Swift's CSCF 2026 adds no mandatory post-quantum control
1 JULY 2026, LA HULPE
Swift's Customer Security Controls Framework for 2026 adds no mandatory post-quantum control, according to analysis of the framework. Quantum readiness therefore remains outside the framework's required controls for this cycle, so Swift users face no obligation to meet a post-quantum control through the CSCF yet.
The CSCF matters because of its reach. It sets security controls that Swift users must meet, forming a baseline across the global messaging network that connects a large share of the world's financial institutions. When the CSCF mandates a control, that control propagates widely, which is exactly why the absence of a post-quantum control draws attention.
That absence does not remove the underlying risk. Other supervisors already expect financial institutions to act on quantum, and projects like the BIS Innovation Hub's Project Leap show the sector testing post-quantum cryptography in live systems. Swift users should continue their own planning rather than read the framework's silence as permission to defer.
Why it matters. The CSCF 2026 leaves post-quantum readiness as a user responsibility rather than a mandated control, so Swift users cannot rely on the framework to drive their migration this year. Given the risk and the expectations other supervisors set, institutions should keep advancing their own post-quantum work. Watching future CSCF cycles is worthwhile, since a mandated control would quickly reach the whole network when it arrives.