Prepare for your SWIFT CSCF attestation with less manual effort

SWIFT CSCF is the Customer Security Controls Framework, the set of security controls that Swift requires its users to implement under the Customer Security Programme. Swift updates it every year. Version 2025 contains 32 controls, of which 25 are mandatory and 7 are advisory, organised under three objectives: secure your environment, know and limit access, and detect and respond. Users attest their compliance annually.

Every Swift user must attest against the mandatory CSCF controls each year. That includes banks, market infrastructures, corporates and other institutions connected to the Swift network. Which controls apply depends on the user's architecture type, for example whether it runs its own Swift infrastructure, uses a connector, or relies on a service bureau or other third-party provider for connectivity.

The attestation must be submitted by 31 December each year. Swift publishes each new CSCF version around July, a year before it applies, and users then attest against it between July and 31 December of the following year through the KYC Security Attestation application. Attestations must also be updated if a user's compliance status changes during the year.

Yes. Since 2021, every CSCF attestation must be supported by an independent assessment. This can be performed by an external assessment firm or by an independent internal function, such as internal audit or a second line of defence team, that is separate from the people who operate the Swift environment. The assessor reviews each applicable control against the CSCF guidance.

Non-compliance is not fined directly by Swift, but it carries real consequences. Swift can report users that fail to attest, or that attest non-compliance with mandatory controls, to their supervisors. Counterparties can also request to see a user's attestation status through the KYC Security Attestation application, so a weak attestation can affect correspondent banking relationships and due diligence reviews.

CSCF v2025 is a stability release: no advisory control was promoted to mandatory for all users. The main changes affected architecture type B users of customer client connectors, who are now treated as type A4, bringing additional controls into scope for them. Swift also signalled that control 2.4A, Back Office Data Flow Security, is planned to become mandatory in a later version.

SWIFT CSCF and ISO 27001 overlap in areas such as access control, multi-factor authentication, malware protection, logging, vulnerability management and incident response. ISO 27001 covers an organisation's whole information security management system, while CSCF focuses specifically on the Swift-related environment. Holding ISO 27001 does not replace a CSCF attestation, but much of the same evidence can support both.

Yes. SWIFT CSCF v2025 is supported in OneClickComply today. Controls that overlap with your other standards can reuse the same automatically collected evidence. OneClickComply does not issue CSCF attestations or replace your independent assessor, but it helps you prepare the evidence they will review.