Services

SWIFT CSP

SWIFT's Customer Security Programme sets baseline and advisory security controls for every institution connected to the SWIFT messaging network, and participation isn't optional — self-attestation against the current Customer Security Controls Framework is a condition of staying connected, and your attestation is visible to your counterparties through SWIFT's own KYC-Security Attestation Application.

The framework is organized around a small number of security objectives — restricting internet access and segregating critical systems, protecting your environment, preventing compromised credentials, detecting anomalies, and planning for incident response — broken down into specific mandatory and advisory controls. The controls get updated periodically as the threat landscape and SWIFT's own guidance shift, so this isn't a one-time attestation and done.

Where the real risk sits

SWIFT-related fraud incidents have historically involved compromised credentials and insufficient segregation between a bank's general network and its SWIFT-connected infrastructure — which is exactly what the mandatory controls target. Treating the attestation as a paperwork exercise rather than an accurate reflection of your actual environment is the most common way institutions end up exposed despite having "passed."

How I'd work with you

I'd assess your actual environment against the current mandatory and advisory controls, help you understand honestly where you stand before you self-attest, and work through closing any real gaps — particularly around segregation, access control, and logging, which tend to be where the gaps concentrate. For an institution's independent assessment requirement, I can also support that review process directly.

If your attestation is coming up or you want an honest check against the current framework, get in touch.