| Point | Detail |
|---|---|
| Point 1 | The SWIFT Customer Security Programme, known as CSP |
| Point 2 | One core CSP requirement is to protect the local SWIFT environment |
| Point 3 | Another core requirement is to protect and manage credentials with care |
| Point 4 | Network security for SWIFT also includes monitoring, logging and incident response |
| Point 5 | Attestation under CSP is not a tick box exercise |
SWIFT Customer Security Programme and Network Security
What you will learn
Your objective. By the end of this lesson, you will be able to explain SWIFT customer security programme and network security. The SWIFT Customer Security Programme, known as CSP, was created after a series of high profile frauds in which attackers used stolen SWIFT credentials to send fraudulent payment instructions.
Why it matters. The bank must log every SWIFT session, every message sent and received, and every change to configuration or user access.
Chapter objective: Learner explains payment security controls, including encryption, authentication, fraud monitoring, and PCI scope, and assesses the security of a payment flow. Learner applies this skill in realistic banking scenarios, with clear examples and correct terminology throughout.
Key learning points
- SWIFT Customer Security Programme
- Bank that fails to attest
- Separation reduces the chance that malware
- Bank allows a shared SWIFT
- Bank: detected
- Control is not met
Key terms
SWIFT: The Society for Worldwide Interbank Financial Telecommunication, a member owned cooperative that provides secure messaging services for financial institutions.
MT103: A SWIFT message that carries a single customer credit transfer instruction from one bank to another. It names the ordering customer, the beneficiary, the amount, the currency and the value date.
Regulatory comparison showing SWIFT Customer Security Programme and Network Security.
Practise this lesson
Exercise
Decide what the screening or monitoring outcome should be for the scenario in this lesson.
Use the lists, rules and thresholds in this lesson.
- What to do. State whether the payment is stopped, held, frozen or released, and what must be recorded for audit.
Correct result. A true match against a sanctions list stops the payment. A false positive is cleared with a reason recorded. An alert that is escalated becomes a case, and a case that meets the threshold becomes a suspicious activity report.
Why. Screening is a control, not a suggestion. A missed true match is a regulatory breach, and an unexplained clearance is an audit finding.
Check your understanding
Practice question
Which of the following best describes SWIFT customer security programme and network security?
Takeaway and next step
What to remember
A plan that exists only on paper, and has never been tested, will fail when it is needed most.
Run the exception from this lesson and follow the investigation to its resolution.
Open the Exception Investigation Simulator →
Builds on "mTLS, API Security and Secure Connectivity".
Transcript and full text
Show transcript
The SWIFT Customer Security Programme, known as CSP, was created after a series of high profile frauds in which attackers used stolen SWIFT credentials to send fraudulent payment instructions. The programme sets mandatory controls that every SWIFT user must follow, and it requires an annual attestation in which the bank confirms its compliance. The controls cover areas such as restricting internet access, protecting credentials, segregating the SWIFT environment, and detecting anomalous activity. A bank that fails to attest, or that attests falsely, faces consequences from SWIFT and from its regulators. One core CSP requirement is to protect the local SWIFT environment from the wider corporate network. The SWIFT workstations and servers must sit in a segregated zone, with strict firewall rules, no general internet browsing, and no email access from the same machines. An operator who needs to send a 5 million dollar MT103 must do so from a dedicated, hardened workstation, not from a laptop that is also used for web browsing. This separation reduces the chance that malware from a phishing email can reach the SWIFT system and steal credentials or alter a payment message. Another core requirement is to protect and manage credentials with care. SWIFT operators must use strong passwords and multi factor authentication, and shared accounts must not be used. Each operator should have a unique account, so that every action can be traced to a person. Privileged accounts must be reviewed regularly, and access must be removed promptly when a person leaves the team or changes role. A bank that allows a shared SWIFT login, or that leaves access active for a former employee, has created a gap that an attacker or a dishonest insider can exploit. Network security for SWIFT also includes monitoring, logging and incident response. The bank must log every SWIFT session, every message sent and received, and every change to configuration or user access. It must monitor for unusual patterns, such as a payment of 10 million dollars to a new beneficiary at 3am, or a large number of messages sent in a short period. When an anomaly is detected, the bank must have a plan to stop payments, isolate the affected system, notify SWIFT, and start an investigation. A plan that exists only on paper, and has never been tested, will fail when it is needed most. Attestation under CSP is not a tick box exercise, it is a formal statement that the bank meets the controls. The bank must gather evidence for each control, such as firewall rules, access reviews, patch records and test results, and it must have that evidence reviewed by an independent assessor. If a control is not met, the bank must record a plan to fix it and a date for completion. For a payment professional, CSP is a useful checklist, if a bank cannot show how it protects its SWIFT connection, it cannot be trusted to protect the payments that flow through it. The SWIFT Customer Security Programme was created after a series of high profile frauds in which attackers used stolen SWIFT credentials to send fraudulent payment instructions. The most famous case was the Bangladesh Bank heist in 2016, where attackers sent fraudulent MT202 messages worth 81 million dollars through the SWIFT network. The programme sets out mandatory and advisory controls that every SWIFT user must meet, covering the local SWIFT environment, access control, physical security, malware protection, and incident response. A bank that fails to meet the mandatory controls can lose its SWIFT access, which would cut it off from the global payment network. Attestation under CSP is a formal statement that the bank meets the controls, and it is not a tick box exercise. The bank must gather evidence for each control, such as firewall rules, access reviews, patch records, and training logs, and submit an attestation to SWIFT every year. An independent assessor may be required for larger banks. If the attestation shows a control is not met, the bank must report it and agree a remediation plan with a deadline. For a business analyst, the practical lesson is to treat CSP as a project with a calendar: the controls must be implemented, the evidence must be collected, and the attestation must be submitted on time. Missing the deadline is a regulatory event, not an administrative delay.
The SWIFT Customer Security Programme, known as CSP, was created after a series of high profile frauds in which attackers used stolen SWIFT credentials to send fraudulent payment instructions. The programme sets mandatory controls that every SWIFT user must follow, and it requires an annual attestation in which the bank confirms its compliance. The controls cover areas such as restricting internet access, protecting credentials, segregating the SWIFT environment, and detecting anomalous activity. A bank that fails to attest, or that attests falsely, faces consequences from SWIFT and from its regulators.
One core CSP requirement is to protect the local SWIFT environment from the wider corporate network. The SWIFT workstations and servers must sit in a segregated zone, with strict firewall rules, no general internet browsing, and no email access from the same machines. An operator who needs to send a 5 million dollar MT103 must do so from a dedicated, hardened workstation, not from a laptop that is also used for web browsing. This separation reduces the chance that malware from a phishing email can reach the SWIFT system and steal credentials or alter a payment message.
Another core requirement is to protect and manage credentials with care. SWIFT operators must use strong passwords and multi factor authentication, and shared accounts must not be used. Each operator should have a unique account, so that every action can be traced to a person. Privileged accounts must be reviewed regularly, and access must be removed promptly when a person leaves the team or changes role. A bank that allows a shared SWIFT login, or that leaves access active for a former employee, has created a gap that an attacker or a dishonest insider can exploit.
Network security for SWIFT also includes monitoring, logging and incident response. The bank must log every SWIFT session, every message sent and received, and every change to configuration or user access. It must monitor for unusual patterns, such as a payment of 10 million dollars to a new beneficiary at 3am, or a large number of messages sent in a short period. When an anomaly is detected, the bank must have a plan to stop payments, isolate the affected system, notify SWIFT, and start an investigation. A plan that exists only on paper, and has never been tested, will fail when it is needed most.
Attestation under CSP is not a tick box exercise, it is a formal statement that the bank meets the controls. The bank must gather evidence for each control, such as firewall rules, access reviews, patch records and test results, and it must have that evidence reviewed by an independent assessor. If a control is not met, the bank must record a plan to fix it and a date for completion. For a payment professional, CSP is a useful checklist, if a bank cannot show how it protects its SWIFT connection, it cannot be trusted to protect the payments that flow through it.
The SWIFT Customer Security Programme was created after a series of high profile frauds in which attackers used stolen SWIFT credentials to send fraudulent payment instructions. The most famous case was the Bangladesh Bank heist in 2016, where attackers sent fraudulent MT202 messages worth 81 million dollars through the SWIFT network. The programme sets out mandatory and advisory controls that every SWIFT user must meet, covering the local SWIFT environment, access control, physical security, malware protection, and incident response. A bank that fails to meet the mandatory controls can lose its SWIFT access, which would cut it off from the global payment network.
Attestation under CSP is a formal statement that the bank meets the controls, and it is not a tick box exercise. The bank must gather evidence for each control, such as firewall rules, access reviews, patch records, and training logs, and submit an attestation to SWIFT every year. An independent assessor may be required for larger banks. If the attestation shows a control is not met, the bank must report it and agree a remediation plan with a deadline. For a business analyst, the practical lesson is to treat CSP as a project with a calendar: the controls must be implemented, the evidence must be collected, and the attestation must be submitted on time. Missing the deadline is a regulatory event, not an administrative delay.
Full lesson text (all scenes)
Completing a lesson updates your progress dashboard on the homepage.
Scene timestamps are estimated by allocating the narration text proportionally across the real audio length. The audio playback position is the source of truth: pause freezes the visual, seeking restores the correct scene, replay restarts the scene animation.