Launched in 2016, the Customer Security Programme (CSP) is designed to reinforce the security of the SWIFT community by:
- Maintaining appropriate cybersecurity hygiene
- Reducing the risk of cyberattacks
- Minimizing the impact of fraudulent transactions
To achieve these objectives, SWIFT introduced the Customer Security Controls Framework (CSCF), which defines mandatory and advisory security controls that customers must implement and attest to on an annual basis.
As cyber threats and regulatory expectations continue to evolve, SWIFT regularly enhances the CSCF through annual updates.
While the core structure of the framework remains stable, CSCF v2026 introduces several significant updates compared to the 2025 including new mandatory requirements, expanded component coverage, and clearer expectations for cloud-based and API-driven environments.
Together with our Lead Assessors, we break down the most important CSCF v2026 changes that financial institutions need to understand and prepare for.
Back Office Data Flow Security Is Now Mandatory
As announced in CSCF v2025, the most significant change in CSCF v2026 is that Control 2.4 – Back Office Data Flow Security has moved from advisory to mandatory status.
This control addresses the protection of data exchanges between a user’s secure zone and back-office systems, particularly where data is not protected end-to-end.
Under CSCF v2026, institutions must ensure:
- Protection of bridging servers that manage communication between user’s secure zones and back-office environments.
- Protection of data flows between bridging servers and between bridging servers and the secure zone when end-to-end protection is not in place.
- Security-by-design for new direct data flows between the secure zone and back-office systems where modern end-to-end protection is not in place.
SWIFT has adopted a phased approach, keeping legacy direct data exchanges between the back office and bridging servers, or between the back office and the user’s secure zone, advisory in CSCF v2026, while indicating 2028 as the target for making these flows mandatory.
Takeaway: Start validating your data transfer architecture now—especially middleware and file transfer layers—to prepare for phased enforcement under CSCF v2026.
Customer Client Connectors Now In-Scope for Multiple Controls
To ensure consistent security across all user-to-SWIFT data flows, CSCF v2026 treats any endpoint that connects to SWIFT indirectly through a shared service provider as a customer client connector, whether it is a server or a client.
Introduced as advisory in CSCF v2025, customer client connectors—such as API endpoints, middleware, or file-transfer clients—are now mandatory in scope component of several controls to ensure basic cyber security (controls 1.2, 1.3, 1.4, 2.2, 2.3, 2.6, 2.7, 3.1, 4.1, 4.2, 5.1, 5.4, 6.1, 6.4).
As a result, some organizations that previously attested under Architecture Type B may now need to attest under Architecture Type A4 when customer client connectors are used.
Control Clarifications and Enhancements
Several minor clarifications and refinements have been introduced to improve the clarity, usability, and practical implementation of the CSCF framework.
- Between 2026 and 2028, SWIFT will modernize Alliance Connect by transitioning to SD-WAN technology, introducing a Virtual On-Premises VPN that customers can deploy on their own virtual machines.This new VPN option is explicitly in scope under CSCF controls, ensuring security expectations remain consistent with existing hardware-based and cloud-hosted VPN models.
- Containerization (Control 1.3):Containers are now treated as co-hosted by default, but isolation is acceptable if supported by a risk assessment.
- Cryptography Guidance: Knowledge Base article 5021566 has been refreshed with updated cryptographic best practices, aligned with SWIFT’s post-quantum roadmap.
- System Hardening (2.3): Now explicitly includes Windows Management Instrumentation (WMI) and PowerShell.
- Multi-Factor Authentication (4.2): MFA is now required for external privileged firewall access and for Alliance Security Officer (LSO/RSO) accounts.
- Malware Protection (6.1): Expands coverage to include non-Windows systems in secure zones.
- Security Awareness (7.2): Updated to reference AI-related threats, including Deepfakes.
- Penetration Testing (7.3A): Updated with new community-driven guidance.
Bottom line: v2026 focuses less on new controls and more on improving the precision, consistency, and modern relevance of existing ones.
Updated Scope and Terminology
Several definitions and scope boundaries have been updated to reflect evolving technologies and deployment models:
- Clarifications around bridging servers, back-office first hops, and customer connectors.
- Expanded definitions for service providers (now includes third parties, Swift connectivity providers, and Group Hubs).
- General IT environment now explicitly includes servers supporting change and release management processes.
- Visual updates to diagrams in Appendices B and G better represent hybrid and API-based architectures.
In short: SWIFT is making the framework more reflective of modern financial infrastructures—where cloud, APIs, and shared services play a central role.
AI Tools and Risk Management
While SWIFT hasn’t issued specific requirements around AI-based tools, v2026 formally recognizes AI-related risks.Institutions using AI for compliance, monitoring, or operational purposes must apply the same standards of confidentiality, integrity, and availability as for traditional systems. We expect AI to become an essential part of compliance and security over the next few years, and we encourage our clients to get a head start in understanding their security posture.
End-of-Life and Planning Ahead
SWIFT confirms that Alliance Access Integration Platform (IPLA) and Swift Integration Layer (SIL) will reach end-of-life in 2026, though they remain in-scope until then.Appendix G now includes new visuals showing shared responsibility models for cloud environments, aligning CSCF with common IaaS and SaaS governance practices.
Final Thoughts: Preparing for SWIFT CSP 2026 Compliance:
CSCF v2026 marks an important step in aligning security expectations across the SWIFT ecosystem, particularly as cloud, APIs, and indirect connectivity become more common. By prioritizing Control 2.4 implementation, reassessing architecture classification, and preparing for Alliance Connect modernization, institutions can meet 2026 attestation requirements while strengthening long-term cyber resilience.