Published on July 1, 2025, the 2026 edition of the CSCF is composed of three objectives (environment protection, knowing and limiting access, and detection and response), seven security principles, and 32 security controls
Of the 32 security controls defined in this version, 26 are mandatory, while the remaining 6 are recommended to enhance the security level within the defined scope. These security controls help mitigate specific cybersecurity risks that SWIFT users must face. Within each security control, SWIFT documents the most common risks that the control is designed to mitigate. In this way, it prevents or minimizes unwanted and potentially fraudulent business consequences such as:
▪️Unauthorized submission or modification of business transactions.
▪️Processing of altered or unauthorized incoming SWIFT transactions.
▪️Conducting business with unauthorized entities.
▪️Confidentiality breaches (business data, systems, operator details, etc.).
▪️Integrity breaches (business data, systems, operator details, etc.).
The implementation of these security controls must be incorporated by organizations at the cybersecurity governance level and within their defined risk management program.
The 2026 version of the SWIFT CSCF introduces only a few changes compared to the previous edition, the 2025 release, with most of the existing security controls and guidelines remaining unchanged. All updates included in this new version are analyzed below:
Mandatory nature of Control 2.4 – Back Office Data Flow Security
As announced last year, Control 2.4 Back Office Data Flow Security moves from being a recommended control to a mandatory one. For SWIFT type B architectures, this control becomes not applicable.
The objective of this control is to ensure the confidentiality, integrity, and authenticity of the data exchanged between the first back‑office hops and the components of the SWIFT infrastructure in on‑premise or remote environments, protecting against any Man‑in‑the‑Middle attack, data leakage or alteration, and unauthorized access to data in transit.
To do so, the data flows that must be taken into account are:
▪️Direct or indirect flows between components within the SWIFT infrastructure and the first back‑office hops, using one or more bridging servers, such as middleware servers, file transfer servers, or similar systems.
▪️Flows to New HSMs.
▪️Direct Legacy flows (their protection is recommended).
To achieve this, the CSCF provides guidance recommending the implementation of the following security controls:
Other minor changes included in the 2026 edition of the CSCF, which do not have a significant impact on the implementation or assessment of security controls within SWIFT environments, are as follows:
▪️Update of the cryptography guidance and best practices in article 5021566: https://www2.swift.com/knowledgecentre/kb_articles/5021566
▪️Inclusion of Alliance LSO/RSO accounts (Left Security Officer / Right Security Officer) as privileged accounts, which must comply with a set of additional security controls, along with new specifications to protect against the use of emergency or break‑glass accounts.
▪️MFA requirement for privileged access by administrators managing firewalls from outside the environment.
▪️Malware protection for non‑Windows systems located within the secure zone or hosting a customer client connector, recommending the use of EPP or EDR solutions.
▪️Addition of SWIFT Universal Confirmation (UC) as an option for transaction validation or reconciliation beyond MT 900/MT 910 and MT 940/MT 950 when activity occurs outside business hours.
▪️Validation of all downloadable software, both external and internal, to protect the integrity of all components within the SWIFT environment through checksum verification, release management processes, etc.
▪️Clarification of terminology, such as bridging servers, first back‑office hop systems, customer client connectors, and the new Alliance Connect options, as well as updates to the included diagrams.
▪️Other minor changes that do not have a major impact on SWIFT implementation or assessment. These minor updates can be found in the document published by SWIFT in its library.
The 2026 version of the Customer Security Controls Framework (CSCF) does not introduce a large number of major changes compared to the previous edition, but it does incorporate adjustments that are significant for the security of SWIFT environments, confirming the maturity of the framework and its evolution toward an increasingly strict and broader security landscape.
The main change in the 2026 edition is found in Control 2.4 Back Office Data Flow Security, which moves from being recommended to mandatory, protecting any flow between back‑office systems and SWIFT components, reducing the likelihood of security breaches and safeguarding information from its origin to the in‑scope components. For type B architectures, this security control becomes not applicable.
Similarly, new controls applicable to customer client connectors are introduced, expanding the scope of the framework and ensuring that these types of integrations comply with the same security standards. Fourteen of the 32 controls included in CSCF 2026 now apply to customer client connectors, improving security in these systems and covering aspects such as malware protection, multi‑factor authentication, secure configuration, and protection of passwords used for authentication in these components.
Finally, a series of minor changes have been introduced, including additional specifications within each CSCF security control, as well as clarifications that provide greater precision and consistency to the framework, facilitating its correct interpretation and implementation in SWIFT environments.
In summary, CSCF 2026 strengthens the confidentiality, integrity, and authenticity of transactional data exchanged between entities, with the aim of further reducing cybersecurity risks in SWIFT environments and minimizing the financial impact of fraudulent transactions. All of this is achieved through a continuous‑improvement approach, maintaining the same objectives, principles, and security controls from previous editions of the CSCF, while enhancing the defined controls, evaluating new vulnerabilities, threats, and attack vectors, and considering new safeguards to protect user environments.
Referencias:
SWIFT Customer Security Controls Framework 2026: https://www2.swift.com/knowledgecentre/rest/v1/publications/cscf_dd/70.0/CSCF_v2026_202507015.pdf?logDownload=true
SWIFT Customer Security Controls Framework 2026 compared to v2025: https://www2.swift.com/knowledgecentre/rest/v1/publications/cscf_dd/70.0/CSCF_v2026_20250701_compared_to_v2025.pdf?logDownload=true
SWIFT glossary: https://www2.swift.com/knowledgecentre/publications/udic/18.0