Skip to main content

​
Cover SWIFT Customer Security Programme requirements without bolting on a niche product

The SWIFT Customer Security Programme (CSP) is the financial industry’s standard for monitoring access to the SWIFT network. Its CSCF (Customer Security Controls Framework) requires institutions to track who logs in to SWIFT-related systems, when, from where, and what they do - both for active threat detection and for audit evidence after the fact. Generic UAM products don’t typically know what “SWIFT login” means; they capture screen and metadata generically. Dedicated SWIFT monitoring products exist but are expensive and live outside the broader security stack. Syteca’s SWIFT Username Monitoring captures SWIFT login identity as a first-class data field - the username used to log in to the SWIFT network on a monitored endpoint is logged separately from generic OS/application login data, written to a dedicated log file on the Application Server, and (with SIEM integration enabled) forwarded into the SIEM alongside other Syteca security events. Same Client agent that’s already running for general session monitoring; an additional feature flag turns SWIFT capture on.
Use SWIFT Username Monitoring when you need to:
  • Meet SWIFT CSP CSCF controls for tracking access to SWIFT-related systems (specifically the controls around session monitoring and user accountability).
  • Provide auditors with a dedicated SWIFT access trail separate from general session logs - easier evidence handover during SWIFT CSP attestations.
  • Feed SWIFT login events into your SIEM alongside other security telemetry - for correlation with other indicators of compromise or insider risk.
  • Run unified UAM + SWIFT monitoring on the same Client without licensing a separate SWIFT-specific product.
Applies to: Windows Clients, macOS Clients. The feature is configured on the Monitoring [Windows/macOS] tab, indicating it’s available on both platforms.

​
Two-step enablement

SWIFT username monitoring requires both an Application Server-side feature flag and a per-Client checkbox.

​
1. Enable the feature on the Application Server

Enable SWIFT username monitoring in the Application Server .config file. See Enabling SWIFT username monitoring for the canonical procedure.
In SaaS only: Contact your Syteca vendor or the Syteca Support team to enable this feature in your environment - SaaS customers don’t have direct access to the Application Server .config file.

​
2. Enable per Client / Client group

Select the Enable SWIFT username monitoring checkbox on the Editing Client / Editing Client Group page, on the Monitoring [Windows/macOS] tab, in the Monitoring Parameters section at the top.

​
What gets logged

When both Step 1 and Step 2 are configured for a Client, the user name used to log in to the SWIFT network on that Client computer is written: The SWIFT username is captured in addition to all standard Syteca monitoring data - session recordings, clipboard data, application metadata. SWIFT capture doesn’t replace any other monitoring stream.

​
Compliance context

SWIFT CSP CSCF control 7.2 (Session Monitoring) and adjacent controls require institutions to monitor SWIFT operator activity. Syteca’s SWIFT username capture, combined with general session recording, contributes evidence toward these controls. Consult your SWIFT CSP attestation requirements and your auditor - Syteca’s documentation describes the technical capability, not the compliance interpretation.

SIEM integration

Forward SWIFT events into your SIEM alongside other security telemetry.

User activity recording

The full session recording that runs alongside SWIFT-specific capture.

Audit log

Administrative audit trail - what admins did in Syteca itself.

Application Server settings

Other .config file settings on the Application Server.