SWIFT Architecture Types A1 to A4 and B: Find Yours Before You Scope

Your SWIFT CSP architecture type is not an administrative label it is the foundational input that determines everything else in your compliance programme. Before you define scope, assign controls, or engage an assessor, you need to know precisely which architecture type applies to your environment, because the Customer Security Controls Framework (CSCF) applies different mandatory controls depending on how your institution connects to and operates within the SWIFT network.

 SWIFT’s Customer Security Programme (CSP) was established in direct response to a series of high-profile cyber-enabled financial frauds, and its architecture classification system exists for a deliberate reason: different deployment models carry different risk profiles and different attack surfaces. A compliance programme built on a misidentified architecture type is not just incomplete it may leave your institution exposed in exactly the areas that matter most.

This blog provides a practical overview of the five SWIFT CSP architecture types, their key differences, and the importance of accurate classification before commencing a CSCF assessment.

Understanding SWIFT CSP Architecture Types

SWIFT recognises that financial institutions use different deployment and connectivity models. Some manage their SWIFT-related infrastructure internally, while others rely on service bureaus, outsourcing agents, or SWIFT connectivity providers.

To accommodate these different arrangements, SWIFT defines five reference architecture types:

A1, A2 and A3: Architectures involving different forms of customer-owned or managed SWIFT-related infrastructure and components.

A4: An architecture involving a customer-side connection or component associated with an externally hosted SWIFT service.

B: An architecture with no SWIFT-specific infrastructure operated by the user, where access is provided through an interactive service model.

The distinction is important because the CSCF maps security controls to specific architecture types. Not every control applies equally to all five architectures.

SWIFT CSP Architecture Types: A1, A2 and A3

Architecture types A1, A2 and A3 represent different deployment arrangements involving SWIFT-related infrastructure and components.

The applicable controls are broadly aligned across these architectures, although specific exceptions apply. For example, CSCF Control 6.3 (Database Integrity) has an explicit exception for Architecture A3.

For institutions operating these architectures, assessment activities may involve reviewing SWIFT-related infrastructure, communication components, messaging interfaces, supporting systems, access management, and network security.

The actual components included in the assessment must be determined using the applicable CSCF scoping requirements.

SWIFT CSP Architecture Type A4

Architecture A4 covers a different deployment arrangement in which the institution uses customer-side components or connectivity to access SWIFT services provided or hosted externally.

Although the SWIFT messaging infrastructure may be managed by a service provider, the institution may still have local components that require security assessment.

The assessment should consider the applicable customer-side components, connectivity arrangements, user access, and responsibilities shared with the service provider.

Institutions should also obtain the relevant information about the provider’s architecture and security compliance to establish a clear understanding of their respective responsibilities.

SWIFT CSP Architecture Type B

Architecture B generally applies to institutions that access SWIFT messaging services through an interactive user interface, without operating their own SWIFT-specific infrastructure.

For example, users accessing SWIFT services through a browser-based interface may fall under this architecture, subject to the applicable classification criteria.

However, Type B does not mean that the institution is exempt from CSP compliance.

The institution must still address applicable security controls relating to user access, endpoint protection, authentication, and the security of the environment used to access SWIFT services.

Important: Under CSCF v2026, certain customer client connectors can change the applicable architecture classification. Some institutions that previously attested under Type B may need to reclassify to A4. Therefore, institutions should review their connectivity and application integration arrangements before confirming their architecture type.

Why Architecture Classification Matters for CSCF Assessment?

Architecture classification is a critical input to the SWIFT CSP assessment because it determines which security controls and components are applicable.

• Before starting the assessment, institutions should:
• Identify how their SWIFT messaging and communication interfaces are deployed.
• Determine whether the infrastructure is internally managed or outsourced.
• Identify local applications, connectors, workstations, and supporting components.
• Understand the responsibilities of service bureaus and other third-party providers.
• Validate the architecture against SWIFT’s applicable architecture decision tree.
• Map the applicable mandatory and advisory CSCF controls to the identified components.

This process helps prevent incorrect scoping, missing evidence, and unnecessary assessment activities.

Common SWIFT CSP Scoping Mistakes

Some common issues identified during SWIFT CSP readiness and assessment activities include:

• Selecting an architecture type based only on whether SWIFT infrastructure is hosted internally or externally.
• Assuming that using a service bureau automatically qualifies an institution as Type B.
• Overlooking local applications, customer client connectors, and supporting infrastructure.
• Failing to establish clear security responsibilities between the institution and its service provider.
• Using outdated architecture documentation or previous-year classifications without reviewing changes.
• Applying the wrong CSCF control applicability matrix.
• Architecture classification should be reviewed whenever there are significant changes to SWIFT connectivity, infrastructure ownership, hosting arrangements, or application integration.

Conclusion

Selecting the correct SWIFT CSP architecture type is fundamental to defining an accurate CSCF assessment scope. The five architectures—A1, A2, A3, A4, and B—represent different SWIFT deployment and connectivity arrangements, with corresponding differences in applicable security controls and assessment requirements.

Institutions should not determine their architecture type based solely on infrastructure hosting or connectivity methods. A detailed review of the actual deployment, ownership, customer-side components, and third-party arrangements is essential. ValueMentor supports financial institutions with SWIFT CSP architecture reviews, CSCF gap assessments, assessment scoping, and independent security assessments. Our specialists can help identify the applicable architecture, evaluate security control requirements, and prepare your institution for its SWIFT CSP assessment.

Contact ValueMentor to strengthen your SWIFT CSP compliance programme and prepare for your next assessment.

Frequently Asked Questions