# SWIFT CSP / CSCF v2025/v2026: KYC-SA Assessment and Penetration Testing Guide

Locale: `en`

Source: `/en/compliance/swift-csp/`

Summary: SWIFT CSCF v2025/v2026: all 32 controls, annual independent assessment, and Control 1.1 scope segmentation testing.

On this page

1. [Overview](/en/compliance/swift-csp/#topic-overview)
2. [SWIFT CSP and CSCF v2025/v2026 Architecture](/en/compliance/swift-csp/#swift-csp-framework-overview)
3. [Mandatory Independent Assessment and KYC-SA Attestation](/en/compliance/swift-csp/#independent-assessment-mandate)
4. [Control 1.1 Scope Segmentation Testing and Back Office Security](/en/compliance/swift-csp/#scope-segmentation-testing)
5. [Requirements Matrix](/en/compliance/swift-csp/#compliance-matrix)
6. [Readiness Assessment](/en/compliance/swift-csp/#compliance-readiness-checklist)
7. [Frequently Asked Questions](/en/compliance/swift-csp/#compliance-faq)
8. [Related Frameworks](/en/compliance/swift-csp/#related-compliance-frameworks)

# SWIFT CSP / CSCF v2025/v2026: KYC-SA Assessment and Penetration Testing Guide

An authoritative guide to the SWIFT Customer Security Controls Framework (CSCF v2025/v2026), detailing all 32 controls, mandatory annual independent assessment expectations, and Control 1.1 scope segmentation testing methodologies.

Executive Summary and Mandate Overview

Target Audience

Financial institutions, commercial banks, and business entities connected to the global SWIFT financial messaging network

Mandatory Frequency

Community-Standard Independent Assessment at least annually, attested via KYC-SA by December 31

Required Scope

SWIFT Secure Zone, Architecture Types (A1 to B), Control 1.1 Segmentation, messaging interfaces, and connected systems

Non-Compliance Risk

Non-compliance reporting to global counterparties via KYC-SA, increased transaction scrutiny, and potential messaging suspension

## SWIFT CSP and CSCF v2025/v2026 Architecture

The SWIFT Customer Security Programme (CSP) establishes mandatory cybersecurity baselines to safeguard the global financial messaging ecosystem.

[![SWIFT CSP: architecture scope: Classify connectivity, Map in-scope systems, Protect the environment, Check data flows](/assets/compliance/swift-architecture-en-v1.webp)](/assets/compliance/swift-architecture-en-v1.webp)

**SWIFT CSP: architecture scope**

An explanatory overview. Read the article for scope, applicability and supporting evidence.

- **Classify connectivity** — A1 • A2 • A3 • A4 • B
- **Map in-scope systems** — Organisation and provider responsibilities
- **Protect the environment** — Separate boundaries and restrict access
- **Check data flows** — Verify approved connections

- Structured around 3 overarching security principles: Secure your Environment, Know and Limit Access, and Detect and Respond.
- Comprises 7 security objectives and 32 controls: In CSCF v2025, 25 mandatory controls (must do) and 7 advisory controls (should do).
- Transition to CSCF v2026: Control 2.4 (Back Office Data Flow Security) transitions from Advisory 2.4A (should do) to Mandatory Control 2.4 (must do) for bridging servers (26 mandatory, 6 advisory), and customer client connectors are incorporated into mandatory control scope.
- Enforceable across all SWIFT-connected financial institutions globally, including commercial banks and specialized financial institutions in Thailand.
- Requires organizations to classify their deployment into Architecture Types (A1, A2, A3, A4, or B) to determine their applicable control baseline.

## Mandatory Independent Assessment and KYC-SA Attestation

Swift requires an independent assessment to support the annual KYC-SA attestation. Eligible independent internal departments, external assessors, or mixed teams may be used under the Independent Assessment Framework (IAF).

[![SWIFT CSP: assessment cycle: Define scope, Verify and remediate, Independent assessment, Attest through KYC-SA](/assets/compliance/swift-assessment-cycle-en-v1.webp)](/assets/compliance/swift-assessment-cycle-en-v1.webp)

**SWIFT CSP: assessment cycle**

An explanatory overview. Read the article for scope, applicability and supporting evidence.

- **Define scope** — Architecture and applicable controls
- **Verify and remediate** — Test, collect evidence and follow up
- **Independent assessment** — Eligible assessors under the IAF
- **Attest through KYC-SA** — Report the assessed status

- Mandatory requirement (must do): Assessments must be conducted as a Community Standard Independent Assessment by qualified external assessors or an independent internal audit function.
- Lead assessors must hold globally recognized professional credentials such as CISSP, CISA, CRISC, or offensive security certifications.
- Attestation window (must do): Annual attestations must be renewed and published in the Swift KYC-Security Attestation (KYC-SA) directory between July 1 and December 31 annually.
- SWIFT reserves the right to report non-compliant institutions directly to international counterparties and national regulators including the Bank of Thailand.

## Control 1.1 Scope Segmentation Testing and Back Office Security

Control 1.1 mandates strict physical or logical segregation of the SWIFT secure zone from general corporate enterprise networks.

[![SWIFT CSCF: three principles: Secure your environment, Know and limit access, Detect and respond](/assets/compliance/swift-control-framework-en-v1.webp)](/assets/compliance/swift-control-framework-en-v1.webp)

**SWIFT CSCF: three principles**

An explanatory overview. Read the article for scope, applicability and supporting evidence.

- **Secure your environment** — System boundaries and attack surface
- **Know and limit access** — Identity, privileges and authentication
- **Detect and respond** — Monitoring and incident preparedness

- Mandatory requirement (must do): Independent scope segmentation testing must be performed at least annually and upon network changes to validate that perimeter firewalls enforce strict isolation.
- Assessments evaluate firewall rules, VLAN isolation, jump server / bastion host hardening, and multi-factor authentication enforcement.
- Control 2.4 enhancement: Back-office bridging servers interfacing directly with SWIFT messaging systems must enforce strict data flow protection to prevent unauthorized message tampering.
- Penetration testing evaluates host configuration hardening, session security timeouts, least-privilege administrative access, and anti-tampering.

## Requirements and Testing Scope Matrix

Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle.

| Reference | Mandate Title | Scope Required | Testing Cycle |
| --- | --- | --- | --- |
| **Control 1.1** | SWIFT Environment Protection (Network Segmentation) | Strictly isolate the SWIFT Secure Zone from general enterprise networks and perform independent segmentation penetration testing | At least annually and following significant network changes |
| **Control 2.3** | System Hardening Baseline and Operating System Security | Disable unnecessary services, enforce baseline configurations, and restrict communication protocols into the Secure Zone | Continuous enforcement and annual independent review |
| **Control 4.2** | Multi-Factor Authentication (MFA) | Mandate MFA for all interactive access into SWIFT components, jump hosts, and remote operator connections | Enforced continuously across all sessions |
| **KYC-SA Assessment Policy** | Community-Standard Independent Assessment Mandate | Independent validation of compliance across all mandatory CSCF controls by qualified external or independent assessors | Annually submitted to SWIFT KYC-SA by December 31 |

### Compliance Readiness Self-Assessment

Select items your organization has completed to evaluate your readiness score.

0%

Identify the SWIFT Architecture Type (A1 through B) and document an accurate architectural blueprint of the SWIFT Secure Zone
          
          
            
            Strictly segment the SWIFT Secure Zone from general enterprise networks and perform independent segmentation penetration testing
          
          
            
            Enforce Multi-Factor Authentication (MFA) across all SWIFT access points, jump servers, and administrative terminals
          
          
            
            Apply least privilege access policies and rigorous operating system hardening baselines across all in-scope systems
          
          
            
            Appoint an eligible independent internal department, external assessor, or mixed team under the IAF to support the annual attestation
          
          
            
            Compile independent assessment evidence and submit the annual attestation via the SWIFT KYC-SA portal before December 31

Assessment Status

Check items above to view assessment result.

[Request Pentest Quote](/en/#contact)

## Frequently Asked Questions (FAQ)

Key answers and practical guidance addressing common compliance questions.

### Is self-attestation without an independent assessment still accepted by SWIFT?

No. Since 2021, SWIFT has mandated that all KYC-SA submissions must be backed by a Community-Standard Independent Assessment performed either by an independent external security firm or an independent internal audit team holding recognized cybersecurity credentials.

### What must be covered during Control 1.1 segmentation testing?

Segmentation testing must empirically prove that standard enterprise workstations and networks cannot bypass firewall rules to reach the SWIFT Secure Zone. Independent penetration testers validate ACLs, routing restrictions, and protocol boundaries at least annually.

### Does CSCF apply to institutions connecting via a SWIFT Service Bureau or cloud provider?

Yes, determine the controls applicable to the actual connectivity. Using a service bureau or cloud provider alone does not establish an architecture type. Use Swift's decision tree to classify A1, A2, A3, A4, or B, then map in-scope systems and the responsibilities of the institution and provider.

## Related Compliance Frameworks and Security Standards

- [
                Bank of Thailand pentest rules for financial institutions
                
              ](/en/compliance/bank-of-thailand/)
- [
                PCI DSS v4.0.1: VA, ASV Scan, Pentest, Segmentation
                
              ](/en/compliance/pci-dss/)
- [
                Does ISO/IEC 27001:2022 require penetration testing?
                
              ](/en/compliance/iso-27001/)
- [
                SOC 2 Type II pentest guide and CC7.1 compliance
                
              ](/en/compliance/soc-2/)

Open full-size image to zoom

## Official source documents

Review SWIFT Customer Security Programme (CSP) and CSCF v2025/v2026 on the official SWIFT website.

[Go to the official source ](https://www.swift.com/myswift/customer-security-programme-csp)

## Need a pentest that satisfies these requirements?

Tell us about your systems and the requirements you must meet. The STH team will assess the approach and prepare a quotation.

[Request a Pentest quote](/en/#contact)

Last updated 16 October 2026