SWIFT Customer Security Programme

Need for the establishment of a Cybersecurity Program

In 2016 attackers compromised systems at the Bangladesh Central Bank and sent payment instructions totalling USD $951m, of which $101m were processed by the Federal Reserve Bank of New York. This remains the biggest bank heist in history.

Evolution of the Customer Security Programme

Since this time, SWIFT's payments community continues to suffer from a number of cyber-attacks and breaches. While all SWIFT customers remain primarily responsible for protecting their own environments, SWIFT aims to support its community in the fight against cyber-attacks. In 2017, SWIFT published its Customer Security Programme which consisted of 16 mandatory and 11 advisory (optional) security controls which they required their 11,000 customers worldwide to self-attest to on an annual basis.

This has evolved over the years and has now been refined to 22 mandatory and 9 advisory (optional) security controls as per the latest SWIFT Customer Security Controls Framework (“CSCF”) v2021, which was released in July 2020. Furthermore, for 2021, SWIFT has introduced a requirement that mandates an independent assessment for all customers' attestations to be performed either through use of an independent third-party or accredited second line (e.g Compliance) or third line of defense (e.g Internal Audit). This was originally planned to be implemented in 2020, but was delayed due to the COVID-19 pandemic.

Changes in Customer Security Controls Framework (“CSCF”) v2021 vs v2020

The latest SWIFT CSCF v2021 builds incrementally on v2020 and therefore adds to it. Minimal changes were made to ensure that customers have sufficient time to fully implement controls from previous CSCF versions. A brief summary of changes are as follows:

Promotion of control 1.4 - Restriction of Internet Access from an advisory control to a mandatory control.
Clarification of a number of guidelines and scope definitions (mainly for ‘connectors’).
Identification of a new architecture type A4, which differentiates users relying on SWIFT related connectors (or SWIFT footprint), currently designated as A3 from those relying on customer connectors (no SWIFT footprint).
Some user suggested implementations have also been incorporated under the following controls: (1.1; 2.9A; 6.1; 6.5A and 7.4).

SWIFT CSP - journey so far and the road ahead

_{Note: As a result of the global COVID-19 pandemic, SWIFT published updated guidelines on 18 June 2020 regarding changes to the CSP self-attestation and independent assessment requirements for 2020 and announced that in 2020, customers had the option to self-attest against the 2019 version of the SWIFT CSP and optionally support the self-attestation with an independent assessment. In 2021, an independent assessment will be a mandatory requirement and customers will be required to attest against the 2021 version of the CSP framework.}

How are PwC positioned to help with this?

Swift CSP Audit

Validation of successful alignment of controls with the SWIFT CSP guidelines resulting in a controls report under recognised standards (e.g. ISAE3000).

SWIFT CSP Assessment

A detailed assessment of SWIFT CSP controls by leveraging our CSP accelerator.

Embedded in Internal Audit

Work alongside your internal audit function to report on SWIFT CSP controls.

Download our brochure Find out more about the impact of SWIFT's CSP on your organisation and how we can help

Why PwC?

PwC will leverage inhouse accelerators and our extensive SWIFT CSP expertise to ensure that your needs are met ahead of SWIFT's required independent assessment due on 31 December 2021.

Proven CSP Assurance Experience

We have performed numerous SWIFT CSP assurance engagements across multiple territories and industries.

Cohesive team who understand SWIFT

We understand SWIFT like no other as we performed an annual review of SWIFT under the internationally recognised ISAE3000 standard for over 10 years.

Technical expertise and knowledge

We are the only ‘Big-4’ firm with a professional Certified Cyber Security Consultancy certificate from the NCSC. We are unique in our ability to leverage threat intelligence to build and simulate realistic cyber-attack scenarios.

Adapting to your requirements

PwC will leverage inhouse accelerators and our extensive SWIFT CSP expertise to ensure that your needs are met ahead of SWIFT's required independent assessment due on 31 December 2021.

PwC will provide industry insight that is relevant to your market segment and geographical segment, as well as a balanced view on how to prioritise any associated actions.

SWIFT customer security programme: FAQs

1. What is the SWIFT CSP?
2. When is the deadline for SWIFT CSP compliance?
3. What form does the SWIFT required independent assessment need to take?
4. What are the 22 SWIFT CSP mandatory controls?
5. What happens if you attest non-compliance?
6. What happens if I suspect my organisation has been targeted or breached?

1. What is the SWIFT CSP?

SWIFT's customer security programme (CSP) aims to prevent and detect fraudulent activity through a set of mandatory security controls, community-wide information sharing initiatives and enhanced security features on their products.

2. When is the deadline for SWIFT CSP compliance?

SWIFT's customers are required to submit their attestations on an annual basis to SWIFT's KYC portal by 31st December.

In 2020, customers were able to self-attest their compliance to either CSCF v2019 or CSCF v2020. In 2021, an independent assessment is required, alongside the customer's attestation, to CSCF v2021.

3. What form does the SWIFT required independent assessment need to take?

There are two forms in which a SWIFT customer can gain an independent assessment:

An internal assessment. This is similar to an internal audit, carried out by the internal audit function of the customer and independent from the function submitting the attestation.
An external assessment. This is similar to an external audit, carried out by organisations such as PwC who will provide an independent assessment against the CSP controls.

4. What are the 22 SWIFT CSP mandatory controls?

There are 22 mandatory controls focussed on 3 key objectives: securing your environment, limiting access, detecting and responding. These key objectives span the following 8 principles:

Restrict internet access
Protect critical systems from general IT environment
Reduce attack surface and vulnerabilities
Physically secure the environment
Prevent compromise of credentials
Manage identities and segregate privileges
Detect anomalous activity to system or transaction records
Plan for incident response and information sharing

Contact us

Christopher Eaton

Advisory Director, Head of Risk Assurance, PwC Channel Islands

Tel: +44 7797 900015

Kevin Thompson

Senior Manager, Advisory, PwC Channel Islands

Tel: +44 7797 915430

Industries Services Insights Careers About us Events Blogs Meet the leadership team Our offices

© 2017 - 2025 PwC. All rights reserved. PwC refers to the Channel Islands member firm and may sometimes refer to the PwC network. Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details.