Preparing for a Swift Customer Security Programme (CSP) assessment requires more than gathering evidence at year-end. For financial institutions, effective attestation starts with accurate scope, clear ownership, and supported results. That means confirming the organization’s architecture type, mapping the applicable Customer Security Controls Framework (CSCF) controls, assigning responsibility for evidence and remediation, and submitting the attestation through KYC Security Attestation (KYC-SA).
The requirement is consistent, but organizations often enter the assessment process from different starting points. Some are preparing for an annual assessment. Others are confirming architecture classifications and control applicability. Many are reviewing findings and remediation priorities before year-end attestation activities.
The sections below outline considerations for each scenario.
What is Required?
Organizations participating in the Swift CSP have four key responsibilities:
- Identify the Swift architecture type applicable to their environment.
- Identify and implement the applicable CSCF requirements.
- Complete an independent assessment of compliance with the applicable controls.
- Submit an annual security attestation through the KYC-SA application no later than December 31.
KYC-SA is Swift’s application for submitting and managing security attestations. Through KYC-SA, an organization formally declares its level of compliance. The attestation should be supported by an independent assessment, but management remains responsible for reviewing results, understanding gaps, and accurately reporting compliance status.
Architecture Matters More Than Many Realize
One of the most important factors in any Swift CSP assessment is determining which architecture type applies to the organization’s environment.
Swift architecture types classify how an organization connects to Swift and where related components are hosted or operated. Architecture types, including A1, A2, A3, A4, and B, shape which mandatory and advisory controls apply, which evidence is needed, and how compliance should be assessed.
| Architecture | High-Level Description |
|---|---|
| A1 | The organization hosts and manages its own Swift messaging interface and related connectivity components. |
| A2 | A service provider hosts or operates certain Swift connectivity components for the organization, while relevant messaging components remain within the organization’s environment. |
| A3 | The organization uses a service-provider or group-based arrangement in which more of the Swift messaging and connectivity environment is operated outside its local environment. |
| A4 | The organization accesses Swift through a provider or lightweight connectivity arrangement, while maintaining user access or business applications that interact with Swift services. |
| B | The organization does not host a Swift messaging interface but uses a business application or other mechanism that communicates through a service provider or another Swift-connected entity. |
An inaccurate architecture classification could affect:
- Assessment scope
- Which controls need to be evaluated
- Evidence collection efforts
- Remediation priorities
- Attestation accuracy
If the architecture classification is inaccurate, the organization may assess the wrong controls, gather incomplete evidence, and report compliance status based on an inaccurate scope.
Where Should Your Organization Begin?
To help identify where preparation should begin, choose the scenario that best reflects the organization’s current assessment needs.
Scenario 1: Preparing for an Annual Assessment
Many organizations maintain mature cybersecurity programs but still encounter challenges when preparing for annual CSP activities.
Common areas of focus include:
- Confirming applicable CSCF requirements
- Coordinating evidence collection
- Reviewing supporting documentation
- Validating implementation of required controls
In this scenario, it can be helpful to begin preparations well before the attestation window opens to allow time for documentation reviews and stakeholder coordination.
Scenario 2: Independent Assessment Activities
Swift requires an independent assessment of compliance with applicable CSCF controls. Depending on organizational structure, the assessment may be performed by a qualified third-party organization or an appropriately independent internal function, such as compliance, risk management, or internal audit.
When preparing for independent assessment activities, organizations often focus on:
- Scope determination
- Control applicability
- Evidence expectations
- Assessment methodology
- Documentation quality
Early coordination can help clarify scope, align expectations, and reduce pressure later in the assessment cycle.
Scenario 3: Evaluating Findings & Remediation Priorities
Assessment activities can identify opportunities to strengthen the control environment. Observations may involve:
- Documentation gaps
- Incomplete evidence
- Control ownership questions
- Infrastructure changes affecting compliance requirements
- Remediation activities that remain open from prior years
In this scenario, management typically focuses on understanding observations, determining remediation priorities, and preparing for future assessment cycles.
Common Readiness Gaps
Swift assessments are rarely delayed because organizations are unaware of the requirements. More frequently, challenges stem from issues such as:
- Architecture Classification Assumptions. Organizations may not revisit architecture classifications regularly, even when infrastructure changes occur.
- Documentation Readiness. Evidence exists but is not organized or easily accessible during assessment activities.
- Control Ownership. Responsibilities span multiple teams, creating uncertainty regarding who maintains documentation and evidence for specific controls.
- Open Remediation Activities. Findings from previous assessment cycles may remain unresolved or insufficiently documented.
Addressing these issues early can help improve readiness, reduce delays, and give management clearer visibility into compliance status.
Who Should Participate?
Successful Swift assessments often involve multiple stakeholders.
| Role | Typical Contribution |
|---|---|
| Information Security | Security controls and supporting evidence |
| Infrastructure Teams | System architecture and technical implementation |
| Swift Administrators | Swift-specific configuration and operations |
| Operations Teams | Operational procedures and workflows |
| Compliance & Risk | Governance and oversight |
| Internal Audit | Independent assessment activities when applicable |
| Senior Management | Attestation oversight and compliance awareness |
Cross-functional communication can help each team understand its role and support a smoother assessment process.
Four Questions to Ask Before Attestation
Organizations should consider the following:
- Has the architecture type been confirmed? Assessment requirements depend on architecture classification and applicable CSCF controls.
- Have applicable controls been identified? Organizations should understand which requirements apply to their environment.
- Have findings been evaluated? Management should understand any identified gaps, associated risks, and remediation status.
- Has management reviewed the assessment results? Leaders responsible for compliance oversight should have sufficient visibility into assessment outcomes before attestation activities are completed.
How Forvis Mazars Can Help
Although the Swift CSP assessment culminates in an annual attestation, the process also creates an opportunity to evaluate security controls, strengthen governance practices, and support overall cyber resilience.
IT Risk & Compliance at Forvis Mazars assists organizations with Swift CSP assessment activities, architecture considerations, CSCF compliance reviews, independent assessments, and remediation planning activities. Our professionals can help organizations understand applicable requirements, check control implementation, and complete annual assessment activities.
For additional guidance related to Swift requirements and assessment activities, connect with us today.