Step 1 of 11: Identity
SWIFT Customer Security Programme
Phase 2 · Technical controls CoreEngaging the independent assessor and running the control assessment.
Mandatory external or internal independent assessor audit, segregation of duties enforcement, and certification.
Basis: SWIFT Independent Assessment Framework (IAF)
/swift-csp/validateSWIFT Customer Security Controls Framework (CSCF v2025/v2026)
11 steps, completed in order. Each step is validated against the schema before the next unlocks.
Step 1 of 11
Complete the Identity fields. Each value is validated against the schema before the next step unlocks.
Assessment Name (required)
assessmentNameEnter assessment name. An example value is "Q3 Independent Audit".
Entity ID (Primary BIC) (required)
entityIdEnter entity id (primary bic).
Step 2 of 11
No manual input is captured here: this step is completed from the preceding sections or by the platform.
No manual inputs in this step.
Step 3 of 11
Complete the Assessor fields. Each value is validated against the schema before the next step unlocks.
Assessor Type (required)
assessorTypeEnter assessor type.
Lead Assessor / Firm Name (required)
assessorNameEnter lead assessor / firm name.
Lead Assessor Certifications (e.g., CISA, CISSP)optional
assessorCertificationsEnter lead assessor certifications (e.g., cisa, cissp).
Is the lead assessor SWIFT CSP Certified?optional
isSwiftCertifiedAssessorEnter is the lead assessor swift csp certified?.
I confirm the assessor is fully independent from the 1st line of defenseoptional
independenceVerifiedEnter i confirm the assessor is fully independent from the 1st line of defense.
Step 4 of 11
Complete the Methodology fields. Each value is validated against the schema before the next step unlocks.
Audit Sampling Methodology (required)
auditSamplingMethodEnter audit sampling methodology.
Evidence Retention Period (Minimum 2 years) (required)
evidenceRetentionPeriodEnter evidence retention period (minimum 2 years).
Step 5 of 11
Complete the Special Checks fields. Each value is validated against the schema before the next step unlocks.
Were Customer Client Connectors (APIs) included in scope?optional
apiConnectorsAssessedEnter were customer client connectors (apis) included in scope?.
Was AI-threat training (Deepfakes/Phishing) verified per Control 7.2?optional
aiThreatTrainingVerifiedEnter was ai-threat training (deepfakes/phishing) verified per control 7.2?.
Step 6 of 11
No manual input is captured here: this step is completed from the preceding sections or by the platform.
No manual inputs in this step.
Step 7 of 11
No manual input is captured here: this step is completed from the preceding sections or by the platform.
No manual inputs in this step.
Step 8 of 11
Complete the Reporting fields. Each value is validated against the schema before the next step unlocks.
Planned SWIFT KYC-SA Portal Update Dateoptional
kycRegistryUpdatedDateEnter planned swift kyc-sa portal update date.
Step 9 of 11
No manual input is captured here: this step is completed from the preceding sections or by the platform.
No manual inputs in this step.
Step 10 of 11
Complete the Deadlines fields. Each value is validated against the schema before the next step unlocks.
Trigger date (starts the clock) (required)
triggerAtEnter trigger date (starts the clock).
Step 11 of 11
Complete the Sign-Off fields. Each value is validated against the schema before the next step unlocks.
I confirm the independent assessment is complete and accurateoptional
reviewSignOffEnter i confirm the independent assessment is complete and accurate.
Continue with the next guide in this framework's table of contents.
Tracking of non-compliant control findings, remediation milestones, SLA breach escalation, and board risk acceptance.
Read guide Phase 2 · Technical controlsBilateral consent, active data exchange, and regulatory transparency with counterparty institutions.
Read guide Phase 2 · Technical controlsPer-control self-assessment, independent assessment, policy evaluation, and exception/remediation tracking for 32 CSCF controls.
Read guide