Understanding the 2025 SWIFT CSP Framework: Stabilization and Strategic Evolution

World Informatix

The SWIFT Customer Security Programme (CSP), introduced in 2016, continues to evolve in response to the increasing sophistication of cyber threats targeting the global financial community. The 2025 SWIFT CSP version of the Customer Security Controls Framework (CSCF) marks a strategic stabilization phase, aiming to consolidate past progress while laying the groundwork for future security expectations. This article outlines key changes, their impact on customers, and strategic context for effective compliance and forward planning.

November 2025 Update: As the year comes to a close, we prepare to close out end-of-year attestations and prepare for the future. See our 2025 SWIFT CSP Insights based on real-world assessment data.

Key Changes in CSCF v2025

1. Stabilization: No New Mandatory Controls

The 2025 SWIFT CSP update introduces no new mandatory controls. Swift has deliberately chosen to stabilize the framework after several years of increasing security requirements. All changes in v2025 are either clarifications, scope adjustments, or preparatory advisories for future mandatory expectationsCSCF_v2025_20240701.

Customer Impact: Organizations can focus on maintaining compliance without the pressure of immediate implementation of new controls—allowing time to mature existing security processes and reassess their risk posture.

2. Control 2.4A: Back Office Data Flow Security

While still advisory in 2025, Control 2.4A continues its phased journey to becoming mandatory by 2026. New milestones have been introduced:

Customer Impact: Users should begin prioritizing risk-based assessments and mitigation plans for back-office data flows. Early preparation will ensure smoother transitions in 2026 and 2028CSCF_v2025_20240701.

3. Expanded Scope: Customer Client Connectors

CSCF v2025 introduces a new advisory in-scope component: the “customer client connector,” which includes endpoints like API consumers, middleware, or file transfer clients. These will become mandatory in CSCF v2026.

Customer Impact: This change may shift customers from a B-type to A4-type architecture, requiring them to reassess their architectural classification and potentially expand their security controls coverageCSCF_v2025_20240701.

4. Clarified Definitions and Scope Enhancements

Several terms and scope conditions have been revised to improve clarity, such as:

“Swift connectivity providers” now includes Business Connect and L2BA.
Enhanced visualizations for the scope of controls, especially relevant with the rise of API usage.
Expanded guidance on pre-validation and value-added services and their potential to be de-scoped under strict risk assessmentCSCF_v2025_20240701.

Customer Impact: These updates improve interpretation consistency and reduce the likelihood of misalignment during audits or attestations.

5. Enhanced Implementation Guidance Across Controls

Notable updates include:

Clarified co-hosting rules for environment protection controls (1.1, 1.5).
Virtual desktops now referenced in virtualization protection (1.3) for Architecture B.
Reinforced that flows (e.g., in 2.1, 2.4, 2.6) may span on-prem and cloud environments.
Control 2.7 (Vulnerability Scanning) reminds users to address OS and application-level vulnerabilities.
Updated cloud responsibility visuals in Appendix GCSCF_v2025_20240701.

Strategic Context and Considerations

Industry Collaboration

The CSCF Working Group continues to integrate feedback from over 30 National Member Groups (NMGs), reflecting a collaborative and global approach to cybersecurity governanceCSCF_v2025_20240701.

Integration with Broader Security Governance

SWIFT encourages users to embed CSP controls into their enterprise-wide cyber risk governance and align them with standards like NIST, ISO 27002, PCI-DSS, SOC2, and UCF. Mapping guidance is provided in Appendix ECSCF_v2025_20240701.

Attestation Timeline

Organizations must attest compliance against CSCF v2025 between July and December 2025 using the KYC Security Attestation (KYC-SA) platformCSCF_v2025_20240701.

The Framework Is Set. Is Your Implementation?

Knowing the CSCF changes is step one. WICS reviews your current controls and tells you exactly what needs to close before your attestation.

Book a SWIFT CSP Consultation

Recommendations for Customers

Non-compliance is not only visible to regulators. Within the SWIFT ecosystem, attestation status is commonly exposed to counterparties through the KYC Security Attestation application.

Start Early on 2.4A: Conduct a gap analysis and begin hardening bridging servers and flow channels.
Prepare for Scope Expansion: Identify and assess all customer client connectors in your architecture.
Audit Current Compliance: Ensure full implementation of existing mandatory controls with an eye on co-hosting and virtual environments.
Engage with Swift Resources: Review the CSCF Knowledge Centre, FAQs, and updated visual diagrams.
Plan for 2026 and Beyond: Align budgeting and IT project plans with the 2026 and 2028 anticipated changes.

About the Author

Rakesh Asthana is the founder of World Informatix Cyber Security and a veteran technology and security leader with over 30 years of experience safeguarding complex global institutions. As a former Senior IT Director and CIO for the World Bank, he led large-scale IT and cybersecurity transformations, strengthening resilience across highly regulated environments. Notably, he played a pivotal role in the incident response and digital forensics during the Bangladesh Bank cyber heist. This experience continues to shape his pragmatic, risk-driven approach to securing financial systems worldwide.

Mr. Rakesh Asthana

Founder & CEO, World Informatix Cyber Security