SWIFT updates its Customer Security Controls Framework every year. Version 2026 is the one users attest against in the current cycle, which closes on 31 December 2026. Beyond the usual clarifications, it brings two changes that matter.
1. Control 2.4 is now mandatory
Back Office Data Flow Security (2.4) moves from advisory to mandatory. It protects SWIFT-related data as it travels between the secure zone and back-office systems. For v2026, the mandatory scope covers:
- Bridging servers between the secure zone and the back office.
- Data flows between bridging servers, and between bridging servers and the secure zone, where data is not protected end to end.
- New direct flows, which must be secure by design.
Legacy direct flows stay advisory for now, with full coverage tentatively planned for 2028.
2. Customer connectors move into mandatory scope
Middleware, API clients and file transfer tools that connect to SWIFT, including through a service provider or service bureau, move from advisory to mandatory scope for many controls. As a result, some users who attested as architecture type B may need to move to type A4, which brings more controls and more evidence.
Other updates
Several controls were clarified or tightened: minimum TLS 1.2 and SSH v2, restrictions on WMI and PowerShell, stronger multi-factor authentication for security officer accounts, and security awareness that now covers deepfakes. Read them carefully: clarified wording often changes what an assessor expects to see.
What to do now
- Confirm your architecture type against the new connector definition before the assessment starts.
- Map every data flow between the secure zone and your back office, and identify the bridging servers.
- Check that your independent assessor is working against v2026, not v2025.
- Leave time for remediation. The attestation deadline does not move.
From my SWIFT assessments in the GCC, data flow mapping is where banks lose the most time. Flows are rarely well documented, and bridging servers are often shared with other business applications. Starting that exercise early is the best way to keep this year's attestation on schedule.