Resources SWIFT CSCF v2026 Changes
+44 20 3996 1505

SWIFT CSCF v2026: What Changed and What To Do

CSCF v2026 raises the bar again: 32 controls, 26 of them mandatory, Control 2.4 on back-office data flow security promoted from advisory to mandatory, customer connectors firmly in scope, and some Type B users reclassifying to A4. The attestation window runs 1 July to 31 December 2026, and independent assessment has been mandatory since 2021.

This guide, written by a listed SWIFT CSP assessment provider, summarises every material change in v2026, who it affects by architecture type, and a practical sequence to reach a clean KYC-SA attestation before the December deadline.

CREST Certified Pen Test Provider ISO Certified OSCP Certified Industry Certification

Which Path Fits Your Contracts?

Tell us what your customers are asking for and we’ll recommend the right sequence, with fixed-fee quotes for both routes.

You’ll get our Danzell readiness checklist by reply. No mailing lists, ever.

32
Controls in CSCF v2026
26
Mandatory controls (6 advisory)
2.4
Back-office data flows: advisory → mandatory
31 Dec
2026 attestation deadline (window opened 1 July)
2021
Independent assessment mandatory since

The material changes in v2026

ChangeWhat it means in practice
Control 2.4 now mandatoryData flows between your SWIFT-related components and back-office systems must be protected: confidentiality, integrity and mutual authentication of those flows now require evidence, not intent. For most users this is the largest remediation item of the cycle.
Customer connectors in scopeComponents that connect to a service bureau or L2BA provider are explicitly in the secure zone conversation. Architecture diagrams and scoping documents need updating before the assessment, not during it.
Type B reclassification pressureUsers who assumed Type B (no local footprint) may find middleware, file transfer or connector components push them to A4. Confirm architecture type first, everything else in the assessment flows from it.
32 controls, 26 mandatoryPublished July 2025 and effective for the 2026 cycle. Advisory controls remain strong signals of future mandates; assess them now to avoid remediating under deadline later.
KYC-SA attestation window1 July to 31 December 2026. Counterparties can view your attestation status; a late or qualified attestation is visible to every correspondent that checks.

A practical sequence to a clean attestation

1. Confirm architecture type. A1–A4 or B, based on where the SWIFT footprint actually lives, including connectors. This determines which of the 26 mandatory controls apply.

2. Gap-assess against v2026 early. Control 2.4 remediation, segmentation changes, privileged access tooling and logging typically need budget and change windows; a Q3 gap review leaves Q4 for fixes.

3. Book the independent assessment before the Q4 rush. Every SWIFT user attests in the same six-month window, and assessor capacity tightens sharply in November and December.

4. Attest in KYC-SA with assessment evidence behind every answer. Counterparty due-diligence teams increasingly ask for the assessment report, not just the attestation status.

Get the Sequence Right Before Spending

Book a call and we’ll read your actual contract requirements with you, then scope your architecture type and quote the v2026 assessment fixed, same business day.

Get the Free Readiness Checklist Book a 15-Minute Call

Where to next

Related SWIFT CSP services worth exploring.

SWIFT CSP Assessment Services

SWIFT CSP UK

SWIFT CSP UAE

SWIFT CSP Saudi Arabia

CSCF v2026: FAQs

Yes. Community-standard attestations have required an independent assessment, internal second line or an external provider, since 2021. Most institutions use an external listed assessment provider for objectivity and counterparty credibility.

The KYC-SA attestation window opened on 1 July 2026 and closes 31 December 2026. Assessor capacity tightens sharply in Q4, so institutions that assess in Q3 remediate on their own schedule rather than under deadline.

Control 2.4, back-office data flow security, moving from advisory to mandatory. Flows between SWIFT-related components and back-office systems now need demonstrated confidentiality, integrity and authentication controls.

Yes. Customer connectors are explicitly in scope, and outsourcing the infrastructure never outsources the attestation obligation. Your architecture type determines which controls you must evidence.

Possibly. Some users who classified as Type B find middleware, file-transfer or connector components move them to A4, which brings additional mandatory controls. Confirm type before planning the assessment.

Your attestation status and level in KYC-SA, where you have granted access. Late, missing or qualified attestations are visible to every correspondent that checks, and increasingly trigger due-diligence questions.
📞 Call us Book a call