--- title: SWIFT - Security controls in international financial transactions description: The model defined by SWIFT allows monetary exchange from one country to another in a certain, reliable and above all safe way. image: https://newsroom.kireygroup.com/hubfs/Blog_security_controlli_sicurezza_transazioni_finanziarie_internazionali.jpg --- [kireygroup.com](https://www.kireygroup.com/) [![](https://newsroom.kireygroup.com/hubfs/item-2020-dicembre/logo-Blog-v2.svg)](https://newsroom.kireygroup.com/en/news) - [Ita](https://newsroom.kireygroup.com/news/swift-society-for-worldwide-interbank-financial-telecommunication-controlli-di-sicurezza-nelle-transazioni-finanziarie-internazionali?hsLang=it) - Eng - [Esp](https://newsroom.kireygroup.com/es/news/swift-controles-de-seguridad-para-las-transacciones-financieras-internacionales?hsLang=es) [Kireygroup.com](https://www.kireygroup.com/) # Get your daily dose of tech! ## We Shape Your Knowledge # [Welfare: from compliance to competitiveness, digital services and technologies are key to pension funds’ future](https://newsroom.kireygroup.com/en/news/welfare-digital-services-and-technologies-are-key-to-pension-funds-future?hsLang=en) By Michela Sertorio, Business Line Manager - BU Pension Funds atKirey. [Read more](https://newsroom.kireygroup.com/en/news/welfare-digital-services-and-technologies-are-key-to-pension-funds-future?hsLang=en) 9 MIN READ 26 October 2026 ### Latest News - [Welfare: from compliance to competitiveness, digital services and technologies are key to pension funds’ future](https://newsroom.kireygroup.com/en/news/welfare-digital-services-and-technologies-are-key-to-pension-funds-future?hsLang=en) - [Inference Costs: how to prevent AI agents from driving costs up exponentially](https://newsroom.kireygroup.com/en/news/inference-costs-how-to-prevent-ai-agents-from-driving-costs-up-exponentially?hsLang=en) - [Kirey Advisory at the ABI Lab workshop on Processes, Operations and Organization](https://newsroom.kireygroup.com/en/news/kirey-advisory-at-the-abi-lab-workshop-on-processes-operations-and-organization?hsLang=en) - [Kirey Strengthens Its SAP Presence: Mind The Value Achieves Reselling Partner Status](https://newsroom.kireygroup.com/en/news/kirey-strengthens-its-sap-presence-mind-the-value-achieves-reselling-partner-status?hsLang=en) - [The Dark Side of Multicloud: how to prevent workload placement from generating technical debt](https://newsroom.kireygroup.com/en/news/the-dark-side-of-multicloud-how-to-prevent-workload-placement-from-generating-technical-debt?hsLang=en) - [Shadow AI: 4 out of 5 employees use tools not governed by the company](https://newsroom.kireygroup.com/en/news/shadow-ai-4-out-of-5-employees-use-tools-not-governed-by-the-company?hsLang=en) 18 MIN READ 26 February 2021 - Share on: - - - - [Cybersecurity](https://newsroom.kireygroup.com/en/news/tag/cybersecurity) / # SWIFT - Security controls in international financial transactions #### Kirey [![](https://newsroom.kireygroup.com/hubfs/it.svg)](https://newsroom.kireygroup.com/news/swift-society-for-worldwide-interbank-financial-telecommunication-controlli-di-sicurezza-nelle-transazioni-finanziarie-internazionali?hsLang=it)    [![](https://newsroom.kireygroup.com/hubfs/ES.svg)](https://newsroom.kireygroup.com/es/news/swift-controles-de-seguridad-para-las-transacciones-financieras-internacionales?hsLang=es) 18 MIN READ 26 February 2021 - Share on: - - - - [All](https://newsroom.kireygroup.com/news?hsLang=en) - Categories + - [Corporate](https://newsroom.kireygroup.com/en/news/tag/corporate) - [Cybersecurity](https://newsroom.kireygroup.com/en/news/tag/cybersecurity) - [Cloud](https://newsroom.kireygroup.com/en/news/tag/cloud) - [Data Value](https://newsroom.kireygroup.com/en/news/tag/data-value) - [Innovation](https://newsroom.kireygroup.com/en/news/tag/innovation) - [Artificial Intelligence](https://newsroom.kireygroup.com/en/news/tag/artificial-intelligence) - [Software Development](https://newsroom.kireygroup.com/en/news/tag/software-development) - [Corporate Social Responsibility](https://newsroom.kireygroup.com/en/news/tag/corporate-social-responsibility) - [Advisory](https://newsroom.kireygroup.com/en/news/tag/advisory) - [Welfare & Social Services](https://newsroom.kireygroup.com/en/news/tag/welfare-social-services) - [Press & PR](https://newsroom.kireygroup.com/en/news/tag/press) ## **The Society for Worldwide Interbank Financial Telecommunication, better known as SWIFT, globally determines common processes and standards for financial transactions.** *By Angelo Chiarot – Senior Security Advisor of [Kirey Group](https://www.kireygroup.com/en/)* The Society for Worldwide Interbank Financial Telecommunication, better known as SWIFT, is an organization founded in Brussels in 1973 with the aim of establishing common processes and standards for financial transactions worldwide. Used for the exchange of 37.7 million daily messages in 2020 [\[1\]](https://newsroom.kireygroup.com/en/news/swift-security-controls-in-international-financial-transactions#n1), [with a growth of 10.3% compared to 2019\[2\]](https://newsroom.kireygroup.com/en/news/swift-security-controls-in-international-financial-transactions#n1), the SWIFT circuit counts in February 2021 the membership of more than 11,000 global institutions connected by 200 different countries[\[3\]](https://newsroom.kireygroup.com/en/news/swift-security-controls-in-international-financial-transactions#n1). | In relation to the continuous occurrence and evolution of fraud events that have an impact on the financial sector (as reported by [ENISA](https://www.enisa.europa.eu/)- European Union Agency for Cybersecurity and [CLUSIT](https://clusit.it/)- Italian Association for Information Security) the model defined by SWIFT is the answer to the requests of international banking and financial institutions. The latter had and still have the necessity to arrange a system that allows the monetary exchange from one country to another with certain, reliable and especially secure methods. | ![marlet distribution](https://newsroom.kireygroup.com/hs-fs/hubfs/marlet%20distribution.png?width=218&name=marlet%20distribution.png) Source: SWIFT, December 2019 | | --- | --- | Initially set up and managed by banking institutions as a replacement for TELEX, now obsolete and lacking sufficient security guarantees, the SWIFT circuit is now the reference standard for the exchange of financial messages. It is also accessible to other financial operators, such as brokers, stock exchange operators, clearing and depository institutions, institutions authorised to exchange securities. The circuit provides for the assignment to the member parts of a Bank Identifier Code - BIC, i.e. a code with a length of eight or eleven characters, uniquely assigned to each associated entity. The SWIFT model, together with the transactional mechanisms that are based on the exchange of messaging compliant with [**ISO 15022**](https://www.iso.org/standard/28373.html)[\[4\]](https://newsroom.kireygroup.com/en/news/swift-security-controls-in-international-financial-transactions#n4) and [**ISO 20022**](https://www.iso20022.org/)[\[5\]](https://newsroom.kireygroup.com/en/news/swift-security-controls-in-international-financial-transactions#n5) standards, is composed of security measures qualified in the Customer Security Programme and detailed in the Customer Security Framework (two of the main technical-regulatory documents on security controls). These measures are designed to guarantee the confidentiality and the integrity of information and the availability of the service, with the aim of mitigating the risk of incurring fraud. In order to guarantee proper levels of security throughout the circuit, member entities must formally and periodically demonstrate that they have arrange, applied and maintained the necessary security controls, according to the reference architectures. ### **Architectures of reference** With the goal of determining the system components concerned, in addition to the organizational aspects (e.g. company or third party roles involved), within the perimeter on which insists the application of security controls (secure zones), SWIFT requires entities to identify which of the five reference architectures (see Figure 1) is closer to what is deployed in their operating environment for message transmission and reception. In accordance with an approach based on the identification and mitigation of risk, the identification of the reference architecture allows the timely determination of the security controls applicable to the secure zone and to the internal and external parties involved (e.g. service provider). Elements on which the following Assessment activity, necessary to demonstrate security compliance and maturity. Achieving and being able to demonstrate compliance, as well as being factors that allow the mitigation of fraud and direct loss phenomena, allow the sharing with its national and international partners of the character of reliability and security achieved, thus further strengthening the Organization’s image and reputation. ![ENG\_news\_swift\_figura\_2-1](https://newsroom.kireygroup.com/hs-fs/hubfs/ENG_news_swift_figura_2-1.png?width=650&name=ENG_news_swift_figura_2-1.png) Figure 1 – Reference architectures   With the *Customer Security Programme* (CSP), SWIFT classifies reference architectures through the identification of interfaces, applications and tools, specifying how different implementations can however be characterized by a substantial level of customization, compared to the groups identified below: **A1 architecture**: ownership of license and use of the communication interface and the messaging interface, or of the communication interface only, which typically reside within the premises of the Organization or at the service provider. **Architecture A2**: ownership of license and use of the messaging interface only, located at the Organization or at a service provider. **A4 architecture**: use of a custom connector, typically using an application solution (e.g. file transfer or middleware such as IBM MQ Server) that allows communication with a service provider. **Architecture B**: no specific infrastructure components. The messaging service is used via a PC or other device through a *Graphical User Interface* (*GUI*) or through a back-office application through the Application Programming Interface (API) that connects to services provided by a service provider. ### **How does SWIFT ensure security controls for payment processes and technological components?** The Customer Security Programme (CSP) also requires each entity to define, document, apply and verify its payment processes and technological components with respect to control objectives, the principles and individual security controls defined by SWIFT (see Figure 2), in compliance with the applicability criteria of each type of architecture used. The security controls, not limited to technologies but also applicable to persons and processes of the Organization, are divided into mandatory (mandatory) and advisory (discretionary). These represent the selection made by SWIFT of controls from the main standards and best practices, more used and recognized globally, such as the Payment Card Industry Data Security Standard *([PCI DSS](https://www.pcisecuritystandards.org/)),* *Information Security Management Systems ([ISO/IEC 27002](https://www.iso.org/standard/54533.html))* and the *National Institute of Standards and Technology (NIST),* for the protection of confidentiality, integrity and availability of information and continuity of service. ### **![ENG\_news\_swift\_figura\_1](https://newsroom.kireygroup.com/hs-fs/hubfs/ENG_news_swift_figura_1.png?width=680&name=ENG_news_swift_figura_1.png)** Figure 2 – Taxonomy of controls   ## **What are the potential events that security controls help prevent in financial transactions?** The selected controls help Organizations to mitigate security risks that seem increasingly looming, in today's threat landscape. Addressing these risks adequately thus enables the prevention and reduction of potential adverse, fraudulent and potential loss events, such as: - **Unauthorised transmission** and/or modification **of financial transactions** - **Receipt** and processing **of altered** or unauthorised **transactions** - **Conduct of transactions with unauthorised**/unintended **parties** - **Breach of confidentiality and integrity of information** concerning personnel, business and technological components - The resulting occurrence of losses related to corporate risk, such as financial, legal, regulatory and image risks. The Regulation requires that organizations must certify annually their compliance status, typically within the period July-December, in relation to the annual update criteria of the reference documentation, in particular the *Customer Security Control Framework* (*CSCF*). Starting from mid-2021, the attestations of compliance submitted in accordance with CSCF v.2021, shall be the result of the safety control assessment conducted independently, exclusively through: - **Independent internal assessment**: conducted by functions belonging to the *second or third line of defence*[\[6\]](https://newsroom.kireygroup.com/en/news/swift-security-controls-in-international-financial-transactions#n6)*,* such as compliance, risk management or internal audit or their equivalent. The selected function must be independent from the first line of defence and be in possession of recent and relevant experiences for the performance of Assessment related to cyber security controls. - **Independent External Assessment**: conducted by an **independent external organisation** with relevant expertise in cyber security assessment and certified by the security industry. ### **Kima's Accreditation as SWIFT Assessor and Compliance Expert** [Kima Projects & Services S.r.l. | Kirey Group](https://www.kireygroup.com/en/), already Certification Body for electronic payment environments since 2006 according to the Payment Card Industry Data Security Standard ([PCI DSS](https://www.pcisecuritystandards.org/)) in banking and finance, in 2020 has obtained accreditation as an Assessor qualified by SWIFT, through the Customer Security Programme (CSP) Assessment Provider, enabling the evaluation and validation of SWIFT payment environments. Kima has a Senior Security Advisor with more than twenty years of expertise and experience, as well as security certifications that allow them to be qualified as suitable entities for carrying out compliance activities regarding the security requirements of SWIFT. To date, the certifications held by the Security Advisory Team are the following: - Payment Card Industry Data Security Standard - Qualified Security Assessor (**PCI DSS QSA**) - Payment Card Industry Data Security Standard Professional (**PCIP**) - Certified Information Systems Auditor (**CISA**) - Certified Information Security Manager (**CISM**) - Certified in Risk and Information Systems (**CRISC**) - Cybersecurity Nexus Fundamentals (**CSX**) - Lead Auditor **ISO/IEC 27001** - Internal Auditor **ISO/IEC 20000** Actively involved in the provision of services for banking institutions and financial operators, Kima is therefore the appropriate interlocutor who has an offer for the SWIFT Regulation which consists of the following main activities: - **Identification of the customer’s reference architecture** (A1, A2, A3, A4 and B) - **Definition of system components** and parts in scope - Conduct of preliminary conformity assessments (**Gap Analysis**) - Performance of mandated technological audits (**Vulnerability Assessment** and **Penetration Test**) - **Formal assessment** and validation of compliance for the purpose of periodic assessment - Staff **training** [![New call-to-action](https://no-cache.hubspot.com/cta/default/6224655/dbec2f42-a4e4-496a-9f2b-f94cd9400f6f.png)](https://cta-redirect.hubspot.com/cta/redirect/6224655/dbec2f42-a4e4-496a-9f2b-f94cd9400f6f) ### **Notes** \[1\] \[2\] \[3\] Messaggi in ambito finanziario (FIN), [swift.com](https://swift.com/) \[4\] [ISO 15022 Securities](https://www.iso.org/standard/28373.html) - Scheme for Messages (Data Field Dictionary), Part 1 - Data Field and Message Design Rules and Guidelines e Part 2 - Maintenance of the Data Field Dictionary and Catalogue of Messages, [ISO.org](https://www.iso.org/home.html) \[5\] [ISO 20022](https://www.iso20022.org/) – Universal financial industry message scheme, [ISO.org](https://www.iso.org/home.html) \[6\] [Bank of International Settlements](https://www.bis.org/) – BIS, Occasional paper n.11 - 2015, The four lines of defence model for financial institutions - [Previous post](https://newsroom.kireygroup.com/en/news/kirey-group-is-gold-partner-of-infoblox?hsLang=en) - [Read all posts](https://newsroom.kireygroup.com/en/news?hsLang=en) - [Next post](https://newsroom.kireygroup.com/en/news/data-governance-and-data-quality-key-factors-for-country-recovery?hsLang=en) ## Related posts: #### [Shadow AI: 4 out of 5 employees use tools not gove...](https://newsroom.kireygroup.com/en/news/shadow-ai-4-out-of-5-employees-use-tools-not-governed-by-the-company?hsLang=en) “While 80% of professionals use AI in their work, only 22% rely exclusively on tools provided by the... [Read more](https://newsroom.kireygroup.com/en/news/shadow-ai-4-out-of-5-employees-use-tools-not-governed-by-the-company?hsLang=en) 11 MIN READ 26 February 2021 #### [Autonomous SOC: reality, limitations, and prospect...](https://newsroom.kireygroup.com/en/news/autonomous-soc-reality-limitations-and-prospects-for-ai-driven-security?hsLang=en) Artificial intelligence is certainly not new to the world of cybersecurity. For more than a decade, ... [Read more](https://newsroom.kireygroup.com/en/news/autonomous-soc-reality-limitations-and-prospects-for-ai-driven-security?hsLang=en) 11 MIN READ 26 February 2021 #### [Cybersecurity awareness must change form: human de...](https://newsroom.kireygroup.com/en/news/cybersecurity-awareness-must-change-form-human-decision-quality-at-the-center?hsLang=en) By Roberto Marzocca, Head of Cybersecurity di Kirey For a long time, the cybersecurity sector has ar... [Read more](https://newsroom.kireygroup.com/en/news/cybersecurity-awareness-must-change-form-human-decision-quality-at-the-center?hsLang=en) 6 MIN READ 26 February 2021 #### Explore - [Home](https://www.kireygroup.com/) - [Competencies](https://www.kireygroup.com/en/competencies) - [Industries](https://www.kireygroup.com/en/industries) - [About Us](https://www.kireygroup.com/en/about-us) - [Tech&Partners](https://www.kireygroup.com/en/tech-partners) - [Careers](https://www.kireygroup.com/en/careers) - [Contact](https://www.kireygroup.com/en/contact) - [Corporate Social Responsibility](https://www.kireygroup.com/en/corporate-social-responsibility) - [Advisory](https://www.kireyadvisory.com/en) #### Policy - [Quality](https://www.kireygroup.com/oven/media/PKG-COMP-AL14-Quality-Policy.pdf) - [Security](https://www.kireygroup.com/oven/media/PKG-CIS-LG02-Security-Policy.pdf) - [Gender Equality](https://www.kireygroup.com/oven/media/PKG-COMP-LG03-Politica-per-la-parita-di-Genere-v2.pdf) - [Service Management](https://www.kireygroup.com/oven/media/PKG-COMP-AL45-Politica-per-la-gestione-dei-servizi.pdf) - [Environment](https://www.kireygroup.com/oven/media/PKG-COMP-AL44-Politica-Ambientale-Kirey.pdf) - [Health, Safety & Wellbeing](https://www.kireygroup.com/oven/media/PKG-COMP-LG02-Policy-on-health-safety-and-well-being-in-the-work-environment.pdf) - [ESG](https://www.kireygroup.com/oven/media/Policy-ESG-ENG-v1.pdf) - [Info on Data Processing](https://www.kireygroup.com/en/information-on-data-processing) #### Certifications - [ISO 9001:2015](https://www.kireygroup.com/oven/media/KIREY-S-R-L-9001.pdf) - [ISO/IEC 27001:2022](https://www.kireygroup.com/oven/media/KIREY-S-R-L-27001.pdf) - [PDR 125](https://www.kireygroup.com/oven/media/PDR-125-2022.pdf) - [ISO/IEC 20000-1:2018](https://www.kireygroup.com/oven/media/ISOIEC-20000-12018-ENG.pdf) - [ISO 14001:2015](https://www.kireygroup.com/oven/media/ISO-14001-2015-ENG.pdf) - [ISO 45001:2018](https://www.kireygroup.com/oven/media/CERTIFICATO-ISO-45001-KIREY-ENG.pdf) - [ISO 22301:2019](https://www.kireygroup.com/oven/media/ISO-22301-2019-ENG.pdf) #### Info **Kirey Srl** [info@kireygroup.com](mailto:info@kireygroup.com) Viale Francesco Restelli, 5 20124 Milano [kirey@pec.it](mailto:kirey@pec.it) **PI/CF**: 06729880960 **REA**: MI 1910802 **Tel**: +39 02 78625200 Capitale sociale 1.089.620,00  [![Linkedin](https://newsroom.kireygroup.com/hs-fs/hubfs/Linkedin.png?width=20&name=Linkedin.png)](https://www.linkedin.com/company/kireygroup/)   - [Privacy Policy](https://www.kireygroup.com/oven/media/Kirey-Privacy-ENG-policy-art-13.pdf) - [Cookie Policy](https://www.kireygroup.com/oven/media/Kirey-Cookie-Policy-ENG-1.pdf) - [Terms and Conditions](https://www.kireygroup.com/oven/media/Kirey-Website-Terms-and-Conditions-1.pdf) [![KIREY LOGO](https://newsroom.kireygroup.com/hs-fs/hubfs/KIREY_LOGO_PAYOFF_RGB_POS.png?width=200&height=72&name=KIREY_LOGO_PAYOFF_RGB_POS.png)](https://www.kireygroup.com/) © Copyright 2026 by Kirey