SWIFT assurance
framework:
How Crédit MutuelArkéa got ahead of
its assessment

Case study

Challenge
Like many financial services organizations around the world,
Crédit Mutuel Arkéa is a member of a cooperative known
as SWIFT, which is the secure way of transmitting financial
messages relating to securities, treasury and trade.
In 2020, SWIFT introduced additional mandatory andadvisory security controls. At the same time, its standards
were raised as they increasingly reflected Payment Card
Industry (PCI) Data Security Standard requirements.
Assessments based on the SWIFT assurance frameworkneeded to be completed by 2021.

“We decided to look at
the regulations as anopportunity to innovate andenhance the value we offer
to B2B partners and otherthird parties.”
Gildas Guillerm
Head of payments development andinterbanks relations

The process of auditing myriad security controls can beboth time- and labor-intensive, and the outbreak of theCOVID-19 pandemic only added to the workload that
Crédit Mutuel Arkéa would face.
“Regulation is getting stronger and stronger everywherein the world,” said Gildas Guillerm, the firm’s head ofdevelopment and relations department. “We decided tolook at the regulations as an opportunity to innovate andenhance the value we offer to B2B partners and otherthird parties.”

Solution
To validate that it had successfully aligned its
controls based on the SWIFT assurance framework,
Crédit Mutuel Arkéa turned to Verizon, which acted as anindependent auditor.
This included working closely with the Crédit MutuelArkéa team to analyze the scope, effectiveness andmaturity level of its controls based on the SWIFT
assurance framework. It also required collecting dataand conducting interviews.
The auditing process offered by Verizon as part of its
Payment Security Programs services enabled themto help organizations like Crédit Mutuel Arkea identify
security controls that aren’t fully documented, as wellas any potential vulnerabilities or key risk areas where it
might have to make improvements.

2Results“This kind of assessment is very strict. If you can validate
every point, you are compliant. If not, you’re not compliant,”
said Jacques Bodilis, Crédit Mutuel Arkéa’s head of the ITrisks and projects department within the operations andtechnologies division. “The result is 0% or 100%. It’s nota sure thing that a company succeeds. If they are foundnoncompliant, they have to start back at square one andundergo infrastructure upgrades.”Crédit Mutuel Arkéa not only avoided that fate but enjoyeda positive customer experience that included:

Adaptability amid
unexpected constraints
It’s important to have a close relationship with your auditor
and regularly meet to discuss the status of an assessment,
Bodilis said. However, the pandemic threatened to makethat far more difficult than usual.
“Normally, some of these status meetings are done face
to face. Naturally, this was impossible due to the pandemic
and all meetings took place virtually,” he said. “Thanks toVerizon, this all worked very well, and the assessment was
not delayed.”

A timely, six-month process

With its experience in providing similar audits for Crédit
Mutuel Arkéa around payment card industry (PCI) security
standards, however, Verizon was able to get the work donein less than six months.
“Verizon has made it possible to go faster, to help intransversality and to make internal discussions much
more fluid,” Guillerm said.

Knowledge transfer tobenefit the entire team“Verizon has helped us improve our security maturity levelby going in-depth during evidence collection and review,”
Bodilis said.
Verizon also helped educate a wide range of Crédit
Mutuel Arkéa stakeholders on the process, from seniorconsultants and project managers to those who were new
to the SWIFT assurance framework.
“The methodology applied by Verizon, based on anextensive collaboration, has been of value and brought ourteams up to speed on SWIFT CSP compliance,” he said.

Learn more:
How Verizon can help with independent
assessments of SWIFT compliance.

An independent assessment such as the one SWIFT
requires can take up to 6 months to complete. The amountof time is based on the breadth and depth of the audit, as
well as how data is stored and all the access requirements
involved.

3