Architecture type and scope
Confirm your architecture type (A1, A2, A3, A4 or B), the secure zone, operator PCs and in-scope components, so the right controls are assessed.
- Home
- SWIFT CSCF
SWIFT CSCF assessments for banks in the GCC and India.
I've run the full SWIFT Customer Security Programme lifecycle for eight financial institutions, from architecture scoping and control walkthroughs to evidence validation and attestation support.
- SWIFT CSCF engagements
- 8
- Countries
- 4
- Framework
- v2026
What I do
Independent assessment, done properly.
Control assessment
Assessment of every mandatory control and the advisory controls you choose to attest to, backed by interviews, evidence review and testing.
Back-office data flows
With control 2.4 now mandatory, map flows between the secure zone and back office, identify bridging servers and confirm protection.
Customer connectors
Middleware, API clients and file transfer tools are now in mandatory scope for many controls. Check whether this changes your architecture type.
Attestation support
An assessment report and evidence mapping that support an accurate attestation in the KYC Security Attestation application.
Year-on-year consistency
A repeatable review and validation method, so each annual assessment is consistent and quicker to complete.
How it runs
From kick-off to attestation.
Kick-off and architecture review
Confirm the architecture type, in-scope components and the CSCF version you are attesting against.
Control walkthroughs
Interview control owners and understand how each control operates in practice, not just on paper.
Evidence validation
Review configurations, logs and records, and test controls where evidence alone is not enough.
Report and attestation
Document compliance status per control, agree fixes for gaps and support an accurate attestation before the deadline.
Where
SWIFT CSCF work across four countries.
- United Arab Emirates4
- Oman2
- Bahrain1
- India1
SWIFT CSCF client engagements per country. Client names stay confidential.
Next step
Preparing for this year's attestation?
Tell me your architecture type and timeline. I'll tell you honestly what the assessment involves.