SWIFT CSP: Customer Security Programme Guide
The SWIFT Customer Security Programme (CSP) was launched in 2017 following a series of high-profile cyberattacks targeting SWIFT-connected institutions, most notably the $81 million Bangladesh Bank heist. The programme requires all SWIFT users worldwide to meet mandatory security controls defined in the Customer Security Controls Framework (CSCF) and to attest to their compliance annually.
What SWIFT CSP Covers
The CSCF organizes controls into three objectives: secure your environment, know and limit access, and detect and respond. Controls are classified as mandatory (must be implemented by all users) or advisory (strongly recommended best practices). The 2024 version includes 25 mandatory and 7 advisory controls covering network security, privilege management, multi-factor authentication, software integrity, logging, and incident response.
The specific controls applicable to each institution depend on their architecture type — ranging from Type A1 (SWIFT infrastructure within the user's environment) to Type A4 (using a service provider) — with different control applicability for each type.
Who Needs SWIFT CSP Compliance
Every organization connected to the SWIFT network must comply with the CSP. This includes banks, broker-dealers, clearinghouses, custodians, and other financial market infrastructure providers. Service bureaus that operate SWIFT infrastructure on behalf of clients face additional requirements. SWIFT has over 11,000 member institutions across 200+ countries.
Implementation Approach
Determine your architecture type and identify applicable mandatory and advisory controls. Conduct a gap assessment against the CSCF. Prioritize remediation of mandatory control gaps, focusing on network segmentation, multi-factor authentication, and privileged access management. Engage an independent assessor for the annual assessment and submit your attestation through the KYC Security Attestation portal before the annual deadline.
Cost Considerations
Typical costs range from $30,000 for institutions with mature security programs and simple architectures to $300,000 for those requiring significant remediation. SWIFT publishes compliance rates and non-compliant institutions face increased counterparty scrutiny, potentially affecting their ability to transact on the network. The independent assessment requirement, introduced in 2021, added $20,000 to $50,000 in annual assessment costs.