As part of its Customer Security Programme (CSP), SWIFT has released the Customer Security Controls Framework (CSCF) v2025. In this article, we break down what’s new and how your organization can prepare for a smooth and successful compliance journey.
As cyber threats grow more sophisticated, each year, SWIFT revises the CSCF to reinforce cybersecurity hygiene across its user base, reduce the risk of cyberattacks, and minimize the financial impact of fraudulent transactions. These updates apply to all organizations using SWIFT.
To meet the 2025 requirements, users of the SWIFT network must undergo an independent assessment to verify that all mandatory controls are in place and complete their attestation in accordance with the Customer Security Controls Framework (CSCF).
Understanding the Customer Security Controls Framework (CSCF)
The CSP is designed to be a collaborative effort between SWIFT and its users to strengthen the overall security of the financial ecosystem. It establishes a common set of security requirements known as the Customer Security Controls Framework (CSCF), which is designed to help customers secure their environments and promote a more resilient financial network.
The CSCF consists of 32 security controls – 25 mandatory and 7 advisory. These controls are based on SWIFT’s continuous analysis of cyber threat intelligence and developed in consultation with industry experts and user feedback.
To support the adoption of the framework, SWIFT has introduced an attestation process that requires users to confirm compliance with the mandatory (and optionally, advisory) controls. All users must submit their attestation via the KYC Security Attestation (KYC-SA) application by the end of each calendar year.
Overview of Changes in CSCF v2025
The latest update to SWIFT’s CSCF introduces no advisory control or in-scope component being promoted to mandatory status, marking a rare moment of stability after several years of incremental tightening. However, several noteworthy updates and clarifications have been made—especially in preparation for upcoming mandatory changes, most notably Control 2.4A.
While the core control set remains consistent, organizations must pay close attention to upcoming transitions, reclassification of architecture types, and updated implementation guidance that may affect their compliance posture.
Control 2.4A – Journey to Mandatory
Control 2.4A (Back Office Data Flow Security) remains advisory in 2025 but is scheduled to become mandatory in 2026. SWIFT has introduced a phased roadmap:
- 2026: Protection of bridging servers (middleware/file transfer servers) and new direct flows between the secure zone and the back-office first hop.
- 2028 (tentative): Protection of legacy flows.
Users are strongly encouraged to begin preparations by identifying flows between the secure zone and the back-office, and prioritizing them based on risk and existing security posture.
Changes for Architecture Type B Users
The definition of “customer connector” has expanded significantly:
- It now includes both servers and client endpoints (e.g., middleware clients, file transfer clients) that connect to SWIFT or a service provider.
- This change may impact organizations currently attesting as Architecture B—if using such endpoints, a reclassification to Architecture A4 may be required.
Clarifications to Key Terminology
CSCF v2025 revisits and refines key definitions to ensure consistency across assessments:
- SWIFT Connectivity Providers: Now explicitly defined as service bureaux, Business Connect, or Lite2 for Business Application (L2BA) providers.
- Service Providers: A broader category that includes connectivity providers, IT/cloud vendors, outsourcing agents, and Group Hubs.
- General (Enterprise) IT Environment: Now includes servers supporting change and release management processes.
Additionally, Standalone Alliance Access is reaffirmed as a messaging interface, and CREST WebAPI is identified as an example of a graphical user interface (GUI).
Updated Implementation Guidance
Minor but important clarifications have been made across several controls:
- Controls 1.1 & 1.5 (Environment Protection): Updated for environments with co-hosted components.
- Control 1.3 (Virtualisation/Cloud Platform Protection): Now recommended for Architecture B users utilizing virtual desktops.
- Controls 2.1, 2.4, 2.5, 2.6: Reaffirm that data flows may span hybrid environments (on-premises, cloud, or both).
- Control 2.7 (Vulnerability Scanning): Now clearly includes OS and application-level scans.
- Control 2.8 (Outsourced Critical Activity Protection): Clarifies expectations when relying on SWIFT connectivity providers.
- Control 7.1 (Cyber Incident Response Planning): Expanded to include extreme events such as ransomware or supply chain attacks.
Are You Ready for Compliance v2025?
All SWIFT users must align with the CSCF v2025 requirements and complete their annual attestation, including an independent review of all applicable mandatory controls. This ensures accuracy, consistency, and trust across the global SWIFT ecosystem.
Now is the time to identify and resolve any non-compliance issues before the year ends. DeshCyber offers comprehensive cybersecurity services, including expert support for evaluating your SWIFT Customer Security Programme. Our assessment reviews your current security posture and provides clear, actionable recommendations to help you meet the 2025 requirements.