Swift CSP attestation and requirements support for a Swift footprint your counterparties can trust.

What it is

What is the Swift Customer Security Programme?

The Customer Security Programme is Swift's mandatory initiative for protecting each user's Swift footprint against cyber threats. Swift, often written SWIFT, owns the programme and its Customer Security Controls Framework (CSCF), which sets the security baseline for the local environment through which an institution connects to Swift. It contains mandatory controls and advisory, good-practice controls.

Each year you implement the controls that apply to your architecture, have them validated by an independent assessment and attest your compliance in Swift's KYC-SA application, where counterparties and supervisors can see it.

Current version. Swift publishes a new CSCF version every July, a year before it comes into effect, and users have up to 18 months to prepare for new or changed controls. Attestations in the 2026 cycle, which closes on 31 December 2026, are made against CSCF v2026. Swift has already published CSCF v2027 for the 2027 cycle, so a first programme started today should plan against both.

Who it is for

Who needs a Swift CSP attestation?

Every Swift user is in scope, whether it runs its own components or connects through a provider; the architecture type decides which controls apply. Institutions come to Sterling from four starting points:

• Counterparties are checking your attestation. Counterparties review KYC-SA status in third-party risk management. A gap or a missed remediation date prompts difficult questions.
• A new connection or architecture change is coming. A new provider or connectivity model can change your architecture type and controls in scope.
• Your supervisor takes an interest. Supervisors can see attestation results. They ask how controls are validated, not only whether a form was filed.
• Group or shared infrastructure complicates the picture. Shared teams or providers do not change the rule: each attestation must describe the real environment.

Requirements

What are the main Swift CSP requirements?

The CSCF groups its controls under three objectives, inside an annual cycle of assessment and attestation. This is a plain-language map; your implementation is checked against the applicable CSCF version for your architecture type.

• Architecture type: identify which of Swift's five architecture types describes your set-up, using Swift's architecture decision tree, since it decides which controls apply.
• Secure your environment: restrict internet access, reduce the attack surface and physically secure the systems in scope.
• Know and limit access: prevent credential compromise, manage identities and segregate privileges.
• Detect and respond: detect anomalous activity and plan how you will respond to incidents.
• Mandatory and advisory controls: meet every mandatory control that applies to you; treat the advisory controls as recommended good practice.
• Independent assessment: have the design and implementation of your controls validated by a second or third line of defence, such as risk, compliance or internal audit, or by an external independent assessor.
• Attestation in KYC-SA: record your compliance for each applicable control between 1 July and 31 December; for any control not yet met, give a remediation date and update the attestation once compliant.

Attestation route

How does Swift CSP attestation work?

There is no certificate in the Customer Security Programme. Your institution attests its own compliance, and the attestation must rest on an independent assessment of your controls.

1. 01
   Confirm the architecture type and the controls in scope.Use Swift's decision tree, map in-scope components and agree the applicable controls.
2. 02
   Gap analysis: compare your environment with the CSCF.Each control is tested against what operates today; gaps get owners and dates.
3. 03
   Remediate and build the evidence.Technical changes, procedures, training and records, so each control can be demonstrated.
4. 04
   Complete the independent assessment.Your second or third line, or an external assessor, validates design and implementation; we prepare the evidence and help close findings.
5. 05
   Attest in KYC-SA and plan the next cycle.Submit before 31 December, give remediation dates for open items and start on the next version.

Check the route before you sign. If you use an external assessor, confirm their independence from the team that built the controls and check Swift's Directory of Swift CSP Certified Assessors. If you use your own second or third line, make sure it is genuinely separate from the first line. After submission, confirm that your attestation shows as published in KYC-SA.

Cost

How much does Swift CSP compliance cost?

No single price fits every Swift user. A user connecting through a provider has fewer controls in scope than one operating its own components across several sites. We promise a proposal with every component visible and an all-inclusive proposal.

Timeline

How long does Swift CSP compliance take?

The fixed point is the attestation window, 1 July to 31 December. The pace depends on the gaps, change lead times and the assessor's schedule. As an estimate, a first programme typically takes three to six months; a well-run renewal is quicker because it only has to absorb the new version's changes.

With each version published about 18 months before its deadline, start next year's changes soon after this year's submission.

Your engagement

What your Swift CSP engagement includes

Sterling does not attest or assess: your institution submits the attestation, and the independent assessment is performed by your second or third line or an external assessor. Under Sterling OS™ you choose one support level: Design™, where we guide and your team does the work, or Drive™, where we manage and carry most of it. Automate™ runs the programme in Effivity, and Sustain™ keeps it current through every later cycle and version change.

• Architecture review, gap analysis and plan

  Decision tree confirmed, controls in scope agreed, and actions with owners and dates.

• Procedures and control documentation

  Written for your operators and security team, on Sterling's own templates, mapped to each applicable control.

• Effivity ISO & GRC software

  Controls, evidence and findings managed in Effivity from day one, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for the people who review your controls, as applicable to your framework, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Pre-assessment review

  We test your controls the way an assessor will and close findings with evidence before the independent assessment begins.

• Assessment and attestation support

  Evidence packs for the assessor, help closing findings and a completeness check before you submit in KYC-SA.

The independent assessment remains with your second or third line or external assessor, and the attestation remains yours.

Often combined with

Standards organisations pair with Swift CSP

• ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
• Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
• BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
• CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.