swift footprint against cyber threats. By implementing the applicable Customer Security Controls Framework (CSCF) controls and attesting their level of compliance, Swift users contribute to the resilience and trust of the wider financial ecosystem.

Forvis Mazars in Malta supports Swift-connected organisations with practical readiness, gap assessment, control testing and independent assessment support aligned to the latest CSCF requirements. Our approach focuses on helping clients understand their architecture, identify applicable controls, strengthen evidence, remediate gaps and prepare for annual KYC-Security Attestation.

CSCF v2026: what has changed

The 2026 framework continues to be structured around Swift’s core security objectives: secure your environment, know and limit access, and detect and respond. Swift’s 2026 training material refers to the mandatory and advisory controls to be implemented by Swift users in 2026 and guides users through the controls based on their CSP architecture type.

For the 2026 cycle, particular attention should be given to:

• Architecture and scope assessment — applicable controls depend on the user’s Swift setup and architecture type.
• Back Office Data Flow Security — Swift’s 2026 conformance material identifies Control 2.4 as Back Office Data Flow Security and requires protection of data exchanged between the back office or middleware and the messaging/communication interface, including confidentiality, integrity and mutual authentication. Organisations that previously attested under Architecture Type B may now be required to attest under Architecture Type A4 where a customer client connector is used.
• Secure architecture and segregation — controls address restricting internet access, segregating critical systems, securing flows, managing credentials and privileges, anomaly detection and incident response.
• Cloud, virtualisation and third-party considerations — implementation must cover all CSP in-scope components, and organisations using Swift connectivity providers remain responsible for their own in-scope footprint.
• Evidence and annual attestation — users must submit their annual attestation through KYC-SA, supported by an independent assessment.

How we can help

We provide practical support across the SWIFT CSP compliance lifecycle, including:

• CSCF v2026 gap assessment — identifying gaps against applicable mandatory and advisory controls.
• Architecture and scope review — confirming the relevant Swift architecture type, in-scope components, secure zones, data flows and outsourced or service-provider dependencies.
• Control readiness support — reviewing controls over internet access, system hardening, patching, privileged access, MFA, logical access, malware protection, logging, monitoring, incident response and security awareness.
• Back-office data flow review — assessing data exchanges between Swift-related components, middleware, file transfer solutions, APIs and back-office systems.
• Evidence preparation — helping teams organise policies, procedures, diagrams, configurations, screenshots, logs, testing records and management evidence for assessment.
• Independent assessment support — supporting the annual independent assessment process required to validate the level of compliance before KYC-SA attestation.
• Remediation planning — providing practical recommendations to address gaps before the attestation deadline.

Why Forvis Mazars

SWIFT CSP compliance is not only an annual attestation exercise. Swift describes implementation as a cross-functional effort involving IT, business, compliance and risk management, with controls applied across the relevant Swift-related infrastructure and documented to support assessment and attestation.

Our IT assurance and cybersecurity specialists combine technical control testing, regulatory awareness and financial services experience to help clients approach SWIFT CSP in a structured, evidence-led and proportionate way.

Preparing for your CSCF v2026 attestation?

Contact Forvis Mazars in Malta to discuss your SWIFT CSP readiness, gap assessment, independent assessment support and remediation planning.