ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
KYC-SA — the KYC Security Attestation application — is where a Swift user’s compliance with the Customer Security Controls Framework becomes a record: the application on swift.com in which the annual attestation is submitted, the independent assessment is declared, and counterparties are granted access to read the result. It is the operational end of the Customer Security Programme, and it is where the programme’s consequences live: an attestation that is late, missing or unsupported by an independent assessment is visible to Swift and, on request, to every counterparty that asks. This guide explains what KYC-SA is and who uses it, what is submitted and when, how the independent assessment is recorded, how counterparty access works in both directions, what Swift does with non-compliance, and how to run the annual cycle so the submission is an upload rather than a scramble.
The KYC Security Attestation application is a module of Swift’s KYC Registry, accessed through swift.com by users holding the appropriate roles. Every Swift user — banks, corporates, market infrastructures and service bureaux with their own BIC — is required under the Customer Security Programme to attest annually against the current CSCF, and KYC-SA is the only channel for doing so. The attestation records, per applicable control, whether the user is compliant, and it is supported since 2021 by a mandatory independent assessment. Our guide to SWIFT CSP attestation covers the five steps; this post covers the application the steps end in.
| Element | Detail |
|---|---|
| Attestation window | 1 July to 31 December each year, against the CSCF version for that year — v2026 for the window ending 31 December 2026 |
| Scope | Every control applicable to the user’s architecture type; mandatory controls attested as compliant or non-compliant, advisory controls attested voluntarily |
| Architecture type | Declared in the attestation; from v2026, users with a customer client connector who previously attested type B attest A4 |
| Independent assessment | Declared with the attestation: performed by an independent internal function or an external assessment provider, covering at least all applicable mandatory controls; assessor details and date recorded |
| Non-compliance | Each non-compliant mandatory control attested as such with a remediation plan and target date |
| Approval | Submitted by a user with submission rights and approved by a separate user with approval rights — Swift expects the attestation to be signed off at an appropriate level of seniority, typically the CISO or a senior officer |
| Validity | One attestation per annual cycle; a new attestation is required every year, and an updated attestation is expected if the situation changes materially before the next window |
The controls attested are the ones CSCF v2026 makes applicable to the declared architecture — which is why the architecture type is the first field to get right. Our guides to CSCF v2026 and SWIFT mandatory vs advisory controls cover what goes into the per-control answers.
Since the 2021 attestation cycle, Swift has required every attestation to be supported by an independent assessment. The assessment can be performed by an internal function that is independent of the first line — internal audit, or a second-line risk function with the right competence — or by an external provider; Swift maintains a directory of CSP assessment providers and a certification for CSP assessors, but use of a listed provider is not mandatory. The assessment must cover at least all mandatory controls applicable to the architecture, and its existence, the assessor and the completion date are recorded in KYC-SA with the attestation. The attester is attesting that the assessment was performed; Swift may ask for the assessment report. Our guide to the SWIFT CSCF independent assessment covers the internal-versus-external choice.
KYC-SA is an exchange as much as a filing. A user can request access to a counterparty’s attestation data through the application; the counterparty grants or refuses; once granted, the requesting user sees the attestation — architecture type, compliance per control, assessment status — and can use it in its own counterparty risk management. The same applies in reverse: your correspondents will request yours. Three practices follow.
A non-compliant attestation is a legitimate outcome — it is what the remediation plan and target date exist for — and Swift’s follow-up is proportionate to what is declared. Failure to attest at all by 31 December, or an attestation without the independent assessment, is treated more seriously: Swift may inform the user’s counterparties and supervisors, and non-attesting users are identifiable to correspondents who request access. The commercial effect is the one that matters — correspondents that see a missing or unsupported attestation can and do restrict the relationship — which is why the 80% initial non-compliance rate Deloitte Canada reported across its 2025 assessments, falling to 10% after remediation, argues for assessing early in the window rather than declaring in December.
What is KYC-SA?
The KYC Security Attestation application on swift.com, part of the KYC Registry, in which every Swift user submits its annual attestation against the Customer Security Controls Framework, records the supporting independent assessment, and grants counterparties access to the result.
When must the attestation be submitted?
Within the annual window of 1 July to 31 December, against that year’s CSCF version — v2026 for the window ending 31 December 2026.
Is the independent assessment recorded in KYC-SA?
Yes. The attestation declares that an independent assessment covering at least all applicable mandatory controls was performed, by whom and when. It has been mandatory since 2021 and can be internal or external.
Can counterparties see my attestation?
Only if you grant their access request in KYC-SA. Refusal is possible but is generally read as a warning sign; Swift can also share non-compliance and non-attestation with counterparties and supervisors.
What if we are non-compliant on a mandatory control?
Attest it as non-compliant with a remediation plan and target date. A disclosed non-compliance is a normal outcome; a false compliant attestation or a missing attestation is what carries consequences.
Treat KYC-SA as the end of a twelve-month cycle rather than a December form: read the new CSCF in January, close the gaps by June, get the independent assessment in the first half of the window, attest from its result, and run the counterparty grants and reviews as a standing process. The application records exactly what you declare, shows it to whoever you allow, and remembers whether you declared it on time.
The KYC-SA Self-Attestation Workbook, the Independent Assessment Evidence Pack and the CSCF Control Implementation Summary that produce the per-control answers are in the SWIFT CSP Compliance Toolkit, or start with the free templates.
September 20, 2026
September 20, 2026
September 19, 2026
September 19, 2026
September 19, 2026