SWIFT CSP attestation 2026: the evidence pack for CSCF v2026 — flow inventories, registers, runbooks

Who this is for (the long tail the consultancies don't price for)

Browser-only ("Type B") usersYou still attest, your operator PCs are still in scope — and v2026's connector change may quietly make you A4. The pack's 10-minute self-test puts your classification rationale in writing.

A4 / customer-connector usersYour file-transfer client, middleware, or API integration is now a mandatory in-scope component of 14 controls. The pack maps each one to the evidence it needs.

Service-bureau / Lite2 / Alliance Cloud usersOutsourcing the stack never outsources the obligation — and your provider's status is auto-appended to your published attestation. The pack covers what stays yours.

Small banks & corporates with no security staffOne ops person can run this pack: decision trees, fill-in registers, and a back-planner that works the calendar from 31 December to this week.

What changed in v2026 (why last year's attestation posture is stale)

Control 2.4 (Back Office Data Flow Security) is now mandatory — the corridor between your SWIFT infrastructure and your payment engine needs a documented flow inventory, diagrams, and written risk acceptances. Most small institutions have never drawn these. The pack's biggest file builds them.
Customer connectors were pulled into 14 controls — client-side file-transfer tools, middleware, and API integrations are now mandatory in-scope components, from hardening to MFA to logging.
The B→A4 reclassification — per SWIFT's own change material, some institutions that attested as browser-only must now attest as A4. Carrying forward last year's type without revalidating is the misclassification assessors report most.
Plus the minor moves — MFA tightened for remote privileged access, non-Windows malware scope, refreshed crypto expectations — each mapped to a concrete operational step.

Counterparties see your status color-coded in KYC-SA (green / amber / grey), and SWIFT reserves the right to report late or absent attestations — and missing independent assessments — to your supervisor. This is not a form you quietly skip.

What's in the pack

START HERE — your architecture type in 10 minutes (with the B→A4 connector self-test), your v2026 changes, your clock, and the CISO sign-off rule.
v2026 delta map — the one promotion, the 14-control connector table, and every minor change with its operational move.
Architecture & scoping — the five types in plain language, the five misclassification traps, and the scoping memo assessors accept instead of probe.
Control 2.4 evidence workbook — the wedge: flow-inventory and bridging-server registers, per-leg vs end-to-end decision sheet, diagram checklist, legacy-flow risk-acceptance memos.
Evidence checklist, all 26 mandatory controls — what assessors typically ask for, control by control, organized by the framework's objectives and principles.
Independent assessment runbook — internal vs external path, the assessor procurement one-pager, and the back-planner from 31 December to this week.
KYC-SA submission runbook — Submitter/Approver roles, the CISO rule, counterparty visibility, the 3-month re-attestation trigger, and a submission log.
Service-bureau & Lite2 guide — provider compliance results, the auto-append, operator-PC scope, honest flags where policy is unverified.
Fill-in templates — flow inventory CSV, bridging-server register, components register, scoping memo, risk-acceptance memo, assessor handoff index.
Update tracker option — v2027 watch, the tentative-2028 legacy-flow date, crypto KB changes, Alliance Connect migration.

Instant downloadEditable templatesEvery file datedOriginal content — the CSCF itself stays SWIFT's; you download it free and verify

US$390 one-off

Versus a five-figure, contact-us-only consulting engagement — this pack does the evidence-building so the people you do pay (your assessor) spend their days assessing, not hunting. Optional update tracker (+$49/mo): CSCF v2027 watch, the tentative-2028 legacy-flow date, crypto knowledge-base changes, Alliance Connect migration notes — folded into re-issued files, not links.

Get the pack — instant download

Not sure yet? Download a free 4-page sample (PDF) — see exactly what you're buying.

14-day unconditional refund — email esau@trykilde.com, no questions asked, refunded the same business day. How it works.

Secure checkout by Polar (merchant of record; card processing by Stripe) · VAT handled · instant download · edition 1.0, current to 21 August 2026. Question first? esau@trykilde.com — a person answers within one business day.

Questions we'd ask too

Is this affiliated with SWIFT?

No. Independent publication by Kilde. Not affiliated with, endorsed by, or approved by S.W.I.F.T. SC. SWIFT is a registered trademark of S.W.I.F.T. SC. The pack contains our own original explanations and templates — it never reproduces the framework's text, and every file starts by telling you to download the CSCF v2026 yourself from SWIFT's Knowledge Centre (free, no login) and verify against it.

Does this replace the independent assessment?

No — nothing can; the assessment has been mandatory since the 2021 cycle. The pack makes you cheap to assess: assessors bill by the day, and days are consumed hunting for evidence that doesn't exist yet. You hand over an indexed evidence package on day one instead.

Is this security consulting or legal advice?

Neither. It's general information and document templates. Your independent assessor and your own copy of the framework are authoritative, and no compliance outcome is guaranteed — anyone who guarantees you one is selling something else.

We're a tiny browser-only user. Do we really need this?

You still attest annually, your operator PCs are in scope, and v2026's connector redefinition is exactly the change that turns "browser-only" institutions into A4 without their noticing. The self-test takes 10 minutes; if it comes back clean, the pack still gives you the lightest-set evidence story and the scoping memo that documents why B is right — for your assessor to validate.

What if the framework changes?

It does, annually — that's what the $49/mo tracker is for: v2027 publication watch, the tentative 2028 legacy-flow date (announced, not in force — we keep the tense honest), crypto expectations, and connectivity-product migrations, each folded into re-issued files.

Why trust this pack

Read from the primary source, not summariesEvery regulatory claim is taken from the instrument itself — the Official Journal text, the regulator's own published guidance, the framework document — not from a secondary explainer. Where a pack turns on a list (product categories, control sets, banned practices), that list was read from the source document item by item and checked against it again before release.

Every claim carries a dateEach pack states the date its research was verified, and each page in it is stamped with what it is current to. Where a fact is contested, provisional or merely announced rather than in force, it says so in the text instead of being smoothed over.

Changes are published, not quietly patchedWhen a tracked instrument moves, the change is dated in a public changelog and on the deadline radar. You can see what changed and when, before you buy and after.

Independent, and explicit about itKilde is not affiliated with, endorsed by or approved by any regulator, standards body or scheme operator. Where a pack covers a private framework, it identifies controls by number and title and directs you to the operator's own document.

See it before you payFour real pages of every pack are free — the actual cover and opening section, not a brochure. Every purchase carries a 14-day unconditional refund.

Kilde sells document templates and organised regulatory information. It is not a law firm and does not provide legal advice; buying a pack does not create an attorney-client relationship. Built and maintained by Kilde's founder, a practising attorney admitted to a US state bar (not an EU or Hong Kong admission). About Kilde · Verification log · Refunds · Terms · Privacy · esau@trykilde.com

This edition: v1.0 · current to 21 August 2026 · changelog · CSP guides. A copy obtained anywhere else receives no updates and goes stale from the day it was taken.

Disclaimer: General information and document templates only — not security consulting, not an independent assessment, not legal advice; no compliance outcome is guaranteed. Your independent assessor and your own copy of the CSCF are authoritative. Every file is dated "current to 21 August 2026."

Your assessor asks for evidence. This pack builds it.