ISO 20022 investigations: how the new E&I messages change exception handling

An ISO 20022 investigations solution must do more than translate an MT message into XML. It must connect the investigation request, response, original payment, parties, status, ownership, and audit trail through a controlled workflow.

Swift's current Exceptions and Investigations roadmap uses camt.110 for an investigation request and camt.111 for the response. These messages are exchanged through Swift Case Management, also called Case Orchestrator, rather than bilaterally.[1]

The migration has two major milestones. In November 2026, institutions must be able to receive camt.110 with in-flow translation and an embedded MT 199. In November 2027, investigation requests and responses move to camt.110 and camt.111 through Case Management, while payment cancellations move to ISO 20022 messages through Stop and Recall.[1]

This guide reflects Swift public material accessed on 20 August 2026. Institutions should confirm the current roadmap, eligibility, usage guidelines, testing, and onboarding requirements before implementation.

What changes in ISO 20022 exceptions and investigations?

Legacy exception handling often relies on formatted MT messages, free-format MT 199 or MT 299 exchanges, manual queues, email, and local case references. Information can be incomplete, repeated, or disconnected from the original payment.

Swift says Case Management centrally orchestrates the new ISO 20022 investigation request and response messages and uses the unique end-to-end transaction reference, or UETR, together with smart routing and end-to-end tracking.[2]

The practical change is not only message syntax. It is a move toward a governed case process with:

• a structured request and response
• an end-to-end case reference
• routing through a shared orchestration service
• a visible case status
• linkage to the original payment
• consistent evidence and ownership

That can reduce ambiguity, but only if banks redesign their internal workflow. A well-formed camt.110 entering an unmanaged mailbox is not a modern investigations solution.

ISO 20022 is sometimes misspelled ISO 20222 in search queries. The standard and message family discussed here are ISO 20022.

Which camt messages are in scope?

Swift's public E&I FAQ lists these message groups.[1]

Exceptions and investigations

• camt.110: Investigation Request
• camt.111: Investigation Response

Swift states that camt.110 and camt.111 can only be exchanged through Case Management and cannot be exchanged bilaterally.[1]

Payment cancellations

• camt.056: Payment Cancellation Request
• camt.029: Payment Cancellation Response

Swift currently allows payment-cancellation messages to be exchanged bilaterally without Case Management, but says Stop and Recall becomes mandatory for all payment cancellations from November 2027.[1]

Notifications

Swift's FAQ also names:

• trck.003: Tracker Alert Notification
• trck.005: Tracker Investigation Status Notification

Do not treat every camt message as an investigation message. Payment cancellation, investigation, and notification flows have different purposes and controls.

The November 2026 milestone

Swift's current FAQ says that in November 2026 all institutions must be able to receive a camt.110 with in-flow translation, with an embedded MT 199 included in the message.[1]

This supports reachability while institutions migrate at different speeds. A Case Management participant can initiate the investigation through Case Orchestrator. A receiver that is not yet using the full Case Management workflow can process the embedded MT 199 through its legacy FIN channel.

The operational preparation is broader than opening an MX message:

1. Receive and validate the camt.110 envelope.
2. Identify and extract the embedded MT 199 where the legacy path is used.
3. Preserve the UETR, investigation reference, sender, receiver, timestamps, and source format.
4. Route the case to the correct operations queue.
5. Prevent duplicate cases when both new and legacy representations are visible.
6. Test the reply path and status visibility.
7. Reconcile the case with the original payment and downstream accounting state.

Swift's May 2026 update says early adopters can use camt.110 and camt.111 before the mandatory end state, while other institutions can use the in-flow translation path during the transition.[2]

The November 2027 end state

Swift's FAQ states that by November 2027:[1]

• investigation requests and responses must use camt.110 and camt.111 through Case Management
• payment cancellations for all underlying transactions must use Stop and Recall and ISO 20022 camt.056 and camt.029
• all eligible financial institutions will be mass enabled for Case Management
• formatted MT messages used for payment cancellation and E&I will be removed

Swift's current FAQ also says free-format MT n99 messages remain available but should not be used for E&I purposes after the migration.[1]

Swift's May 2026 update says in-flow translation support ends in November 2027 and the community must use the ISO messages for both Case Orchestrator and Stop and Recall.[2]

These dates should be controlled as source-dependent configuration in a migration plan, not copied into hard-coded logic without an owner and review date.

Why message translation is not enough

A translator can convert fields. It cannot create missing operational meaning.

An investigation workflow still needs to answer:

• What happened to the original payment?
• Which party is requesting information?
• Which team owns the case now?
• What evidence is missing?
• Which response is permitted?
• Has the case breached a service-level target?
• Did another channel already resolve it?
• Can the response be released without exposing protected data?

If the institution stores a camt.110 as unstructured text, the richer message has not improved the process. Case data should be mapped to explicit fields, case states, ownership, timers, and reason codes.

A practical E&I workflow

receive camt.110
-> validate message and source
-> resolve UETR and original payment
-> create or match the internal case
-> classify request and required evidence
-> assign owner and timer
-> investigate across payment, screening, ledger, and correspondent data
-> prepare camt.111 response
-> apply approval and data-disclosure controls
-> send through Case Management
-> reconcile status and close with evidence

Payment cancellations should use a separate controlled workflow because a cancellation request can affect funds in flight and needs Stop and Recall semantics.

Controls for camt investigations

Case identity and deduplication

Use the end-to-end investigation reference, UETR, message identifiers, parties, and timestamps to detect duplicates. A retry must not create a second independent investigation.

Original-payment linkage

The case record should link to the exact payment version, its message history, status, route, and any prior repairs. Do not rely on a free-text payment reference alone.

Data minimization

An investigation response may include customer or transaction information. Apply purpose, role, and jurisdiction controls before exposing data to another party.

Structured reason and status mapping

Map internal case reasons and statuses to the applicable message rules. Preserve the original internal detail when the external code is broader.

Human approval

High-risk disclosures, sanctions-related cases, suspected fraud, and irreversible cancellation actions may require specialist or four-eyes approval. The message schema does not decide the approval policy.

Full traceability

Store the inbound message, parsed data, source channel, case assignment, evidence consulted, approvals, outbound response, and service acknowledgement. Hash or protect evidence according to policy without copying secrets into case notes.

Reconciliation

A sent response is not proof that the other party received or processed it. Reconcile service status, downstream updates, and case closure.

Internal systems that need change

An ISO 20022 E&I migration can touch:

• Swift gateway and messaging interfaces
• Case Management connectivity
• translation and message-validation services
• payment hub and archive
• investigations platform
• sanctions and fraud case systems
• customer-service workstations
• correspondent-banking operations
• data warehouse and reporting
• entitlements and approval controls

The site's ISO 20022 Address Parser illustrates the wider migration principle: converting data is not enough. Weak source information must remain reviewable rather than being forced into precise output.

The structured versus hybrid addresses guide covers another November 2026 data change that payment teams should coordinate with E&I readiness rather than manage as an isolated project.

Testing the migration

Test end-to-end scenarios, not only schema-valid examples:

• valid camt.110 for a known UETR
• unknown or malformed payment reference
• duplicate investigation request
• embedded MT 199 transition path
• early-adopter camt.111 response
• timeout and retry
• incorrect receiver or queue
• disclosure requiring approval
• case already resolved through another channel
• cancellation through camt.056 and camt.029
• cutover and rollback
• service outage and backlog recovery

Prove that the same case can be traced from the incoming Swift message to the internal investigation, response, service result, and final payment status.

Practitioner takeaway

The new E&I messages can improve investigation handling because they add structure, references, orchestration, and tracking. The benefit appears only when banks redesign case ownership, data mapping, approvals, and reconciliation around the message flow.

The post-coexistence ISO 20022 briefing provides additional migration context alongside the official Swift roadmap.

Prepare for November 2026 reception first. Then prove the full camt.110 and camt.111 operating model required for November 2027. Keep payment cancellations distinct and align them with the camt.056, camt.029, and Stop and Recall roadmap.

Sources

1. Swift, ISO 20022: Exceptions and Investigations FAQ, accessed 20 August 2026.
2. Swift, Transforming exceptions and investigations, published 7 May 2026, accessed 20 August 2026.
3. Swift, Case Management, accessed 20 August 2026.