This question examines the messaging capabilities of Alliance Lite2 under the Swift Customer Security Programme (CSP).

Step 1: Understand Alliance Lite2

Alliance Lite2 is a lightweight Swift solution designed for smaller financial institutions, providing access to Swift messaging services. Its capabilities are detailed in theSwift Alliance Lite2 User Guideand referenced in theCSCF v2024context.

Step 2: Analyze the Statement

The statement claims that Alliance Lite2 "only supports the sending and receiving of FIN messages." FIN messages are part of the FIN service for payment transactions, but Alliance Lite2’s scope extends beyond this.

Step 3: Evaluate Against Swift Guidelines

TheSwift Alliance Lite2 User Guidespecifies that Alliance Lite2 supports multiple message types, including:

FIN messages(e.g., MT103 for payments).

FileAct(for file transfers).

InterAct(for real-time messaging).

TheCSCF v2024does not restrict Alliance Lite2 to FIN messages; it applies security controls to all supported services. TheSwift CSP FAQconfirms that Alliance Lite2 users must comply with controls for all active services, not just FIN.

Thus, the statement that it "only supports" FIN messages is false, as it also supports FileAct and InterAct.

Step 4: Conclusion and Verification

The answer isB, as Alliance Lite2 supports more than just FIN messages, including FileAct and InterAct, per theSwift Alliance Lite2 User GuideandCSCF v2024.

References

Swift Alliance Lite2 User Guide, Section: Supported Services.

Swift Customer Security Controls Framework (CSCF) v2024, Control 1.1: Swift Environment Protection.

Swift CSP FAQ, Section: Alliance Lite2 Scope.

The "Outsourcing Agents - Security Requirements Baseline v2025" and "Independent Assessment Framework" address reliance on outsourcing agents’ assessments. Let’s evaluate each option:

•Option A: Yes, after confirmation and validation of the scope

This is correct. The SWIFT user can rely on the outsourcing agent’s independent assessment report if it covers the relevant CSP components and uses the latest CSCF version. However, the user’s assessor must confirm and validate the scope and findings to ensure alignment with the user’s attestation, as per the "Independent Assessment Process for Assessors Guidelines."

•Option B: Yes, only if the outsourcing agent is a global trusted provider and published the report on their compliance portal

This is incorrect. The CSP does not require the outsourcing agent to be a "global trusted provider" or publish the report publicly; validation by the user’s assessor is sufficient.

•Option C: No, an audit report (and not an assessment) is required from the outsourcing agent as an external provider

This is incorrect. An independent assessment report is acceptable, not necessarily an audit report, as long as it meets CSCF standards, per the "Outsourcing Agents - Security Requirements Baseline v2025."

•Option D: No, except if the cloud provider components are partially covered by the SWIFT Alliance Connect Virtual programme

This is incorrect. The Alliance Connect Virtual programme’s coverage is irrelevant; the key is the report’s validity and scope validation.

Summary of Correct Answer:

The report is sufficient after confirmation and validation of the scope (A).

References to SWIFT Customer Security Programme Documents:

•Outsourcing Agents - Security Requirements Baseline v2025: Allows reliance on agent assessments.

•Independent Assessment Process for Assessors Guidelines: Requires scope validation.

•Swift_CSP_Assessment_Report_Template: Supports integrated reporting.

========

The SWIFT CSP defines architecture types (A1 to A4) based on the components a user owns and manages, as outlined in the "CSP Architecture Type - Decision tree" and "Swift Customer Security Controls Framework v2025." These types determine the applicable security controls and assessment requirements. Let’s analyze the scenario and options:

•A customer connector is a component (e.g., a custom application or integration layer) that connects to SWIFT services, such as through the SWIFT API or a messaging interface. It handles data flows but is not a standard SWIFT-provided interface.

•A communication interface refers to a component like Alliance Gateway (SAG), which manages connectivity to the SWIFT network via SwiftNet Link (SNL) and VPN boxes.

•The architecture types are:

oA1: Full stack (owns messaging interface, communication interface, and network components, e.g., Alliance Access, Alliance Gateway, VPN boxes).

oA2: Owns a customer connector and communication interface, with the messaging interface hosted elsewhere (e.g., by a service bureau or SWIFT).

oA3: Owns only a customer connector, relying on external communication and messaging interfaces.

oA4: Uses a fully hosted solution (e.g., Alliance Cloud or Lite2), owning no local components.

•In this case, the user owns a customer connector and a communication interface but does not mention owning a messaging interface (e.g., Alliance Access). This matches the A2 architecture type, where the user manages a custom integration (connector) and the communication layer (e.g., SAG), while the messaging interface is provided by another party (e.g., a service bureau or SWIFT-hosted environment). The "CSP Architecture Type - Decision tree" confirms this classification, and the "Assessment template for Mandatory controls" applies A2-specific requirements.

•Option A: A1

This is incorrect. A1 requires ownership of a messaging interface (e.g., Alliance Access), which is not mentioned.

•Option B: A2

This is correct. A2 fits the scenario of owning a customer connector and communication interface without a messaging interface.

•Option C: A3

This is incorrect. A3 involves only a customer connector, not a communication interface.

•Option D: A4

This is incorrect. A4 applies to fully hosted solutions with no local ownership of connectors or interfaces.

Summary of Correct Answer:

The SWIFT user with a customer connector and a communication interface is of architecture type A2 (B).

References to SWIFT Customer Security Programme Documents:

•Swift Customer Security Controls Framework v2025: Defines architecture types A1-A4.

•CSP Architecture Type - Decision tree: Classifies A2 for customer connector and communication interface ownership.

•Assessment template for Mandatory controls: Applies to A2 architecture.