GENERAL PROVISIONS REGARDING AUTHORIZED SOCIETIES FOR OPERATING NOVEL MODELS REFERENCED IN THE LAW TO REGULATE FINANCIAL TECHNOLOGY INSTITUTIONS

Published in the Official Gazette of the Federation on March 19, 2019.

The National Banking and Securities Commission, based on the provisions of articles 82, fraction VI; 83, last paragraph, and 89, fraction IV of the Law to Regulate Financial Technology Institutions, as well as 4, fractions XXXVI and XXXVIII; 16, fraction I, and 19 of the Law of the National Banking and Securities Commission, and

CONSIDERING

That in accordance with article 78 of the General Law for Regulatory Improvement and with the purpose of reducing the compliance cost of these provisions, the National Banking and Securities Commission, through a resolution published in the Official Gazette of the Federation on January 23, 2018, reformed the General Provisions applicable to savings and credit entities for popular use, integration bodies, community financial societies, and rural financial integration bodies, referred to in the Savings and Popular Credit Law, in order to extend the deadline these entities have to adjust their accounting information systems so that they can comply with the Financial Information Standards mentioned in the SECOND Transitory Article, starting from January 1, 2020, instead of January 1, 2019;

That on March 9, 2018, the "Decree by which the Law to Regulate Financial Technology Institutions is issued and various provisions of the Credit Institutions Law, the Securities Market Law, the General Law of Organizations and Auxiliary Credit Activities, the Law for Transparency and Ordering of Financial Services, the Law to Regulate Credit Information Societies, the Law for Protection and Defense of Users of Financial Services, the Law to Regulate Financial Aggregations, the Law of the National Banking and Securities Commission, and the Federal Law for Prevention and Identification of Operations with Resources of Illicit Origin" was published in the Official Gazette of the Federation, with which the Law to Regulate Financial Technology Institutions was issued, in which it is specified that the National Banking and Securities Commission may determine the criteria and conditions for granting temporary authorization to societies that operate with novel models, as well as request the necessary information to be included in the report that said societies must prepare and present to the National Banking and Securities Commission, and

That the same legal framework empowers the National Banking and Securities Commission to keep a public record of said authorized societies, the dissemination of which will be carried out through the Commission's electronic page on the Internet, has resolved to issue the following:

GENERAL PROVISIONS REGARDING AUTHORIZED SOCIETIES FOR OPERATING NOVEL MODELS REFERENCED IN THE LAW TO REGULATE FINANCIAL TECHNOLOGY INSTITUTIONS

INDEX

Chapter One
General Provisions

Chapter Two
On Additional Information to Obtain Authorization

Chapter Three
On Additional Criteria and Conditions for Granting Authorization

Chapter Four
On the Register, Its Registrations, and Annotations

Chapter Five
On Periodic Reports of Activity Information

TRANSITORY

List of Annexes

ANNEX A Formats of protest letter for persons or trusts that intend to participate in the share capital of a society authorized to operate novel models.

ANNEX B Formats of protest letter for persons proposed to occupy positions in the administration and oversight bodies of a possible society authorized to operate a novel model.

---

Chapter One

General Provisions

Article 1.- For the purposes of these provisions, in addition to the definitions provided in the Law, the following shall be understood, in singular or plural:

I. Annotation, the registry act by which the CNBV records in the Register:
a) Any modification to Registration data. b) Extension of the temporary authorization to operate a Novel Model. c) Cancellation of the Registration.

II. Operational Contingency, any event that hinders, limits, or prevents an Authorized Society from providing its services or carrying out those processes that could affect its Clients.

III. Register Folio, the consecutive identification number of the Registration corresponding to each Authorized Society.

IV. Information Security Incident, that event which the Authorized Society evaluates, according to its management processes, that may:
a) Endanger the confidentiality, integrity, or availability of a component or the entire Technological Infrastructure used by an Authorized Society or of the information that said infrastructure processes, stores, or transmits. b) Represent a loss, extraction, alteration, or misplacement of information. c) Constitute a violation of information security policies and procedures. d) Represent the realization of a loss due to damage, interruption, alteration, or failures derived from the use of hardware, software, systems, applications, networks, and any other channel of information transmission in the provision of services, in interconnected Technological Infrastructures that allow interactions between people, processes, data, and components of information and telecommunications technologies, which are caused or derive, among others, in unauthorized access, misuse of information or systems, fraud, theft of information, or in interruption of services, which puts at risk the confidentiality, integrity, and availability of information. e) Compromise the systems or components of the Technological Infrastructure with an adverse effect on the Authorized Society, its clients, third parties, suppliers, or counterparties, commonly known as cyber-attacks.

V. Registration, the registry act carried out by the CNBV, through which publicity is given to the temporary authorization granted to the Authorized Society.

VI. Law, the Law to Regulate Financial Technology Institutions.

VII. Register, the public register of Authorized Societies to operate Novel Models referenced in the Law.

VIII. Authorized Society, the legal entity constituted in accordance with Mexican commercial legislation, distinct from Financial Technology Institutions, Financial Entities, and other subjects supervised by the CNBV, that enjoys the temporary authorization of the CNBV to operate Novel Models.

---

Chapter Two

On Additional Information to Obtain Authorization

Article 2.- Interested parties seeking authorization as an Authorized Society must submit their application, accompanied by both the information and documentation referred to in article 83 of the Law, as well as the following:

I. In applicable cases, testimony or certified copy of the public instrument in which the legal representation of the interested party is recorded, as well as a copy of the official identification of the legal representative, issued by a competent authority, valid on the date of its presentation, containing a photograph and signature.

II. Draft social statutes or their modification in which, in addition to what is provided in article 83, fraction I of the Law, the social object indicates that the activities intended to be carried out will be conducted under the protection of the temporary authorization referred to in article 80 of said Law. In the case of legal entities already constituted at the time of the application, they must additionally present a certified copy of the public instrument in which their constitution is recorded and, if applicable, their registration data in the Public Registry of Commerce, or, in the case of simplified joint-stock companies, the document containing their social statutes and their registration slip in the Public Registry of Commerce.

III. Indication of the address where the possible Authorized Society will have its principal place of business, including street, avenue, or route, exterior and interior number, neighborhood or urbanization, delegation, municipality, or similar political demarcation, postal code, city or population, and federal entity.

IV. Taxpayer Registry (RFC) with homoclave.

V. In applicable cases, trade name that will be used when offering services to the public.

VI. List of persons who directly or indirectly will have a participation in the share capital of the possible Authorized Society, indicating the percentage of participation in such share capital, according to the following table:

Legal Entities	Physical Persons	Trusts
Name or Company Name	%	First Name	Paternal Surname	Maternal Surname	%	Contract Number and Name of Trustee	%

Likewise, they must present the protest letters signed by the persons referred to in accordance with Annex A of these provisions.

If there is participation of legal entities or trusts, directly or indirectly, in the share capital of the possible Authorized Society, a copy of the public instrument or document in which the constitution of the legal entity and the registration data in the Public Registry of Commerce are recorded, or a copy of the respective trust agreement, must also be attached.

Additionally, they must provide the Taxpayer Registry (RFC) with homoclave, Unique Population Registry Key (CURP), and a copy of the official identification of the persons referred to in this fraction, issued by a competent authority, valid on the date of its presentation, containing the photograph and signature.

In the case of already constituted legal entities, the relationship referred to in this fraction must be signed by the secretary of the board of directors or the person competent to do so.

The information referred to in this fraction must be sent in an electronic file that allows it to be extracted for compilation.

VII. Organizational structure of the possible Authorized Society, according to the following table:

| Administration Bodies or Persons in Charge of Administration | Oversight Body | Others (specify) |

Additionally, they must provide the Taxpayer Registry (RFC) with homoclave, Unique Population Registry Key (CURP), and a copy of the official identification of the persons who will form part of the organizational structure of the possible Authorized Society, issued by a competent authority, valid on the date of its presentation, containing a photograph and signature, as well as their curriculum vitae and protest letter in accordance with Annex B of these provisions, signed by each of said persons.

VIII. Email address, telephone number, interfaces, computer applications, or any other means of electronic or digital communication through which their Clients can communicate, and, if applicable, the address of the Internet page containing the information through which the user public can know the product offered or the service provided, location of their establishments, and other related information.

IX. Regarding the description of the Novel Model referred to in article 83, fraction II of the Law, it must include, at least, the following information:

a) The reasons and, if applicable, evidence for why it considers the proposal to be a Novel Model in relation to those existing in the market.

b) The business model, including the products, services, operations, or activities it intends to carry out, target Clients, access channels, and specific use cases that comprise the Novel Model, detailing the processes for handling information and, if applicable, flows of resources, assets, or goods, as well as the interaction between the possible Authorized Society, its Clients, service providers, and any other third party. Likewise, in the event that the Novel Model implies the receipt, maintenance, or administration of resources, assets, or goods, it must indicate whether the possible Authorized Society will be responsible for safeguarding them or if the Financial Entity or person who will perform said custody will be responsible.

c) Description of the Technological Infrastructure that will be used in the operation of the Novel Model, as well as the facilities in which it will be housed, specifying the function that each component of the Technological Infrastructure will perform, as well as the way in which the set of its components will be integrated.

d) Evidence that the Novel Model is available to be put into operation immediately and the definition of each of the tests that will be carried out during the validity of the authorization, indicating the indicators and ranges that will be used for continuous review and evaluation of the development of the Novel Model.

e) The estimated period required for the operation of the Novel Model, as well as its implementation stages, including a calendar of start and end of each of them and a justification of why the duration is appropriate for the services to be provided.

X. Regarding the legal provisions regulating the reserved activity referred to in article 83, fraction IV of the Law, all and each of the provisions applicable to the financial entity or supervised subject, whose authorization, registration, or concession is sought to be obtained at the end of the validity of the authorization to operate a Novel Model, in accordance with what is stated in fraction XI of this article, that hinder the development of the products or services that would be offered through the Novel Model, must be specified, explaining the reasons why they are considered so.

XI. Regarding what is provided in article 83, fraction IX of the Law, it must specify the Financial Entity or supervised subject whose regime the possible Authorized Society would adopt at the end of the validity of the authorization, indicating the form, method, and deadlines by which they will fulfill the requirements to obtain the definitive authorization or registration within the period of validity of the temporary authorization to operate the Novel Model.

XII. Regarding the exit procedure referred to in article 83, fraction X of the Law, the following must be described, at least:

a) The form and means by which Clients will be notified that the Authorized Society did not obtain the definitive authorization or registration, or that the validity of the temporary authorization has concluded, as well as the procedures referred to in the following subsection b).

b) The procedures and deadlines for returning the resources, assets, or goods held by their Clients or for formalizing their delivery to a third party that is authorized by laws to receive them, as well as, if applicable, to compensate for damages and losses generated, as agreed in the contracts celebrated with them.

XIII. If applicable, the result of the risk assessment to which the Authorized Society will be exposed regarding being used by its Clients to carry out acts or operations that could update the assumptions provided in articles 139 Quáter or 400 Bis of the Federal Penal Code, in accordance with the general provisions issued by the Secretariat in terms of article 58 of the Law.

XIV. The statement indicating whether any standardized application programming interfaces referred to in article 76 of the Law and the general provisions emanating from said provision will be used in the operation of the Novel Model and, if applicable, explaining the way in which it will comply with said article.

XV. The information and documentation that accredits compliance with what is provided in article 3 of these provisions.

For the purposes of what is provided in this article, voter credentials issued by the National Electoral Institute or passports issued by the Ministry of Foreign Affairs will be considered valid official identification documents. Likewise, regarding physical persons of foreign nationality, documentation issued by the National Institute of Migration that accredits their status of stay in the country, or, in case they do not reside in Mexico, the passport issued by the competent authority of the country of origin, will be considered valid personal identification documents.

The proof of address indicated in accordance with fraction III of this article and, in the case of newly created societies, the Taxpayer Registry (RFC) of the Authorized Society, as well as the original or certified copy of the agreement or resolution of the administration body in which the presentation of the application to obtain the authorization referred to in this article is approved, may be submitted after the presentation of the authorization application.

Copies of payment receipts for domestic services such as electricity supply, telephony, natural gas, property tax, or water supply rights, among others, or copies of bank statements, all with an age not greater than three months from their date of issuance, or a copy of the proof of registration before the Taxpayer Registry, will be considered valid documents to prove the address.

---

Chapter Three

On Additional Criteria and Conditions for Granting Authorization

Article 3. In addition to the criteria and conditions referred to in article 82 of the Law, for the granting of authorization to operate as an Authorized Society, interested parties seeking authorization must demonstrate, among other aspects, the following:

I. Have the necessary human, material, and monetary resources to initiate and maintain the operation of the Novel Model during the period of validity of the temporary authorization.

II. That for the operation of the Novel Model, measures exist that mitigate the risks to which Clients will be exposed regarding the handling of their resources, assets, goods, and information that they provide to the Authorized Society.

III. Have sufficient means, insurance, guarantees, or other mechanisms to compensate their Clients for damages and losses that may be caused during the period of validity of the temporary authorization.

---

Chapter Four

On the Register, Its Registrations, and Annotations

Article 4.- The Register will contain the following:

I. Name or company name of the Authorized Society.

II. Date of constitution and, if applicable, number of public instrument and name of the public notary before whom the constitution of the Authorized Society is formalized, as well as registration data in the Public Registry of Commerce.

III. The information referred to in article 2, fractions III, IV, V, VI, first paragraph, VII, first paragraph, and VIII of these provisions.

IV. General description of the Novel Model, the totality of operations or activities it intends to carry out through this model, and the detail of each of them.

V. Target market or maximum number of Clients to whom the product or service in question will be offered, specifying, if applicable, the respective geographic location and the maximum amount of resources that can be received from each Client, as well as the maximum total amount that can be received during the validity of the temporary authorization.

VI. Validity of the temporary authorization granted and, if applicable, the extension.

VII. Any Annotation.

Article 5.- The CNBV will have a deadline of five business days, once it grants the temporary authorization to the Authorized Society to operate the Novel Model in question, to carry out the Registration in the Register, specifying the information referred to in article 4, fractions I to VI of these provisions.

Article 6.- Authorized Societies must notify the CNBV about the modifications they make to the information indicated in articles 2, fractions III, V, VI, VII, and VIII, and 4, fraction I of these provisions, within ten business days following the date on which they make them, presenting a copy of the documentation that accredits the change in Registration data or a certified copy in the case of public instruments.

Regarding the modifications referred to in fractions VI and VII of article 2 of these provisions, Authorized Societies must present the documentation referred to in said fractions.

Article 7.- Authorized Societies that require modifying the information and documentation other than that referred to in article 6 of these provisions, with the purpose of expanding, updating, or improving the scope of their Novel Model, will require prior authorization from the CNBV.

Article 8.- The CNBV must carry out the Annotations deriving from the modifications referred to in articles 6 and 7 above, as well as those relative to the extension of the temporary authorization, no later than five business days following the day in which the notice referred to in article 6 of these provisions was presented or the authorization or extension was granted, as applicable.

Article 9.- The Annotation relative to the cancellation of the Registration in the Register will take place in any of the following cases:

I. Revocation of the temporary authorization in terms of article 92 of the Law.

II. Conclusion of the validity of the temporary authorization.

III. Obtaining the definitive authorization, registration, or concession to carry out activities that require it in accordance with the Law or other financial laws.

The CNBV must carry out the Annotation for the causes indicated in this article, within five business days following their occurrence.

Article 10.- The Registry shall be maintained by assigning a Registration Folio to each Authorized Society, in which entries regarding Inscriptions and Annotations shall be recorded successively within the Registration Folio, in order to generate a complete chronological history of each Authorized Society, considering the precedence of the information that is modified. Regarding each entry, at least the year and month in which they are made must be included.

Fifth Chapter
Of the periodic reports of activity information

Article 11.- Authorized Societies shall prepare and deliver to the CNBV the report referred to in the first paragraph of Article 89 of the Law during the first fifteen natural days of January, April, July, and October of each year. Said report, in addition to what is stated in the cited article, shall contain the following:

I. If applicable, the number of operations, as well as the individual and total amount transacted, for each type of operation, at the close of the immediately preceding quarter.

II. A list of Operational Contingencies and Information Security Incidents that, if applicable, have occurred at the close of the immediately preceding quarter, which shall include the start date and time and their duration; the processes, systems, and channels affected; Clients and, if applicable, affected amounts; a description of the event that was recorded and the causes that motivated it; the indication of actions implemented to resolve them and those to prevent their recurrence.

III. The number of claims or clarifications that, if applicable, their Clients have filed at the close of the immediately preceding quarter, as well as the causes of these that have been most recurrent during said period.

IV. The report on the progress of actions taken to obtain definitive authorization or registration at the end of the temporary authorization.

V. The data and information that, according to the nature of the Novel Model, the CNBV indicates in the temporary authorization notice granted to the Authorized Society.

TRANSITORY
SINGLE.- These Provisions shall enter into force the day following their publication in the Official Gazette of the Federation.