ISO 20022 readiness consulting for payment data you can govern and defend.

What it is

What is ISO 20022 and what is it used for?

ISO 20022, titled Financial services, Universal financial industry message scheme, is a multi-part international standard from ISO Technical Committee 68. It does not define one payment message. It sets out a method for modelling financial business, a repository holding a data dictionary and a business process catalogue, and the process by which messages are developed and maintained. Payments, securities, trade services and foreign exchange messages are all built from the same models, which is why the richer, structured data travels intact from one institution to the next.

For most organisations ISO 20022 arrives through a network rather than a decision. On Swift, the cross-border payments and reporting messages, known as CBPR+, now use ISO 20022 in place of the older MT formats. Readiness therefore means more than new message files: the names, addresses, purposes and references your systems hold must be complete and correctly structured, and the changes that achieve this must be controlled.

Current edition and milestones. ISO 20022-1:2026, Part 1: Metamodel, was published in April 2026 as the third edition. On Swift, coexistence between MT and ISO 20022 for cross-border payments and reporting ended on 22 November 2025, and additional charges for contingency processing of MT sent apply from 1 January 2026. From 14 November 2026, payments carrying unstructured addresses are no longer supported under CBPR+.

Who it is for

Who needs ISO 20022 readiness?

Anyone whose payments cross a border touches ISO 20022, whether they run a Swift connection or rely on a bank to do it. Organisations come to Sterling for readiness work from four starting points:

• Your bank or a customer is asking for structured data. Swift's guidance to corporates is that creditor addresses carry at least a town name and country. Your supplier and customer master data has to deliver that before the payment file is built.
• A correspondent or payment infrastructure sets the terms. Correspondent banks and payment market infrastructures publish their own acceptance rules and dates. Readiness means knowing which rules apply to each flow, and proving you meet them.
• The board, internal audit or a supervisor asks how the migration is controlled. They want decisions, testing, data remediation and residual risk on record, not a vendor's assurance that the mapping works.
• Group companies migrated on different timetables. Subsidiaries, shared service centres and treasury entities often reached ISO 20022 by separate routes, leaving inconsistent data rules and no single owner.

Requirements

What are the main ISO 20022 requirements?

ISO 20022 itself is a methodology, so the obligations an organisation meets come from the messages and market practice built on it, and from the network or infrastructure that carries the payment. The list below separates what Swift publishes for cross-border payments from Sterling's recommended readiness areas, which are the governance disciplines that make those requirements hold.

• ISO 20022 messages for cross-border payments and reporting: CBPR+ instructions and reports are exchanged in ISO 20022, with MT coexistence ended on 22 November 2025.
• Contingency processing of MT: MT still sent is converted by Swift, with additional charges from 1 January 2026, so any residual MT traffic is a cost and a risk to remove.
• Structured or hybrid postal addresses: town name and country in designated fields at a minimum from 14 November 2026; fully structured addresses allow up to 14 address components, and hybrid addresses have been allowed since November 2025.
• Correspondent and infrastructure rules: the acceptance rules and dates of each correspondent bank and payment market infrastructure your flows reach.
• Sterling's recommended readiness area, data governance: owners, quality rules and remediation for party, address and remittance data at source.
• Sterling's recommended readiness area, change control: approved, tested and reversible changes to payment systems, mappings and interfaces.
• Sterling's recommended readiness area, controls and assurance: reconciliation, exception handling, third-party oversight and evidence that each control works.

Readiness route

How do you get ready for ISO 20022?

Your payments technology team, software vendors or service bureau build and configure the messages. Sterling works around that engineering on governance, data and control, so the migration is decided, tested and evidenced. Nobody issues a certificate at the end: the proof is payments that pass and records that show why.

1. 01
   Map the payment flows and dependencies in scope.Entities, flows, counterparties, message types, source systems and the networks or infrastructures each payment reaches.
2. 02
   Gap analysis: compare data and controls with the published rules.The gap analysis tests address and party data, change practice and controls against Swift's requirements and your correspondents' rules, then sets owners and dates.
3. 03
   Remediate data and put controls in place.Address data cleansed at source, quality rules agreed, change control applied to every mapping and interface change your technical teams make.
4. 04
   Assure the result before the milestone.Test evidence reviewed, rejection and exception handling rehearsed, an internal review of the programme, and open risks accepted by named owners.
5. 05
   Keep the data and controls working afterwards.Data quality monitoring, change governance for later standards releases and periodic review of third parties continue under Sustain™.

Check the route before you sign. No body certifies ISO 20022 compliance, so treat any offer of an ISO 20022 certificate as a warning. Confirm the rules that apply to you directly in Swift's published documentation and with your correspondent banks and payment infrastructures, and ask any adviser exactly which work it performs and which remains with your technical teams.

Cost

How much does ISO 20022 readiness cost?

A single-entity corporate with one banking channel and a clean supplier master needs a different scope from a bank with several payment systems and years of free-text address data. The factors below set the size of the governance and data work; the engineering sits with your technical teams and vendors and is budgeted separately.

Timeline

How long does ISO 20022 readiness take?

Pace depends on how many flows and systems are in scope, how poor the address data is, how quickly owners decide and when your technical releases land. A typical governance and data programme runs three to six months, and dates your bank or infrastructure has set take precedence over any plan.

If the 14 November 2026 address milestone is close, say so at the start. We will tell you what can be done in time and which decisions must be made first.

Your engagement

What your ISO 20022 readiness engagement includes

The engagement is built on Sterling OS™. Design™ and Drive™ are alternative levels of support, not stages: under Design™ we guide and your team does the work; under Drive™ we manage the programme and carry more of the work. Either way the scope is governance, data and control. Sterling does not certify, attest or validate ISO 20022 compliance, and does not engineer payment systems.

• Flow map, gap analysis and readiness plan

  Owners, dates and decisions agreed before remediation starts.

• Data governance and quality rules

  Ownership and rules for party and address data, with measured results.

• Effivity ISO & GRC software

  Risks, actions, changes and evidence in Effivity, included with the engagement at no additional cost.

• Awareness for the people involved

  Preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Change control and controls design

  Change, reconciliation, exception and third-party controls that fit your operations.

• Assurance and Sustain™

  An internal review before the milestone, then continued monitoring under Sustain™, with Automate™ running in Effivity.

Acceptance of your payments remains with your correspondents, Swift and the payment infrastructures concerned.

Often combined with

Standards organisations pair with ISO 20022 readiness

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
• Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
• BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
• CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.