By DeshCyber Assessment Team. Sources reviewed October 31, 2026.
When money moves between countries, banks need to trust the instructions they receive. But what happens when criminals gain access to the systems used to send those instructions?
In February 2016, Bangladesh Bank experienced that threat firsthand. The incident helped drive a worldwide effort to strengthen the security of institutions connected to SWIFT. That effort became the SWIFT Customer Security Programme, usually called SWIFT CSP.
For a bank leader, the purpose is straightforward: protect the systems and people involved in financial messaging, check that security controls are working, and report the institution’s compliance status accurately.
An independent assessment provides the evidence. Attestation declares the result. Both belong to the programme. SWIFT’s programme overview
What happened in the Bangladesh Bank heist?
In February 2016, attackers compromised Bangladesh Bank’s computer environment and used it to send fraudulent payment instructions.
According to a later US Department of Justice indictment, the attackers attempted transfers worth approximately $951 million. Approximately $81 million went to accounts in the Philippines, with another $20 million transferred to Sri Lanka. These figures describe the transfers involved, rather than the amount permanently lost after recovery efforts. US Department of Justice indictment
An important distinction often gets lost in the headlines: SWIFT reported no indication that its network or core messaging services had been compromised. The attack targeted the bank’s own environment connected to SWIFT. SWIFT Annual Review 2016
Think of a secure delivery service. It can carry a message safely, but it cannot make an instruction trustworthy if someone has taken control of the sender’s office. For banks, that means protecting more than the connection. The computers, accounts, approvals, and monitoring around it also matter.
Why did SWIFT introduce CSP?
SWIFT launched the Customer Security Programme in 2016 as part of its response to cyber threats affecting its community. The programme established a common security baseline for customers’ SWIFT-related environments. SWIFT announced mandatory customer security requirements in September 2016, with self-attestation beginning in 2017. SWIFT’s original announcement
The Bangladesh Bank attack showed why a shared approach was needed. A weakness inside one institution could have consequences for banks and payment recipients elsewhere. CSP gives institutions a structured way to examine those risks and demonstrate how they are addressing them.
What is the difference between CSP and CSCF?
The names sound similar, but they serve different purposes.
- SWIFT CSP: The overall Customer Security Programme.
- CSCF: The Customer Security Controls Framework: the security controls used within the programme.
- Independent assessment: An examination of how the institution has designed and implemented applicable controls.
- Attestation: The institution’s declaration of its compliance status through SWIFT’s KYC-Security Attestation application.
SWIFT’s official guidance separates understanding and implementing controls, independent assessment, and submission of the attestation into distinct steps. SWIFT’s compliance journey
What does a SWIFT CSP assessment examine?
The CSCF addresses three broad areas:
- Protecting the environment: keeping critical systems appropriately separated and reducing security weaknesses.
- Controlling access: protecting credentials and limiting what users can do.
- Detecting and responding: identifying suspicious activity and preparing to handle incidents.
The exact controls depend on how an institution connects to SWIFT and which systems are in scope. The framework includes mandatory and advisory controls. Teams should use the version applicable to their assessment cycle. SWIFT’s controls guidance
An assessment turns written statements into questions that can be checked. For example, a policy might say that access is restricted. The next questions are practical: who currently has access, who approved it, and what happens when someone changes jobs? Those are examples of the evidence-focused conversations an institution should be ready to have.
Assessment and attestation: why the difference matters
An assessment examines the controls. An attestation communicates the institution’s declared compliance status. Submitting a declaration does not replace the independent work supporting it.
SWIFT requires an annual independent assessment to support the security attestation. It permits qualifying internal independent assessors, external assessors, or a combination, provided independence requirements are met. SWIFT’s independent assessment guidance
For management, the useful questions go beyond whether a submission is complete:
- What evidence supports each conclusion?
- Which weaknesses remain open?
- Who owns the corrective action?
- What has changed since the review?
A clear assessment helps leaders understand what they are declaring.
How can your institution prepare?
Start by identifying your SWIFT environment and applicable architecture type. Then map the relevant controls, review existing safeguards, and identify gaps before the independent assessment.
SWIFT describes CSP as an annual process. Its standard attestation window runs from 1 July to 31 December. SWIFT’s preparation and timing guidance
A practical preparation pack can include system diagrams, access records, security procedures, monitoring evidence, and an owner for each outstanding issue. The assessor should agree the specific evidence needed for your scope. Giving each item an owner and a review date makes preparation easier to manage throughout the year.
How DeshCyber helps
DeshCyber provides SWIFT CSP assessment services. DESHCYBER LIMITED appears in SWIFT’s official CSP Certified Assessors Directory, with named certified assessors and onsite and remote assessment options. Institutions can verify the listing directly before appointing an assessor. SWIFT’s assessor directory
Our approach brings the conversation back to your environment: what is in scope, what evidence is available, and what findings need attention.
DECIMA supports the evidence side of compliance work. DeshCyber describes the platform as collecting operational evidence and evaluating it against published requirements, including SWIFT CSP. Its purpose is to help teams maintain a traceable record for review. About DeshCyber and DECIMA
The platform supports the work; the independent assessor remains responsible for the assessment conclusions, and your institution remains responsible for its attestation.
Preparing for your next SWIFT CSP assessment? Contact DeshCyber’s assessment team to discuss your scope and evidence needs.
Common questions
Is SWIFT CSP just an annual form? No. It includes implementing security controls, independent assessment, and attestation. SWIFT programme overview
Do we always need an external assessor? No. SWIFT allows qualifying independent internal assessment as well as external assessment. Independence and the applicable assessment requirements still matter. SWIFT assessment guidance
Will an assessment guarantee that we cannot be hacked? No. An assessment evaluates the controls within its scope. Institutions still need to maintain their safeguards and respond to changes and threats.
Topics: SWIFT CSP, CSCF, independent assessment, SWIFT attestation, Bangladesh Bank heist, payment security.
Related reading: Why the DoD created CMMC—and which companies need it.