Among other things Swift is a cooperative organization of financial institutions who agree to using the same standardized messaging system for financial transactions. As such they publicly promote the use of ISO 20022 as their primary standard for messaging between financial institutions. That said each member may implement this standard using a very wide variety of software on different platforms each of which can have it's own security vulnerabilities. The standard itself is a bit dated and probably could be improved but the bigger issue creating vulnerabilities for financial institutions is each entities implementation and choice of security controls.
The ISO 20022 standard is accessible for review but each vendor's implementation of it is probably not. As far as certification these components would most likely be certified for ISO 20022 compatibility if anything and not for security from an attackers perspective so probably not something meaningful from the standpoint of your question.
I think it would be wise for the organization to create a more rigorous set of security standards which members must adhere too, possibly similar but stronger than PCI-DSS, but I suspect there would be a lot of objections to this from member organizations that do not want the additional requirements. That said I think you are bringing up very valid points and I think it would be very wise for organizations using Swift to put pressure on their peers to help address the security needs. More importantly I think a lot of these member organizations are currently stuck using traditional security methods to fight much more high-tech adversaries. Now would be a great time for that organization to put a stronger emphasis on increasing the strength of its network to reduce future expenses related to breaches.
