SWIFT CSP / CSCF v2025/v2026: KYC-SA Assessment and Penetration Testing Guide

An authoritative guide to the SWIFT Customer Security Controls Framework (CSCF v2025/v2026), detailing all 32 controls, mandatory annual independent assessment expectations, and Control 1.1 scope segmentation testing methodologies.

Executive Summary and Mandate Overview

Target Audience: Financial institutions, commercial banks, and business entities connected to the global SWIFT financial messaging network
Mandatory Frequency: Community-Standard Independent Assessment at least annually, attested via KYC-SA by December 31
Required Scope: SWIFT Secure Zone, Architecture Types (A1 to B), Control 1.1 Segmentation, messaging interfaces, and connected systems
Non-Compliance Risk: Non-compliance reporting to global counterparties via KYC-SA, increased transaction scrutiny, and potential messaging suspension

SWIFT CSP and CSCF v2025/v2026 Architecture

The SWIFT Customer Security Programme (CSP) establishes mandatory cybersecurity baselines to safeguard the global financial messaging ecosystem.

SWIFT CSP: architecture scope: Classify connectivity, Map in-scope systems, Protect the environment, Check data flows — **SWIFT CSP: architecture scope**
An explanatory overview. Read the article for scope, applicability and supporting evidence.
**Classify connectivity** — A1 • A2 • A3 • A4 • B
**Map in-scope systems** — Organisation and provider responsibilities
**Protect the environment** — Separate boundaries and restrict access
**Check data flows** — Verify approved connections

Structured around 3 overarching security principles: Secure your Environment, Know and Limit Access, and Detect and Respond.
Comprises 7 security objectives and 32 controls: In CSCF v2025, 25 mandatory controls (must do) and 7 advisory controls (should do).
Transition to CSCF v2026: Control 2.4 (Back Office Data Flow Security) transitions from Advisory 2.4A (should do) to Mandatory Control 2.4 (must do) for bridging servers (26 mandatory, 6 advisory), and customer client connectors are incorporated into mandatory control scope.
Enforceable across all SWIFT-connected financial institutions globally, including commercial banks and specialized financial institutions in Thailand.
Requires organizations to classify their deployment into Architecture Types (A1, A2, A3, A4, or B) to determine their applicable control baseline.

Mandatory Independent Assessment and KYC-SA Attestation

Swift requires an independent assessment to support the annual KYC-SA attestation. Eligible independent internal departments, external assessors, or mixed teams may be used under the Independent Assessment Framework (IAF).

SWIFT CSP: assessment cycle: Define scope, Verify and remediate, Independent assessment, Attest through KYC-SA — **SWIFT CSP: assessment cycle**
An explanatory overview. Read the article for scope, applicability and supporting evidence.
**Define scope** — Architecture and applicable controls
**Verify and remediate** — Test, collect evidence and follow up
**Independent assessment** — Eligible assessors under the IAF
**Attest through KYC-SA** — Report the assessed status

Mandatory requirement (must do): Assessments must be conducted as a Community Standard Independent Assessment by qualified external assessors or an independent internal audit function.
Lead assessors must hold globally recognized professional credentials such as CISSP, CISA, CRISC, or offensive security certifications.
Attestation window (must do): Annual attestations must be renewed and published in the Swift KYC-Security Attestation (KYC-SA) directory between July 1 and December 31 annually.
SWIFT reserves the right to report non-compliant institutions directly to international counterparties and national regulators including the Bank of Thailand.

Control 1.1 Scope Segmentation Testing and Back Office Security

Control 1.1 mandates strict physical or logical segregation of the SWIFT secure zone from general corporate enterprise networks.

SWIFT CSCF: three principles: Secure your environment, Know and limit access, Detect and respond — **SWIFT CSCF: three principles**
An explanatory overview. Read the article for scope, applicability and supporting evidence.
**Secure your environment** — System boundaries and attack surface
**Know and limit access** — Identity, privileges and authentication
**Detect and respond** — Monitoring and incident preparedness

Mandatory requirement (must do): Independent scope segmentation testing must be performed at least annually and upon network changes to validate that perimeter firewalls enforce strict isolation.
Assessments evaluate firewall rules, VLAN isolation, jump server / bastion host hardening, and multi-factor authentication enforcement.
Control 2.4 enhancement: Back-office bridging servers interfacing directly with SWIFT messaging systems must enforce strict data flow protection to prevent unauthorized message tampering.
Penetration testing evaluates host configuration hardening, session security timeouts, least-privilege administrative access, and anti-tampering.

Requirements and Testing Scope Matrix

Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle.

Reference	Mandate Title	Scope Required	Testing Cycle
Control 1.1	SWIFT Environment Protection (Network Segmentation)	Strictly isolate the SWIFT Secure Zone from general enterprise networks and perform independent segmentation penetration testing	At least annually and following significant network changes
Control 2.3	System Hardening Baseline and Operating System Security	Disable unnecessary services, enforce baseline configurations, and restrict communication protocols into the Secure Zone	Continuous enforcement and annual independent review
Control 4.2	Multi-Factor Authentication (MFA)	Mandate MFA for all interactive access into SWIFT components, jump hosts, and remote operator connections	Enforced continuously across all sessions
KYC-SA Assessment Policy	Community-Standard Independent Assessment Mandate	Independent validation of compliance across all mandatory CSCF controls by qualified external or independent assessors	Annually submitted to SWIFT KYC-SA by December 31

Compliance Readiness Self-Assessment

Select items your organization has completed to evaluate your readiness score.

Identify the SWIFT Architecture Type (A1 through B) and document an accurate architectural blueprint of the SWIFT Secure Zone Strictly segment the SWIFT Secure Zone from general enterprise networks and perform independent segmentation penetration testing Enforce Multi-Factor Authentication (MFA) across all SWIFT access points, jump servers, and administrative terminals Apply least privilege access policies and rigorous operating system hardening baselines across all in-scope systems Appoint an eligible independent internal department, external assessor, or mixed team under the IAF to support the annual attestation Compile independent assessment evidence and submit the annual attestation via the SWIFT KYC-SA portal before December 31

Frequently Asked Questions (FAQ)

Key answers and practical guidance addressing common compliance questions.

Is self-attestation without an independent assessment still accepted by SWIFT?

No. Since 2021, SWIFT has mandated that all KYC-SA submissions must be backed by a Community-Standard Independent Assessment performed either by an independent external security firm or an independent internal audit team holding recognized cybersecurity credentials.

What must be covered during Control 1.1 segmentation testing?

Segmentation testing must empirically prove that standard enterprise workstations and networks cannot bypass firewall rules to reach the SWIFT Secure Zone. Independent penetration testers validate ACLs, routing restrictions, and protocol boundaries at least annually.

Does CSCF apply to institutions connecting via a SWIFT Service Bureau or cloud provider?

Yes, determine the controls applicable to the actual connectivity. Using a service bureau or cloud provider alone does not establish an architecture type. Use Swift's decision tree to classify A1, A2, A3, A4, or B, then map in-scope systems and the responsibilities of the institution and provider.