SWIFT CSCF v2026: Is Your Organization Ready for Annual Attestation?

Your Swift environment may be stable and operating without interruption, but that does not necessarily mean its controls remain aligned with the latest security requirements. As cyber threats evolve, a weakness in an operator workstation, a back-office data flow, or an outsourced service can become an entry point that threatens the integrity of financial transactions.

This is why SWIFT continues to update its Customer Security Program (CSP) and Customer Security Controls Framework (CSCF) annually. As of August 2026, CSCF v2026 is the version applicable to 2026 attestations, comprising mandatory and advisory controls based on each user’s SWIFT connectivity architecture.

What Is the Swift Customer Security Program?

Swift launched the CSP in 2017 to strengthen the security of users’ local SWIFT-related environments and support industry-wide collaboration against cyberattacks and fraud.

The CSCF defines the security baseline for SWIFT users. Mandatory controls must be implemented, while advisory controls represent recommended practices that may become mandatory as threats, technologies, regulations, and community expectations evolve.

The framework retains three core objectives:

1. Secure your environment: Restrict internet access, segregate critical systems, reduce the attack surface, and physically secure the environment.
2. Know and limit access: Protect credentials, manage identities and segregate privileges.
3. Detect and respond: Monitor anomalous activity and prepare for incident response and information sharing.

The control definitions align with recognized security references, including ISO 27002, PCI DSS, SOC 2, and the NIST Cybersecurity Framework.

Control applicability also depends on the user’s connectivity setup. Each institution should therefore identify which of the five reference architecture types applies before defining the assessment scope.

What Does CSCF v2026 Mean in Practice?

The 2026 edition should not be treated as a documentation update. Its practical impact extends to control design, operating effectiveness and the quality of evidence supporting compliance. Areas requiring particular attention include:

• Back-office data flow security

  Protecting data exchanged between SWIFT interfaces and back-office systems against unauthorized disclosure, alteration, and access through suitable authentication and encryption mechanisms.

• Transaction business controls

  Using configurable restrictions such as four-eyes approval, permitted transaction hours, amount limits, counterparties, and end-of-day or intraday reconciliation.

• System and application hardening

  Securely configuring systems and applications, managing patches and vulnerabilities, and reducing unnecessary services and ports.

• Third-party arrangements

  Confirming that outsourced critical activities are performed against clearly defined security requirements and that the institution retains effective oversight and sufficient evidence.

• Testing and response

  Connecting penetration testing and technical monitoring results to traceable remediation while maintaining and exercising cyber-incident response plans.

Swift states that its English-language documentation is the official and binding version. Institutions should therefore use the latest CSCF and relevant product security guidance when determining how each control applies technically.

Independent Assessment and Annual Attestation

Independent assessment is no longer an optional step before attestation. Applicable mandatory controls must be independently assessed before the annual attestation is submitted through the KYC-Security Attestation application.

Under Swift’s published annual cycle, the attestation window runs from 1 July to 31 December of the applicable year.

An assessment may be performed internally, where appropriate independence and competence are demonstrated, or externally by a qualified assessment provider. Swift also permits reliance on the previous cycle’s assessment once, provided that:

• the independent assessor agrees;
• the in-scope Swift environment has not undergone significant changes; and
• the new CSCF does not contain mandatory controls or material changes not covered by the previous assessment.

Independence requires more than assigning different team names. The assessor must be separate from those responsible for designing and operating the controls and preparing the attestation. The assessment must also be supported by current, specific, and traceable evidence.

Requirements for Entities Regulated by the Central Bank of Kuwait

In addition to the SWIFT requirements applicable to its users globally, certain institutions operating in the State of Kuwait are subject to additional local requirements issued by the Central Bank of Kuwait (CBK).

In December 2025, the CBK issued the Cyber and Operational Resilience Framework for All Local Banks and Financial Institutions (CORF), updating the Cybersecurity Framework issued in 2020. CORF applies to CBK-regulated entities according to their licensed activities and approved scope of applicability, including Kuwaiti banks and foreign banks operating in Kuwait; exchange companies; finance companies; e-payment of funds companies; and credit information companies.

Control 4.3.1.2 of CORF requires regulated entities to comply with the latest applicable versions of relevant practices and standards, including the SWIFT Customer Security Program. Control 4.3.1.3 further requires regulated entities to complete their SWIFT CSCF attestation and provide evidence of compliance to the CBK upon request or at regular intervals in line with the requirements of the relevant standard.

CORF also requires regulated entities to maintain a compliance register documenting applicable regulatory and standards requirements and to review and update the register at least annually.

For institutions outside the CBK’s regulatory perimeter, CORF does not represent a direct regulatory obligation, although it may provide a useful benchmark for strengthening cyber and operational resilience.

How Should Your Institution Prepare?

Start by confirming the architecture type and in-scope components, then map each mandatory control to an accountable owner and the evidence required. Institutions should subsequently:

1. Perform a gap analysis.
2. Remediate identified issues.
3. Test the operating effectiveness of controls.
4. Verify the completeness and quality of supporting evidence.
5. Complete the independent assessment well before the attestation deadline.
6. For CBK-regulated entities, map CSCF requirements to applicable CORF controls, the compliance register, and related regulatory assessments.

Early preparation reduces the risk of material gaps emerging at year-end and makes attestation the outcome of an effective security program rather than an annual compliance exercise.

Will Your 2026 Evidence Withstand Independent Assessment?

Baker Tilly Kuwait assists institutions in determining their applicable CSCF scope, conducting gap analysis, assessing control design and operating effectiveness, reviewing evidence quality, and preparing for annual attestation.

For CBK-regulated entities, readiness activities may also be aligned with the relevant CORF requirements, subject to the independence and approval requirements applicable to each engagement.

Contact Baker Tilly Kuwait’s specialists to begin your institution’s readiness assessment before the attestation deadline.

Please contact the Business Development Department at +965 1887 799 , Ext.: 335, and a meeting can be arranged accordingly for further discussion.

You can share the article with others through the following communication channels: