The wrong assessor doesn’t just waste your budget; it can invalidate your attestation. Here is how to get the selection right.
Your SWIFT attestation is only as credible as the assessor who validated it.
Most banks spend more time selecting a vendor for officesupplies than selecting the firm that signs off on their SWIFT compliance. The assessor choice is an afterthought, until a regulator or correspondent bank questions the attestation behind it.
This guide gives you six questions to ask before engagingany assessor. The questions are drawn directly from the requirements of SWIFT’s IAF v2026 and CSCF v2026. A qualified assessor will answer everyone without hesitation.
“It is the responsibility of the Swift user to confirm that the certification scope is sufficient and covers both cybersecurity and assessment/audit related topics.”
— SWIFT Independent Assessment Framework v2026, Section 2.4
The 6 questions at a glance:
1. Are you listed on SWIFT’s official assessor directory?
2. What certifications does your lead assessor hold?
3. How many SWIFT CSP assessments have you completed?
4. How do you validate controls beyond document review?
5. What happens if you find gaps during the assessment?
6. What deliverables do you provide — and does the completion letter meet SWIFT’s requirements?
1. Are you listed on SWIFT’s official assessor directory?
Start here. SWIFT users who select a CSP assessment provider with a SWIFT CSP Certified Assessor will have this displayed prominently within the KYC-SA application. That visibility matters, your counterparties and regulators can see it.
An unlisted firm can still conduct an assessment. But their work will not trigger the certified assessor badge in KYC-SA, and they are notsubject to SWIFT’s service monitoring programme. Ask first, verifyindependently.
2. What certifications does your lead assessor hold?
The lead assessor must hold at least one industry-relevantprofessional cybersecurity-related certification, and other individualsassigned to carrying out the assessment should also have relevant security industry certifications.
Critically, it is the responsibility of the Swift user to confirm that the certification scope is sufficient. SWIFT places that duty onthe bank, not the assessor. Acceptable certifications include CISA, CISSP, ISO 27001 Lead Auditor, PCI QSA, and CompTIA Security+. An audit-only certification without cybersecurity coverage does not meet the standard. Ask for written confirmation of the lead assessor’s credentials before signing any engagement.
3. How many SWIFT CSP assessments have you completed — and in which architecture types?
Experience in general IT audit does not translate directlyinto SWIFT CSP assessment quality. External assessors bring specialised expertise, often with deep backgrounds in the CSCF, ISO 27001, PCI-DSS, NIST, and other security frameworks, which ensures a far more technically rigorous and industry-aligned evaluation.
The follow-up matters more than the headline number: askspecifically whether they have assessed your architecture type (A1 through A4, or B), and whether they have worked in your regulatory jurisdiction. South Asia has specific regulatory nuances that only assessors with regional experience will recognise.
4. How do you validate controls beyond document review?
This is where the real differentiation lies. Assessors verify that all mandatory controls are in place and functioning as intended, evaluating the effectiveness of security measures and identifying any gaps or weaknesses.
A document-only review will consistently miss technicalgaps. The most significant findings in our assessments, including anunintegrated cloud EDR at a central bank that internal review had cleared, are only caught through hands-on technical validation. Ask what the assessor will actually test, inspect, and re-perform. If the answer is primarily “we review your policies and ask questions,” that is not sufficient.
5. What happens if you find gaps — do you provide remediation guidance?
Finding gaps is the purpose of the assessment. What happensnext determines whether the engagement delivers real value. A gap report without remediation guidance leaves your team to solve a technical SWIFT compliance problem without expert input.
A qualified assessor will provide a prioritised remediationroadmap, support your team through implementation, and re-test remediated controls before your KYC-SA submission. Ask whether that support is included in the engagement or billed separately. The answer tells you something about the firm’s commercial model.
6. What deliverables do you provide — and does the completion letter meet SWIFT’s requirements?
Assessors document their findings in a detailed report, includingan assessment of each control, noting any deficiencies and providing recommendations for improvement.
The completion letter is the second critical deliverable. It must be signed by the lead assessor, in English, and must meet the content requirements specified in IAF Section 6.1. Without it, the attestation has no valid supporting documentation. Ask to see a sample report and letter format before engagement.
The standard that governs all of this
Independent external assessment is widely regarded as thestrongest and most reliable approach for meeting SWIFT CSP requirements. Because external assessors have no operational role or vested interest in your internal control environment, the review is conducted with true independence, free from internal bias or influence.
The seven questions above are not a checklist for ruling outvendors. They are a framework for finding the assessor who can genuinely deliver that independence — and the technical depth to make it count.
→ We have prepared a free downloadable guide — the full 6-question selection framework with detailed evaluation criteria for eachanswer. Download the full 6-question assessor selection guide here:
DeshCyber answers all 6 questions completely. Listed on SWIFT’s official assessor directory. CISA · CISSP · CEH · ISO 27001 Lead Auditor. 40+ assessments · Bangladesh · Nepal · Sri Lanka, and Macedonia.
audits@deshcyber.com · deshcyber.com