Circular 1/2026: Security Controls Framework for SWIFT Customer-to-Customer Messages

Circular 1/2026 Date: 18 January 2026

To: All Banks and Financial Institutions Subject: Security Controls Framework (CSCF) for SWIFT Customer-to-Customer Messages

Reference is made to the Central Bank of Libya's Circular No. 1 dated 2005, regarding the security controls framework for SWIFT messages.

This circular updates the security controls framework applicable to SWIFT Customer-to-Customer (C2C) messages, specifically those utilizing the SWIFT Customer Security Controls Framework (CSCF), Registration Management Application (RMA), and Segregation of Duties (SoD).

The following security controls are mandated:

1. All SWIFT Customer-to-Customer messages must be authenticated and encrypted in accordance with the SWIFT CSCF standards.
2. Access to SWIFT systems must be restricted to authorized personnel only, with strict segregation of duties implemented.
3. Regular security audits and penetration testing must be conducted to identify and mitigate vulnerabilities.
4. Incident response plans must be established and tested regularly to ensure effective handling of security breaches.
5. All security incidents must be reported to the Central Bank of Libya within 24 hours of detection.
6. The Central Bank of Libya reserves the right to conduct on-site inspections to verify compliance with these security controls.
7. Non-compliance with these security controls may result in regulatory sanctions, including fines and suspension of SWIFT services.
8. This circular is effective immediately and applies to all banks and financial institutions operating in Libya.

For further information, please contact the Cybersecurity Department at the Central Bank of Libya.

Website: www.cbl.gov.ly SWIFT Code: CBLJLYLX Telephone: +218 21 444 1488 Fax: +218 21 333 3591

((2))

All banks and financial institutions are required to implement the above security controls within 30 days of the issuance of this circular.

The Central Bank of Libya will monitor compliance and may conduct periodic reviews to ensure adherence to these requirements.

Failure to comply with these security controls may result in regulatory action, including but not limited to fines, restrictions on SWIFT services, and revocation of banking licenses.

The Central Bank of Libya emphasizes the importance of maintaining robust security measures to protect the integrity and confidentiality of financial transactions.

All stakeholders are urged to cooperate fully with the Central Bank of Libya in implementing these security controls.

For any queries or clarifications, please contact the Cybersecurity Department at the Central Bank of Libya.

Website: www.cbl.gov.ly SWIFT Code: CBLJLYLX Telephone: +218 21 444 1488 Fax: +218 21 333 3591