Swift Policy for End Users of Enablers

Date: 01 July 2023  |  Confidentiality: Public

Introduction

Swift is active in the field of secure messaging services and offers various services and products supporting or complementary or ancillary to such messaging services.

The technology solution provider you have engaged supplies a technology solution to its customers (hereafter referred to as 'End Users') and has opted to integrate or embed certain Swift services or products with or in that solution offering.

Swift has developed a Programme (hereafter referred to as the 'Enabler Programme') whereby such technology solution providers can enable End Users that are also Swift customers to access certain Swift services or products via Swift APIs and, in addition, certain technology solution providers may have qualified to provide the Business Connect Solution to End Users that are Swift users so as to enable such End Users to connect to the Swift messaging network via Swift's Alliance Cloud service. The Enabler Programme is designed to provide easy and convenient access to such Swift services or products. End Users must be Swift customers (and must be qualified as Swift users in the case of the Business Connect Solution) in order to access Swift services or products as contemplated by the Enabler Programme and subscribe to such services or products with Swift. The Enabler Terms and Conditions can be found on swift.com.

Unless the context indicates otherwise, capitalized terms used in this document and not otherwise defined have the meanings assigned to them in the Enabler Terms and Conditions.

Purpose of This Document

This document sets out Swift's policy with respect to a Swift customer wishing to use certain Swift services or products via a technology solution provider (hereafter an "Enabler Partner"; referred to in the Enabler Terms and Conditions as a "Partner") that participates in the Enabler Programme. To that end, Swift customers will rely on the Enabler Partner when consuming Swift services or products in conjunction with the Enabler Partner's Partner Service.

This End User Policy forms an integral part of the contractual terms between Swift and its users and customers. It must be read along with any other specific terms and conditions relating to the provision of the Swift Services that you access via the Service Enablement of the Enabler Partner, as specified in the relevant Swift contractual documentation (typically a service description for the Swift Service, together with the Swift General Terms and Conditions, or a document setting out the terms and conditions for the Swift Service; the Swift API Gateway Service Description, Swift Software Development Kit Service Description and/or the Swift Microgateway Service Description will be relevant to the consumption of Swift Services via Swift APIs; for the Business Connect Solution, the Swift Alliance Cloud Service Description will be relevant).

Audience

This document is intended for the following audience:

• Swift customers wishing to understand the policy that governs the use of an Enabler Partner to access a Swift Service.
• Enabler Partners participating in the Enabler Programme.

This Policy will be available on swift.com and may be amended from time to time by Swift.

Swift-Defined Terms

In the context of Swift documentation, certain terms have a specific meaning. These terms are called Swift-defined terms (for example, customer, user, or Swift services and products). The definitions of Swift-defined terms appear in the Swift Glossary.

Related Documentation

• Partner Programme Terms and Conditions
• Enabler Terms and Conditions
• Swift General Terms and Conditions
• Swift Corporate Rules
• Swift By-laws
• Swift Personal Data Protection Policy
• Swift Software Development Kit Service Description (for End Users accessing Swift Services via Swift APIs)
• Swift Microgateway Service Description (for End Users accessing Swift Services via Swift APIs)
• Swift API Gateway Service Description (for End Users accessing Swift Services via Swift APIs)
• Swift Alliance Cloud Service Description (for End Users obtaining connectivity to the Swift network via the Business Connect Solution)
• The applicable Swift contractual documentation for the Swift Service being accessed
• Swift Customer Security Controls Framework
• Swift Customer Security Controls Policy
• Swift Customer Security Programme Terms and Conditions
• KYC-SA

The Enabler Programme

1.1 Overview

As mentioned above, the Enabler Programme is intended to allow Enabler Partners to pair Swift Services with Partner Services in order to enable End Users that are also Swift customers (Swift users in the case of the Business Connect Solution) to access these Swift Services through the Enabler Partner. As set out in the Enabler Terms and Conditions, Enabler Partners may do this by using a Business Application Model or an API Concentrator Model. The API Concentrator Model may involve Distribution Elements other than the Enabler Partner. End Users should understand from their Enabler Partner which model is being utilized and which, if any, Distribution Elements or distribution channels for the Swift Services may be relevant.

The Enabler Programme includes eligibility criteria as well as a Swift accreditation of the Partner Service into which the Swift Service will be embedded or integrated and the need for the Enabler Partner to comply with certain qualification criteria, including, in some cases, Swift operational and security requirements. Details concerning the eligibility criteria and the accreditation process, as well as Swift operational and security requirements, are referenced in the Enabler Terms and Conditions that can be found on swift.com or upon request to Swift.

1.2 General Principles

It is incumbent upon the End User to assure itself that it understands the model and any distribution channels or Distribution Elements being utilized by the Enabler Partner and that the Enabler Partner has instituted appropriate operational and security and service level terms and procedures to assure the smooth and proper functioning and provision of Swift Services being facilitated by the Enabler Partner via its Service Enablement.

The Enabler Partner is not entitled to use for its own purposes or benefit Swift Services that are the subject of its Service Enablement. Likewise, security features, including certificates of End User's identity, allocated to End Users, are not intended to be used by an Enabler Partner for its own benefit except when performing testing on an isolated test bed environment and with the End User's consent.

End Users understand that depending upon various circumstances, including, but not limited to, the Swift Service(s) being distributed to them via the Service Enablement of an Enabler Partner, as well as the functional/operational role of the Enabler Partner in distributing such Swift Service(s), an Enabler Partner may have access to confidential information and/or data of the End User or its customers or staff in connection with carrying out its role as Enabler Partner. It is the responsibility of End User to put in place appropriate controls and safeguards to address this issue.

The End User must be aware that granting any staff of the Enabler Partner an official Swift capacity on behalf of End User (such as "API Administrator" or "security officer") will confer a wide range of authority upon such Enabler Partner staff member to act in the name of End User. The decision to do so, and the imposition of appropriate controls with regard to the Enabler Partner, is the sole responsibility of the End User.

1.3 End User's Roles and Responsibilities

Responsibility when consuming Swift Services through an Enabler Partner

End Users that decide to use Swift Services via the Service Enablement of an Enabler Partner do so based upon their own assessment of that Enabler Partner and the distribution model used by such partner (Business Application Model or API Concentrator Model) and under their own responsibility. Swift disclaims any liability or responsibility whatsoever for the acts, faults, or omissions of the Enabler Partner or any aspect of such partner's Partner Service, Service Enablement or any aspect of a Distribution Element.

It is important to note that while Swift engages in a limited degree of compatibility and integration testing of the Enabler Partner's Partner Service with relevant Swift Services and Swift APIs, it is ultimately the sole responsibility of the Enabler Partner to validate, test for and assure such compatibility initially and on an ongoing basis.

Swift disclaims any liability for any failure by an Enabler Partner to assure that (1) Swift Services and Swift APIs are interoperable and properly synced and compatible with the relevant Partner Service and (2) the model of distribution selected by the Enabler Partner (Business Application Model and/or API Concentrator Model) functions smoothly, properly and without corruption or impairment of Swift Services or Swift APIs. An End User must assure itself that any technical, functional, security or operational responsibilities being assumed by an Enabler Partner (or any third party or relevant Distribution Element) with regard to any Swift Services are being carried out in a manner that is prudent and consistent with all relevant Swift contractual documentation and being carried out in a manner that is secure and functionally and operationally sound.

Swift encourages and expects any End User considering using a Partner Service and an Enabler Partner as a distribution channel for Swift Services to undertake all due diligence that the End User believes is necessary or prudent.

An End User that leaves, or changes (or intends to leave or change) its Partner Service must promptly inform Swift with, to the extent possible, at least three months advance notice of its intention to do so. An End User no longer using (or allowed to use) a Partner Service must make any necessary arrangements with Swift to migrate any Swift Service paired with such Partner Service to another Enabler Partner or to a direct relationship with Swift.

Responsibility to adhere to Customer Security Programme

Swift customers must adhere to the Customer Security Programme. For the components that fall under the scope of the Enabler Partner, the relevant Security and Operational Requirements apply.

Removal of an Enabler Partner

Should Swift remove an Enabler Partner from its Enabler Programme, Swift will use commercially reasonable efforts to notify the impacted Swift customers at least three months in advance (or, in circumstances not permitting three months' notice, as much advance notice as possible) of the removal of their Enabler Partner from the Enabler Programme. Such a removal does not affect the End User's right to continue to use Swift Services. However, it will be necessary for the End User to migrate to an alternative distribution channel or method in order to continue to consume such Swift Services.

Removal of an End User by an Enabler Partner

End Users understand and agree that their Enabler Partner may terminate their appointment to provide Swift Services in conjunction with the Partner Service, by, to the extent possible, notifying the terminated End User and Swift at least three months in advance. End Users understand that they will have contracts with their Enabler Partner that are outside the responsibility and control of Swift and the terms of which are not known to Swift. End Users no longer allowed to use a Partner Service must make any necessary arrangements with Swift to migrate any Swift Service paired with such Partner Service to another Enabler Partner or to a direct relationship with Swift.

Other End User responsibilities

The Enabler Partner will in principle represent its End Users in dealing with Swift. However, Swift remains a direct contact towards its End Users for any matter related to Swift usership/membership and the Swift Services, including matters related to Swift's Customer Security Programme.

An End User must ensure that the scope of rights that it grants to its Enabler Partner in respect of Swift Services is aligned with applicable Swift contractual documentation. Also an End User must ensure that its Enabler Partner is bound by no less stringent obligations than those incumbent upon the End User under its contractual documentation with Swift.

An End User remains responsible to Swift for due performance and observance by its Enabler Partner of those of its obligations owed to Swift that the End User may delegate or sub-contract to the Enabler Partner. In particular, a failure by the Enabler Partner selected by its End User to comply with these obligations may result in the suspension or the termination of the End User's access to and use of the Swift Services via such Enabler Partner.

In particular, the End Users have the following responsibilities:

• Control how the Enabler Partner manages access to, and the use of, the Swift Services and, in particular, ensure that all security features allocated to the End User to secure its access and use of the Swift Services are securely operated and kept safe to prevent any unauthorised access to or use of the Swift Services.
• Ensure that the Enabler Partner maintains and documents an acceptable level of security procedures and standards with respect to data privacy, data segregation, confidentiality, integrity, and systems availability.
• Ensure that the Enabler Partner is bound by no less stringent obligations of confidentiality and use of information and data than those applicable to End User as a Swift customer in respect of information and data related to Swift Services; assure that any contractual requirements of the relevant Swift Service relating specifically to partners or third parties are observed by the Enabler Partner to the extent applicable.
• Ensure all necessary technical, operational and functional processes relevant to distribution or execution or Service Enablement of Swift Services are carried out by the Enabler Partner accordingly.
• Should End User participate in an API Concentrator Model, it will provide Swift and/or Enabler Partner with any relevant information about Distribution Elements that are under End User's control or responsibility, to the extent necessary to assure smooth distribution and functioning of Swift Services subscribed by End User.

Customer Security Controls Framework and Customer Security Controls Policy

While customers are responsible for protecting their own environments and access to Swift, Swift has published the Customer Security Controls Framework (CSCF) and the Swift Customer Security Controls Policy (CSCP) to support Swift customers in the fight against cyber fraud. The CSCF establishes a common set of mandatory and optional security controls designed to help customers to secure their local environments and to foster a more secure financial ecosystem. The CSCP describes the obligation for Swift customers to self-attest against the Swift security controls set out in the CSCF. End Users, like all Swift customers, are responsible for meeting their obligations under the CSCP and CSCF.

Confidential Information

End Users agree that Swift may share their confidential information with their Enabler Partner and that the Enabler Partner can also share such information with Swift, for the execution of their respective contractual obligations and for legitimate purposes, such as provisioning, support, security, operational, or reporting purposes or in order to market any Swift products or services that could meet the needs of the End Users.

1.4 Enabler Partner Requirements

All Enabler Partners willing to participate in the Swift Enabler Programme must fulfill the criteria and requirements set out in the Enabler Terms and Conditions, including, but not limited to, registration to, and compliance with the, the Swift Partner Programme and the Partner Programme Terms and Conditions and must have their Partner Service qualified, as contemplated by the Partner accreditation process set out in the Enabler Terms and Conditions. Failure by the Enabler Partner to comply with such criteria and requirements may result in its being terminated from the Enabler Programme and result in an End User having to make alternative arrangements for consumption of any Swift Services being consumed as contemplated by the Enabler Programme.

Service Level Agreement Implementation

The Enabler Partner must provide End Users with a service level agreement consistent with the Enabler Programme and the particular Swift Services being accessed by the End User via the Enabler Partner.

1.5 Centralised Billing

Swift may (but is not obligated to) allow Centralised Billing for some Swift Services and/or some Enabler Partners. Allowing Centralised Billing for one Swift Service made available through a particular Enabler Partner does not imply that any other Swift Services offered via such Enabler Partner will be permitted to use Centralised Billing.

To the extent that Swift agrees with an Enabler Partner to allow Centralised Billing, for those End Users of an Enabler Partner that has agreed with Swift that Enabler Partner will provide Centralised Billing whereby Enabler Partner will be invoiced, and make payment, for certain Swift services and products used by its End Users, the following paragraph applies:

For a predefined set of Swift products and services that will be offered by the Enabler Partner to its End Users and ordered by the Enabler Partner on behalf of its End Users, Swift will invoice the Enabler Partner, and the Enabler Partner will pay all fees and charges due for the use of these Swift services and products by the End Users. In such case, the Enabler Partner will act as an intermediary in the sense of article 28 of the EU VAT directive. If the Enabler Partner does not pay all such fees and charges in a timely manner, then Swift is entitled to suspend or terminate the provision of Swift services and products to the End Users concerned. In the event that Centralised Billing is terminated for any reason, Swift will invoice End Users directly for the fees and charges previously invoiced to the Enabler Partner in connection with such Centralised Billing.

1.6 For End Users Participating in the Business Connect Solution

In addition to the other terms of this End User Policy, End Users that obtain connectivity to Swift messaging services through an Enabler Partner via the Business Connect Solution agree to the following terms as they relate to the Business Connect Solution. As mentioned, the Business Connect Solution is provided by means of Swift's Alliance Cloud service and End Users will be subscribers to the Alliance Cloud Service per the terms and conditions of the Alliance Cloud Service Description and the Swift General Terms and Conditions.

For the Business Connect Solution, it is within the Enabler Partner's discretion to determine exactly what types and sets of messages the Enabler Partner will enable an End User to send or receive via its Partner Service. Under certain circumstances Swift might limit or restrict the range of message types or sets permitted to be sent via the Partner Service. It is important to note that while Swift engages in a limited degree of compatibility testing of the message sets that Enabler Partner will be permitted to allow via its Partner Service, it is ultimately the sole responsibility of the Enabler Partner to validate, test for and assure such compatibility initially and on an ongoing basis.

End Users that decide to connect to the Swift messaging network through an Enabler Partner do so under their own responsibility. Swift disclaims any liability for any failure by Enabler Partner to assure that message types and sets allowed to be sent or received via its Partner Service may be transmitted smoothly, properly and without corruption via any Partner Service. With respect to Swift's Alliance Cloud service, an End User must assure itself that any functional or operational responsibilities being assumed by Enabler Partner with respect to any such service are being carried out in a manner that is prudent, secure and consistent with all relevant Swift contractual documentation.

If an End User decides to use two or more Enabler Partners, it will have to order separate BICs to be associated with the respective Enabler Partners.

End Users have the following responsibilities:

• Control how the Enabler Partner manages access to, and the use of, the Swift messaging services and, in particular, ensure that all security features allocated to the End User to secure its access and use of the Swift messaging services are securely operated and kept safe to prevent any unauthorised access to or use of the Swift messaging services.
• Ensure that the Enabler Partner maintains and documents an acceptable level of security standards for message confidentiality, integrity, and systems availability.
• Ensure that the Enabler Partner is bound by no less stringent obligations of confidence than those applicable to End User as a Swift user in respect of information related to Swift services and products or, more generally, Swift operation.
• Select and use an Enabler Partner which has and maintains an accredited/qualified Partner Service at all times.
• Ensure all traffic that is intended to go to the Swift messaging services is processed by the Enabler Partner accordingly.

Responsibility to adhere to Customer Security Programme

Swift users must adhere to the Swift Customer Security Programme. A user connected to the Swift network via an Enabler Partner must attest compliance against all mandatory security controls as documented in the Customer Security Control Framework (CSCF) in effect at the time of publication of the attestation. End Users must attest for all in-scope components in their local environment according to their architecture type as described in the CSCF. For the components that fall under the scope of the Enabler Partner, the Provider Security Controls Framework applies. The compliance status of the Enabler Partner is visible in the Swift Business Connect Directory on swift.com and in the Know Your Customer Self-Attestation (KYC-SA) application.

Responsibility to secure the connection to an Enabler Partner

It is a joint responsibility of the End User and the Enabler Partner to secure the connection to an Enabler Partner. When connecting to an Enabler Partner, some PSCF controls may be more restrictive than the CSCF controls applicable to End User.

Removal of an Enabler Partner

In the exceptional case that Swift would remove an Enabler Partner from its Enabler Programme, Swift will use all commercially reasonable efforts to notify the impacted End Users at least three months in advance (or, in circumstances not permitting three months' notice, as much advance notice as possible) of the removal of its Enabler Partner from the Enabler Programme. Such a removal does not affect the End User's right to continue to use the Alliance Cloud service to send messages directly with Swift, i.e. without going through the Partner Service. It may be necessary for the End User to migrate certain Swift services and products to a direct subscription with Swift. In due time, the invoice for the Swift related fees will then be sent to the End User directly instead of the Enabler Partner.

An End User's responsibility for all messages sent and received

To avoid any doubt, End Users as identified on Swift through their own BIC remain fully responsible for all messages sent or received by them or operations performed under their BIC through an Enabler Partner. In particular, Swift users recognize that the delivery of a message or file to the Swift Alliance Cloud portal (or the equivalent in the case of any on-premises connectivity infrastructure) operated by an Enabler Partner is considered to be a delivery of that message to them.

Use of an Enabler Partner does not affect the responsibility of the End User for all messages emanating from the End User and identified by the BIC 8 of the End User.

End Users also acknowledge that the types or sets of Swift messages that can be sent through an Enabler Partner are limited and depend on the particular Partner Service they are using. The list of authorised Swift message types or sets for a Partner Service is made available to the End Users by Swift or the Enabler Partner upon request.

End Users have also the option to send messages via Alliance Cloud directly to Swift when not using the applicable Partner Service.

End Users acknowledge that should they send or receive any Swift messages, whether of a type authorized in connection with a particular Partner Service or otherwise, the Enabler Partner will have access to such messages, except to the extent Swift has agreed with End User to implement (and has implemented) customized set-ups and/or configurations with respect to the messages in question.