Circular 1/2022 — Modifications to Circular 14/2017

Wednesday, March 23, 2022 OFFICIAL GAZETTE 1 BANK OF MEXICO CIRCULAR 1/2022, addressed to the participants of the Interbank Electronic Payment System and other interested parties in acting with such status, regarding the modifications to Circular 14/2017 (Expanded SPEI, indirect participation in SPEI, and miscellaneous topics).

A logo appears on the margin, which says: Bank of Mexico.

CIRCULAR 1/2022 TO THE PARTICIPANTS OF THE INTERBANK ELECTRONIC PAYMENT SYSTEM AND OTHER INTERESTED PARTIES IN ACTING WITH SUCH STATUS:

SUBJECT: MODIFICATIONS TO CIRCULAR 14/2017 (Expanded SPEI, Indirect Participation in SPEI, and Miscellaneous Topics)

The Bank of Mexico, with the purpose of continuing to promote the good functioning of payment systems, as well as promoting the healthy development of the financial system and the protection of the public's interests, with the commitment to continue providing the population with digital payment services in a secure and efficient environment for innovation, has resolved to modify the Rules of the Interbank Electronic Payment System (SPEI), in order to regulate the indirect participation of financial entities in said system, expand its processing capabilities, and implement measures in favor of SPEI user clients.

By regulating the indirect participation of financial entities in the SPEI, standardized and accessible criteria are established for the provision of such services by participants, in order for the clients of said financial entities to have the same protection measures and service levels as the clients of SPEI participants, promoting the protection of user clients' interests, preserving the adequate traceability of operations, and integrating these processes into the SPEI ecosystem.

The increase in SPEI processing capacity seeks to preserve operational continuity, as well as maintain the system's service and functioning standards, due to the sustained growth in the number of transfers processed in this infrastructure, for which a new SPEI instance has been implemented for transfer processing, whose operating rules are instrumented in this reform.

In the same way, new measures are established in favor of the system's user clients and its participants, in order to maintain an efficient operating scheme; continue the strengthening of operational continuity schemes; improve the experience of SPEI user clients and the electronic platform called “Digital Collection” (CoDi), including allowing the execution of operations for higher amounts during extended hours; the offering of new payment services, such as the sending of fund transfers identifying the beneficiary only with the ten digits of the account holder's mobile phone number, and the strengthening of remittance processing.

For the above, based on articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 2, fractions I, IV and VIII, and 6 of the Payment Systems Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, paragraphs fourth and eighth, 10, first paragraph, 14 Bis, first paragraph, in relation to 17, fraction I, and 20 Quáter, fraction IV, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Legal Directorate and the Directorate of Policy and Studies of Payment Systems and Market Infrastructures, respectively, as well as Second, fractions X and XVII, of the Agreement on the Assignment of Administrative Units of the Bank of Mexico, has resolved to modify rules 1a., second paragraph, 2a., first paragraph, the definitions “CLABE”, “Beneficiary Client”, “Collaboration Agreement for the Protection of Issuing Clients”, “Client Account”, “SPEI Account”, “Provisions”, “Manual”, “Collection Message”, “CoDi Transfer Order”, “Low Value Transfer Order”, “Participant”, “Numeric Reference” and “SPEI”, of 2a., 5a., 6a., first and second paragraphs, 7a., first paragraph and fractions II, III and VI, 7a. Bis., fractions I, II, III, IV, V, first paragraph, VI, VIII, second paragraph, and XI, 9a., first paragraph, 9a. Bis., fractions I, II, III, first paragraph and item a), IV, items a), b), c), first paragraph, d), e), and V, items a), c), numerals 2 and 3, e), g), i) and j), 10a., fractions I and II, 11a., fractions II and III, as well as the second paragraph, the denomination of 12a., as well as its fractions I, item a), and sub-items ii and iii, fraction II, items a) and b), and the last paragraph, 14a., fraction I, second paragraph, 15a., 16a., first and second paragraphs, as well as fractions I and II, 17a., first, third, fourth, fifth, seventh and eighth paragraphs, as well as fraction II, 18a., first and third paragraphs, 19a., first paragraph, fractions I, second, third and fourth paragraphs, II, second paragraph, IV, item b), and VI, first paragraph, 20a., first, second, third and fifth paragraphs, 21a., second paragraph, the denomination of Section IV, 23a., first paragraph and fractions II, IV, VIII and IX, 24a., first paragraph, 25a., fractions III, second paragraph, VI and VII, 25a. Bis., 27a., second, third and fourth paragraphs, as well as fractions I and II, 28a., 29a., 30a., first paragraph, 31a., second and fourth paragraphs, as well as fractions I and II, 35a., 37a., 39a., first and third paragraphs, 43a., first and second paragraphs, as well as fractions II, item a), VI, and VIII, 45a., first paragraph and fractions I, II, VI and VII, 46a., first, third, fourth, fifth, sixth, seventh and penultimate paragraphs, as well as fractions III, items a), b) and e), and VI, 46a. Bis., first and third paragraphs, 47a., second paragraph, 48a., second paragraph, the denomination of Chapter IV, 50a., 51a., 51a. Bis., 52a., fraction I, 53a., first and second paragraphs, 55a., first paragraph, 57a., first and second paragraphs, 58a., fractions I, literal A, items c), first paragraph, numerals 1, first paragraph and sub-items i, ii, iii, iv and v, 3, 4, 5 and 6, d), numerals 4 and 5, and e), numerals 4 and 5, II, item c), numeral 1, and III, items a) and b), and V, last paragraph, the denomination of Section II of Chapter VI, 59a., first and second paragraphs, as well as fraction I, 59a. Bis., first paragraph and fraction I, 60a., first and second paragraphs, 62a., first and second paragraphs, 66a., 69a., first paragraph, 70a., second paragraph, 71a., fractions I, items b) and c), II and IV, 72a., fractions I, I Bis, last paragraph, and II, 73a., first, second and third paragraphs, as well as fractions I and II, first and second paragraphs, 74a., first and third paragraphs, 75a., first paragraph, 77a., first paragraph, and fractions I, item g), and II, 78a., first paragraph, 82a., 83a., fraction I, items d), e) and i), 84a., fractions III, V and VI, 85a., first, second paragraphs and fraction IV, 86a., first paragraphs, and fractions II and III, and second, fraction I, 87a., 89a., 90a., first and fifth paragraphs, 92a., last paragraph, 93a., last paragraph, 95a., second paragraph, 98a., first and last paragraphs, the denomination of Chapter XIII, 100a., first and second paragraphs, and ANNEX I, as well as add, the definitions “Indirect Beneficiary Client”, “Indirect Issuing Client”, “Indirect Clients”, “Set of Transfer Orders”, “Consortium”, “Contract of Indirect Participation Services”, “Control”, “Indirect Client Account”, “Group of Persons”, “Business Group”, “SPEI Instance”, “Indirect Participant”, “Indirect Participation Service Provider”, “Remittance”, “Indirect Participation Services”, “Unit of Measure and Update”, to 2a., 5a. Bis., the fifth paragraph to 6a., the second, third and fifth paragraphs to fraction I of 7a. Bis., moving the current second paragraph to be the fourth paragraph of said fraction I, 7a. Ter., the third, fourth, fifth, sixth, seventh, fractions I and II, and eighth paragraphs to 9a., the second paragraph to fraction I, the second, third and fifth paragraphs to fraction II, moving the current second paragraph to be the fourth paragraph of said fraction II, fraction II Bis, the second paragraph to item a), items f) and g), and a last paragraph to fraction III, the second, third, fourth, fifth and sixth paragraphs to item a), the second paragraph to item b) and the second paragraph to item e) of fraction IV, item a Bis), numerals 1 and 2, the second paragraph to item d), the second paragraph to item e), the second paragraph to item f), the second and fourth paragraphs to item g), moving the current second paragraph to be the third paragraph of said item g), the second paragraph to item h), the second paragraph to item i), the second paragraph to item j) of fraction V, and the second, third, fourth, fifth and sixth paragraphs to 9a. Bis., Section I Bis 1 “Obligations corresponding to the provision of Indirect Participation Services” to Chapter III, 9a. Bis 1., 9a. Bis 2., 9a. Bis 3., 9a. Bis 4., 9a. Bis 5., 9a. Bis 6., 9a. Bis 7., 9a. Bis 8., 9a. Bis 9., Section I Bis 2 “Transfer instructions corresponding to the provision of Indirect Participation Services” to Chapter III, 9a. Bis 10., the second, third and fourth paragraphs to 10a., the third paragraph to 11a., item c) to fraction II and the last paragraph to 12a., 12a. Bis., fraction III to 14a., the second paragraph and fractions I and II to 15a., moving the current second paragraph to be the third paragraph of said 15a., the sixth paragraph to 16a., 16a. Bis., the sixth paragraph to 17a., moving the current sixth and seventh paragraphs to be the seventh and eighth paragraphs, respectively, of said 17a., the second, third, sixth and seventh paragraphs to 19a., fractions I and II and paragraphs sixth and eighth to 20a., moving the current sixth paragraph to be the seventh paragraph of said 20a., 20a. Bis., the second paragraph to fraction VII of 25a., the second paragraph to 26a., the second paragraph to 27a., subsequently moving the current second, third and fourth paragraphs to be the third, fourth and fifth paragraphs, respectively, of said 27a., the fourth paragraph to 28a., the second, third and fourth paragraphs to 30a., the second paragraph to 31a., subsequently moving the current second, third and fourth paragraphs to be the third, fourth and fifth paragraphs, respectively, of said 31a., the second paragraph to 33a., the second and fourth paragraphs of 43a., subsequently moving the current second, third and fourth paragraphs to be the third, fifth and sixth paragraphs, respectively, of said 43a., fraction VIII and the second paragraph to 45a., the fourth, sixth, seventh and ninth paragraphs, as well as fractions I and II to the fifth paragraph of 46a., subsequently moving the current fourth, fifth, sixth, seventh, eighth and ninth paragraphs to be the fifth, eighth, tenth, eleventh, twelfth and thirteenth paragraphs, respectively, of said 46a., the third and last paragraphs to 46a. Bis., subsequently moving the current third and fourth paragraphs to be the fourth and fifth paragraphs of said 46a. Bis., 46a. Bis 1., the third paragraph to 47a., 49a. Bis., fraction IV to 50a., 50a. Bis., the third and fourth paragraphs to 53a., 57a. Bis., numeral 6 to item d) of literal A of fraction I of 58a., 58a. Bis., the third paragraph to 59a. Bis., subsequently moving the current third paragraph to be the fourth paragraph of said 59a. Bis., 59a. Bis 1., the second paragraph to fraction I and fractions I Ter, II Bis and V to 72a., the third paragraph to fraction I of 73a., the second paragraph to 74a., subsequently moving the current second, third, fourth and fifth paragraphs to be the third, fourth, fifth and sixth paragraphs, respectively, of said 74a., 75a. Bis., fractions III, IV, V, VI, VII, VIII, IX and X to 77a., fraction VII to 84a., fractions I Bis and III Bis to the first paragraph and the last paragraph, with its literals A and B, to 86a., the third paragraph to 88a., the second and third paragraphs to 89a., the last paragraph to 90a., the third, fourth and fifth paragraphs to 100a., moving the current third paragraph to be the sixth paragraph of said 100a., and 101a., to the “Rules of the Interbank Electronic Payment System”, contained in Circular 14/2017, to remain in the following terms:

RULES OF THE INTERBANK ELECTRONIC PAYMENT SYSTEM

“1a. Internal Rules.- ...

Participants must observe, at all times, in their operation in the SPEI, the technical requirements, protocols, procedures, forms, formats, terms, conditions, deadlines, schedules and other aspects and characteristics of the operations provided for in these internal SPEI rules.”

“2a. Definitions.- For the purposes of these Rules, without prejudice to the scope or definitions that any other regulation gives to the terms indicated below, the following shall be understood:

I. to VII. ...

VIII. CLABE: the unique identifier called “Basic Standardized Key”, which Participants and Indirect Participants must assign or assign, as the case may be, to each of the Client Accounts or Indirect Client Accounts, respectively, with the structure that, for this purpose, section 6 of the Manual establishes.

IX. ...

X. Beneficiary Client: the person holding the Client Account that has been opened in the corresponding Receiving Participant and is indicated in the respective Transfer Order that is directed to the latter or received by it, as the case may be, as that in which the final credit of the resources subject to said Transfer Order must be made. Likewise, the person holding the aforementioned Client Account who generates Collection Messages for the purpose that the Receiving Participant credits to said account the amounts of the CoDi Transfer Orders that it receives as a result of the processing of such Collection Messages, shall also be a Beneficiary Client.

X Bis. Indirect Beneficiary Client: the person holding the Indirect Client Account that has been opened in the corresponding Indirect Participant and is indicated in the respective Transfer Order that is directed to the latter or received by it, as the case may be, through the Participant with whom the relationship exists for this purpose in accordance with the Contract of Indirect Participation Services, as that account in which the credit of the resources subject to said Transfer Order must be made, as the final destination. Likewise, the person holding the aforementioned Indirect Client Account who generates Collection Messages, for the purpose that the Indirect Participant credits to said account the amounts of the CoDi Transfer Orders that it receives, in turn, from the Participant with whom it has celebrated the Contract of Indirect Participation Services, as a result of the processing of such Collection Messages by said Participant, shall also be an Indirect Beneficiary Client.

XI. ...

XI Bis. Indirect Issuing Client: the person holding the Indirect Client Account opened in the Indirect Participant with whom it has agreed to process, by virtue of the Indirect Participation Services that the latter has agreed with the Participant in question, its instructions to send fund transfers charged to said account. Likewise, the person holding the aforementioned Indirect Client Account who instructs the sending of fund transfers resulting from the acceptance of Collection Messages by said person, through the systems made available to the Indirect Participant by the Participant with whom it has celebrated the corresponding Contract of Indirect Participation Services, shall also be an Indirect Issuing Client.

XII. ...

XII Bis. Indirect Clients: the Indirect Issuing Clients and Indirect Beneficiary Clients, jointly or interchangeably.

XIII. to XVII. ...

XVII Bis. Set of Transfer Orders: the groupings of types of Transfer Orders specified in section 9 of the Manual.

XVII Ter. Consortium: the set of legal entities linked to each other by one or more natural persons who, forming a Group of Persons, have Control of the former.

XVIII. ...

XVIII Bis. Contract of Indirect Participation Services: the contract celebrated, in the name and on behalf of itself, between a Participant and a Client of this, in its capacity as Indirect Participant, for the provision of Indirect Participation Services.

XVIII Ter. Control: the capacity to impose, directly or indirectly, decisions in the general shareholders' meetings, partners' meetings or equivalent bodies, or to appoint or remove the majority of directors, managers or their equivalents of a legal entity; or to maintain the ownership of rights that allow, directly or indirectly, to exercise voting rights with respect to more than fifty percent of the share capital of the company, or to direct, directly or indirectly, the administration, strategy or main policies of the company, whether through the ownership of securities representing the share capital of legal entities or by any other legal act.

XIX. Collaboration Agreement for the Protection of Issuing Clients: the instrument by which Participants agree on collaboration measures to protect their Issuing Clients and, where applicable, the Indirect Issuing Clients of those Clients that have the status of Indirect Participants, against Transfer Orders Accepted by SPEI not instructed by said Issuing Clients or Indirect Issuing Clients, prepared in the terms provided for in 43a. of these Rules.

XX. ...

XXI. Client Account: the uniquely identified accounting record, for each demand deposit account or any other financial product specified in Appendix D of the Manual, that a Participant maintains for the respective holder to record the charges and credits of the amounts corresponding to the Transfer Orders that said Participant sends or receives in the name and on behalf of said holder, as Issuing Client or Beneficiary Client, respectively.

XXI Bis. Indirect Client Account: the uniquely identified accounting record for each demand deposit account or any other financial product specified in Appendix D of the Manual, that an Indirect Participant, in the terms and under the conditions of the Contract of Indirect Participation Services that it has celebrated with a Participant, maintains for the respective holder, to record the charges and credits of the amounts corresponding to the Transfer Orders that the Indirect Participant sends or receives, through said Participant, in the name and on behalf of said holder, as Indirect Issuing Client or Indirect Beneficiary Client, respectively.

XXII. SPEI Account: that called in national currency that the Administrator maintains for each Participant to operate in the SPEI on each business day, through the corresponding SPEI Instance in accordance with these Rules. The uniquely identified accounting records that Participants maintain for Indirect Participants shall not be considered as SPEI Accounts.

XXIII. to XXVI. ...

XXVII. Provisions: to the "Provisions applicable to the operations of credit institutions, multiple-object financial companies regulated that maintain equity links with credit institutions and the National Financial Development Institution for Agriculture, Rural, Forestry and Fisheries" contained in Circular 3/2012 of the Bank of Mexico, or those that, in their case, replace them.

XXVII Bis. Group of Persons: to the persons who have agreements, of any nature, to make decisions in the same sense. It is presumed, unless proven otherwise, that they constitute a Group of Persons: a) Persons who have kinship by blood, affinity or civil up to the fourth degree, spouses, the concubine and the concubine partner, and b) Companies that are part of the same Consortium or Business Group and the person or group of persons who have Control of said companies.

XXVII Ter. Business Group: to the set of legal entities organized under schemes of direct or indirect participation in share capital, in which the same company maintains Control of said legal entities, as well as to financial groups constituted in accordance with what is established in the Law to Regulate Financial Aggregations.

XXVIII. ...

XXVIII Bis. SPEI Instance: to that component of the Technological Infrastructure for the processing of Transfer Orders and sending of Settlement Notices, which is specified in section 9 of the Manual, so that Participants send the Transfer Orders corresponding to the Sets of Transfer Orders applicable in accordance with what is specified in section 9 of the Manual and in these Rules.

XXIX. ...

XXX. Manual: to the document named "SPEI Operation Manual", which the Administrator prepares and makes available to Participants, to describe in it the operational processes and the technical requirements and conditions that Participants need to observe to carry out the actions related to their operation in the SPEI, in the terms of the modifications that, in their case, the Administrator makes to said document.

XXX Bis. Charge Message: to that message that the Beneficiary Customer or, in its case, the Indirect Beneficiary Customer generates for delivery to the Issuer Customer or to the Indirect Issuer Customer in question, respectively, with the purpose that, once the referred Issuer Customer or Indirect Issuer Customer accepts what is indicated in said message through the procedure established for that purpose in accordance with these Rules, the respective CoDi Transfer Order is sent with the characteristics determined in accordance with the message itself or, the Participant in question directly credits the respective funds in the Account of the Customer of the Beneficiary Customer or the Indirect Participant directly credits the respective funds in the Account of the Indirect Customer of the Indirect Beneficiary Customer with the funds that the Participant itself had previously credited to the Indirect Participant.

XXXI. to XXXIII. ...

XXXIII Bis. CoDi Transfer Order: to that Transfer Order that the Participant in question sends on behalf of the Issuer Customer, or, in its case, of the Indirect Issuer Customer, as a result of the acceptance, by said Issuer Customer or Indirect Issuer Customer, of a Charge Message generated by the Beneficiary Customer or, in its case, by the Indirect Beneficiary Customer indicated in said Transfer Order, as provided in the Catalog of Payment Types corresponding to CoDi of the Manual that, for its realization, complies with the requirements established for that purpose in these Rules and the Manual.

6 OFFICIAL GAZETTE Wednesday, March 23, 2022

XXXIV. Low-Value Transfer Order: to the Transfer Order directed to a Participant that has the status of Credit Institution or that is sent or received by a Clearing House for Transfers Through Mobile Devices, for an amount of up to twenty-one thousand pesos.

XXXV. ...

XXXVI. Participant: to any of the interested parties referred to in these Rules, other than Indirect Participants, who comply with the requirements established in these to send and receive Transfer Orders.

...

XXXVII. ...

XXXVII Bis. Indirect Participant: to the Customer of a Participant who, under the protection of an Indirect Participation Service Contract that it has celebrated with said Participant, can process, through this, the sending and receiving of Transfer Orders in favor of Indirect Issuer Customers and Indirect Beneficiary Customers of said Customer in accordance with these Rules.

XXXVIII. to XXXIX. ...

XXXIX Bis. Indirect Participation Service Provider: to that person who provides some service to an Indirect Participant for the provision of Indirect Participation Services by the respective Participant, such as the provision of software programs or information and telecommunications technology infrastructure, among others.

XL. Numerical Reference: to the numerical data that the Issuer Customer of the Issuing Participant indicates in the Sending Request that it presents to this, or in its case, that the Indirect Issuer Customer of the Issuer Customer who acts as Indirect Participant indicates in the instruction that it presents to this and that will be included in the Sending Request that corresponds, with the purpose of identifying the respective Transfer Order.

XL Bis. Remesa: to the transmission of funds, as part of the service offered by entities dedicated to it, from Mexico to some entity abroad or from abroad to Mexico, that, in its sending by the originator who initiates said transmission or in its reception by the final beneficiary, involves a Transfer Order of the SPEI.

XLI. and XLII. ...

XLII Bis. Indirect Participation Services: to those services that a Participant agrees to provide to its Customer so that the latter acquires the status of Indirect Participant and that said Participant carries out: (a) the reception and processing of Transfer Orders and CoDi Transfer Orders directed to Indirect Beneficiary Customers, and (b), in its case, the sending and clearing of Transfer Orders generated at the request of said Customer by instruction of its Indirect Issuer Customers, as well as CoDi Transfer Orders generated as a result of the acceptance, by the respective Indirect Issuer Customers, of Charge Messages, in addition to the settlement, reconciliation and other services related to said orders. The services that the Bank of Mexico, in its capacity as Participant, provides to its Customers will not be included in this definition.

XLIII. to XLIV. ...

XLV. SPEI: to the payment system named "Interbank Electronic Payment System", composed of the SPEI Instances established in the Manual.

XLVI. ...

XLVII. Unit of Measure and Update: to that referred to in the Law to Determine the Value of the Unit of Measure and Update, calculated in accordance with said legislation.

..."

Wednesday, March 23, 2022 OFFICIAL GAZETTE 7

"5a. Types of Transfer Orders.- Participants may send, in the terms and under the conditions established in these Rules and in the Manual, the Transfer Orders that correspond to the types defined in section 8 of the Manual, through the corresponding SPEI Instances that have been assigned to them respectively in section 9 of the Manual, according to the Sets of Transfer Orders in which said types of Transfer Orders are grouped."

"5a. Bis. Connection to SPEI Instances.- Each Participant must process Transfer Orders through the SPEI Instance that is assigned in section 9 of the Manual, corresponding to the Set of Transfer Orders in which they have been grouped, in accordance with the following: I. That Participant that has the status of Credit Institution or electronic payment fund institution and that, in accordance with what is provided in the 15a. of these Rules, maintains, at least, three thousand deposit accounts for money at sight or electronic payment funds, as the case may be, as well as any other Participant that has voluntarily manifested to the Administrator, in accordance with Appendix G of the Manual, its decision to process Transfer Orders in all SPEI Instances, must connect to all SPEI Instances, in accordance with the Sets of Transfer Orders established in section 9 of the Manual, on each operating day of the SPEI. II. Participants who do not fall under the assumption provided in the previous paragraph must connect only to the SPEI Instance assigned in section 9 of the Manual, which corresponds to the Set of Transfer Orders that must be processed. Notwithstanding the foregoing, the Participants referred to in paragraph II of this Rule must be able to connect to any of the SPEI Instances at the moment the Administrator so determines and communicates it to the Participant, without prejudice to any other connection obligation that the Participant must comply with in case of contingency. Participants must have one or more SPEI Applications certified by the Administrator that guarantee the connection to the SPEI Instances to which they must connect in accordance with what is provided in this Rule."

"6a. Liquidity availability.- The balance that each Participant maintains in its SPEI Accounts will be used to settle, through the SPEI, the respective Transfer Orders that said Participant sends to the SPEI Instances that correspond in accordance with section 9 of the Manual and these Rules. The settlement of Transfer Orders sent by a Participant for amounts greater than the balance of its respective SPEI Account at the time of said settlement cannot be carried out, so that Participants cannot incur overdrafts in their respective SPEI Accounts. Each Participant may increase the balance of its SPEI Accounts other than the Alternative SPEI Account, through fund transfers that it makes from its account in the SIAC-BANXICO or from its account in the DALÍ, or through the credit of the amounts corresponding to Transfer Orders Accepted by SPEI that it receives through the corresponding SPEI Instance from other Participants. The operations referred to in this paragraph must be carried out in accordance with what is established in Chapter IV of these Rules and, in its case, in the Applicable Provisions. ... The Participant that provides Indirect Participation Services to a Customer must maintain a Customer Account to register in it the fund transfers of said Customer in its capacity as Indirect Participant, as well as another Customer Account in which it registers the fund transfers that correspond to the same Customer in its own name."

"7a. Operational process.- The operational process of transfers of amounts denominated in national currency between Customer Accounts through the SPEI will be carried out based on Transfer Orders of the third-party to third-party type, in accordance with Chapter III of these Rules and sections 4 and 5 of the Manual, in the following steps: I. ... II. The Issuing Participant carries out the verifications that correspond in accordance with the 13a. of these Rules and, based on them, determines whether it accepts the Sending Request, in which case, it processes said Sending Request in accordance with what is provided in these Rules. In this case, the Issuing Participant carries out the referred processing by sending the respective Transfer Order to the Administrator, through the SPEI Instance that corresponds, according to the Set of Transfer Orders to which said Transfer Order belongs as established in section 9 of the Manual. Otherwise, the Issuing Participant rejects the Sending Request and notifies the Issuer Customer of the fact and the cause; III. The Administrator, once it receives, in an automated manner in the SPEI, the Transfer Order from the Issuing Participant, carries out the corresponding validations and verifies the sufficiency of balance in the respective SPEI Account of said Participant that corresponds to the SPEI Instance in which the Transfer Order must be processed. In case that, through said validations and verification, it is verified that the conditions established for the processing of the Transfer Order are met, the Administrator will carry out its settlement through the automated processes of the SPEI. On the contrary, if in accordance with said validations and verification, the conditions mentioned are not met, the Administrator, in an automated manner in the SPEI, will reject the Transfer Order. Additionally, in those cases where the aforementioned settlement cannot be carried out, for the causes provided in the 17a. of these Rules, the Administrator will eliminate, in an automated manner through the SPEI, the respective Transfer Orders in accordance with what is provided in said Rule; IV. and V. ... VI. The Receiving Participant that accepts the Transfer Order Accepted by SPEI carries out the credit in the Account of the Customer corresponding to the Beneficiary Customer, sends the respective Credit Confirmation to the Administrator and notifies the Beneficiary Customer thereof through any of the means that they have agreed upon for those effects."

"7a. Bis. Operational process corresponding to CoDi Transfer Orders.- ... I. The holder of a Customer Account who wishes to generate Charge Messages to receive CoDi Transfer Orders in their favor in said account, as Beneficiary Customer, will enable with the Administrator the specific mobile device they wish to use for this purpose. This person will carry this out through some software program installed on that device, among those programs offered by the Administrator itself or, in its case, by the Receiving Participant or a third party, that have been previously enabled with the Administrator and comply with the requirements established for that purpose in Appendix AD of the Manual. For its part, the holder of an Indirect Customer Account who wishes to generate Charge Messages to receive in said account CoDi Transfer Orders in their favor, as Indirect Beneficiary Customer, will enable the specific mobile device they wish to use for this purpose in accordance with the above. The enabling of the device referred to in the two preceding paragraphs must be carried out only once, prior to the generation of the first of the Charge Messages. Additionally, the Participant that administers Customer Accounts referred to in this paragraph, as well as, in its case, the Participant that has agreed to provide Indirect Participation Services to an Indirect Participant, may enable with the Administrator, on behalf and on account of the holders of said accounts, as well as of the Indirect Customer Accounts, with their consent, the mobile devices and the software programs referred to, for the same effects, in accordance with the procedure established for that purpose in Appendix AD of the Manual. On the other hand, the holder of a Customer Account and, in its case, the holder of an Indirect Customer Account, who wish to generate Charge Messages for sending through the internet will register with the Administrator, through the software program offered by the latter or by a third party for such effects, said Customer Account and Indirect Customer Account, respectively, as well as the other data indicated in Appendix AD of the Manual, in accordance with the procedure established for that purpose in said Appendix. Likewise, the Indirect Participant that intends to offer its Indirect Customers the generation of Charge Messages through software programs developed and enabled without the intervention of the Participant that provides it with Indirect Participation Services, must observe what is stated in Chapter III Bis of the "General provisions applicable to credit institutions and other companies that professionally provide the service of fund transfers, as well as to the participants in the payment systems administered by the Bank of Mexico and to the other interested parties in acting with the status of participant in said systems", issued by the Bank of Mexico through Circular 13/2017, published in the Official Gazette of the Federation on July 4, 2017, as they may be modified subsequently, insofar as it corresponds to the third parties referred to in said provisions. II. Having done what is indicated in the previous paragraph, the Administrator, in attention to the request of the holder of a Customer Account or an Indirect Customer Account presented directly or through the corresponding Participant through any of the software programs previously referred to, will carry out the validation of the respective Customer Account or Indirect Customer Account, in accordance with the 51a. Bis. of these Rules. To carry out the validation of the aforementioned Customer Account or Indirect Customer Account, the Participant in question must previously send to the Administrator the funds referred to in the 51a. Bis. of these Rules. III. Once what is provided in the previous paragraphs has been carried out, the holder of a Customer Account or Indirect Customer Account who wishes to receive fund transfers in their favor, as Beneficiary Customer or Indirect Beneficiary Customer, will generate a Charge Message, through the respective software program installed on the mobile device indicated in the previous paragraph I or, in the case of Charge Messages for sending through the internet, through the software program that complies with the requirements established in Appendix AD of the Manual. The Charge Message generated by the holder of a Customer Account or an Indirect Customer Account in accordance with the above will be delivered to the Issuer Customer or, in its case, to the Indirect Issuer Customer, in accordance with the procedure established for that purpose in Appendix AD of the Manual, through any of the software programs that, for this purpose, have the certification of the Administrator and that have been installed on the mobile device of said Issuer Customer or Indirect Issuer Customer, with their consent. IV. For its part, the holder of a Customer Account who wishes to receive Charge Messages so that they can generate Sending Requests, as Issuer Customer, will enable with the Administrator the mobile device they specify for receiving said Charge Messages, as well as some of the software programs installed on said device provided, for such effects, by the Participant itself, such as those corresponding to mobile banking, or by a third party authorized by the same Participant, that comply with the requirements established for that purpose in Appendix AD of the Manual. Likewise, in case that the holder of an Indirect Customer Account wishes to receive Charge Messages so that they can generate, as Indirect Issuer Customer, instructions to their Indirect Participant so that this, in turn, generates the respective Sending Requests, said Indirect Issuer Customer will also enable with the Administrator the mobile device they specify for receiving said Charge Messages, as well as some of the software programs installed on said device through the electronic or computer means that the Indirect Participant offers to its Indirect Issuer Customers to provide the services related to transfers. Additionally, the Participant that administers Customer Accounts corresponding to Issuer Customers or the Participant that maintains Indirect Participants that administer Indirect Customer Accounts corresponding to Indirect Issuer Customers, with the consent of the Issuer Customers, or of those that Indirect Issuer Customers grant to said Indirect Participants, as appropriate, may enable with the Administrator, on behalf and on account of said customers, the mobile devices and the software programs referred to, for the same effects, in accordance with the procedure established for that purpose in Appendix AD of the Manual. V. The Issuer Customer or, in its case, the Indirect Issuer Customer, who receives the Charge Message in accordance with what is indicated in the previous paragraph, may carry out any of the following actions, through the referred software program installed on the mobile device indicated in the previous paragraph: a) to c) ... VI. In case that the Issuer Customer or, in its case, the Indirect Issuer Customer, accepts the Charge Message in accordance with the previous paragraph V, the corresponding Issuing Participant will allow them to issue the Sending Request or, in its case, the Issuer Customer in their capacity as Indirect Participant will allow them to issue the instruction to generate the Sending Request, which will allow sending the CoDi Transfer Order with the characteristics indicated in the referred Charge Message. For these effects, the Issuing Participant or the Issuer Customer in their capacity as Indirect Participant, as the case may be, will make the software program referred to in the mentioned paragraph V show the necessary data so that the Issuer Customer or, in its case, the Indirect Issuer Customer, accepts the generation of the respective Sending Request or the

10 OFFICIAL GAZETTE Wednesday, March 23, 2022 instruction to generate the Send Request, as appropriate, with the characteristics established for this purpose in Appendix AD of the Manual, as well as the applicable provisions to authenticate said operation by electronic means. VII. ... VIII. ... As an exception to what is indicated in said subsection III, in the event that the balance in the SPEI Account of the respective Issuing Participant corresponding to the SPEI Instance through which the respective CoDi Transfer Orders must be processed, in terms of section 9 of the Manual, is insufficient to cover the referred CoDi Transfer Order, or if the Receiving Participant is not connected to the SPEI Instance through which the CoDi Transfer Order must be processed, it shall be eliminated immediately after finishing the clearing cycles of the Transfer Orders in which the settlement has not been carried out, according to what is referred to in the 17th of these Rules. IX. and X. ... XI. In the event that the Receiving Participant accepts the referred Accepted Transfer Order by SPEI, it will follow the procedure provided for in subsection VI of the 7th or, in its case, the one provided for in subsection V of the 7th Ter. of these Rules and, additionally, it will send to the Administrator a processing notice regarding said acceptance, in accordance with what is specified in Appendix AD of the Manual.” “7th Ter. Operational process corresponding to Transfer Orders subject to Indirect Participation Services.- In addition to what is provided in the 7th of these Rules, the operational process to carry out fund transfers derived from Transfer Orders subject to Indirect Participation Services will be carried out in accordance with the following: I. Prior to the Send Request referred to in subsection I of the 7th of these Rules, the Indirect Issuing Customer delivers to the Issuing Customer who has the status of Indirect Participant, through the electronic or computerized means that said Indirect Participant has made available to it, an instruction for the sending of a fund transfer through the SPEI. II. Subsequently, the Issuing Customer who has the status of Indirect Participant delivers to the Issuing Participant, under the Indirect Participation Services Contract celebrated by these parties, a Send Request in the terms indicated by the Indirect Issuing Customer in the instruction referred to in the previous subsection, to credit the corresponding amount in the Customer's Account in national currency indicated in the instruction of the Indirect Issuing Customer and administered by another Participant, or in the respective Indirect Customer's Account in national currency administered by another Indirect Participant of another Participant. III. The Send Request referred to in the immediate previous subsection will be processed in accordance with the operational process described in subsection II of the 7th of these Rules. At this stage, prior to the Issuing Participant sending the respective Transfer Order to the Administrator, said Issuing Participant verifies and validates the name of the Indirect Issuing Customer based on the list of Indirect Customers that the Indirect Participant has provided to it, as stipulated in the Indirect Participation Services Contract. IV. Having done the above, the same operational process described in subsections III to V of the 7th of these Rules will be followed. V. In the event that the respective Transfer Order is directed to a Customer Account as the final recipient, the Receiving Participant that accepts the Accepted Transfer Order by SPEI will carry out what is provided for in subsection VI of the 7th of these Rules. VI. In the event that the respective Transfer Order is directed to an Indirect Customer Account, the Receiving Participant that accepts the respective Accepted Transfer Order by SPEI makes the credit to the Customer Account of the Indirect Participant referred to in the last paragraph of the 6th of these Rules and that, under the Indirect Participation Services Contract celebrated by these parties, has opened to send or receive fund transfers from said Indirect Participant, so that this, in turn, credits the amount referred to in said Transfer Order in the respective Indirect Customer's Account. Once the credit to the Indirect Customer's Account referred to in the previous paragraph has been made, the Indirect Participant that holds said Indirect Customer's Account sends to the Receiving Participant a notification confirming said credit and said Participant ensures that such notification contains the information indicated in Appendix D of the Manual. Said Receiving Participant, in turn, sends to the Administrator the corresponding Credit Confirmation that it generates in accordance with the referred notification and notifies the Indirect Participant thereof. Once the Indirect Participant receives the aforementioned notice, it in turn notifies its Indirect Beneficiary Customer about the credit of the funds to the Beneficiary Customer's Account through any of the means that have been agreed upon for these purposes. The operational process of the fund transfers subject to Indirect Participation Services referred to in this Rule must be carried out, from start to finish, within the same times and hours indicated in these Rules for the type of transfer sent as the object of said services.” “9th. Assignment of CLABE and registration of accounts associated with cellular phone numbers.- Participants must, in accordance with what is established for this purpose in section 6 of the Manual, assign at least one CLABE to each of the Customer Accounts that they keep open and that correspond to the financial products indicated in the catalog of said products included in Appendix D of the Manual. Participants must ensure that each CLABE is distinct for each Customer Account. ... Likewise, Participants must assign sets of CLABE to their Customers who have the status of Indirect Participants, as well as assign the digits that will identify in each of said CLABE each of the Indirect Participants, with the purpose that these, in turn, assign each of said CLABEs to the Accounts of the Indirect Customers that said Indirect Participants hold for their Indirect Customers. The sets of CLABE assigned in terms of the present paragraph must comply with the requirements established in section 6 of the Manual. Additionally, Participants must present to the Administrator the information referred to in Appendix AN of the Manual regarding the sets of CLABE that the respective Indirect Participants have assigned, in accordance with what is established in section 6 of the Manual. Participants must ensure that the Indirect Participants to whom they provide Indirect Participation Services for the sending of CoDi Transfer Orders use the CLABE identifiers that said Indirect Participants have assigned to their Indirect Customers only once. CLABEs can only be used as identifiers of Customer Accounts and cannot be used as identifiers of Customers or fund transfers carried out through the SPEI. Without prejudice to what is provided above — subject to the express consent of the respective Customers, which Participants must obtain in accordance with what is provided in the 9th Bis., subsection III, inciso a), second paragraph, of these Rules, as part of the requests that those present with the aim of carrying out the validation of their Customer Accounts for the processing of CoDi Transfer Orders in terms of said Rule — Participants must provide to the Administrator, in the formats and with the specifications established for this purpose in Appendix AR of the Manual and no later than within five minutes after the referred consent has been collected from the holder of the Customer's Account with the aim of integrating the database provided for in subsection I of Rule 12th Bis. of these Rules, the following data: I. The CLABEs that, on the one hand, have been assigned, as well as those modified and cancelled, in accordance with what is provided above in this Rule, to the Customer Accounts of the Participants themselves, as well as to the Indirect Customer Accounts of the Indirect Participants to whom the Participants provide Indirect Participation Services, and that, on the other hand, have become associated with the ten digits of mobile phone line numbers, as an identifier of said accounts with the purpose of receiving, through the credit to the referred accounts, electronic fund transfers executed through the payment systems in which the Participant in question is a party, including the SPEI, and II. The ten digits of the mobile phone line numbers referred to in the previous subsection I, including those that have been replaced or modified for the purposes of the association mentioned in said subsection, as well as the CLABEs referred to in subsection I above that correspond to said numbers. The Participant who has provided the Administrator with the information indicated in the previous subsections must provide the same with the information referred to in Appendix AR of the Manual regarding the revocation of consent by the respective Customers and the disassociation of mobile phone line numbers from Customer Accounts or from the Indirect Customer Accounts of the Indirect Participants to whom said Participant provides Indirect Participation Services, within five minutes after having received the revocation of consent or request for disassociation by

12 OFFICIAL GAZETTE Wednesday, March 23, 2022 part of the person holding the Customer's Account or, in its case, from when the Indirect Participant informs the Participant of the revocation of consent or disassociation requested by the person holding the Indirect Customer's Account, in accordance with what is provided in the third paragraph of inciso a) of subsection IV of the 9th Bis. of these Rules, in the formats and with the specifications established for this purpose in said Appendix AR.” “9th Bis. Obligations related to CoDi Transfer Orders.- ... I. The Participant that so decides may allow the persons holding the Customer Accounts opened in said Participant to generate Charge Messages, in order to receive the corresponding resources for the CoDi Transfer Orders issued in their favor, as Beneficiary Customers, in accordance with these Rules, through computer programs provided by this Participant or by a third party and installed, with the consent of said Customers, on the mobile devices that they choose and that comply with the requirements established for this purpose in Appendix AD of the Manual. Likewise, the Participant that provides Indirect Participation Services to any of its Customers may stipulate in the respective Indirect Participation Services Contract the faculty of said Customer, as an Indirect Participant, to allow the persons holding the Indirect Customer Accounts, opened in said Indirect Participant, to generate Charge Messages for the purposes and in the terms of the previous paragraph through the computer programs that the Indirect Participant chooses. II. In the event that the Participant has the status of a Credit Institution or an electronic payment fund institution that, in accordance with what is provided in the 15th of these Rules, maintains at least three thousand deposit accounts for money at sight or electronic payment funds, as appropriate, and allows its Issuing Customers to generate Send Requests through computer programs installed on mobile devices, it must allow all referred persons to generate Send Requests, which it must process in the terms of these Rules for the sending of CoDi Transfer Orders, as a result of the acceptance of said persons to the Charge Messages that they receive through computer programs that these latter install on their respective mobile devices. Likewise, in the event that the Participant provides Indirect Participation Services to any of its Customers, and this latter, in turn, is a Credit Institution or electronic payment fund institution that, in accordance with what is provided in the 15th of these Rules, maintains at least three thousand deposit accounts for money at sight or electronic payment funds, as appropriate, and allows its Indirect Issuing Customers to generate instructions for the issuance of Send Requests through computer programs installed on mobile devices, said Participant must stipulate, in the respective Indirect Participation Services Contract, the obligation of said Indirect Participant to allow all persons holding the Indirect Customer Accounts to generate instructions for the issuance of Send Requests, which must be processed in the terms of these Rules for the sending of CoDi Transfer Orders, as a result of the acceptance of said persons to the Charge Messages that they receive through computer programs that these latter install on their respective mobile devices. For the purposes of the two previous paragraphs, the Participant referred to there must certify, in accordance with the procedure established in Appendix O of the Manual, the computer programs that it makes available to the persons holding the Customer Accounts opened in said Participant, as well as those computer programs that the referred Indirect Participant makes available to the persons holding the Indirect Customer Accounts opened in said Indirect Participant, for the carrying out of those financial and payment operations, as well as the other acts related to these, such as those corresponding to mobile banking, that the Participant or the Indirect Participant agrees upon with its Customers or Indirect Customers, as appropriate, with the aim that said Customers and Indirect Customers can generate the Send Requests or the instructions for the issuance of the Send Requests, as appropriate, for the sending of the CoDi Transfer Orders corresponding to the Charge Messages that they receive in accordance with what is provided above. Any other Participant that does not fall under the circumstances of the first two paragraphs of this subsection may: a) allow its Customers to generate Send Requests, as a result of the acceptance of Charge Messages that they receive through the computer programs offered by the Participant itself or by a third party authorized by said Participant and that said Customers install on their respective mobile devices, and b) agree

Wednesday, March 23, 2022 OFFICIAL GAZETTE 13 in the Indirect Participation Services Contract that, in its case, it celebrates with the respective Indirect Participant, the faculty of the latter to allow its Indirect Customers to generate instructions for the issuance of Send Requests, as a result of the acceptance of Charge Messages that said Indirect Customers receive through the computer programs offered by the Participant itself or the Indirect Participant, and that said Indirect Customers install on their respective mobile devices. The Participant that falls under the respective circumstance of this paragraph must present to the Administrator its request to provide these services formulated in accordance with the Model established in Annex 1 of Appendix AE of the Manual and will be subject to the same obligations applicable to the Participant referred to in the first paragraph of this subsection II. Those Participants referred to in subsections I and II of this Rule must notify the Administrator in the event that they intend to provide Indirect Participation Services in relation to the sending or processing of CoDi Transfer Orders, in which case they must be subject to what is provided in these Rules and in the Manual. II Bis. The Participant that, on the one hand, allows its Customers to receive resources corresponding to CoDi Transfer Orders issued as a result of the Charge Messages generated by said Customers and, on the other hand, provides Indirect Participation Services, will be obliged to include, in the provision of said services, the receipt of CoDi Transfer Orders in favor of the Indirect Beneficiary Customers of the Indirect Participant to whom it provides the referred services. In this case, said Participant must stipulate, in the Indirect Participation Services Contract, that the Indirect Participant will be obliged to offer to its Indirect Customers, at least, the crediting in the respective Indirect Customer Accounts of the resources corresponding to the CoDi Transfer Orders, without prejudice to other related services that may be agreed upon. Additionally, in the event that a Participant, on the one hand, provides Indirect Participation Services to an Indirect Participant that maintains more than three thousand deposit accounts for money at sight or electronic payment funds and, on the other hand, allows its Customers to generate Send Requests as a result of the acceptance of Charge Messages through computer programs installed on the mobile devices of said Customers, said Participant must stipulate, in the Indirect Participation Services Contract, that the Indirect Participant will be obliged to offer to its Indirect Customers, the receipt of the CoDi Transfer Orders, without prejudice to other related services that may be agreed upon. III. The Participants referred to in subsections I, II and II Bis of this Rule must comply with the following obligations: a) Carry out the processing of the Charge Messages, as well as the CoDi Transfer Orders and, in its case, the electronic fund transfers between Customer Accounts opened in the same Participant or between Indirect Customer Accounts opened in the Indirect Participants to whom the same Participant provides Indirect Participation Services or between Customer Accounts opened in the Participant in question and Indirect Customer Accounts of Indirect Participants to whom that Participant provides Indirect Participation Services, in accordance with what is established for this purpose in these Rules, as well as maintain, with the technical characteristics established for this purpose in Appendix AD of the Manual, the computer programs that they make available to the holders of the respective Customer Accounts opened in said Participants, for the carrying out of those financial and payment operations, as well as other acts related to these, that they agree upon for this purpose, through which said holders can execute the actions corresponding to the Charge Messages that they receive. Likewise, those Participants that provide Indirect Participation Services must ensure that, under the respective Indirect Participation Services Contract, the Indirect Participants that intend to offer to their Indirect Customers the sending of CoDi Transfer Orders, maintain the computer programs with the same characteristics indicated in the previous paragraph, that said Indirect Participants make available to the persons holding the respective Indirect Customer Accounts opened in the respective Indirect Participants. b) to e) ...

f) Refrain from conditioning the receipt and sending of CoDi Transfer Orders on the contracting of any other value-added service that the Participant might offer to its Clients. For these purposes, the offering of internet electronic banking or the carrying out, via the internet, of acts related to the operations contracted by Participants or Indirect Participants, other than Credit Institutions, with their Clients or Indirect Clients, shall not be considered as a value-added service.

g) Maintain a record, in the format and timeframes indicated in Appendix AD of the Manual, of the actions specified in said Appendix that are carried out by Participants, their Clients and Indirect Participants, as well as Indirect Clients, regarding each of the Payment Messages and CoDi Transfer Orders that are issued.

Likewise, in the event that the Participant referred to in this subsection provides Indirect Participation Services that include the sending and receiving of CoDi Transfer Orders, it must ensure that the Indirect Participant to whom it provides such services complies with the same obligations set forth in this subsection for the Participant.

IV. ...

a) Allow the respective holders of Client Accounts opened with the same Participant to request the Administrator, through the computer program established with the characteristics indicated in Appendix AD of the Manual that is offered by the Participant itself or a third party to such holders for the generation of Payment Messages, to validate their Client Accounts for use in processing CoDi Transfer Orders derived from the Payment Messages they generate, without prejudice to the Participant's authority to directly request the Administrator to validate the Client Accounts on behalf of the respective holders, subject to the consent granted by the latter for this purpose.

As part of the Client Account validation requests indicated in the previous paragraph, the Participant in question must obtain the express consent, for the purposes indicated in this subsection, from the holders of the Client Accounts. The aforementioned consent shall have the sole purpose of allowing the Administrator to receive, preserve, and provide the information referred to in 12a. Bis., subsection I, of these Rules, regarding the Client Accounts in question, consisting of the identifiers of said accounts that any Issuing Participant may consult with the Administrator to process Transfer Orders derived from Sending Requests in which the respective Issuing Clients have indicated only the ten digits of mobile phone numbers.

The Participant referred to in the previous paragraph must obtain the consent indicated therein, as part of the Client Account validation requests indicated in the same paragraph, which are submitted by the holders of said accounts through the computer program offered by the Participant for generating Payment Messages. Regarding this, such consent must be obtained no later than at the moment the holders of the Client Accounts submit the aforementioned requests. Under no circumstances shall the validation of the aforementioned Client Accounts be conditioned on the holders of said accounts granting the indicated consent.

To obtain the aforementioned express consent, the Participant must inform the holders of the Client Accounts about the nature and scope of the information that the Administrator will provide to SPEI Participants in order to process the operations referred to in 12a. Bis. of these Rules.

Likewise, the Participant must allow the holders of the aforementioned Client Accounts to revoke, through the same computer program indicated, the consent they have granted in accordance with the foregoing.

In the event that the Participant provides Indirect Participation Services, it must stipulate, in the Indirect Participation Services Contract, the obligation of the Indirect Participant to allow the holders of Indirect Client Accounts opened with the Indirect Participant to carry out the actions mentioned above with the same characteristics and conditions and for the same purposes indicated previously, without prejudice to the Participant's authority to directly request the Administrator to validate the Indirect Client Accounts on behalf of the respective holders, subject to the consent granted by them for this purpose, through the Indirect Participant, as well as the obligation to provide the information indicated above.

Wednesday, March 23, 2022 OFFICIAL GAZETTE 15

b) Allow the aforementioned holders of Client Accounts to generate Payment Messages for amounts up to twenty-one thousand pesos per message or for those higher amounts that, in their case, said Participant decides to establish.

Likewise, in the event that the Participant offers Indirect Participation Services, it must stipulate, in the Indirect Participation Services Contract entered into for this purpose, the obligation of the respective Indirect Participant to allow the holders of Indirect Client Accounts to generate the Payment Messages with the same characteristics and subject to the same conditions provided above.

c) Allow the aforementioned holders of Client Accounts to include the following information in the Payment Messages generated by the Participant at the request of said holders through the computer programs referred to, with the characteristics established for this purpose in Appendix AD of the Manual and, in the event that the Participant offers Indirect Participation Services, it must stipulate, in the Indirect Participation Services Contract entered into for this purpose, the obligation of the respective Indirect Participant to allow the holders of Indirect Client Accounts to include the same type of information:

1. to 4. ...

d) Refrain from modifying the information provided by the holder of the Client Account or Indirect Client Account that has been included in the generated Payment Message, as well as, in their case, stipulate in the contract they enter into with the Client to whom they provide Indirect Participation Services, who in turn intends to offer their Indirect Clients the generation of Sending Requests for CoDi Transfer Orders, the obligation of said Indirect Participant to refrain from modifying the information that would have been included in the payment instruction sent by the Indirect Client.

e) Change the status of the Payment Message in question to expired when the holder of the Client Account or Indirect Client Account that generated it has specified a date and time until which said Payment Message can be accepted by the Issuing Client receiving it and such date and time has passed without such acceptance having occurred.

Likewise, in their case, the Participant must ensure that the Client to whom it provides Indirect Participation Services, who intends to offer their Indirect Clients the generation of instructions for the issuance of Sending Requests for CoDi Transfer Orders, changes the status of the Payment Message in question to expired, when the holder of the Client Account or Indirect Client Account that generated it has specified a date and time until which said Payment Message can be accepted by the Indirect Issuing Client receiving it and such date and time has passed without such acceptance having occurred.

V. ...

a) Allow the respective Issuing Clients to receive Payment Messages through computer programs on mobile devices enabled in accordance with these Rules, either without an amount or up to twenty-one thousand pesos per Payment Message, or for those higher amounts that, in their case, said Participant decides to establish.

a Bis) In the event that the Participant referred to in this subsection provides Indirect Participation Services, it must ensure, in accordance with the Indirect Participation Services Contract entered into for this purpose, that the Indirect Participant to whom it provides such services and who intends to offer their Indirect Clients the sending or receipt of funds corresponding to CoDi Transfer Orders complies with the following:

16 OFFICIAL GAZETTE Wednesday, March 23, 2022

1. Allow their Indirect Clients to receive Payment Messages through computer programs on mobile devices enabled in accordance with these Rules, either without an amount or up to twenty-one thousand pesos per Payment Message, or for those higher amounts that, in their case, said Participant decides to establish, and

2. Send to their Indirect Clients, when appropriate, the information of the Payment Messages, such as that indicated in subsection c) below.

b) ...

c) ...

1. ...

2. “Operation Folio”, as this term is defined in the Manual, corresponding to the Payment Message in question.

3. Name, denomination, or corporate name of the holder of the Client Account that generated the Payment Message and that will remain as the Beneficiary Client in the respective CoDi Transfer Order.

4. to 7. ...

d) ...

1. to 3. ...

...

In the event that the Participant referred to in this subsection provides Indirect Participation Services that include the sending and receiving of CoDi Transfer Orders, it must ensure that its Indirect Participants, through the computer programs made available to their respective Indirect Clients, allow the latter to instruct any of the actions referred to in this subsection d).

e) Once the Issuing Client has carried out any of the actions indicated in subsection d) immediately above, the Participant must, in accordance with the processes established for this purpose in Appendix AD of the Manual, on the one hand, send a processing notice to the Administrator regarding said action within the two seconds immediately following the moment that action was executed and, on the other hand, store the Payment Message in its systems with the specification of the corresponding statuses.

In their case, the Participant must ensure that the Client to whom it provides Indirect Participation Services, who intends to offer their Indirect Issuing Clients the generation of instructions for the issuance of Sending Requests for CoDi Transfer Orders, sends a processing notice to the Administrator regarding the action carried out by its Indirect Issuing Client of those indicated in the aforementioned subsection d) immediately above within the two seconds immediately following the moment that action was executed and, on the other hand, stores the Payment Message in its systems with the specification of the corresponding statuses.

f) ...

In the event that the Participant referred to in this subsection provides Indirect Participation Services that include the sending and receiving of CoDi Transfer Orders, it must ensure that the Indirect Participant to whom it provides such services allows its Indirect Clients to again carry out any of the actions indicated in items 1, 2, and 3 of subsection d) above, in the event that said Indirect Clients have accepted a Payment Message, but their authentication in the computer program to generate the Sending Request has not been carried out in accordance with the requirements established for this purpose.

g) Send a new CoDi Transfer Order with a new Tracking Key and inform the Issuing Client, in the event that the latter has accepted, on more than one occasion, a Payment Message when the Participant has allowed them to again carry out any of the actions indicated in items 1, 2, and 3 of subsection d) in the event that the Administrator, through the system used for the operation of the SPEI, has deleted the CoDi Transfer Order corresponding to the Sending Request generated due to the previous acceptance of the Payment Message, due to the disconnection of the SPEI of the Receiving Participant in the corresponding SPEI Instance or to the insufficiency of funds in the respective SPEI Account of the Issuing Participant.

In the event that the Participant referred to in this subsection provides Indirect Participation Services that include the sending and receiving of CoDi Transfer Orders, it must ensure that the Indirect Participant to whom it provides such services informs the respective Indirect Issuing Client that a new Transfer Order with a new Tracking Key has been sent, in the event that the latter has accepted, on more than one occasion, a Payment Message when they have been allowed to again carry out any of the actions indicated in items 1, 2, and 3 of subsection d) in the event that the Administrator, through the system used for the operation of the SPEI, has deleted the CoDi Transfer Order corresponding to the Sending Request generated due to the previous acceptance of the Payment Message, due to the disconnection of the SPEI of the Receiving Participant in the corresponding SPEI Instance or to the insufficiency of funds in the respective SPEI Account of the Issuing Participant.

In the cases referred to in this subsection, as well as in subsection f) above, the Participant must allow the Issuing Client to again carry out any of the actions indicated in items 1, 2, and 3 of subsection d) up to three times.

Likewise, in the event that the Participant referred to in this subsection provides Indirect Participation Services that include the sending and receiving of CoDi Transfer Orders, it must ensure that the Indirect Participant to whom it provides such services allows the respective Indirect Issuing Client to again carry out any of the actions referred to by the same number of occasions indicated above.

h) ...

Likewise, in the event that the Participant referred to in this subsection provides Indirect Participation Services that include the sending and receiving of CoDi Transfer Orders, it must ensure that the Indirect Participant to whom it provides such services allows its Indirect Clients, through the computer program made available to them, to report to the Indirect Participant itself the situation referred to in the previous paragraph, in order for the latter to notify the Participant for the purposes of the provisions in the aforementioned paragraph.

i) Allow its Issuing Client, in the event that it has received a Payment Message for an amount greater than previously agreed with the holder of the Client Account that generated said Payment Message, to report this situation through the computer program installed on its respective mobile device, without prejudice to the actions that said Issuing Client may carry out in accordance with the indication in subsection d) above. In this case, the Participant must send a notification to the Administrator regarding said report, in accordance with what is specified in Appendix AJ of the Manual.

Likewise, in the event that the Participant referred to in this subsection provides Indirect Participation Services that include the sending and receiving of CoDi Transfer Orders, it must ensure that the Indirect Participant allows its Indirect Clients, through the computer program made available to them, to report to the Indirect Participant itself the situation referred to in the previous paragraph, without prejudice to the actions that said Indirect Client may carry out in accordance with the indication in subsection d) above. In this case, the Indirect Participant must give notice to the Participant so that it carries out what is indicated in the previous paragraph.

j) Allow its Issuing Client to enable the computer program installed on its device as the default program for receiving Payment Messages that have been sent via the internet, for which they must adhere to what is established in Appendix AD and have evidence of the request that the Issuing Client had presented to them.

Likewise, in the event that the Participant referred to in this subsection provides Indirect Participation Services that include the sending and receiving of CoDi Transfer Orders, it must ensure that the Indirect Participant allows its ...

18 OFFICIAL GAZETTE Wednesday, March 23, 2022

Indirect Issuing Clients must enable the software program installed on their devices as the default program for receiving Charge Messages that have been sent via the internet, for which they must adhere to what is established in Appendix AD and have evidence of the request that the Indirect Issuing Client had presented.

In the event that a Participant or, as applicable, an Indirect Participant, offers to the holders of Client Accounts or Indirect Client Accounts opened with the Participant itself, or with the same Indirect Participant, the receipt of funds in said accounts derived from electronic funds transfers executed against other Client Accounts or Indirect Client Accounts opened with the same Participant or Indirect Participant, as well as with other Indirect Participants to whom the same Participant provides Indirect Participation Services, in accordance with instructions issued through equipment, means, systems or mobile devices, as a result of the acceptance of Charge Messages, these must be generated through computer programs that meet the requirements and specifications established for this purpose in Appendix AD of the Manual.

In the case referred to in the preceding paragraph, the Participant indicated therein must comply with the same requirements and limits established in fractions III, item a), and IV, items b), c), d) and e), of this Rule, as well as make the credit of the respective funds to the Client's Account corresponding to the respective Charge Message within four seconds after that in which the charge to the Client's Account or the Indirect Client's Account of the Client or Indirect Client accepting the Charge Message in question had been executed by the Participant or, as applicable, by the Indirect Participant, during the 24 hours of every day of the year. Likewise, in the event that the referred Participant provides Indirect Participation Services, it will be obliged to credit the amount of the funds transfer to the respective Client's Account corresponding to the Indirect Participant that such Participant carries, and, in turn, must ensure that said Indirect Participant credits the same amount to the Indirect Client's Account indicated in the transfer instruction.

Likewise, in the event that a Participant or an Indirect Participant under the respective Indirect Participation Service Contract, offers to its Clients or Indirect Clients, as the case may be, to generate instructions for sending funds transfers to Client Accounts or Indirect Client Accounts opened with the same Participant or with the same Indirect Participant or with other Indirect Participants to whom the same Participant provides Indirect Participation Services, the respective Participant must comply with the same requirements and limits established in fraction V of this Rule, to carry out the actions referred to therein, as well as send the instructions for the corresponding funds transfers, instead of generating and processing the Send Requests referred to therein or making the respective transfers, instead of sending the CoDi Transfer Orders provided for in the same fraction.

Additionally, the Participant referred to in the preceding paragraph must generate a processing notice, in accordance with the terms and characteristics specified in Appendix AD of the Manual, by which it confirms the credit of the amount indicated in the funds transfer derived from the acceptance of the Charge Message in question, which said Participant has made to the Client's Account corresponding to the Issuing Client of the Charge Message, as well as, as applicable, the credit to the Client's Account corresponding to the Indirect Issuing Client of the Charge Message that the Indirect Participant in question has made. In this regard, said Participant must send the referred notice to the Administrator, no later than six seconds after that in which the charge to the Issuing Client's Account or the Indirect Issuing Client's Account had been executed by the same Participant or, as applicable, by the Indirect Participant. In the event that the Participant or the Indirect Participant to whom the Participant provides Indirect Participation Services has not made the credit to the Client's Account or, as applicable, to the Indirect Client's Account corresponding to the respective Charge Message, within the four-second period indicated in the third paragraph of this Rule, it will be exempt from sending the processing notice referred to in this paragraph and must make the credit of the funds to the same Client's Account or Indirect Client's Account to which the charge had previously been made to process the transfer instructed as a result of the acceptance of the respective Charge Message. In this same case, the Participant or Indirect Participant must make the referred credit no later than eight seconds after that in which it had executed the charge in said account and send the associated processing notice no later than ten seconds after that in which it had executed the referred charge, in accordance with the specifications established in Appendix AD.

Regarding the Participant that allows or must allow the holders of Client Accounts or Indirect Client Accounts opened with said Participant or its Indirect Participant to generate Charge Messages, in order to receive the corresponding funds for the CoDi Transfer Orders issued in their favor, as Beneficiary Clients or Indirect Beneficiary Clients, in accordance with these Rules, in the event that the Client Accounts or Indirect Client Accounts corresponding to the Issuing Clients or Indirect Issuing Clients are opened with the same Participant or with its Indirect Participant, it must observe what is provided in the preceding paragraph.

"Section I Bis 1 Obligations corresponding to the provision of Indirect Participation Services"

"9a. Bis 1. Circumstances for the provision of Indirect Participation Services.- The Participant interested in providing Indirect Participation Services must previously obtain authorization from the Bank of Mexico to operate as a clearing house for indirect participation funds transfers, in accordance with the general provisions issued by the Bank of Mexico for this purpose, in order for said Participant to be able to carry out the corresponding actions for the processing of funds transfers between Indirect Clients of the Indirect Participants to whom it provides the referred Indirect Participation Services. Additionally, except for what is provided in 9a. Bis 2. of these Rules, the Participant interested in providing Indirect Participation Services may only provide them to its Clients that are regulated and supervised financial entities by a national financial authority and that are duly empowered and authorized to provide the services of sending or receiving funds transfers on a habitual and professional basis to their respective clients or users.

Participants and Indirect Participants, except those Participants that provide Indirect Participation Services to their respective Clients, must refrain from processing Transfer Orders and CoDi Transfer Orders of their Clients or Indirect Clients that derive from services that said Clients and Indirect Clients offer to third parties to carry out the receipt, in favor of said persons or the sending, at their own request, of funds derived from said Transfer Orders and CoDi Transfer Orders. The sending and receiving of Remittances will not be considered part of the aforementioned circumstance.

Likewise, Participants and Indirect Participants must refrain from offering or providing to the public services for sending and receiving funds transfers through SPEI using brands, notices or trade names that are not owned by the Participants or Indirect Participants with whom they have formalized the respective Indirect Participation Service Contracts."

"9a. Bis 2. Entities excluded from Indirect Participation Services.- Participants must refrain from providing Indirect Participation Services to financial entities that fall under the circumstances indicated below:

I. Entities that are Credit Institutions considered of systemic importance in terms of what is provided in the "General Provisions applicable to credit institutions", published in the Official Gazette of the Federation on December 2, 2005, as they may be modified by subsequent resolutions, as well as securities depository institutions, clearing houses and central counterparties for securities and derivatives.

II. Those that exceed the volume or amount limits of funds transfers or Indirect Client Accounts indicated in fractions I, II and III of 9a. Bis 9. of these Rules.

Participants may only provide the Indirect Participation Services corresponding to those operations or services that the respective Participant is authorized to offer to its Clients and to carry out on their behalf or for their account. Likewise, Participants that provide Indirect Participation Services may only offer other services related to those, such as reconciliation, clearing and settlement of funds transfers between their respective Indirect Participants with whom they have celebrated Indirect Participation Service Contracts. To this effect, Participants may provide the referred reconciliation, clearing and settlement services when their Clients that have the status of Indirect Participants have expressly requested them from the respective Participants, in which case said services will be subject to the conditions applicable to Indirect Participation Services, in accordance with these Rules and the Indirect Participation Service Contract that they formalize for such purposes."

"9a. Bis 3. Requirements for the provision of Indirect Participation Services.- The Participant interested in providing Indirect Participation Services must, at least ten Banking Business Days prior to that in which it begins the provision of said services to its Clients, present to the Administrator, through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, an express declaration signed by a representative with valid power to perform administrative acts, which states that the board of directors or equivalent body of the Participant is aware of its intention to provide Indirect Participation Services. Additionally, in the aforementioned declaration, the Participant must declare to the Administrator that it has the operational and technical capacity to provide said services, as well as to gather the files referred to in 9a. Bis 5., third paragraph, of these Rules.

In order for the interested Participant to state that it meets the operational and technical capacity to provide Indirect Participation Services, it must indicate to the Administrator, in the declaration referred to in the preceding paragraph, that it complies with the following:

I. That it has the operational capacity to: a) Implement all SPEI connection schemes in contingency; b) Maintain its connection with SPEI during applicable hours and with the availability indices established in Appendix AN of the Manual, and c) Process the operations subject to the Indirect Participation Services it intends to provide.

II. That it has the technical and operational capacity to: a) Have connections to SPEI and with its Client that allow it to handle the expected processing volume when providing Indirect Participation Services; b) Keep communications and the communication channel with its Client encrypted at all times; c) Monitor information coming from its Client and identify the alteration of said information carried out by third parties or by the Indirect Participant itself on the information coming from the Indirect Client; d) Maintain and verify compliance with vulnerability identification policies in the computing and telecommunications infrastructure, as well as the measurement and management of operational risks, which must be approved by the board of directors or equivalent body of the Participant, and e) Maintain adequate infrastructure to ensure the traceability of information during the operational process corresponding to funds transfers subject to Indirect Participation Services referred to in 7a. Ter. of these Rules.

The Administrator may, at any time, request information and make observations on the documentation presented and, as applicable, may order the respective Participant to suspend the total or partial provision of Indirect Participation Services, which the Participant must establish in the Indirect Participation Service Contracts it celebrates.

The Administrator will publish and maintain on its website a list of Participants offering Indirect Participation Services. Additionally, the Administrator may publish the list of entities acting as Indirect Participants, with the prior consent of these presented to the Administrator through the respective Participants providing them with Indirect Participation Services in terms of 98a. of these Rules. The lists referred to in this paragraph will not relate Participants with the Indirect Participants to whom they provide Indirect Participation Services."

"9a. Bis 4. Minimum content of Indirect Participation Service Contracts.- The Participant interested in providing Indirect Participation Services to a Client, in addition to complying with what is established in Rules 9a. Bis 1., 9a. Bis 2. and 9a. Bis 3. above and others applicable, must celebrate an Indirect Participation Service Contract with said Client, which must contain, at least, the following:

I. The services that, as applicable, the Indirect Participation Service Provider will provide to the Indirect Participant, as well as the guidelines and characteristics that the Indirect Participant must meet for connection to the systems through which the Indirect Participation Service is provided. In all cases, in the Indirect Participation Service Contracts celebrated by the Participant, it must stipulate that it will provide to the respective Indirect Participants the service of receiving Transfer Orders directed to the Indirect Beneficiary Clients of said Indirect Participants. Additionally, at the request of the Participant's Client, the latter may agree to provide it with services for sending and clearing Transfer Orders, receiving and sending CoDi Transfer Orders, clearing, compensation and reconciliation of Transfer Orders sent and received by other Indirect Participants of the same Participant, as well as other related services. The foregoing will be observed without prejudice to what is stated in 9a. Bis., fractions II and II Bis, of these Rules;

II. The rights, duties, obligations, restrictions and responsibilities of the Participant and Indirect Participant vis-à-vis each other and third parties, related to the provision of the Indirect Participation Service;

III. The activities that the Participant and Indirect Participant must carry out;

IV. The days and hours during which the Participant will provide the Indirect Participant with Indirect Participation Services, as well as service levels. In the event that the processing of Charge Messages and the reception of CoDi Transfer Orders are included among the Indirect Participation Services, the parties must establish in the Indirect Participation Service Contract the obligation of the Indirect Participant to provide its Indirect Clients with services related to the processing of CoDi Transfer Orders twenty-four hours a day, every day of the year. In cases where the parties have not stipulated the processing of Charge Messages and the reception of CoDi Transfer Orders among the Indirect Participation Services, the days and hours agreed in the Indirect Participation Service Contract for the provision of Transfer Order processing services to the Indirect Clients of the Indirect Participant must cover, at least, Banking Business Days from 06:00:00 to 17:30:00 hours;

V. The technical elements for the provision of the Indirect Participation Services subject to the referred contract, such as the details of the communication and connection characteristics between the Participant and its Client, in its capacity as Indirect Participant, as well as between the latter and its Indirect Clients. Such technical elements must comply with the minimum information security guidelines provided in Appendix AN of the Manual. Likewise, in the event that, in the Indirect Participation Service Contract, the parties agree on the provision of services for processing Charge Messages and sending transfers and crediting CoDi Transfer Orders, they must establish in the Indirect Participation Service Contract that the Indirect Participant will be obliged to maintain the necessary technical elements of the computer programs to process said operations;

VI. The manner in which the Indirect Participant will credit the Client Accounts under its administration with the funds subject to Transfer Orders processed under Indirect Participation Services, as well as, as applicable, the handling of balances outside service hours;

VII. The minimum number of operators that the Indirect Participant must have for the correct operation of Indirect Participation Services, which cannot be less than that number of operators that Participants must have in accordance with these Rules, the processes for the registration and deregistration of such operators, as well as the functions they will perform;

VIII. The minimum requirements that the Indirect Participant must meet in the operations it carries out with its Indirect Clients as part of Indirect Participation Services, in matters of: a) Computer security in its technological infrastructure and the electronic or computer means it uses to process the instructions of Indirect Clients referred to in fraction I of Rule 7a. Ter. above, which must comply with what is provided in fractions I and II of 58a. of these Rules; b) Operational risk management; c) Use and validation of the functioning of the Indirect Participant's applications that allow connection with the Participant;

22 OFFICIAL GAZETTE Wednesday, March 23, 2022 d) Protection requirements for Indirect Issuing Clients, which shall at least ensure that the processing of instructions for the sending of electronic fund transfers through the SPEI is fully automated and does not contemplate manual processes between the submission of said instructions and the submission of the Sending Requests that, in accordance with said instructions, the Indirect Participant sends to the Participant with whom it has formalized an Indirect Participation Service Contract, except in contingency cases, based on what is established in Appendix AN of the Manual; e) Additional risks, in accordance with what is provided in the 72nd of these Rules, in those scenarios that are applicable to them, and f) Interoperability between the systems of the Participant and the Indirect Participant, in terms of what is determined in accordance with the following subsection. IX. The connection schemes that the Participant and the Indirect Participant must allow so that said Participant complies, at all times, with what is established in the 19th of these Rules, regarding the crediting of resources from Transfer Orders Accepted by SPEI, or those agreed upon in terms of subsection V of this Rule. The connection schemes referred to in this subsection may be those determined by the Participant, such as those developed by said Participant and offered to the Indirect Participant, the protocols and applications established by the Participant, or those developed by Providers of Indirect Participation Services. At all times, the Participant must ensure that the minimum security requirements established in Appendix AN of the Manual are met; X. The actions that the Indirect Participant undertakes to ensure that the Participant providing it with Indirect Participation Services can comply with the Collaboration Agreements for the Protection of the Issuing Client that it has formalized, as well as the obligation to allow the submission of support requests by Indirect Clients and Indirect Participants in events where operations have not been carried out by said Indirect Clients and Indirect Participants. Likewise, in the event that the Participant requests resources from the Indirect Participant for the protection of Indirect Issuing Clients, said Participant must be obligated to keep them in liquid or easily realizable assets, as well as to return them to the respective Indirect Participant in the event of termination of the Indirect Participation Service Contract; XI. The obligation of the Indirect Participant to collect and validate the information referred to in the 9th Bis 6. of these Rules, prior to allowing the sending or receiving of Transfer Orders, regarding its Indirect Clients, as well as the description of the elements that the Indirect Participant will use to validate said information, as well as the declaration of the Indirect Participant that it has the capacity to comply with said obligations in terms of the 9th Bis 6. of these Rules. Likewise, the Participant must stipulate in the Indirect Participation Service Contract the obligation of the Indirect Participant to have schemes that allow it to comply with the regulations applicable to it in matters of prevention and identification of operations with resources of illicit origin and terrorist financing, as well as not opening Anonymous Indirect Client Accounts; XII. The obligation of the Indirect Participant to report to the Participant the identification information of the Indirect Clients that is necessary for said Participant to process the operations subject to the Indirect Participation Services, including the information necessary to generate the Crediting Confirmations. Likewise, the obligation of the Indirect Participant to establish, in the contracts it signs with the Indirect Clients related to the Indirect Participation Services, the express authorization of said Indirect Clients to share the identification information that, in terms of the 9th Bis 6. of these Rules, the Participant may require from the Indirect Participant so that it can process the operations related to said Indirect Clients, as well as to carry out prevention and identification measures for operations with resources of illicit origin and terrorist financing, subject, at all times, to the applicable regulations on the protection of the personal data of said Indirect Clients; XIII. The manner in which the Indirect Participant will address plans to remedy irregularities in its operation; XIV. The causes for early termination of the Indirect Participation Service Contract, regarding which, at least the following shall be contemplated: a) Except for what is stated in subsection b) below, the respective party that intends to terminate the Indirect Participation Service Contract early must notify the counterparty at least twenty Banking Business Days in advance of the date on which it intends for the termination of the referred contract to take effect; b) The Indirect Participant will be obligated to give immediate notice to the Participant that is part of the Indirect Participation Service Contract, in the event that said Indirect Participant is notified or becomes aware of the initiation of any sanction imposition procedure referred to in subsection II Bis of the 72nd of these Rules, or of any other judicial or administrative procedure of which the Indirect Participant is a subject, which could produce any risk or affectation to the SPEI. In such cases, it must be stipulated that the Participant may terminate the Indirect Participation Service Contract early from the day on which it is given notice or notified of the aforementioned in this subsection, and c) The Participant must suspend or terminate the Indirect Participation Service Contract early when the Administrator so notifies it, as a consequence of the occurrence of any of the causes referred to in the 9th Bis 8. and 9th Bis 9. of these Rules. The Participant must ensure that when its Indirect Participant receives the aforementioned early termination notice from the Participant in question, the Indirect Participant notifies all its Indirect Clients of said notice, as well as the date on which the respective Indirect Participation Service will end. The notification to the Indirect Clients must be made no later than the next Banking Business Day after receiving the aforementioned notification; XV. The information that the Participant must provide to the Indirect Participant or, in its case, to the Indirect Client, as a consequence of the operations subject to the Indirect Participation Services, as well as the methods and deadlines by which it will inform them of said information; XVI. The information that the Indirect Participant must provide periodically to the Participant with whom it has formalized an Indirect Participation Service Contract; XVII. The fees and commissions that the Participant will charge the Indirect Participant in relation to the Indirect Participation Services, which must be in accordance, in any case, with the scheme provided for in these Rules for Participants, including: a) The fees that the Participant will charge the Indirect Participant for the return of Transfer Orders Accepted by SPEI subject to the Indirect Participation Services, as well as those commissions that Indirect Participants will charge Indirect Clients for such returns of Transfer Orders Accepted by SPEI, when these derive from the instruction that the Indirect Client gives to the Indirect Participant. Participants must refrain from charging Indirect Participants fees established based on the amount of fund transfers that Indirect Clients send or receive as an object of the provision of Indirect Participation Services, as well as refrain from charging fees to said Indirect Participants for the crediting of the respective amounts to their accounts. Likewise, the prohibition of charging commissions by Indirect Participants to Indirect Clients must be established, in the same terms applicable to the fees that Participants may charge their Clients referred to in this paragraph, as well as the commitment of the Indirect Participant to respect said prohibition. Participants may not charge fees directly to Indirect Clients, but only to Indirect Participants with whom they have formalized an Indirect Participation Service Contract, and b) The amounts for compensation for delay, in its case, that the Participant must pay to the Indirect Participant or vice versa. XVIII. The limits to which, in its case, the operations deriving from the Indirect Participation Services are subject; XIX. The responsibilities of the parties in case of failures in the processing of operations in the SPEI or with it, whether due to reasons of failure in the Participant or the Indirect Participant. Likewise, payment schemes for compensation in case of delays in the processing of operations will be included, identifying the events that could generate said delays, of which the Participant will be responsible when they are caused by it. Without prejudice to the foregoing, the Indirect Participation Service Contract must establish that the Indirect Participant will attend to all responsibility related to the affectations to its Indirect Clients, without prejudice to the Participant's obligation to reimburse the Indirect Participant in cases where the responsibility towards the Indirect Client was caused by the Participant; XX. Conventional penalties for breaches, under clear and objective circumstances, to the obligations of the parties stipulated in the Indirect Participation Service Contract, as well as the imposition of correction plans for those cases in which one of the parties incurs in frequent breaches; XXI. The manner in which communications between the personnel of the Participant and the Indirect Participant will be carried out. The Participant will be obligated to refrain from establishing any type of communication with the Indirect Clients of the Indirect Participants to whom it provides Indirect Participation Services, unless the parties expressly agree otherwise. Likewise, the obligation of the Indirect Participant to have communication mechanisms with its Indirect Clients in relation to the operations subject to the Indirect Participation Services must be foreseen; XXII. The dispute resolution procedures and the consent of the parties to submit to Mexican legislation in the application of the Indirect Participation Service Contract, as well as to be subject to these Rules, insofar as they are applicable to them; XXIII. The schemes that Indirect Participants must follow in case of contingencies; XXIV. The obligation of the Indirect Participant to notify the Participant with whom it has formalized an Indirect Participation Service Contract, in the event that it identifies any threat within the connection with the respective Participant; XXV. The obligation of the Indirect Participant to pay the amounts referred to in the 86th of these Rules, for compensation for delay, when the Indirect Participant is in the scenarios provided for the Participant in the cited Rule; XXVI. The schemes for active verification of the compliance with the obligations of the Indirect Participant stipulated in the Indirect Participation Service Contract, which may consist of periodic compliance reports carried out by independent auditors, in which the degree of compliance is determined. Additionally, it must be provided in the Indirect Participation Service Contract that the detailed compliance reports generated by the Indirect Participant will only be delivered to the Participant providing it with Indirect Participation Services in the cases where they are requested by the Administrator to the Participant itself; XXVII. What is provided in Rule 7th Bis., subsection IV, and XXVIII. The other obligations necessary to comply with what is established in these Rules. Participants must verify the strict compliance, by their Indirect Participants, of the terms and conditions for the provision of Indirect Participation Services provided for in these Rules, the Manual, and the Indirect Participation Service Contract. Likewise, Participants must verify that the Indirect Participants to whom they provide Indirect Participation Services comply, at all times, with the same technical requirements, protocols, procedures, forms, formats, terms, conditions, deadlines, schedules, and other aspects and characteristics of the respective operations to which the Participant itself is subject in accordance with these Rules, including the restrictions and operational obligations that correspond, as well as to carry out with their Indirect Clients the same actions that Participants must carry out with their Clients in accordance with these Rules, and may not exempt them from doing so. What is stated in this paragraph must also be included in the Indirect Participation Service Contracts.” “9th Bis 5. Identification and validation of Indirect Participant information.- Without prejudice to what is provided in the 71st and 72nd of these Rules, Participants providing Indirect Participation Services must comply with the requirements provided below, prior to the start of operations subject to the Indirect Participation Services: I. Identify: a) The holders of the representative titles of the social capital of the Indirect Participants, and b) The persons or Groups of Persons that exercise Control over said Indirect Participants; II. Obtain a declaration from the persons referred to in subsection b) of the previous subsection, as well as from the officials of the first three levels of the Indirect Participant in question and from the other persons who are in charge of carrying out acts related to the operation of the Indirect Participant that is the object of the Indirect Participation Service Contract, by which they state whether they are subject to any legal limitation that prevents or restricts them from carrying out any act of commerce and, in the event that they are subject to said limitation, determine if this does not represent a risk for said operation, and III. Identify the business schemes of the Indirect Participant, as well as obtain their express declaration that, through the Indirect Participation Service, they will offer to their Indirect Clients, in their case, the carrying out of operations for the sending or receiving of Remittances. The requirements established in subsections I and II of this Rule will not be applicable in the event that the Indirect Participant proves to the Participant that the persons referred to in said subsections have obtained authorization, from the competent financial authority, for the acquisition of titles representative of their social capital, from the minimum percentages established in the applicable regulations, as well as that the elements indicated in said subsections have been previously verified by the competent financial authority. Participants must observe what is provided in this Rule regarding their Clients who act as Indirect Participants, without prejudice to the compliance they must give to those other obligations by virtue of the provisions to which they are subject in matters of prevention and detection of acts, omissions, or operations that could favor, provide help, aid, or cooperation, of any kind, that could be located in the scenarios of article 400 Bis of the Federal Penal Code or for the commission of the crimes provided in articles 139 or 148 Bis of the same Code, related to operations with resources of illicit origin or terrorist financing. Participants must integrate and update, no later than the last Banking Business Day of February of each year, the respective files of the Indirect Participants to whom they provide Indirect Participation Services, with the information referred to in this Rule, and maintain said files, at least, for a period of five years following the termination of the Indirect Participation Service Contract of the Client in question.” “9th Bis 6. Identification and validation of Indirect Client information.- Participants must verify that those Clients to whom it is intended to offer said Indirect Participation Services have mechanisms and policies for knowing their Indirect Clients, to obtain the following information: I. At least, the same identification data of the Indirect Clients that the general provisions referred to in article 115 of the Credit Institutions Law establish for the holders of level 2 demand deposit accounts opened by Credit Institutions. The Clients to whom the aforementioned Indirect Participation Services are provided must observe the foregoing, unless they must collect and conserve, regarding the persons who are their Indirect Clients, greater information or, in their case, additional documentation to that indicated above, in accordance with the provisions to which such Clients are subject in matters of prevention and detection of acts, omissions, or operations that could favor, provide help, aid, or cooperation of any kind, that could be located in the scenarios of article 400 Bis of the Federal Penal Code or for the commission of the crimes provided in articles 139 or 148 Bis of the same Code, related to operations with resources of illicit origin or terrorist financing.

26 OFFICIAL GAZETTE Wednesday, March 23, 2022

The Participant must stipulate, in the Indirect Participation Services Contract entered into with its Client, the obligation of the latter, in its capacity as Indirect Participant, to obtain the information and, where applicable, documentation from its Indirect Clients in accordance with the regulations to which said Participant is subject in matters of prevention and detection of acts, omissions, or operations that could favor, provide help, assistance, or cooperation of any kind, which could fall under the provisions of Article 400 Bis of the Federal Penal Code or for the commission of the crimes provided for in Articles 139 or 148 Bis of the same Code, relating to operations with funds of illicit origin or terrorist financing. In these cases, the information that Indirect Participants obtain from their Indirect Clients must not be less than that indicated in the first paragraph of this section. Likewise, the Indirect Participation Services Contract must establish, in all cases, the obligation of the Indirect Participant to apply the most stringent measures for the identification and verification of the identity of its Indirect Clients, in accordance with the risk level corresponding to the latter due to their own characteristics or the operations they enter into with the Indirect Participant, and

II. Contact information and respective domiciles of the Indirect Clients. Participants must verify the names or corporate names of the Indirect Sending Clients included in the Send Requests submitted by the respective Indirect Participants, as well as validate said names or corporate names against the list of Indirect Clients that the Indirect Participants have provided to them, in compliance with said obligation stipulated in the Indirect Participation Services Contract, as agreed in said instrument.

Participants must ensure that the Indirect Participants to whom they provide Indirect Participation Services incorporate the information contained in the preceding sections into the files of their Indirect Clients, in addition to ensuring that said Indirect Participants update the aforementioned files in periods not exceeding five years, and that they retain them for a period of at least five years following the termination of the contract that the Indirect Participants have entered into with the Indirect Clients for the operation of fund transfers.

Participants may only obtain, through the Indirect Participants to whom they provide Indirect Participation Services, the information necessary for the execution of the operations subject to the Indirect Participation Services Contracts, including the identification of their Indirect Clients, as well as when there is a request from a competent authority. In the event that additional information is required that is necessary for the processing of any operation, for fraud prevention, or for compliance with applicable regulations in matters of prevention and detection of acts, omissions, or operations that could favor, provide help, assistance, or cooperation of any kind that could fall under the provisions of Article 400 Bis of the Federal Penal Code or for the commission of the crimes provided for in Articles 139 or 148 Bis of the same Code, relating to operations with funds of illicit origin and terrorist financing, Participants may request from the aforementioned Indirect Participants additional information from the respective Indirect Client, in accordance with what is established for this purpose in the Indirect Participation Services Contract. Participants must establish internal mechanisms and policies that prevent the information obtained from Indirect Clients, through Indirect Participants, from being distributed to other internal areas of the Participant that do not intervene in the processing of the operations subject to Indirect Participation Services.

In order for Participants to verify the mechanisms and policies of their Indirect Participants indicated in the first paragraph of this Rule, said Indirect Participants must agree that the respective verification be carried out by the heads of the internal audit area of the Indirect Participants themselves, when they have one, or by an Independent External Auditor.”

“9a. Bis 7. Reports to the Administrator on Indirect Participation Services.- Participants must present to the Administrator, in accordance with what is provided in Rule 98a of these Rules, in addition to what is referred to in 9a. Bis 3., and taking into consideration what is stated in Appendix AN of the Manual, the following information, in the terms and deadlines indicated below:

I. Within five Banking Business Days following the celebration of the Indirect Participation Services Contract with the respective Indirect Participant:

Wednesday, March 23, 2022 OFFICIAL GAZETTE 27

a) The information of the Indirect Participant with whom the aforementioned Indirect Participation Services Contract has been celebrated, such as the corporate name or trade name, the commercial name or brand, and the Federal Taxpayer Registry key (RFC) with homoclave; b) The start date of the provision of Indirect Participation Services and the duration of the validity of the Indirect Participation Services Contract, which may be indefinite. The start date of the provision of the aforementioned services must be subsequent to the date on which the Participant presents to the Administrator the information referred to in this section, and c) The CLABE assigned by the Participant to the Client Account corresponding to each Indirect Participant for the provision of Indirect Participation Services, as well as the identification digits that the Participant assigns to that Indirect Participant, in addition to the additional CLABEs assigned for the operation of the Indirect Client Accounts referred to in the third paragraph of Rule 9a of these Rules.

Additionally, when Participants assign new identification digits to their Indirect Participants or the previously assigned digits cease to be used as part of the Indirect Participation Services of an Indirect Participant, Participants must inform the Administrator thereof, within five Banking Business Days following the day on which the aforementioned occurs;

II. In a document attached to the copy that the Participant, in accordance with Rule 73a, section I, of these Rules, must present to the Administrator, of the annual report submitted by the person responsible for regulatory compliance of SPEI in terms of said Rule, the description of those activities or facts detected by the Participant that contravene these Rules or what is established in the Indirect Participation Services Contract that is formalized, which, in turn, could result in damages in matters of violations to systems, personal data, or Client Accounts or Indirect Client Accounts.

Likewise, in the document referred to in the previous paragraph, the Participant must inform the Administrator of the causes of the aforementioned activities or facts and the measures taken by the Participant as a consequence of said activities or facts, in compliance with its obligation to verify the strict compliance with the terms and conditions for the provision of Indirect Participation Services provided for in these Rules, in the Manual, and in the respective Indirect Participation Services Contract;

III. No later than the last Banking Business Day of February, through a document signed by the person responsible for regulatory compliance of SPEI of the Participant offering the Indirect Participation Service, the final sanctions that, if any, the competent supervisory authorities had imposed on the Indirect Participant during the twelve-month period comprised between February of the previous calendar year and January of the corresponding calendar year;

IV. A notification sent to the Administrator in terms of what is provided in Rule 98a and within five Banking Business Days following the day on which the Indirect Participant reaches the limits indicated in sections I, II, and III of the following 9a. Bis 9.

For the purposes of the previous paragraph, the Participant must agree with the Indirect Participant, in the Indirect Participation Services Contract, the obligation of the latter to provide it, every month, with the information regarding the limits referred to in said paragraph;

V. No later than the last Banking Business Day of February, through a document signed by the person responsible for regulatory compliance of SPEI of the Participant offering the Indirect Participation Service, those information security breach incidents that had materialized in the connection between the Participant and the Indirect Participant, as well as the risks that said incidents could represent to SPEI, registered during the twelve-month period comprised between February of the previous calendar year and January of the corresponding calendar year;

VI. If applicable, the date on which the Indirect Participation Services Contract will terminate early, as well as the reasons why such early termination will take place, at least three Banking Business Days prior to the termination of the aforementioned contract taking effect;

VII. No later than the last Banking Business Day of February, through a document signed by the person responsible for regulatory compliance of SPEI of the Participant offering the Indirect Participation Service, an annual report, prepared in terms of what is stated in Appendix AN of the Manual and Rule 98a of these Rules, which contains, at least, the following aggregated information corresponding to the twelve-month period comprised between the first day of February of the previous calendar year and the last day of January of the corresponding calendar year, of the respective Indirect Participants with whom Indirect Participation Services Contracts have been celebrated:

a) The number of Indirect Participants to whom Indirect Participation Services have been provided, as well as the aggregated number of Indirect Clients of each of said Indirect Participants, during the referred period; b) The following information regarding Send Requests from Indirect Participants for settlement in SPEI:

i. Number of Send Requests sent by each Indirect Participant that have not been processed due to not meeting security elements, having been sent through incorrect infrastructure, or due to insufficient balance in the Client Account of the Indirect Participant destined for the operation of Indirect Participation Services, among other reasons, and

ii. Number of Send Requests allegedly fraudulent sent by the Indirect Participant or received by the Participant;

c) The following information regarding transfer instructions that Indirect Participants have received from their Indirect Clients for processing within the infrastructure of the Participant itself and between accounts opened in the same:

i. Number of transfer instructions returned, sent, or received by each Indirect Participant;

ii. Number of transfer instructions that have not been processed due to not meeting security elements, having been sent through incorrect infrastructure, or due to insufficient balance in the Client Account for the operation of Indirect Participation Services of the Indirect Participant, among other reasons, and

iii. Number of transfer instructions allegedly fraudulent sent by Indirect Clients or received by Indirect Participants.

d) The following information regarding the balances of Client Accounts for the operation of Indirect Participation Services:

i. Average balance and aggregated maximum balance of each Client Account of the Indirect Participant, and

ii. Average balance and aggregated maximum balance of the Indirect Client Accounts that, if any, they have in each Indirect Participant.

e) The following information regarding the number of Client Accounts of Indirect Participants:

i. Number of active Client Accounts of each Indirect Participant in the Participant;

ii. Number of inactive Client Accounts;

iii. Number of Client Accounts that have been blocked for sending or receiving fund transfers, and

iv. Number of unassigned CLABE identifiers.

Notwithstanding the obligation of the Participant to deliver to the Administrator, with the periodicities indicated, the information referred to in the preceding sections, said Participant must, in its capacity as provider of Indirect Participation Services, request every month from its Clients who have the status of Indirect Participants, the respective information, as well as keep it available to the Administrator, for cases where this requests it.”

“9a. Bis 8. Total or partial suspension of provision of Indirect Participation Services.- The Administrator may order the total or partial suspension of the Indirect Participation Services provided by a Participant, when the operations derived from the provision of said services do not comply with these Rules or the Manual.”

“9a. Bis 9. Termination of Indirect Participation Services.- The Participant must terminate early the Indirect Participation Services Contract with an Indirect Participant in case of

Wednesday, March 23, 2022 OFFICIAL GAZETTE 29

the latter, falling under any of the following circumstances and not presenting to the Administrator the admission request as a Participant referred to in Rule 57a of these Rules, within the following nine calendar months counted from the day on which the corresponding circumstance occurs, or not obtaining the authorization to act as a Participant within the three calendar months subsequent to the day on which said nine-month period concludes:

I. The Indirect Participant, at any time, has more than one hundred thousand Indirect Client Accounts corresponding to demand money deposits, electronic payment fund accounts, or any other financial products specified in Appendix D of the Manual, which have registered positive balances, at any time, or from which at least one fund transfer has been sent in the last twelve calendar months;

II. In a maximum period of twelve consecutive calendar months, sends or receives one million two hundred thousand or more fund transfers, or

III. In a maximum period of twelve consecutive calendar months, sends or receives fund transfers, through SPEI or any other system, including those between accounts opened in the same Indirect Participant, for an aggregated amount superior to the equivalent of three million six hundred thousand UDIS, calculated according to the value of said unit of account on the last natural day of the calendar month previous to the first month of the twelve-month period for which the calculation of said amount is made.

Regarding Indirect Participants who fall under any of the circumstances indicated in the preceding sections and who do not present to the Administrator the admission request as a Participant, Participants who provide them with Indirect Participation Services may only continue with the provision of said services when they limit the operation of the respective Indirect Participant to levels lower than those indicated in the aforementioned subsections.

The provisions of this Rule are exempted for those Clients to whom the Bank of Mexico, in its capacity as Participant, provides Indirect Participation Services.

What is provided in this Rule, as well as in 9a. Bis 8., must be expressly established in the Indirect Participation Services Contracts.”

“Section I Bis 2 Transfer Instructions corresponding to the provision of Indirect Participation Services”

“9a. Bis 10.- Transfer Instructions.- The Participant who, under the Indirect Participation Services Contract celebrated with its Indirect Participant, has allowed the latter to submit Send Requests derived from electronic fund transfer instructions presented to said Indirect Participant by its Indirect Clients, must ensure that said Send Requests include the corresponding information indicated for these purposes in section 8 of the Manual, as well as the Federal Taxpayer Registry keys (RFC) or the Unique Population Registry Keys (CURP) of the respective Indirect Sending Clients, and that they meet the following requirements:

I. They are issued in accordance with the transfer instruction forms that Indirect Participants make available to their Indirect Sending Clients, which contain the fields indicated below, and these have been duly filled out by the respective Indirect Sending Client, as a necessary condition to be able to process said instructions:

a) Any of the identification data of the Client Account corresponding to the Beneficiary Client or of the Indirect Client Account corresponding to the Indirect Beneficiary Client indicated in Rule 12a, section I, subsection a), sub-subsections i., ii., and iii., of these Rules, and which the Indirect Participant must allow the Indirect Sending Client to choose, in accordance with what is established in the account type catalog of section 9 of the Manual, and

b) The amount of the transfer subject to the respective instruction.

II. The Sending Client, in its capacity as Indirect Participant, must allow its Indirect Sending Clients to include, in the respective fields of the form of each instruction that it makes available to them, the following data that they decide to specify in relation to the instruction in question:

a) The Payment Concept, and

30 OFFICIAL GAZETTE Wednesday, March 23, 2022 b) The Numeric Reference. III. The processing must be completely automated and not contemplate manual processes between the submission of said instruction and the presentation of the Sender Client's Sending Requests, in its capacity as Indirect Participant, to the Participant, except in contingency cases; IV. For its processing, in the electronic media offered by the Sender Client, in its capacity as Indirect Participant, automatic validation elements regarding the identity of the Indirect Client must be established in which, at a minimum, two independent authentication factors are required and evidence is kept regarding the information of said factors. This is without prejudice to what is established in the Indirect Participation Services Contract that they may have celebrated, and V. The processing takes place entirely in times no greater than those provided in these Rules for Participants. The Issuing Participants must ensure that the Sender Client, in its capacity as an Indirect Participant, notifies the Indirect Sender Client of the status of the Sending Request referred to in the 13th of these Rules, in a time no greater than that established for the Participant to perform the notification to the Client referred to in the third paragraph of said Rule. In case the status of the Sending Request is accepted, the Issuing Participant must grant to the Sender Client, in its capacity as an Indirect Participant, the Tracking Key of the transfer derived from said Request, for subsequent delivery to the Indirect Sender Client. The Participants must provide the Settlement Notices of Accepted Transfer Orders via SPEI to the Indirect Participants regarding the operations carried out by them within the framework of the Indirect Participation Services Contract that they have formalized.” “10th. Sending Request.- ... I. For any amount, provided it does not exceed the balance of available resources in the respective Client Account to be charged. Without prejudice to the foregoing, Participants may establish maximum limits on the amounts of Sending Requests presented to them by their Clients on their own behalf or as part of the Indirect Participation Services provided by said Participants, provided that the Participants themselves have previously established a procedure so that Sender Clients can formulate Sending Requests for amounts higher than such limits; II. To send it to any of the Participants included in the list that the Administrator informs daily to all Participants at the start of SPEI operations, which they must make available to their Sender Clients. The list that Participants make available to their Sender Clients must exclude the identifiers corresponding to Alternative SPEI Accounts of the Participants, the identifiers of the Participants referred to in fraction IV of the 56th of these Rules, as well as those corresponding to the Administrator used for the receipt of deposits referred to in the 51st Bis. of these Rules; III. ... a) and b) ... In cases where a Participant detects that its Technological Infrastructure is not available to operate with the SPEI or the SPEI is not available for sending Transfer Orders, said Participant must refrain from accepting Sending Requests from its Sender Clients and must inform only the Sender Clients who present Sending Requests about that unavailability, during the period of said unavailability, through the means agreed upon for this purpose and by the same medium by which said Clients have presented or attempted to present the respective Sending Request. The Participant referred to in the preceding paragraph may offer Sender Clients the possibility of presenting Sending Requests with the object that they are scheduled so that they can be accepted and processed when the Participant's Technological Infrastructure is again available to operate with the SPEI. In this case, the Participant must allow said Sender Clients to cancel, before their processing, the scheduled Sending Requests in accordance with the above. Likewise, the Participant must make available to the Sender Client, within ten seconds after the latter has executed the aforementioned cancellation, the funds corresponding to the cancelled Sending Request, by any of the means agreed upon for the disposal of resources that are enabled. Wednesday, March 23, 2022 OFFICIAL GAZETTE 31 For the effects indicated in the two preceding paragraphs, the Participant must inform the referred Sender Clients about the unavailability of the Technological Infrastructure contemplated therein in accordance with what is established in fraction III of the 14th of these Rules.” “11th. Schedule for presenting Sending Requests.- ... I. ... II. Regarding Sending Requests formulated in the Participant's branches: during the schedule in which the Participant keeps its branches open; III. Regarding Sending Requests from Sender Clients of Participants that have the character of Credit Institution or are sent through Clearing Chambers for Transfers Through Mobile Devices, in both cases, corresponding to Low Value Transfer Orders formulated through Electronic Channels, including those corresponding to internet banking services: 24 hours every day of the year, and IV. ... The Participant that has the character of Credit Institution or electronic payment fund institution and that maintains less than three thousand deposit accounts for money or electronic payment funds of its Clients, as the case may be, will be exempt from the schedule established in the preceding paragraph and will only have to receive and process said Sending Requests on any Banking Business Day during the schedule from 06:00:00 to 17:30:00 hours. Without prejudice to the above, Participants may offer their Clients the possibility of presenting, at any time, Sending Requests with the object that they are scheduled to be accepted and processed at a later moment, as well as to cancel said Requests before their processing. In case of cancelling the operation, the Sender Client must be allowed to dispose of the funds within ten seconds following the cancellation, by any of the enabled means that allow the disposal of said resources.” “12th. Information that the Sending Request must contain.- ... I. ... a) Any of the following identification data of the Client Account corresponding to the Beneficiary Client or, if applicable, of the Indirect Client Account corresponding to the Indirect Beneficiary Client, which the Participant must allow them to choose in accordance with the catalog of account types established in section 9 of the Manual: i. ... ii. The digits of the debit, electronic payment fund, or credit card that, if applicable, corresponds, or iii. The ten digits of the mobile phone line number that, if applicable, has been associated with the respective Client Account or Indirect Client Account, which corresponds to a money deposit or electronic payment fund in the respective Participant. b) ... II. ... a) The Payment Concept; b) The Numeric Reference, and c) Name, denomination, or corporate name of the respective beneficiary. ... Regarding Sending Requests for CoDi Transfer Orders, the Participant referred to in fraction II of the 9th Bis. of these Rules must refrain from allowing its Sender Client to modify, in the Sending Request generated due to the acceptance of the Charge Message that the latter has made in accordance with what is provided in Rule 9th Bis., fraction V, subsection d), numeral 1, previous, the information displayed by the respective computer program on the screen of its mobile device indicated in the 9th Bis., fraction V, subsection c), of these Rules, except for the amount, only in case this has not been specified in said Charge Message. In this case, the Issuing Participant must allow the Sender Client to introduce the amount that it determines, in accordance with what is established in subsection b) of fraction I of this Rule. Additionally, regarding the Sending Requests generated by the Indirect Participant derived from the transfer instructions presented by its Indirect Sender Clients, as part of the Indirect Participation Services that the Participant in question provides to said Indirect Participant, such Participant must refrain from allowing the Indirect Participant to modify, in the Sending Requests it presents, the information that the Indirect Sender Clients had included in said instructions, through the respective electronic and computer media that it had made available to it.” “12th Bis. Sending Requests processed with mobile phone numbers.- Subject to what is provided in this Rule, the Participant that so determines may allow its respective Clients, as well as, if applicable, those acting as Indirect Participants in attention to the transfer instructions presented by their respective Indirect Sender Clients, when the latter is stipulated in the applicable Indirect Participation Services Contracts, to present Sending Requests in which they specify, as identifier of the Client Accounts corresponding to the Beneficiary Clients, or well, of the Indirect Client Accounts corresponding to the Indirect Beneficiary Clients, only the ten digits of the numbers of the mobile phone lines corresponding, without including the identification of the Participants to which said Client Accounts or Indirect Client Accounts correspond. Prior to Participants beginning to allow their Clients to present Sending Requests with mobile phone numbers as identifier in accordance with the preceding paragraph, said Participants must carry out satisfactory tests of said functionality, in accordance with the certification process before the Administrator established in Appendix O of the Manual. In case the Participant allows receiving Sending Requests in terms of what is referred to above in this Rule, it must carry out the following actions: I. Regardless of the CLABE registration that the Participant carries out itself regarding the Client Accounts of the Participant itself or, if applicable, the Indirect Client Accounts of the Indirect Participants to whom it provides Indirect Participation Services, the Participant itself must, within ten seconds counted from the moment it receives the respective Sending Request, make a consultation before the Administrator, in accordance with the technical and operational specifications indicated in Appendix AR of the Manual, on the mobile phone number specified in said Sending Request, with the aim of obtaining the identifier referred to in the 12th, fraction I, subsection a), subsubsection i, of these Rules, as well as the identification of the Participant that corresponds to the Client Account or Indirect Client Account relative to the Beneficiary Client or Indirect Beneficiary Client, respectively, that the Administrator maintains, if applicable, in its databases corresponding to the records that Clients and Indirect Clients have made to receive or generate Charge Messages to carry out CoDi Transfer Orders, in accordance with the 9th, seventh paragraph, and 9th Bis., fraction IV, subsection a), second paragraph, of these Rules. In this scenario, the Participant must keep evidence of the consultation it has made in accordance with the above due to the update of the scenario provided in this fraction, for the processing of the Sending Requests contemplated in this Rule. II. In case the Participant obtains the data mentioned in the previous fraction from the Administrator, said Participant will display said data, within ten seconds following the moment it obtains them, in the form of the Sending Request it has received or, if applicable, the Participant must establish in the Indirect Participation Services Contract the obligation of the Indirect Participant to display the information of the transfer instruction that the Indirect Sender Client has sent to the Indirect Participant, within ten seconds following the moment it obtains them, in accordance with the technical and operational specifications established in Appendix AR of the Manual. In this case, the Participant must display, at least, the name or denomination of the holder of the Beneficiary Client Account or Indirect Beneficiary Client Account, in such a way that they only show the initials of said name or, if applicable, the denomination identifiers established in Appendix AR of the Manual.

Wednesday, March 23, 2022 OFFICIAL GAZETTE 33 In addition to the previous requirements, in case the Participant obtains the data referred to in this Rule, in order to carry out the processing of the corresponding Sending Request, it must carry out the verification indicated in the 13th of these Rules. III. In case the Client Accounts or Indirect Client Accounts corresponding to the cell phone numbers indicated in the Sending Requests that Participants receive in accordance with this Rule are Client Accounts administered by the same Participant or Indirect Client Accounts of one of its Indirect Participants, the Participant must carry out the transfer of resources between the corresponding accounts, at least, in the same timeframes and in accordance with the same conditions applicable to electronic fund transfers between different Participants in accordance with these Rules. In case a Participant wishes to offer or carry out electronic fund transfers involving the SPEI and that, for their origin, require only the ten digits of cell phone numbers to identify the respective recipients, without including the identifier of the Receiving Participants corresponding, they must be subject to what is provided by this Rule, therefore, it cannot offer the service of said transfers in a different manner.” “14th. Information on the status of the Sending Request.- ... I. ... a) to d) ... In the case of Sending Requests corresponding to CoDi Transfer Orders, the Issuing Participant must, in addition to what is disposed of previously in this Rule, generate and send to the Administrator a processing notice with the result of the respective CoDi Transfer Order, in accordance with what is specified in Appendix AD of the Manual and, in the event that the respective Sending Requests have been rejected, the Issuing Participant must inform the Sender Client thereof in a maximum period of two seconds following the moment the validation and verification referred to in the previous Rule concludes. II. ... III. Regarding that Sending Request referred to in the second and third paragraphs of the 10th of these Rules, the respective Participant must inform the Client who presented it, within sixty seconds following the moment the Participant received it and through the same medium by which it was presented, that the Participant's Technological Infrastructure is not available to operate with the SPEI and that this unavailability may impact processing times and service schedules, therefore, the Sending Request will be accepted and processed until the Participant's Technological Infrastructure is again available to operate with the SPEI, as well as indicate the possibility that Sender Clients may cancel, before their processing, these scheduled Sending Requests. Additionally, in the notice by which the Participant informs the Sender Client of what is referred to in this paragraph, the texts of the notifications established in section 5 of the Manual must be specified, as applicable. ...” “15th. Calculation of the number of financial product accounts.- For the purposes of those scenarios that refer to the number of deposit accounts for money or electronic payment funds, provided in the 5th Bis., fraction I, 9th Bis., fraction II, 11th., fraction IV, second paragraph, 19th., fraction II, second paragraph, and fraction IV, 25th., fraction III, second paragraph, 46th. fraction III, subsection b), and 58th., fraction II, subsection c), numeral 1, fraction i, subsubsection i.a), of these Rules, said number of deposit accounts for money or electronic payment funds, that Participants that have the character of Credit Institution or electronic payment fund institution, as the case may be, maintain open in favor of their Clients will correspond to those that said Participants register at the close of the calendar quarter in question. Regarding the number of checking deposit accounts of credit institutions, this will be determined based on the information that these institutions report to the Bank of Mexico in attention to the information requests made by the latter through the Financial System Information Directorate or, if applicable, in those accounts that the Bank of Mexico corroborates derived from the verification it carries out in exercise of its supervision attributes. Likewise, for the purposes of what is provided in the preceding paragraph, Participants that have the character of electronic payment fund institutions, as well as those that provide Indirect Participation Services to Indirect Participants that have that character, must observe the following:

34 OFFICIAL GAZETTE Wednesday, March 23, 2022

I. Report to the Administrator, within the first twenty-five days of January, April, July, and October, information regarding the number and amount of electronic payment fund accounts that said institutions have maintained in the previous quarter, using the form included in Appendix AN of the Manual, and

II. Report to the Bank of Mexico if they fall under the circumstances provided for in the 5th Bis., 9th Bis., fractions II and II Bis, 11th, fraction IV, second paragraph, 19th, fraction II, second paragraph, and fraction IV, 25th, fraction III, second paragraph, and 46th, fraction III, item b), of these Rules, during the calendar month immediately following the conclusion of the period indicated in the previous fraction, through a communication electronically signed by the compliance officer of the SPEI and sent to the Bank of Mexico in the terms established in the 98th of these Rules.

In the event that any of the Participants referred to in this Rule exceeds the limit of three thousand demand deposit accounts or electronic payment fund accounts, as applicable, in accordance with what is provided in this same Rule, it must comply with what is established for this circumstance in the cited Rules in the first paragraph at the latest on the last day of the calendar semester following the quarter in which the Participant exceeded the referred limit.”

“16th. Transfer Orders.- The Issuing Participant must include, in the Transfer Order it sends to the Administrator in accordance with these Rules, the information corresponding to the Tracking Key field, as well as that of the Numerical Reference and Payment Concept fields that, if applicable, the Issuing Client has specified in the Sending Request that said Issuing Participant has accepted in accordance with the 13th of these Rules. Likewise, in the Client Account field, the Issuing Participant must include only the CLABE of the Client Account corresponding to the Issuing Client or the CLABE of the Indirect Client Account corresponding to the Indirect Issuing Client indicated by the Issuing Client, in its capacity as Indirect Participant.

In the case where said Transfer Order is instructed by an Issuing Client, the Issuing Participant must include the Unique Population Registry Key (CURP) or the Federal Taxpayer Registry key (RFC) for natural persons, as well as the key of this latter registry, with its respective homoclave, for legal entities, in accordance with the 72nd, fraction I, of these Rules and according to the formats established in section 8 of the Manual. Additionally, the Issuing Participant must indicate for each Transfer Order if its priority is normal or high in accordance with what is provided in section 2 of the Manual.

...

I. In the name and on behalf of those Issuing Clients who have transmitted the respective Sending Requests on their own behalf or as Indirect Participants in the name of the respective Indirect Issuing Clients, or

II. In the name and on behalf of the Issuing Participant itself, only in those cases where there are no Sending Requests from its Issuing Clients. Likewise, Participants must establish, in the Indirect Participation Service Contracts, the prohibition for their Indirect Participants to present Sending Requests in the name of Indirect Clients when there is no instruction from the referred Indirect Client.

...

Regarding Transfer Orders originating from Sending Requests in which only the ten digits of the mobile phone line number have been included to identify the Client Account of the Beneficiary Client or, if applicable, the Indirect Client Account of the Indirect Beneficiary Client, in accordance with what is stated in the 12th Bis. of these Rules, said Transfer Orders must be processed through the messaging, terms and conditions applicable to the respective Transfer Orders with the technical and operational specifications indicated in Appendix AR of the Manual.”

“16th Bis. Transfer Orders related to Remittances.- Participants who offer their Issuing Clients the sending of Transfer Orders for the processing of Remittances or as a result of these, must process them under the payment types corresponding to Remittances indicated in section 9 of the Manual, as well as use the respective formats specified in section 8 of the Manual, for which they must collect and include in said Transfer Orders the information required in the referred payment types.

Wednesday, March 23, 2022 OFFICIAL GAZETTE 35

The Participant who, in accordance with what is established in the 9th Bis 5. of these Rules, has knowledge that any of the Indirect Participants to whom it provides Indirect Participation Services allows its Indirect Clients to send Transfer Orders for the processing of Remittances or as a result of these, must process them under the payment types corresponding to Remittances associated with the Indirect Participation Services indicated in section 9 of the Manual, as well as use the respective formats specified in section 8 of the referred Manual. Additionally, said Participant must establish, in the Indirect Participation Service Contract it enters into with its Indirect Participants, the obligations of the latter to include the information required in accordance with the referred payment types. Likewise, the Participant must establish, in the Indirect Participation Service Contract, the obligation of the Indirect Participant to identify its Indirect Clients that could offer the Remittance service, in which case the respective payment types and formats indicated in sections 8 and 9 of the Manual must also be used.

Participants who carry out international fund transfers at the request of their clients or users, without doing so through operations via the SPEI or doing so in an aggregated manner through the SPEI, must preserve the information that evidences said transfers and their characteristics for at least five years from their execution, and keep it available to the Bank of Mexico and the other authorities empowered to regulate and supervise said Participants.”

“17th. Sending of Transfer Orders.- The Issuing Participant must send to the Administrator the Transfer Order corresponding to the Sending Request accepted by said Participant, through the automated processes of the SPEI and through the SPEI Instance corresponding in terms of section 9 of the Manual, according to the Set of Transfer Orders to which the Transfer Order corresponds, during the thirty seconds counted from the moment that the Participant itself has accepted it in accordance with what is stated in the 13th of these Rules. The Issuing Participant must comply with the previous deadline, except in case that it has agreed with its Issuing Client that it will send the Transfer Order at a later hour or date than the receipt of the Sending Request and, in this last circumstance, the thirty-second deadline mentioned will begin to count from the agreed hour for this purpose or, if no specific hour is agreed, from 06:00:00 hours of the day that, if applicable, has been agreed in accordance with the above. In case no specific hour is agreed, the Issuing Participant must inform its Issuing Client that the sending of the Transfer Order will be carried out at 06:00:00 hours of the agreed date.

...

The Issuing Participant may send instructions to the Administrator to cancel Transfer Orders it has previously sent. For these purposes, the Participant must send said cancellation instructions through the SPEI Instance through which it sent the respective Transfer Orders. Transfer Orders can only be cancelled when they have not been settled through the SPEI in terms of the 18th of these Rules. Additionally, the Administrator will automatically eliminate, through the corresponding SPEI Instance, the following Transfer Orders:

I. ...

II. Those other than CoDi Transfer Orders that have not been settled at the conclusion of the number of clearing cycles that correspond in accordance with section 5.7 of the Manual, due to insufficient balance in the respective SPEI Account of the Issuing Participant or as a result of the disconnection of the Receiving Participant from the SPEI Instance through which the respective Transfer Order was sent.

III. ...

IV. ...

In the event that Transfer Orders are eliminated in the circumstances indicated in fractions I, II, and IV above, the respective Issuing Participant must inform the Issuing Client thereof, through a message it sends through the medium by which the Issuing Client presented the corresponding Sending Requests and through the additional medium that must have been agreed for this purpose, within the ten seconds following that in which said Participant receives the message from the Administrator indicating this situation.

Regarding that Transfer Order that has been eliminated in any of the circumstances of fractions II and IV above, the Participant may allow its Issuing Client to resubmit the Sending Request, provided that the initial Transfer Order referred to in the first and third paragraphs of this Rule has not been successfully sent. In this case, once said Sending Request has been accepted, it must be issued with a new Tracking Key and must be subject to the identification, authentication, and verification that the Issuing Participant carries out in accordance with what is established in the 13th of these Rules. Additionally, in this circumstance, the Participant must inform its Issuing Client of what is indicated in the last paragraph of the 13th of these Rules, in accordance with what is provided in this.

The Administrator may eliminate Transfer Orders sent to it while the Issuing Participant does not have sufficient balance in the SPEI Account corresponding to the SPEI Instance through which said Transfer Orders were sent.

Regarding CoDi Transfer Orders eliminated in accordance with fraction III above, the Issuing Participant must send to the Administrator a processing notice in which it reports the elimination of the CoDi Transfer Order in question, in accordance with what is specified in Appendix AD of the Manual, within a maximum period of two seconds following that in which the Administrator has made the respective elimination notice available to the Participant.

As an exception to what is provided in the first paragraph of this Rule, in case a CoDi Transfer Order is generated as a result of the acceptance of a Collection Message, the period during which the Issuing Participant must send to the Administrator said CoDi Transfer Order corresponding to the Sending Request accepted by said Participant will be four seconds counted from that in which the Participant itself has accepted it in accordance with what is stated in the 13th of these Rules.”

“18th. Settlement of Transfer Orders.- Once the Administrator carries out, automatically through the corresponding SPEI Instance, the validations of the Transfer Orders, it will settle said orders starting from the process described in section 4 of the Manual to carry out clearing in terms of the Payment Systems Law, which will consider the balance of the SPEI Accounts corresponding to the SPEI Instances through which said Transfer Orders were sent, the Transfer Orders that are pending settlement, as well as the priority that has been indicated in said Transfer Orders.

...

The Transfer Orders that have met the validations referred to in the first paragraph of this Rule and regarding which the Settlement Notices indicated in the previous paragraph have been made available, will correspond to the accepted transfer orders referred to in the Payment Systems Law. In virtue of this, the Transfer Orders referred to in this paragraph, as well as their clearing and settlement contemplated in these Rules and section 4 of the Manual, will be firm, irrevocable, enforceable, and opposable against third parties.”

“19th. Crediting of Transfer Orders Accepted by SPEI.- The Receiving Participant is obligated to credit, in the respective Client Account corresponding to the Beneficiary Client indicated in the Sending Request, the amount of the Transfer Order Accepted by SPEI, regardless of the SPEI Instance through which it has been processed.

Likewise, in case the Receiving Participant provides Indirect Participation Services, it will be obligated to credit the amount of the Transfer Order Accepted by SPEI in the respective Client Account corresponding to the Indirect Participant that said Receiving Participant holds and, in turn, it must ensure that said Indirect Participant credits the same amount in the Indirect Client Account corresponding to the Indirect Beneficiary Client indicated in the Sending Request.

In the cases referred to above, the Receiving Participant must carry out the credit and, if applicable, ensure that the respective credit is carried out in accordance with the following:

I. ...

The thirty-second deadline specified in the previous paragraph will not apply to that Participant that has the status of Credit Institution regarding the Transfer Order Accepted by SPEI that it receives for an amount greater than twenty-one thousand pesos, in which case the deadline will be five seconds following that in which the Administrator has made it available to it through the SPEI the Settlement Notice cited.

As an exception to what is provided in the previous paragraph, regarding those individual transfers for amounts equal to or greater than fifty thousand pesos, or those referred to the same Client Account corresponding to the Beneficiary Client in question, that are received during the same operating day of the SPEI and that by the sum of their respective amounts reach or exceed said amount, in case any Receiving Participant determines to carry out, in accordance with its internal processes, validations additional to those provided in these Rules to carry out the credit referred to in this fraction, it may request authorization from the Administrator, through the Directorate of Operations and Continuity of Payment Systems and Market Infrastructures, for a period not exceeding six months, to carry out said credits in a period greater than those referred to in the first and second paragraphs of this fraction, as applicable, which it determines for these purposes. Participants who request the indicated authorization must state in their request that they are in the process of automating the validations, for the purposes referred to in this rule in the deadlines indicated in this fraction, once the deadline of the requested authorization concludes.

Additionally, regarding those fund transfers directed to Beneficiary Client Accounts indicated in Rule 58th, fraction V, last paragraph, the respective Receiving Participants must carry out validations additional to those provided in these Rules before carrying out the credit referred to in this fraction, to determine if they accept the respective Transfer Orders Accepted by SPEI, and, regarding said validations, they must take into account, among other aspects they determine, the opening date of the corresponding Client Accounts, as well as the transactional patterns of these in comparison with those considered unusual. In this circumstance, the referred Participants will not be obligated to comply with the deadlines indicated in the first and second paragraphs of this fraction, as applicable, and may carry out the corresponding credits in the period that, for this purpose, the Administrator authorizes each Participant in response to the request it presents to it through the Directorate of Operations and Continuity of Payment Systems and Market Infrastructures. Until the Participants do not have the authorization from the Bank of Mexico referred to in this paragraph, they must carry out each of the aforementioned credits in the same hour of the next Banking Business Day following the hour in which they receive the respective Transfer Order.

II. ...

The Participant that has the status of Credit Institution or electronic payment fund institution and that maintains less than three thousand demand money deposit accounts or electronic payment funds of its Clients, as applicable, will be exempt from the schedule established in this fraction and must credit the Transfer Orders Accepted by SPEI within five seconds following that in which the Administrator has made it available to it through the SPEI the Settlement Notice regarding the Transfer Order Accepted by SPEI in question corresponding to a Low Value Transfer Order, the Banking Business Day that corresponds, during the hour of 06:00:00 to that which corresponds to the closing of SPEI operations specified in the 35th of these Rules.

III. ...

IV. ...

a) ...

b) It concerns Transfer Orders Accepted by SPEI for amounts greater than twenty-one thousand pesos, that those Participants that have the status of Credit Institution or Clearing Chamber for Transfers Through Mobile Devices between the opening hour of the SPEI specified in the 35th of these Rules and 05:59:59 hours of the referred Banking Business Day that corresponds to the operating date of the SPEI;

V. ...

VI. Within four seconds following that in which the Administrator has made it available, through the SPEI, the Settlement Notice regarding the Transfer Order Accepted by SPEI corresponding to CoDi Transfer Orders, during the 24 hours of all days of the year.

...

a) to c) ...

Likewise, the Participant must ensure that the Client, in its capacity as Indirect Participant, regarding Transfer Orders Accepted by SPEI that have been received by said Client as an object of Indirect Participation Services, informs its Indirect Beneficiary Client, at no cost to this, about the credit of the resources corresponding to said Transfer Order through the means they have agreed, at the latest five seconds immediately following that in which it has carried out said credit, as well as provide said Participant with at least the data referred to in items a), b), and c) immediate above.

38 DIARIO OFICIAL Wednesday, March 23, 2022

As an exception to the provisions above in this Rule, the Receiving Participant shall not make the credit referred to herein, only in those cases where it must send a new Transfer Order of the type return of transfer not credited in the Client's Account corresponding, as indicated in the 23rd of these Rules. Consequently, in the event that the Receiving Participant is not located in any of the scenarios contemplated in the aforementioned Rule 23rd, it shall carry out the credit referred to in this Rule in accordance with the provisions thereof.”

“20th. Confirmation of Credit.- In the event that the Receiving Participant processes a Transfer Order Accepted by SPEI —regardless of whether this corresponds to a Transfer Order sent by the respective Issuing Participant, in its own name and on its own behalf, or as a result of the Send Request from its Issuing Client, whether the latter has acted directly or as an Indirect Participant derived from the fund transfer instruction sent to it by its Indirect Issuing Client, as applicable, or if said Transfer Order Accepted by SPEI is directed to a Beneficiary Client of the Receiving Participant or, in its case, to an Indirect Beneficiary Client of the Indirect Participant to whom the Receiving Participant provides Indirect Participation Services— said Receiving Participant shall generate and send, through SPEI, a Confirmation of Credit to the Administrator in terms and with the characteristics specified in Appendix D of the Manual, within five minutes counted from the moment it has carried out the credit in the Client's Account corresponding to the Beneficiary Client or to the Indirect Participant, as the case may be, of the amount of the respective Transfer Order Accepted by SPEI. Regarding Transfer Orders Accepted by SPEI processed as part of Indirect Participation Services, the Confirmation of Credit that the Participant generates and sends to the Administrator in accordance with the foregoing shall contain the information that the Indirect Participant provides to it in the notification that confirms the credit made by said Indirect Participant in the Client's Account corresponding to the Indirect Beneficiary Client for these purposes, in accordance with the 20th Bis. of these Rules.

The Receiving Participant that carries out the credit of the amount of the respective Transfer Order Accepted by SPEI in a Client's Account corresponding to a Beneficiary Client, shall include in the Confirmation of Credit the Unique Population Registry Key (CURP) or the Federal Taxpayer Registry key (RFC), in the case of natural persons, or the Federal Taxpayer Registry key with the respective homoclave in the case of legal entities, corresponding to its Beneficiary Client or, in its case, to the Indirect Beneficiary Client, in accordance with the 72nd, fraction I, of these Rules.

In addition to the Confirmation of Credit provided for in the previous paragraph, regarding CoDi Transfer Orders, the Receiving Participant shall generate a processing notice, in accordance with the terms and characteristics specified in Appendix AD of the Manual, by which it confirms the credit of the amount indicated in the Transfer Order Accepted by SPEI corresponding to the CoDi Transfer Order in question, which said Receiving Participant has made, in accordance with the 19th of these Rules, in the Client's Account corresponding to the Beneficiary Client as well as, if applicable, the credit in the Client's Account corresponding to the Indirect Beneficiary Client that the respective Indirect Participant has made. In this regard, said Participant shall send the aforementioned notice to the Administrator, no later than six seconds after the Administrator has made it available to it, through SPEI, the Settlement Notice regarding the Transfer Order Accepted by SPEI corresponding to the CoDi Transfer Order in question. In the event that the Receiving Participant or the Indirect Participant to whom the Receiving Participant provides Indirect Participation Services has not made the credit in the Client's Account corresponding to the Beneficiary Client or, in its case, in the Client's Account corresponding to the Indirect Beneficiary Client, within the four-second period indicated in fraction VI of the 19th of these Rules, it shall be exempt from sending the processing notice referred to in this paragraph.

...

Regarding CoDi Transfer Orders, the Receiving Participant shall carry out the actions indicated below, in the event that it is located in the following scenarios:

I. If the Receiving Participant in question does not make the credit in the Beneficiary Client's Account and, if applicable, the Indirect Participant in question does not make the credit in the Indirect Beneficiary Client's Account, within the four-second period indicated in fraction VI of the 19th of these Rules, said Receiving Participant shall send a Transfer Order of the type return of transfer not credited in Client Accounts, in accordance with the provision of the 24th of these Rules, no later than eight seconds

Wednesday, March 23, 2022 DIARIO OFICIAL 39

after the Administrator has made it available to it, through SPEI, the Settlement Notice regarding the Transfer Order Accepted by SPEI in question, and

II. If the Receiving Participant in question does not send the processing notice specified in the third paragraph of this Rule, in accordance with the terms established therein, it shall send a Transfer Order of the type return of credited transfer in Client Accounts referred to in the 28th of these Rules, no later than eight seconds after the Administrator has made it available to it, through SPEI, the Settlement Notice regarding the Transfer Order Accepted by SPEI derived from the CoDi Transfer Order in question, regardless of whether the amount corresponding to said Transfer Order Accepted by SPEI has been credited in the Client's Account corresponding to the respective Beneficiary Client or in the Client's Account corresponding to the respective Indirect Beneficiary Client, in accordance with the provision of the 19th of these Rules. In the latter scenario, the Participant and the Indirect Participant that holds the Client's Account or the Indirect Client's Account, respectively, in which the aforementioned amount has been credited, shall make the charge in the respective account resulting from that scenario, subject to what they have agreed to that effect with the respective Client or Indirect Client.

In any of the cases indicated in the aforementioned fractions, the Receiving Participant, after sending, through SPEI, the Transfer Order of the type return not credited in Client Accounts or the Transfer Order of the type return of credited transfer in Client Accounts, as the case may be, shall send to the Administrator a processing notice, in accordance with the terms and characteristics specified in Appendix AD of the Manual, by which it confirms the return of the amount indicated in the Transfer Order of the type return in question, no later than ten seconds after the Administrator has made it available to it, through SPEI, the Settlement Notice regarding the Transfer Order Accepted by SPEI corresponding to the respective CoDi Transfer Order.

...

In the event that the Receiving Participant referred to in the first paragraph of this Rule processes a Transfer Order Accepted by SPEI generated as a result of or for the processing of a Batch, it shall include, in the respective Confirmation of Credit, the information indicated in Appendix D of the Manual.”

“20th Bis. Confirmation of Credit to Indirect Clients.- The Receiving Participant that, as part of the Indirect Participation Services it provides to the respective Indirect Participant, processes a Transfer Order Accepted by SPEI directed to an Indirect Client's Account corresponding to an Indirect Beneficiary Client of said Indirect Participant, shall ensure to receive, from that same Indirect Participant, the notification that confirms the credit it has made in said Indirect Client's Account, prior to the generation and sending, through SPEI, of the Confirmation of Credit referred to in the 20th of these Rules. The foregoing shall be observed without prejudice to the time periods in which the Participant must send the Confirmation of Credit to the Administrator in accordance with the 20th of these Rules.”

“21st. Rejection of Confirmation of Credit.- ...

Receiving Participants shall correct the Confirmations of Credit rejected by the Administrator, as well as send to it, through the mechanisms indicated in Appendix D of the Manual, the corrected Confirmations of Credit, within a period of twenty-four hours, counted from the rejection of the corresponding Confirmation of Credit, except in the event that an event occurs that affects the operation by the Administrator.”

“Section IV Return of Transfer Orders Accepted by SPEI not credited in Client Accounts”

“23rd. Causes for return of Transfer Orders Accepted by SPEI not credited in Client Accounts.- The Receiving Participant shall send a new Transfer Order of the type return of transfer not credited in the Client's Account or in the Indirect Client's Account

40 DIARIO OFICIAL Wednesday, March 23, 2022 corresponding, regarding a Transfer Order Accepted by SPEI, in any of the following scenarios:

I. ...

II. If the respective Transfer Order is directed to a non-existent Client's Account in the Receiving Participant or to a non-existent Indirect Client's Account in the Indirect Participant to whom the Receiving Participant provides Indirect Participation Services, as the case may be;

III. ...

IV. When, by mandate of a competent judicial or administrative authority, it is prevented that the Client's Account corresponding to the Beneficiary Client or, in its case, the Indirect Client's Account corresponding to the Indirect Beneficiary Client, receives funds;

V. to VII. ...

VIII. In the event that it is not possible to credit the amount of the Transfer Order Accepted by SPEI in the Client's Account corresponding to the Beneficiary Client or in the Indirect Client's Account corresponding to the Indirect Beneficiary Client, for any of the return causes indicated with that character in section 9 of the Manual, in addition to those indicated in this Rule;

IX. In the event that the Receiving Participant receives a Transfer Order Accepted by SPEI corresponding to a CoDi Transfer Order and it is not located in the scenarios indicated in fractions I, II and II Bis of Rule 9th Bis, or

X. ...”

“24th. Return of Transfer Orders Accepted by SPEI not credited in Client Accounts.- In the scenarios referred to in the aforementioned Rule 23rd, the Receiving Participant shall send the Transfer Order of the type return of transfer not credited in the respective Client's Account, in accordance with the format defined in section 8 of the Manual, through the same Instance of SPEI through which said Participant had received the respective Transfer Order, and shall indicate the cause of the return from among those indicated as such in the catalog contained in section 9 of the Manual, as well as ensure that the amount included corresponds to:

I. and II. ...”

“25th. Deadlines for the return of Transfer Orders Accepted by SPEI not credited in Client Accounts.- ...

I. to II. ...

III. ... The period referred to in the previous paragraph shall be applicable only during the hours between 06:00:00 and 17:59:50 of the corresponding Banking Business Day, regarding the Settlement Notices of the Transfer Orders Accepted by SPEI regarding Low Value Transfer Orders that the Administrator has made available through SPEI to Participants that have the character of Credit Institution that maintain less than three thousand deposit bank accounts or of electronic payment fund institution that maintain less than three thousand electronic payment fund accounts. For the period between 17:59:51 of any Banking Business Day and 05:59:59 of the following Banking Business Day, the Participants referred to in this paragraph shall send the Transfer Orders of the type return of transfers not credited in Client's Accounts no later than 06:00:10 hours of the aforementioned following Banking Business Day;

IV. and V. ...

VI. Those corresponding to Transfer Orders Accepted by SPEI received by Participants that have the character of Credit Institution or of Clearing House for Transfers Through Mobile Devices for amounts greater than twenty-one thousand pesos, between the opening hours of SPEI specified in the 35th of these Rules and 05:59:59 hours of the referred Banking Business Day that corresponds to the operation date of SPEI. In this case, the Transfer Order of the type return of transfer not credited in the Client's Account shall be sent no later than 06:00:10 hours of the aforementioned following Banking Business Day, or

VII. Those corresponding to CoDi Transfer Orders. In this case, the deadline to send the Transfer Order of the type return referred to in this Rule shall be eight seconds, during the 24 hours of any day of the year, counted from the moment the Administrator has made available to the Participant through SPEI, the respective Settlement Notice.

In this case, the Receiving Participant shall generate and send to the Administrator, once the sending of the Transfer Order of the type return referred to in this fraction has been carried out and within a maximum period of ten seconds after the Administrator has made it available to it, through SPEI, the Settlement Notice regarding the Transfer Order Accepted by SPEI corresponding to CoDi Transfer Orders, a processing notice with the result of the CoDi Transfer Order, in which it will inform of the return in accordance with what is specified in Appendix AD of the Manual.”

“25th Bis. Deadlines for retrying returns of Transfer Orders Accepted by SPEI.- In the event that, on the one hand, the Receiving Participant of a Transfer Order has issued, regarding it, a Transfer Order of the type return in accordance with the aforementioned Rules 23rd and 24th, regardless of whether the latter has been credited or not in the Client's Account or whether it has been late or not, and, on the other hand, said Participant receives from the Administrator a notice indicating that said Transfer Order of the type return has been deleted without being settled, the Participant shall send a new Transfer Order of the type return that corresponds, in accordance with the following:

I. When the deletion of the aforementioned Transfer Order of the type return is due to the Receiving Participant of this having disconnected from the Instance of SPEI through which the Transfer Order of the type return must be sent, the Participant that sent said Transfer Order of the type return shall send the aforementioned new Transfer Order of the type return within five seconds after the moment in which it has received from the Administrator the notification that the connection of the Receiving Participant has been re-established or, in case it does not receive said notification, within sixty minutes after the moment in which it receives from the Administrator, through SPEI, the notification of the deletion of the indicated Transfer Order. The Participant that sent the Transfer Order of the type return shall not send the new Transfer Order of the type return to an Instance of SPEI different from the one in which the original Transfer Order Accepted by SPEI had been processed.

II. When the deletion of the aforementioned Transfer Order of the type return is due to the balance in the SPEI Account, corresponding to the respective Instance of SPEI, of the Participant that sent said Transfer Order of the type return being insufficient to cover it, said Participant shall send the new Transfer Order of the type return within five seconds after the moment in which it receives from the Administrator, through SPEI, the notification of the deletion of the Transfer Order.”

“26th. Late return of Transfer Orders not credited in Client Accounts.- ...

The returns referred to in the previous paragraph shall be processed through the same Instance of SPEI through which the original Transfer Order had been processed, except in the scenarios provided for in section 5.16.4 of the Manual, in which case said returns may be processed through any Instance of SPEI.”

“27th. Crediting of the Transfer Order of type return or late return of transfer not credited in Client Accounts.- ...

Regarding a Transfer Order subject to a return or late return of transfer not credited in the Client's Account that derives from Indirect Participation Services, the Participant shall ensure that the Issuing Client, in its capacity as Indirect Participant, carries out, within the period applicable to the Issuing Participant referred to in the previous paragraph, the credit of the corresponding resources of the Transfer Order to the respective Indirect Issuing Client.”

42 DIARIO OFICIAL Wednesday, March 23, 2022 As an exception to what is provided in the first and second paragraphs of this Rule, regarding CoDi Transfer Orders subject to a return or late return of a transfer not credited to Client Accounts, the maximum time limit to make the credit will be four seconds counted from the moment the Administrator has made available to it, through the SPEI, the Settlement Notice of the Transfer Order of the type of return or late return of a transfer not credited to Client Accounts. In the event that the Issuing Participant cannot carry out the credit of the resources referred to in the previous paragraphs of this Rule, said Participant must: I. Refrain from generating a new Transfer Order of the type return or of the type late return of a transfer not credited to Client Accounts regarding that other Transfer Order of the type return or late return of a transfer not credited to Client Accounts that, in turn, it has received from the Receiving Participant, and II. Make the corresponding resources available to the Issuing Client or the Indirect Issuing Client through the Indirect Participant to whom it provides Indirect Participation Services, as applicable, for withdrawal at the counter, or so that they can be transferred to any other Client Account or Indirect Client Account that, as applicable, is indicated by said Issuing Client or Indirect Issuing Client. The Issuing Participant of the Transfer Order subject to a return or late return of a transfer not credited to Client Accounts must inform the Issuing Client or, as applicable, the Indirect Issuing Client through the Indirect Participant, that has transmitted the respective Sending Request, free of charge for these and through the means they have agreed upon for this purpose and through the same means by which the respective Sending Request was presented, regarding the re-entry of the respective resources into their Client Account or Indirect Client Account that has been carried out due to the return or late return, as well as the cause thereof as indicated by the Receiving Participant of the Transfer Order subject to a return or late return, no later than five seconds counted from the moment the credit was made.” “28a. Return of Accepted Transfer Orders by SPEI credited to Client Accounts.- In the event that a Beneficiary Client does not recognize a Transfer Order Accepted by SPEI whose resources have been credited to their Client Account, the respective Receiving Participant must allow said Beneficiary Client to return the resources by presenting a Sending Request corresponding to a Transfer Order of the type return of a transfer credited to Client Accounts, in accordance with the format detailed in section 8 of the Manual. Likewise, the Participant that provides Indirect Participation Services to any of its Clients must agree with this, in the corresponding Indirect Participation Services Contract, that, in the event that an Indirect Beneficiary Client does not recognize a Transfer Order Accepted by SPEI whose resources have been credited to their Indirect Client Account, said Client of the Participant acting as Indirect Participant must allow said Indirect Beneficiary Client to return the resources by presenting a transfer instruction corresponding to a Transfer Order of the type return of a transfer credited to Client Accounts, in accordance with the format of section 8 of the Manual. Additionally, when the result of the application of the Collaboration Agreement for the Protection of the Issuing Client indicates that the resources should be returned, or in the event that the Receiving Participant of a CoDi Transfer Order credited to the Client Account has not sent the processing notice to the Administrator confirming the credit of the amount corresponding to the CoDi Transfer Order in question to the Client Account corresponding to the Beneficiary Client of the amount of the respective Transfer Order Accepted by SPEI in terms of what is established in the 20a. of these Rules, the Receiving Participant of this Transfer Order Accepted by SPEI must carry out the return of the resources corresponding to this Transfer Order Accepted by SPEI by sending a Transfer Order of the type return of a transfer credited to Client Accounts, in accordance with the format included in section 8 of the Manual, through the same Instance of the SPEI through which the respective Transfer Order Accepted by SPEI was processed. The Receiving Participants or, as applicable, the Beneficiary Clients to whom Indirect Participation Services for the receipt of funds are provided, must make available to their Beneficiary Clients or, as applicable, their Indirect Beneficiary Clients, through the software programs installed on the mobile devices referred to in the 9a. Bis., fraction I, of these Rules, or regarding the Beneficiary Clients, through the electronic and computer means that these, in their capacity as Indirect Participants, make available to their Indirect Clients, the information regarding the sending of the Transfer Orders referred to in the previous paragraph, in accordance with what is specified in Appendix AD of the Manual and within the time limit established in the 84a. of these Rules.

Wednesday, March 23, 2022 DIARIO OFICIAL 43 Regarding the return of a Transfer Order Accepted by SPEI corresponding to a CoDi Transfer Order credited to the Client Account, for which the respective Receiving Participant has not sent to the Administrator, in accordance with the previous Rule 20a., the processing notice confirming the credit of the respective amount in the Client Account, the aforementioned Receiving Participant must generate and send to the Administrator the processing notice informing about said return, in accordance with what is specified in Appendix AD of the Manual, within a maximum time limit of ten seconds following the moment the Administrator makes available to the Participant, through the SPEI, the Settlement Notice regarding the Transfer Order Accepted by SPEI. Regarding the Transfer Orders of the type return or late return of CoDi Transfer Orders provided for in this Rule and in the following 29a., respectively, in which the Participant or the Indirect Participant receives from the Beneficiary Client or the Indirect Beneficiary Client, as applicable, the Sending Request or the transfer instruction for the sending of the Sending Request corresponding to the return, as applicable, the Receiving Participant must send a notification to the Administrator with the specifications indicated in Appendix AD of the Manual, within a maximum time limit of two seconds following the moment it has sent the Transfer Order of the type return of a transfer credited to Client Accounts.” “29a. Late return of Accepted Transfer Orders by SPEI credited to Client Accounts.- In the event that, for any circumstance, the Receiving Participant does not send the Transfer Order of the type return on the same business day of the SPEI on which said Participant has received the original Transfer Order Accepted by SPEI subject to the return, the Transfer Order sent on any subsequent day must be of the type late return of a transfer credited to the Client Account, in accordance with the format of section 8 of the Manual.” “30a. Time limits for the return of Accepted Transfer Orders by SPEI credited to Client Accounts.- The Receiving Participant that falls under any of the circumstances referred to in the 28a. and 29a. of these Rules must send the Transfer Order of the type return of a transfer credited to the Client Account or of the type late return of a transfer credited to the Client Account, as applicable, no later than thirty seconds following the moment it receives the Sending Request corresponding from its Beneficiary Client. Regarding the Participant that provides Indirect Participation Services, it must comply with the aforementioned thirty-second time limit from the moment the Indirect Beneficiary Client sends to the Indirect Participant the transfer instruction corresponding to a Transfer Order of the type return of a transfer credited to Client Accounts. For these purposes, the Participant must agree with the Indirect Participant, in the respective Indirect Participation Services Contract, the necessary actions to comply with the stated time limit. In the cases referred to in the previous paragraph, the Receiving Participant must send the Transfer Order of the type return that corresponds, through the same Instance of the SPEI through which the Transfer Order Accepted by SPEI referred to the respective return was processed, except in the circumstances indicated in section 5.16.4 of the Manual for late returns of Accepted Transfer Orders by SPEI credited to Client Accounts or Indirect Client Accounts, in which case such returns may be processed through any Instance of the SPEI. Regarding Transfer Orders of the type return or late return referred to in this Rule, with respect to CoDi Transfer Orders, the maximum time limit provided in the first paragraph of this Rule will be four seconds following the moment the Receiving Participant or Indirect Participant receives from the Beneficiary Client or the Indirect Beneficiary Client, respectively, the Sending Request or the transfer instruction for the sending of the Sending Request corresponding, as applicable. Likewise, in the event that the Receiving Participant of a CoDi Transfer Order credited to the Client Account has not sent the processing notice to the Administrator confirming the credit of the respective amount in the Client Account, the maximum time limit referred to will be eight seconds following the moment the Administrator has made available to it, through the SPEI, the Settlement Notice regarding the Transfer Order Accepted by SPEI. In the cases previously referred to in this paragraph, the Receiving Participant must send a notification to the Administrator, informing about the sending that said Receiving Participant has made, through the SPEI, of the Transfer Order of the type return of a transfer credited to Client Accounts, in accordance with the terms and characteristics specified in Appendix AD of the Manual and within the time limit established in the 28a. of these Rules.

44 DIARIO OFICIAL Wednesday, March 23, 2022 As an exception to what is provided in the first and third paragraphs of this Rule, in the event that, in the Collaboration Agreement for the Protection of the Issuing Client, the parties have established time limits shorter than those indicated in said paragraphs, the Receiving Participant must apply the time limits stipulated in said agreement.” “31a. Time limits for the crediting of returns of Accepted Transfer Orders by SPEI credited to Client Accounts.- ... Regarding a Transfer Order subject to a return of a transfer credited to the Client Account that derives from Indirect Participation Services, the Participant must ensure that the Issuing Client, in its capacity as Indirect Participant, carries out within the time limit referred to in the previous paragraph, applicable to the Issuing Participant, the credit of the resources to the respective Indirect Issuing Client. As an exception to what is provided in the first and second paragraphs of this Rule, regarding CoDi Transfer Orders subject to a return or late return of Accepted Transfer Orders by SPEI credited to Client Accounts, the maximum time limit to carry out the credit will be four seconds, from the moment the Administrator has made available to it, through the SPEI, the Settlement Notice of the Transfer Order of the type return or late return of a transfer credited. ... I. Refrain from generating a new Transfer Order of the type return or of the type late return of Accepted Transfer Orders by SPEI not credited, as credited to Client Accounts regarding a Transfer Order of the type return or of the type late return of a transfer credited to Client Accounts that, in turn, it has received from the Receiving Participant, and II. Make the corresponding resources available to the Issuing Client or the Indirect Issuing Client, through the Indirect Participant to whom it provides Indirect Participation Services, as applicable, of the Transfer Order subject to the return for withdrawal at the counter, or so that they can be transferred to the Client Account that, as applicable, is indicated by said Issuing Client. The Issuing Participant of the Transfer Order that has been subject to a return or a late return must inform the Issuing Client or the Indirect Issuing Client, through the Indirect Participant to whom it provides Indirect Participation Services, that has carried out the respective Sending Request, as applicable, free of charge for these and through the means by which the Issuing Client sends the Sending Requests and through the additional means that they must have agreed upon for this purpose, regarding the re-entry of the respective resources into their Client Account or Indirect Client Account due to the return or late return, no later than five seconds after having carried out the credit in their Client Account or Indirect Client Account.” “33a. Contingencies in operations with CLS.- ... In the event that any of the events provided for in the 45a. of these Rules occurs, operations with CLS referred to in the preceding Rule 32a. may only be carried out through the Instance of the SPEI that processes the Set of Transfer Orders corresponding with CLS, in accordance with what is specified in section 9 of the Manual.” “35a. SPEI Operating Hours.- The SPEI will have a continuous operating scheme. The operating hours of the SPEI, in all Instances of the SPEI, for a Banking Business Day will start at 18:00:00 hours of the previous Banking Business Day and end at 17:59:59 hours of the Banking Business Day referred to in the first place.” “37a. Request for extension of hours.- In the event that a Participant, due to technical or operational problems, considers that it will not be possible to send all the Transfer Orders it has pending to send to the SPEI, in any of its Instances, before the system's closing of operations on the corresponding business day in accordance with what is provided in the 35a. of these Rules, it may send a request for extension of hours to the Administrator, through the Department of Operations and Continuity of Payment Systems and Market Infrastructures. The interested Participant must send said request at least thirty minutes in advance of the SPEI's closing of operations, in terms of what is provided in the 98a. of these Rules.

Wednesday, March 23, 2022 DIARIO OFICIAL 45 The request referred to in the previous paragraph must adhere to the form established in Appendix J of the Manual and contain, at least, the estimate of the number and total amount corresponding to the Transfer Orders that the Participant has pending to send to the SPEI, in the Instances of the SPEI that apply, at the moment of sending the extension request, as well as an explanation of the causes and type of problem for which it makes the request and the requested time expressed in minutes.” “39a. Resolution of the request for extension of hours.- Once the Administrator has analyzed and evaluated the request for extension of hours presented by the interested Participant, the Administrator will carry out a comparison of: i) the information provided by said Participant, in accordance with what is provided in the 37a. of these Rules, with ii) a proportion of the average daily amount operated in the SPEI in the twelve months prior to the month in which the request is made and, on the other hand, it will take into account possible effects on the efficiency and security of the SPEI. Based on the foregoing, the Administrator will resolve whether it is appropriate to grant the extension of hours requested by the interested Participant. Said extension will be applicable to all Instances of the SPEI provided for in the Manual. ... The Administrator will inform all Participants of the extension of the operating hours referred to in this Rule, through the electronic or telecommunications means that the Administrator itself establishes for this purpose, in which case the Participants must remain connected to the Instances of the SPEI in which it operates until the closing of operations time that the Administrator informs them, during which they must operate under ordinary conditions in terms of these Rules. ...” “43a. Mechanism for collaboration for the protection of Issuing Clients and Indirect Issuing Clients.- Participants must enter into a Collaboration Agreement for the Protection of Issuing Clients under which said Participants agree among themselves the procedure they must follow for the presentation of support requests to Receiving Participants, in order to provide protection to Issuing Clients, as well as, as applicable, to Indirect Issuing Clients, in the event that Transfer Orders Accepted by SPEI that have not been requested by said Clients or Indirect Issuing Clients are processed. Participants may determine the conditions of the aforementioned collaboration agreement in the Participants forum or by any other means that Participants agree upon for this purpose. In the event that Participants have Clients with the status of Indirect Participants, said Participants will carry out the corresponding actions in accordance with the Collaboration Agreement for the Protection of Issuing Clients, with respect to those Clients, as well as the Indirect Clients of these latter in all matters related to the application of that agreement. Participants must request prior authorization from the Administrator for the celebration of the Collaboration Agreement for the Protection of Issuing Clients or for any modification to it. The Administrator's authorization will not be required for the adherence of a new Participant to the Collaboration Agreement for the Protection of Issuing Clients previously celebrated by the other Participants. For the Administrator's authorization referred to, Participants must attach to their request the draft agreement, which must contain, at least, the following information: I. ... II. ... a) Attend the support requests presented by the respective Clients, directly or, as applicable, as a result of the requests that, in turn, are presented to them by their Indirect Clients; b) and c) ... III. a V. ... VI. The mechanism for the return to Issuing Clients of the resources corresponding to the Transfer Orders Accepted by SPEI credited to the respective Client Accounts. In the event that the respective Participants have sufficient elements to presume that a Transfer Order Accepted by SPEI is part of a possibly fraudulent operation, the Receiving Participant in question must send a Transfer Order of the type return of a transfer credited to the Client Account or late return of a transfer credited to the Client Account, in accordance with what is provided in the 28a. and 29a. of these Rules, respectively;

46 DIARIO OFICIAL Wednesday, March 23, 2022 VII. ... VIII. The procedure to establish the responsibilities of each Participant who subscribes to the Collaboration Agreement for the Protection of Issuing Clients, as well as the procedure to be followed in case of disputes. The individuals who subscribe to the Collaboration Agreement for the Protection of Issuing Clients on behalf and in representation of the respective Participants must have sufficient authority at the time of subscription to bind those Participants under the terms and conditions established in said agreement. ...” “45a. Contingencies.- In the event that any event occurs that affects the normal operation of the SPEI or of any of the SPEI Instances, and the integrity or security of the SPEI is put at risk, the Administrator may: I. Suspend the connection of a Participant in one or more of the SPEI Instances; II. Instruct any Participant to suspend the sending of Transfer Orders through one or more SPEI Instances; III. to V. ... VI. Notify all Participants, through the electronic communication means established in the Manual, notices regarding situations in which they must elevate their monitoring and alert mechanisms with respect to fund transfers processed through the SPEI, under the terms and subject to the conditions that, for this purpose, the Manual establishes; VII. Instruct a Participant on the technical parameters that the latter must observe to re-establish its connection to the SPEI in accordance with the procedures established in section 5 of the Manual, or VIII. Instruct Participants or only some or some of them to transfer the operation, through the electronic or telecommunication means that the Administrator itself establishes for this purpose, within section 5 of the Manual. Participants must participate in exercises regarding operational continuity measures and strategies that the Administrator determines as mandatory and that must be implemented and operated in response to the events foreseen in these Rules.” “46a. Participant Contingencies.- In the event that a Participant experiences any event that affects its operation with the SPEI or detects any irregular circumstance in its operation with it, when the duration of said event is more than thirty minutes, the Participant must notify the Administrator by telephone to the Administrator's operational contacts established in section 10 of the Manual and, subsequently, through a communication digitally signed by the SPEI regulatory compliance officer, the SPEI information security officer, or their respective substitutes, in accordance with what is provided in Annex B of Appendix M of the Manual and sent in terms of what is established in Rule 98a. ... Additionally, in the event that a Participant identifies any imminent threat to the operation of the SPEI, such as, among others, the presence of malicious codes, attacks on its Technological Infrastructure, or the commission of acts linked to possible frauds, the Participant must notify these facts to the Administrator immediately upon detection, by telephone to the Administrator's operational contacts established in section 10 of the Manual and, additionally, within sixty minutes following the identification of the threat, through a communication digitally signed by the SPEI regulatory compliance officer, the SPEI information security officer, or their respective substitutes, in accordance with what is provided in Annex A of Appendix M of the Manual and sent in terms of what is established in Rule 98a. When a Participant falls under the contingency scenarios foreseen in the first and third paragraphs of this Rule and has Clients with the status of Indirect Participants, it must inform the latter of such contingency events. The communication by which Indirect Participants are notified regarding the contingency must be sent within sixty minutes following the emergence of the referred event, the detection of the irregular circumstance, or the identification of the security threat in the operation of the SPEI, as applicable, indicating in detail whether the impact occurs within the Participant's own infrastructure, including the Technological Infrastructure.

Wednesday, March 23, 2022 OFFICIAL GAZETTE 47 Technological Infrastructure, through the communication channels that they have previously established for such purposes in the Indirect Participation Services Contract. In those cases where an event occurs in a Participant that affects its operation or connection with one or more SPEI Instances, said Participant shall be obligated to: I. Execute the contingency procedure known as “SPEI Alternate Operation Client” (COA-SPEI), in accordance with the procedures and deadlines foreseen in section 5 of the Manual, and II. Operate in accordance with the procedures and deadlines foreseen in section 5 of the Manual regarding operational continuity. With respect to those mechanisms indicated in the cited section 5 of the Manual that, for their execution, require the Administrator to carry out, on behalf and for the account of the respective Participant, the activities required in the contingency mechanism under which said Participant must operate, the latter must previously celebrate a mandate with the Administrator for such purposes. In the event that the Participant executes the procedure provided in the preceding subsection I, it may only operate through the contingency procedure known as “SPEI Alternate Operation Client” (COA-SPEI) for a maximum continuous period of six months, per event. The Participant may request the Administrator for an extension of said deadline no later than the fifth Banking Business Day prior to the expiration of the referred deadline, detailing the reasons why it has not managed to correct its operation or connection with the SPEI, specifying the period for which it requests the new extension. In the event that, at the end of the six months indicated in the preceding paragraph or, as applicable, the extension period authorized by the Administrator, the Participant is not in conditions to return to operate in the SPEI normally, the latter must implement the actions it has defined in accordance with Rule 58a, subsection II, clause c), numeral 4, of these Rules, for the re-establishment of normal operation, among which may include operation through the contracting of Indirect Participation Services. The Administrator may suspend the Participant's connection to the SPEI until it returns to operate normally through its SPEI Application within the corresponding deadline or may disincorporate it from the SPEI. The Participant that has been suspended or disincorporated in accordance with what is provided in this paragraph may request the lifting of its suspension or its reincorporation to the SPEI, as applicable, once it makes the necessary adjustments to operate in the SPEI normally and comply with the admission requirements whose non-observance gave rise to its suspension or disincorporation. The Participant that, in accordance with Rule 90a of these Rules, at the close of the Calculation Period prior to the one in which it finds itself, has observed a relative participation percentage, determined in accordance with said Rule, greater than three percent, in order to be able to face an event that affects the processing of Transfer Orders, must execute contingency procedures in accordance with the specifications foreseen in Appendix AI of the Manual, starting from three hundred sixty-five natural days counted from the day immediately following the one in which it falls under the scenario indicated in this paragraph. Additionally, the Participant referred to in the preceding paragraph must deliver to the Administrator, within one hundred eighty natural days following the expiration of the three hundred sixty-five natural day deadline indicated in that same paragraph, a report with the characteristics foreseen in Rule 74a of these Rules, which accredits compliance with the information security, operational risk management, and certification requirements established in subsections I, II, and III of Rule 58a of these Rules, applicable to the infrastructure used by the Participant to execute the contingency procedures established in accordance with the preceding paragraph. Bank of Mexico, acting on its own behalf and account or in its capacity as trustee in any trust, and the operator of an international system for the settlement of foreign exchange operations that include the national currency among the participating currencies, shall be exempt from what is established in the two immediately preceding paragraphs. The Participant that has received authorization or instruction from the Administrator to operate through one of the contingency procedures established by it may not provide Indirect Participation Services to its Clients while the contingency lasts and shall be exempt from observing the processing times indicated in Rules 17a, 19a, 20a, 25a, 27a, and 30a of these Rules and, in their place, must: I. to II. ...

48 OFFICIAL GAZETTE Wednesday, March 23, 2022 III. ... a) Those received by the Participant that does not have the status of Credit Institution, electronic payment fund institution, or Clearing House for Transfers Through Mobile Devices, and said reception occurs from 17:00:00 hours of any Banking Business Day and 05:59:00 hours of the following Banking Business Day corresponding to the SPEI operation day. In this case, the Participant must send the respective return of the Transfer Order Accepted by SPEI not credited to the Client Account in question no later than 08:00:00 hours on the same SPEI operation day referred to above; b) Those received by the Participant that has the status of Credit Institution and maintains less than three thousand deposit accounts for sight funds or electronic payment fund institution and maintains less than three thousand electronic payment fund accounts, in accordance with what is provided in Rule 15a of these Rules, and said reception occurs from 17:00:00 hours of any Banking Business Day and 05:59:00 hours of the following Banking Business Day corresponding to the SPEI operation day. In this case, the Receiving Participant of the respective Transfer Order must send the return of the Transfer Order Accepted by SPEI not credited to the Client Account in question no later than 08:00:00 hours on the same SPEI operation day referred to above; c) and d) ... e) Those received by the Participant that has the status of Credit Institution or Clearing House for Transfers Through Mobile Devices for amounts greater than twenty-one thousand pesos, and said reception occurs from 16:00:00 hours of any Banking Business Day and 05:59:59 hours of the following Banking Business Day corresponding to the SPEI operation day. In this case, the Participant must send the respective return of the Transfer Order Accepted by SPEI not credited to the Client Account in question no later than 08:00:00 hours on the same SPEI operation day referred to above. IV. and V. ... VI. Send the return of the Transfer Order Accepted by SPEI credited to the Client Account referred to in Rule 30a of these Rules, no later than sixty minutes following the moment in which the Participant receives the corresponding Sending Request from its Beneficiary Client, or within the deadline agreed in the Collaboration Agreement for the Protection of the Issuing Client. In the event that the Participant falls under any of the scenarios of subsections I and II of Rule 9a Bis. of these Rules and operates through the contingency procedure known as “SPEI Alternate Operation Client” (COA-SPEI), it must suspend the processing of CoDi Transfer Orders, through any of the SPEI Instances where it uses that contingency procedure, starting from the moment it begins to execute said procedure and inform its Clients about this situation through the computer programs referred to in Rule 9a Bis., as well as by the means they have agreed upon for this purpose. Once the Participant re-establishes its connection through its SPEI Application, it must restart the processing of CoDi Transfer Orders, which it must inform its Clients about by the means referred to above. ...” “46a. Bis. Information Retransmission.- Participants shall be obligated to maintain in their SPEI Applications the information that allows knowing, at all times, the position of the last complete message received in each SPEI Instance in which they must remain connected, in accordance with what is indicated in section 5 of the Manual. ... The Participant that requests the retransmission of information in accordance with the preceding paragraph must pay the Administrator a consideration for this concept no later than the tenth Banking Business Day of the month immediately following the one to which the request for retransmission of the information corresponds. The consideration shall be determined as part of the fee for the use of the SPEI in accordance with the rate per bytes retransmitted in terms of what is established in Rule 90a of these Rules.

Wednesday, March 23, 2022 OFFICIAL GAZETTE 49 In the event that the Participant requires the retransmission of messages sent and received on an SPEI operation day prior to the one in which it finds itself, it may present to the Administrator, in terms of what is established in Rule 98a of these Rules, the request for said information in accordance with the model contained in the Manual. In this case, the Administrator will retransmit only the messages sent and received that derive from Transfer Orders. ... For the purposes of what is provided in this Rule, it shall be understood that a retransmission of the information subject to the payment of the consideration referred to in the immediately preceding paragraph is requested, in cases where it concerns information that has previously been delivered by the Administrator.” “46a. Bis 1. Re-establishment of Operation.- The Participant that re-establishes normal operation with the SPEI, after an event that affected said operation or its connection to the SPEI has occurred, must synchronize its systems to the SPEI starting from the position of the last complete message received through the corresponding SPEI Instance. Additionally, said Participant may perform the synchronization at an earlier position, in case the Participant itself so determines. In the event that the Participant requests the Administrator, in accordance with Appendix AM of the Manual, the possibility to connect starting from a position advanced from the last valid position from which it disconnected from the SPEI and the Administrator authorizes it, said Participant shall have the obligation to verify the information of those operations that had been processed between the last valid position in which it was connected and that from which it re-established the connection. In the event that, having obtained the authorization referred to in the preceding paragraph, the Participant does not request the Administrator, in accordance with the mechanisms established in the Manual for these purposes, the information of those operations that are between the last position in which it disconnected and that position from which it re-established the connection, said Participant shall be responsible for any operational and financial repercussions that may arise as a consequence of its omission.” “47a. Communication with the SPEI.- ... Additionally, the Participant must implement the connection scheme indicated by the Administrator to connect with it and operate with the corresponding SPEI Instances. In the event that Participants wish to provide services related to the processing of Transfer Orders through the SPEI through any standardized computer application programming interface, they must do so in accordance with what is established in Appendix AO of the Manual or obtain from the Administrator, by presenting a request, the authorization of any scheme that meets the characteristics established in the mentioned Appendix.” “48a. Connection with the SPEI.- ... In any case, each Participant must maintain its connection with the SPEI in accordance with the annual availability indices measured for each SPEI Instance defined in section 5 of the Manual. In the event that, for any circumstance, the Participant loses the connection, it shall be obligated to re-establish said connection with the SPEI in terms of what is provided in the Manual, as well as inform the Administrator in accordance with what is established in Rule 46a of these Rules.” “49a. Bis. Observance of the Manual.- Participants must comply with the specifications established in the Manual in terms of the modifications the Administrator makes and notifies to Participants through the communication channel established for this purpose. For these purposes, the Administrator will include in the Manual the list of all modifications made since its issuance, as well as the dates on which they enter into force.” “CHAPTER IV Fund Management in SPEI Accounts” “50a. Funding of SPEI Accounts.- The SPEI Accounts of each Participant, which are not Alternate SPEI Accounts, may be credited under the following terms: I. Regarding those SPEI Accounts of the Participant that is the holder of a Single Account or current account in the SIAC-BANXICO, through transfers instructed by the Participant itself through the SIAC-BANXICO, in terms of the Provisions; II. Regarding that SPEI Account of the Participant that acts as the depositor of the S.D. INDEVAL Institution for the Deposit of Securities, S.A. de C.V., through transfers instructed by the depositor itself through the DALÍ system; III. Regarding those SPEI Accounts of all Participants, including those indicated in the preceding subsections I and II, through credits resulting from Transfer Orders that

50 OFFICIAL GAZETTE Wednesday, March 23, 2022 send other Participants in favor of the Participant in question, through the same Instance of the SPEI of said SPEI Accounts, and IV. In the case of those SPEI Accounts of the Participant that it holds in more than one of the SPEI Instances and that does not have a current account in the SIAC-BANXICO, said SPEI Accounts may be funded using the resources that said Participant has in the SPEI Account of any other SPEI Instance, in accordance with what is established in the 50a. Bis. of these Rules.”

“50a. Bis. Funding between SPEI Accounts for Participants who do not have an account in SIAC-BANXICO.- The Participant who does not have a Single Account or a current account in the SIAC-BANXICO may fund its SPEI Account of which it is the holder, with the resources that are found in another SPEI Account of which it is also the holder. The Participant shall carry out the foregoing by sending, from the SPEI Account corresponding to an SPEI Instance with which it is intended to fund the SPEI Account of another SPEI Instance, through a Third-to-Third Transfer Order to the account in the Administrator that the latter indicates, in accordance with the procedure provided for in section 5 of the Manual. The Administrator will process said Transfer Order and generate a new Third-to-Third Transfer Order that will be sent to the SPEI Account in the SPEI Instance that the Participant wishes to fund. For the execution of the process established in the preceding paragraph, the Participant must generate, within its own infrastructure, an account in its name, exclusive for the funding of the SPEI Accounts that it holds.”

“51a. Balances at closing.- The amounts corresponding to the balances that result in the SPEI Accounts in the different SPEI Instances of the Participants who have the status of Credit Institution, as well as of the Alternative SPEI Accounts of these, will be transferred, at the closing of SPEI operations, to their Single Account. In the case of other Participants other than Credit Institutions, the Administrator will maintain the resources corresponding to the balances of their respective SPEI Accounts at the closing of operations in a concentrator account in the SIAC-BANXICO, without generating interest, and will credit them in said SPEI Accounts according to the schedule indicated in section 3 of the Manual. Said resources will be credited in the SPEI Accounts at the next start of SPEI operations in the proportion that the Participant itself requests from the Administrator in accordance with the procedure established in Appendix AK of the Manual.”

“51a. Bis. Accounts for CoDi Transfers.- The Participant that offers its Clients the receipt of CoDi Transfer Orders, in order to make the respective credits in the Client Accounts that correspond to them as Beneficiary Clients, must send to the Administrator, in the form and terms established for this purpose in Appendix AE of the Manual, the amount that corresponds to it in accordance with what is indicated in said Appendix, in order to generate the Transfer Orders to verify said Client Accounts, as well as those of the Indirect Beneficiary Clients whose Clients that provide Indirect Participation Services indicate to it, in accordance with what is provided in the following paragraph. For the purposes of what is provided in the preceding paragraph, the Administrator will maintain the aforementioned resources in the SPEI Accounts corresponding to the SPEI Instance that, solely for the purpose of using said resources to generate, in the name of the Administrator itself, the referred Transfer Order for one cent of a peso, in order to verify the Client Account corresponding to the respective Beneficiary Client that has been registered through the computer program for the generation of Payment Collection Messages, or the Client Account corresponding to the respective Indirect Beneficiary Client, in accordance with the data included in the respective Electronic Payment Receipt that has been obtained as a result of said Transfer Order. At the closing of SPEI operations, the Administrator will transfer the balance of the SPEI Accounts mentioned in the immediately preceding paragraph to a concentrator account that, for such purposes, the Bank of Mexico holds in its capacity as Central Bank. The resources deposited in said account will not generate interest and will be credited again in the SPEI Accounts provided for in the preceding paragraph, on the next SPEI operation day. In the event that the Participant does not have sufficient resources in the respective SPEI Account to carry out the indicated transfers, the Administrator, without any responsibility on its part, will abstain from carrying out the referred validation, in which case the holders of the Client Accounts corresponding to Beneficiary Clients who have requested to generate Payment Collection Messages without carrying out the referred validation will be prevented from doing so.”

Wednesday, March 23, 2022 OFFICIAL GAZETTE 51 “52a. Functions of the Operators.- ... I. Execute the connection of the SPEI Application(s) that the Participant requires to operate in the SPEI; II. to IV. ...”

“53a. Request for registration of Operators.- Only those persons who the respective Participant registers with that status before the Administrator may act as Operators. For this, each Participant must present to the Administrator, through the Directorate of Operations and Continuity of Payment Systems and Market Infrastructures, a registration request in the terms established in Appendix K of the Manual, which must be digitally signed by the legal representative of the Participant in question who has the authority to perform acts of ownership or to designate those who may act as Operators in the payment systems administered by the Bank of Mexico. Each Participant must verify and keep a record that the persons designated as Operators comply with the following: I. and II. ... In addition to what is provided in the preceding subsections, the Participant must present to the Administrator a letter of no criminal record of the person intended to be registered as an Operator, issued by the Administrative Body for Prevention and Social Readaptation of the National Security Commission or by the federal authority that replaces it, with an issuance date not greater than one year prior to its presentation to the Administrator, which must include the electronic signature of the SPEI compliance officer of the Participant in question in case said letter is prepared in electronic format. In addition, the Participant must present a communication signed by the SPEI compliance officer of the Participant itself, in accordance with the form established in Appendix L of the Manual, in which it indicates that the person intended to be designated as an Operator is not disqualified from holding a job, position, or commission in the Mexican financial system, with an issuance date not greater than one month prior to its presentation to the Administrator. The registration of the person that the Participant in question has communicated to the Administrator will take effect for all SPEI Instances once the Administrator has verified that the request presented in accordance with the foregoing meets the requirements established in this Rule. The sending of the communications referred to in this Rule, by the Participant to the Administrator, must be subject to what is established in the 98a. of these Rules. The person whose registration has been approved may act as an Operator in the SPEI Instances in which the Participant itself operates. For the update of the serial number of the Digital Certificate referred to in subsection II of this Rule, the Participant must request such update to the Administrator, through the Directorate of Operations and Continuity of Payment Systems and Market Infrastructures, in accordance with the form established in Appendix K of the Manual.”

“55a. Request for deregistration of Operators.- The Participant that has registered an Operator with the Administrator may request, at any time, the deregistration of said person by presenting a communication, in the terms established in Appendix K of the Manual, which will imply the deregistration of said Operator in all SPEI Instances. Said communication must be sent to the Administrator in the terms established in the 98a. of these Rules. ... I. to III. ... ...”

“57a. Presentation of admission request.- The interested party wishing to be admitted as a Participant must present its admission request to the Administrator, in addition to the request it must present to the Bank of Mexico to obtain its authorization in terms of what is provided by Circular 13/2017 of the Bank of Mexico. The two requests referred to in this Rule may be presented jointly through the Directorate of Operations and Continuity of Payment Systems and Market Infrastructures. In any case, the admission request must be digitally signed by the general director of the interested party, or by the person occupying the position in the interested party that has under its responsibility the administration functions, or by any official occupying a position of at least two immediate hierarchical levels below that of the aforementioned general director, and must be accompanied by the compliance reports referred to in the 62a. of these Rules, which may also be used as the supporting documentation for the authorization request referred to in Circular 13/2017 of the Bank of Mexico.

52 OFFICIAL GAZETTE Wednesday, March 23, 2022 Prior to the presentation of the admission request, the interested party must present to the Administrator a unilateral confidentiality contract, signed by the legal representative of the interested party itself, in terms of the clauses that the Administrator, through the Directorate of Operations and Continuity of Payment Systems and Market Infrastructures, makes available to interested parties who request it. By virtue of this contract, the interested party must obligate itself to keep strict confidentiality regarding all information, whether expressed orally, in writing, graphically, electronically, or in any other form, that is provided to it by the Administrator related to the SPEI, and to obligate itself to use the information exclusively for the effects provided for in these Rules. Likewise, in said contract, the interested party must obligate itself to give access to the information subject to the same only to the persons necessary for the compliance with these Rules and will be responsible for the use that its personnel, representatives, administrators, directors, employees, agents, dependents, or any person related to the interested party, make of the aforementioned information. Likewise, the interested party must obligate itself to hold the Administrator harmless from any liability incurred derived from the acts it performs in relation to the SPEI or with reference to it, such as, among others, civil, commercial, or any other, as well as for the damages and losses that it could cause to the Administrator or to third parties. ...”

“57a. Bis. Shareholder information.- The admission requests referred to in the previous Rule 57a must be accompanied, with respect to each of the persons who have subscribed the share capital of the respective requesting entities, with the following information: I. The number, series, class, and nominal value of the shares that have been subscribed, as well as the amount and percentage that said titles represent with respect to the share capital of the requesting entity. II. The full name or, in its case, denomination or corporate name, nationality, domicile, tax registry key or identification number before the tax authority of the jurisdiction of its domicile, as well as its corporate purpose, the occupation they perform or activities they carry out. In case there are indirect participation schemes in the share capital of the requesting entity, the Administrator will evaluate the structure of any person or investment vehicle that intervenes in those schemes, such as trusts, mandates, commissions, or other similar figures, that participate directly or indirectly in the share capital of the requesting entity up to the ultimate beneficiaries, for which all of them must present the information referred to in subsection II of this Rule.”

“58a. Requirements for admission as a Participant.- ... I. ... A. ... a) to b) ... c) Policy for the implementation of the SPEI Application, either by the Participant or through an external specialized company in the development of computer programs (software) contracted by it, which contain the following procedures:

1. Procedures that ensure that a formal and documented development process is followed for the implementation of its SPEI Application. The development process must consider, at least, the following stages: i. Design of the SPEI Application. ii. Development of the SPEI Application in accordance with the previous design. iii. Validation of functionalities, purpose, capacity, and quality of the SPEI Application. iv. Implementation of the SPEI Application. v. Formal follow-up to changes in the SPEI Application.
2. ...
3. Procedures that ensure that the components or mechanisms that provide security to its SPEI Application are valid and that their validity is reviewed in accordance with what is specified in Appendix M of the Manual;

Wednesday, March 23, 2022 OFFICIAL GAZETTE 53 4. Procedures that ensure that the security of the SPEI Application is reviewed statically and dynamically; 5. Procedures that allow monitoring, auditing, and tracking the accesses and activities carried out by the different users of the SPEI Application regardless of the level of privileges established for its access and the medium or protocol of access communication. These procedures must consider the safeguarding of the information collected for a period of at least six months, and 6. Procedures that allow monitoring, auditing, and tracking all operations carried out in the SPEI Application. These procedures must consider the safeguarding of the information collected for a period of at least six months. d) ...

1. to 3. ...
2. Procedures that allow detecting the alteration or falsification of the information contained in the SPEI Application;
3. Procedures that allow encrypting sensitive information in the SPEI Application, and
4. Procedures that allow having an inventory of the Technological Infrastructure available in accordance with what is specified in Appendix M of the Manual. e) ...
5. to 3. ...
6. Procedures for the management of access privileges to the SPEI Application, and
7. Procedures that allow monitoring and auditing the accesses and activities carried out by the users of the SPEI Application. These procedures must consider the safeguarding of the information collected for a period of, at least, six months, as well as the attention and follow-up to possible fraud events related to transfers. f) ... B. ... ... II. ... a) and b) ... c) ...
8. A continuity policy, as well as the strategies and procedures that the interested party must follow as a Participant so that, upon the materialization of the contingency scenarios identified in the risk analysis, it can continue with the operation with the SPEI at an acceptable minimum level;
9. to 5. ... III. ... a) To prove that, in case a single SPEI Application is used to interact with the SPEI Instances, it complies with the communication protocol of each of the respective SPEI Instances, in accordance with the specifications indicated in section 7 of the Manual and, in case more than one SPEI Application is used to

54 OFFICIAL GAZETTE Wednesday, March 23, 2022 interact with the different SPEI Instances, prove that each of said SPEI Applications complies with the communication protocol of the SPEI Instance for which it will be used, in accordance with the specifications indicated in said section 7 of the Manual; b) To prove that each of the SPEI Applications to be used process adequately the types of Transfer Orders that must be processed in accordance with these Rules, even when a high volume of them is presented in a short period; c) to e) ... IV. ... V. ... a) to d) ... In addition to what is previously established in this subsection, the interested party wishing to act as a Participant must have a documented policy and procedures that it obligates itself to follow in the matter indicated in the second paragraph of this subsection, in which it includes, at least, the activities it will carry out to identify Client Accounts corresponding to subjects other than financial entities that habitually and professionally offer, exchanges or purchase and sale of virtual assets referred to in article 17, subsection XVI, of the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin. VI. ...”

“58a. Bis. Requirements of the business models of the Participants.- In addition to what is provided in the previous Rule 58a, the interested party must present to the Administrator, as part of the information and documentation accompanying to prove what is indicated in said Rule, a description of the business model in which the interested party will carry out the operations related to the SPEI. Said business model must comply with the following characteristics: I. It must not transfer to other entities the risks of the activities that the interested party carries out as a Participant; II. It must not generate: a) market concentration; b) practices of exclusion of competitors; c) discriminatory treatments, or d) barriers to entry into the market of operations through SPEI; III. It must not promote the segmentation of the fund transfer network through the SPEI and must foster interoperability among its Participants; IV. It must not generate systemic risks, and V. It must be developed in accordance with market best practices. The interested party that is admitted as a Participant must notify the Administrator of any change to the business model that it has informed the Administrator in accordance with what is established in this Rule. In this case, the Participant must evaluate if the referred modifications would generate operational, technical, or legal risks for the Participant itself and if the new business model complies with the characteristics established in the preceding subsections I to V. The referred Participant must notify the foregoing in accordance with the 98a. of these Rules with, at least, thirty calendar days prior to the one in which it implements the modifications to the business model.”

“Section II Responsible for the regulatory compliance and official information security of the SPEI”

“59a. Responsible for the regulatory compliance of the SPEI.- Each interested party requesting its admission as a Participant must designate, in accordance with the model established for these effects in Appendix AB of the Manual, a responsible for the regulatory compliance of the SPEI and its respective substitute, in charge of verifying compliance with the applicable regulations to the SPEI, which it must ratify annually during May, through a written document addressed to the Administrator, through the Directorate of Operations and Continuity of Payment Systems and Market Infrastructures, in terms of said Appendix AB. The interested party must verify that the persons it designates as responsible for regulatory compliance and its respective substitute comply with the following requirements: I. Have a letter of no criminal record issued by the Administrative Body for Prevention and Social Readaptation of the National Security Commission or,

---

Wednesday, March 23, 2022 OFFICIAL GAZETTE 55

in its case, the federal authority that replaces it, with an issuance date not more than one year prior to their designation as the SPEI Compliance Officer, and II. ... ...”

“59a. Bis. SPEI Information Security Officer.- Each applicant requesting admission as a Participant must designate, in accordance with the model established for these purposes in Appendix AB of the Manual, a person to serve as the SPEI Information Security Officer and their respective alternate. The Participant must ratify these designations annually during May, via a written notice addressed to the Administrator, through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, in accordance with the aforementioned Appendix AB. These individuals must have independence with respect to the business units and the computer systems and audit areas of said entity, and must be in charge of the following:

I. Participate in the definition and verify the implementation and continuous compliance with the computer security policies and procedures indicated in Rule 58a., fraction I, sections A and B, regarding Participants, and verify the implementation and compliance with the computer security policies and procedures indicated in 9a. Bis 4., fraction V, of these Rules.

II. to VI. ...

...

In the event that a Participant replaces the person they had designated as the SPEI Information Security Officer or their alternate, said Participant must inform the Administrator of this situation via a written notice sent to the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, no later than the fifth Banking Business Day counted from the day the situation arises, in accordance with what is established in 98a. of these Rules. ...”

“59a. Bis 1. Exclusivity of functions of the SPEI Compliance Officers and Information Security Officers.- Persons designated as the SPEI Compliance Officer or as the SPEI Information Security Officer, and their respective alternates, must dedicate themselves exclusively to the activities indicated in 59a. and 59a. Bis. above, as applicable, in cases where the Participant for whom they provide services falls under any of the following circumstances:

I. During a period of twelve consecutive calendar months:

a) Send or receive three million five hundred thousand or more fund transfers via the SPEI or any other system, including those made between Client Accounts administered by the same Participant;

b) Send or receive fund transfers via the SPEI or any other system, including those made between Client Accounts administered by the same Participant, for an aggregate amount greater than the equivalent of six billion UDIS, calculated according to the value of said unit of account on the last natural day of the calendar month preceding the first month of the twelve-month period for which the calculation of said amount is made;

c) At any time during said twelve-month period, have more than one million Client Accounts corresponding to demand deposit accounts or any other financial product specified in Appendix D of the Manual, which have registered positive balances at any time, or

II. At any time, the Client Accounts that have been opened at the Participant sum a total balance greater than the equivalent of four hundred million UDIS, calculated according to the value of said unit of account on the last natural day of the calendar month preceding the day on which the calculation of said amount is made.”

“60a. Registration with the Administrator.- Each applicant must inform, via a written notice addressed to the Administrator through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, the names of the persons designated as the SPEI Compliance Officer, the SPEI Information Security Officer, and their respective alternates.

56 OFFICIAL GAZETTE Wednesday, March 23, 2022

The SPEI Compliance Officer, the SPEI Information Security Officer, and their respective alternates referred to in the previous paragraph must be designated by the General Manager of the applicant or by the person holding the position at the applicant that has under their responsibility the administration functions. ...”

“62a. Compliance Evaluation.- The applicant submitting the admission request to act as a Participant, in accordance with what is provided in 57a. of these Rules, must demonstrate in said request compliance with the computer security, operational risk management, protection of the Applicant's Issuing Clients, Additional Risks management, and interoperability requirements to operate with the SPEI established in fractions I, II, IV, V, and VI of Rule 58a., as well as in 58a. Bis. and 68a. of these Rules. For these purposes, the applicant must attach to the aforementioned admission request, in the terms established in Appendix N of the Manual, the following documentation:

I. to III. ...

The reports referred to in this Rule must be sent to the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures in the terms established in Appendix N of the Manual. ...”

“66a. Alternate Account Agreement.- Credit Institutions that have signed the Contract to operate in the SPEI may sign the corresponding agreement with the Administrator to operate an Alternate Account of the SPEI, provided they meet, to the satisfaction of the Administrator, the requirements established in fractions I, II, and III of 58a. of these Rules. Said Credit Institutions must communicate their interest in operating an Alternate Account of the SPEI through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, in accordance with what is established in 98a. of the Rules.”

“69a. Request for reduction of resource requirement.- Participants whose resource requirement referred to in 68a. of these Rules results in greater than zero may request that the Administrator authorize a lower amount corresponding to said requirement. Participants interested in obtaining authorization for the aforementioned reduction must present their request to the Administrator through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, in accordance with what is established in 98a. of these Rules and the form provided in Appendix W of the Manual. ...”

“70a. Balances in Client Accounts.- ...

I. and II. ...

For the purposes of this Rule, the Participant must send, quarterly, a report to the Administrator of the number of Issuing Clients who can instruct Transfer Orders, which will be used for the aforementioned calculation. Said report must be signed by the SPEI Compliance Officer, addressed to the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, and sent to the Administrator in terms of what is established in 98a. of the Rules.”

“71a. SPEI Transfer Services.- ...

I. ...

a) ...

b) Based on objects that only the Client possesses. They are composed of information obtained from, for example, dynamic one-time password generator devices, a card chip, or mobile devices pre-registered with the Participant. In the event that Participants decide to use these identity verification elements through devices whose main function is the generation of dynamic one-time passwords, they must provide said devices to the Clients with whom they agree on the submission of Send Requests via Electronic Channels;

c) Based on the inherent characteristics of the Client. They are composed of information derived from the Client's own characteristics (biometric), such as live retinal scanning, live fingerprint scanning, facial recognition, among others.

Wednesday, March 23, 2022 OFFICIAL GAZETTE 57

I Bis. ...

II. To allow the initiation of a session in Electronic Channels, Participants other than Credit Institutions must request and validate, at least: i. the Issuing Client identifier, which must be unique for each Issuing Client and have a minimum length of 6 characters. In the case of the submission of Send Requests through ATMs, the Client identifier may be the debit or electronic payment funds card delivered by the Participant to the Issuing Client, and ii. at least one verification element from those included in subsections a), b), or c) of fraction I of this Rule.

III. ...

IV. Each time the Issuing Client intends to execute the instruction of a Send Request, they must be asked for a second identity verification element corresponding to those provided in the previous fraction I, in addition to those used for the initiation of sessions in Electronic Channels, with the exception of Send Request instructions for an amount up to twenty-one thousand pesos, in which the Participant may not require their Issuing Clients to use a second verification element. ...”

“72a. Permanence Requirements in Additional Risks.- ...

I. Collect from each Client who performs operations through the SPEI, at least, their name, denomination, or corporate name, as well as the Unique Population Registry Key (CURP) or the Federal Taxpayer Registry key for natural persons and legal entities, with homoclave for the latter, except in the case that Clients, due to their nature, cannot have these data, and must include this information in the Transfer Orders generated from the Send Requests presented by the Issuing Clients.

Likewise, Participants must collect the identification data referred to in the preceding paragraph from Indirect Clients, through the Clients to whom they provide Indirect Participation Services, and include this information in the Transfer Orders generated from the Send Requests presented by said Issuing Clients, in their capacity as Indirect Participants;

I Bis. ...

a) to c) ...

...

The Participant referred to in this fraction I Bis will be responsible for compliance with the requirements established in this same fraction;

I Ter. Regarding Clients that have the status of Indirect Participant, these may only correspond to one of the entities indicated in Rule 9a. Bis 1., first paragraph, above, subject to Participants collecting the same information and documentation regarding said Clients as the general provisions referred to in article 115 of the Credit Institutions Law establish for those Clients that are legal entities and have a risk degree other than low, as determined in accordance with said provisions.

Without prejudice to what is provided in the previous paragraph, each Participant may only provide Indirect Participation Services to the Clients indicated in this fraction, when the latter collect the same information and documentation as the general provisions referred to in article 115 of the Credit Institutions Law establish, at least, for those Clients that are holders of level 2 money deposit accounts offered by said institutions, regarding the Indirect Clients subject to said services;

II. Notify the Administrator regarding the imposition of any sanction provided for in 58a., fraction V, first paragraph, subsection a), of these Rules, by their supervisory commission, no later than the fifth Banking Business Day following the day on which the Participant receives the notification of said sanction. The notification to the Administrator must indicate the impact that the behaviors observed by said commission could cause in the compliance with the requirements established in these Rules and must be signed by the SPEI Compliance Officer. The Participant must send the notification in the terms established in 98a. of these Rules;

II. Bis. Regarding Clients with whom Participants have signed an Indirect Participation Services Contract and who are subject to regulation and supervision in matters of prevention and detection of acts, omissions, or operations that could favor, provide help, aid, or cooperation of any kind for the commission of any of the crimes provided for in articles 139 and 148 Bis of the Federal Penal Code or that could fall under the circumstances of article 400 Bis of the same Code, said Participants must notify the Administrator regarding the imposition of any final sanction on the referred Clients for infringements to said regulation, no later than the fifth Banking Business Day following the day on which the Participant becomes aware of said sanction. The notification sent by the Participants to the Administrator must indicate the impacts that the sanctioned behaviors could cause in the compliance with these Rules, be signed by the SPEI Compliance Officer, and be sent in the terms established in 98a. of these Rules;

III. and IV. ...

V. Refrain, as part of the services offered to those Clients provided for in the previous fraction I Ter, from issuing Transfer Orders in the name of the Participant in question and on behalf of third parties, for the credit of the corresponding resources in any of the accounts of said Clients opened at the same Participant or at any other, when the Administrator so requires in terms of what is provided in 9a. Bis 6. of these Rules. ...”

“73a. Functions of the SPEI Compliance Officer.- Each Participant, while maintaining said status, must always maintain the SPEI Compliance Officer and their alternate, referred to in 59a. of these Rules, to whom they must entrust and ensure performs, at least, the following functions:

I. Submit an annual written report, in the month of July, to the Participant's audit committee in case it has such a committee, and to the Clients to whom, in their case, they provide Indirect Participation Services, containing the findings and, in their case, irregularities and non-compliances with the internal SPEI norms identified in the period from June of the year prior to June of the current year, as well as other applicable SPEI regulations, the actions adopted to correct them, and the degree of progress and efficiency of such actions. Additionally, the Participant must send to the Administrator a copy of the report referred to in this fraction and the receipt confirmation by the Participant's audit committee, through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, no later than the fifteenth Banking Business Day following the day on which they submitted the mentioned report to said committee.

The obligation to deliver the report referred to in this fraction will begin after one hundred eighty natural days have passed from the date of admission as Participants, in accordance with 64a. of these Rules;

For those Participants that provide Indirect Participation Services in the SPEI, the report indicated in the first paragraph of this fraction I must correspond to the operation carried out by said Participant in their capacity as a Participant in the SPEI and as a provider of Indirect Participation Services. Additionally, in said report, the elements with which the Participant guarantees the review of the operation of the Clients to whom they provide Indirect Participation Services must be indicated, and they ensure that said Clients operate in accordance with what is established in the Indirect Participation Services Contract, these Rules, the Manual, and other applicable regulations, including the control scheme and the application of coercive elements that have been agreed upon for such effects with the Clients to whom they provide Indirect Participation Services, and

II. Prepare a written report when they detect any irregularity or non-compliance with the internal SPEI norms, no later than the Banking Business Day following the day on which said irregularity or non-compliance is detected. In the event that the SPEI Compliance Officer reports directly to the SPEI Compliance Officer of the Participant, they must present said report to the latter. In case that, in accordance with what is provided in 59a. of these Rules, the SPEI Compliance Officer is the same as the Participant's Compliance Officer, said report must be presented to the audit committee and inform the Indirect Participants in cases where applicable. In this latter case, if the Participant does not have an audit committee, the report must be presented to the General Manager or equivalent, and to the Administrator in the terms established in 98a. of these Rules.

In the event that a Participant replaces the person they had designated as the SPEI Compliance Officer or their alternate, said Participant must inform the Administrator of this situation via a written notice sent to the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, no later than the fifth Banking Business Day counted from the day the situation arises.

Likewise, the Participant must inform the Administrator about the designation of the new SPEI Compliance Officer or alternate no later than the tenth Banking Business Day following this appointment, in terms of what is established in 60a. of these Rules. ...”

“74a. Periodic Report and Evaluation.- Each Participant must verify the compliance that they, as well as the Clients to whom they provide Indirect Participation Services, must give to the computer security, operational risk management, and protection of the Participant's Issuing Clients and the Indirect Issuing Clients of their Indirect Participants, Additional Risks, and interoperability requirements to operate in the SPEI established in 58a. of these Rules, as well as the business model or scheme provided for in 58a. Bis. and 9a. Bis 5., fraction III, respectively. Likewise, each Participant must inform the Administrator about any other risk identified, through reviews that must be conducted every two years, alternately, by the head of the internal audit area of the Participant themselves and the Independent External Auditor(s), in the immediate next evaluation period. Said reviews must observe what is provided in fractions II and III of 62a. of these Rules. In the event that the Participant does not have an internal audit area, the respective Independent External Auditors must conduct the aforementioned reviews in all cases, in the two-year periods referred to.

In the report that the Participant presents to the Administrator, if they provide Indirect Participation Services, it must include, in case they provide such services, the results of the audit performed on them as a provider of said services and a list of corrective measures and contractual penalties applied to the Clients to whom they provide said services, as well as the facts, circumstances, and reasons that motivated them. Regarding the compliance and verification of the operation of their Indirect Participants, the Participant in question must include, in the report they present to the Administrator, the degree of compliance of their Indirect Participants and must keep at the disposal of the Administrator, when so required, all information and evidence supporting said degree.

...

The report and confirmation referred to in the previous paragraph must be sent through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, in terms of what is established in Appendix N of the Manual, within sixty natural days following the closing of the exercise in question. ...”

“75a. Compulsory Compliance Plan.- In the event that, as a result of the review carried out by the Administrator on a Participant or of the results of the reviews carried out by the head of the internal audit area of the Participant themselves and the Independent External Auditor(s) in accordance with the previous Rule 74a., the Administrator detects irregularities or non-compliances with these Rules, they may require the Participant to present a compulsory compliance plan in which the actions that the Participant obligates themselves to adopt to correct the detected irregularities or non-compliances are provided, as well as the deadline in which they will be carried out and the persons responsible for attending to each of them. To this effect, the Participant must submit the compulsory compliance plan for approval by the Administrator, through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures. ...”

“75a. Bis. Update of shareholder information. When any person intends to acquire directly or indirectly more than five percent of the paid ordinary share capital of a Participant, or to grant a guarantee on the shares representing said percentage, the Participant must notify thereof

60 OFFICIAL GAZETTE Wednesday, March 23, 2022

the Administrator. In these cases, the Participant must provide the Administrator with information regarding the persons who intend to carry out the mentioned acquisition or encumbrance.

In the event that a person or a Group of Persons, whether or not shareholders, intends to acquire twenty percent or more of the shares representing the social capital of a Participant or to obtain Control of the latter, the Participant must inform the Administrator thereof and include the list or information of the person or persons who intend to obtain Control of the Participant in question, to which must be attached the information indicated in Rule 57a Bis of these Rules.

The provisions of this Rule shall not apply when the persons mentioned above have the status of a financial entity supervised by any of the national supervisory commissions, or if these are shareholders of said entities and their participation was authorized in a period not greater than five years prior to their request, in which case they must present a sworn statement to the effect that their financial situation has not changed with respect to that previously sent to the aforementioned commissions, such that it prevents them from carrying out the acquisition in question.”

“77a. Independence requirements.- The Independent External Auditors who evaluate the level of compliance that the interested parties and the Participants give to the requirements referred to in these Rules, as well as the respective Firms to which they belong, must be independent on the date of celebration of the service provision contract and during the development of the audit. It will be considered that there is no independence when the person or the Firm in question falls under any of the following circumstances:

I. ... a) to f) ... g) Any other that implies or could imply conflicts of interest with respect to the external audit work.

II. The income that the Independent External Auditor receives or will receive for carrying out the evaluation of the interested party or Participant depends on the result of the evaluation itself or on the success of any operation carried out by the interested party or Participant itself that has as its support the certification of the Independent External Auditor;

III. The income received by the Firm from the interested party or Participant, its holding company, subsidiaries, associates, affiliates or the legal entities that belong to the same Business Group, derived from the provision of their services, represent in their entirety ten percent or more of the total income of the Firm during the year immediately preceding that in which it intends to provide the service;

IV. The Firm, Independent External Auditor or any partner or employee of the Firm has been an important client or supplier of the interested party or Participant, its holding company, subsidiaries, associates or affiliates, during the year immediately preceding that in which it intends to provide the service.

An important client or supplier is considered to be one when its sales or, in its case, purchases to the interested party or Participant, its holding company, subsidiaries, associates or affiliates, represent in their entirety ten percent or more of their total sales or, in its case, total purchases;

V. The Independent External Auditor or any partner of the Firm in which they work are or have been during the year immediately preceding their designation as auditor, board member, general manager or employee holding a position within the two levels immediately below the latter of the interested party or the Participant, its holding company, subsidiaries, associates or affiliates;

VI. The Independent External Auditor, the Firm in which they work, any partner or employee thereof, the spouse, the concubine, the concubine or economic dependent of the aforementioned natural persons have investments in shares or debt securities issued by the interested party or the Participant, its holding company, subsidiaries, associates or affiliates, credit instruments that represent said values or derivatives that have them as underlying, except when it comes to fixed-term deposits, including withdrawable deposit certificates on predetermined days, bank acceptances or promissory notes with yield liquidated at maturity, provided that these are contracted under market conditions. The foregoing is not applicable to the holding of shares representing the social capital of investment companies;

VII. The Independent External Auditor, the Firm in which they work, any partner or employee thereof, the spouse, the concubine, the concubine or economic dependent of the aforementioned natural persons maintain with the interested party or the Participant, its holding company, subsidiaries,

Wednesday, March 23, 2022 OFFICIAL GAZETTE 61

associates or affiliates, debts for loans or credits of any nature, except when it comes to credit card debts, for financing destined for the purchase of durable consumer goods and for mortgage credits for the acquisition of real estate, provided that these are granted under market conditions;

VIII. The interested party or the Participant, its holding company, subsidiaries, affiliates or associates have investments in the Firm that carries out the audit;

IX. The Independent External Auditor, the Firm, any partner or employee thereof falls under any of the circumstances provided for in the Professional Ethics Code of the professional college recognized by the Ministry of Public Education to which they belong or, in its absence, that issued by the Mexican Institute of Public Accountants, A.C., as causes of partiality in the judgment to express their opinion and that are not provided for in these Rules, and

X. The Firm of which the Independent External Auditor is a partner has pending accounts receivable with the interested party or the Participant for fees derived from the audit service or for any other service.”

“78a. Voluntary disincorporation.- The Participant may request the Administrator, through the Direction of Operation and Continuity of Payment Systems and Market Infrastructures, its authorization to cease acting as a Participant. The aforementioned request must be submitted in writing to the aforementioned Direction, at least three Banking Business Days in advance of the date on which the Participant intends for its disincorporation as a Participant to take effect.

...”

“82a. Service availability.- The Participants who hold Client Accounts and who, in turn, have agreed with said Clients to process, as Issuing Participants and charged to said accounts, the Sending Requests that such Clients transmit to them, must provide their service for these effects, at least, with the availability of their respective corresponding systems corresponding to the annual availability indices defined in section 5 of the Manual, for the respective Instances of the SPEI in which they carry out their operations.”

“83a. Information on Transfer Orders Accepted by SPEI.- ...

I. ... a) to c) ... d) The CLABE, the debit card number, electronic payment fund number or the ten digits of the mobile phone line number indicated in the Transfer Order to identify the respective Client Account corresponding to the Beneficiary Client;

e) Name, denomination or corporate name of the respective beneficiary, as it has remained indicated by the Issuing Client in the respective Sending Request, followed by the following phrase: “(Data not verified by this institution)”. With respect to CoDi Transfer Orders, the name, denomination or corporate name of the respective beneficiary will be that included in the Digital Payment Message that gave rise to said CoDi Transfer Orders, in which case, the aforementioned phrase shall not be included. Likewise, with respect to those Transfer Orders that have been generated as a result of Sending Requests in which only the ten digits of a cellular phone number have been indicated as contemplated in Rule 12a Bis of these Rules, the Issuing Client will be provided with the name, denomination or corporate name of the respective beneficiary in such a way that only the initials of that name or, in its case, the denomination identifiers established in Appendix AR of the Manual are shown;

f) to h) ...

i) With respect to CoDi Transfers, the information of the field “Digital Payment Scheme Folio” in accordance with Appendix AD of the Manual.

II. and III. ...”

“84a. Method of making information relative to Transfer Orders Accepted by SPEI known.- ...

62 OFFICIAL GAZETTE Wednesday, March 23, 2022

I. and II. ...

III. In addition to what is provided in the preceding subsections, Participants must include the information referred to in the previous Rule in the respective websites that they have made available to their Clients for queries of movements in the corresponding Client Accounts and for queries of the Transfer Orders that they have processed, as well as in the Electronic Channels corresponding to the telecommunications mobile device, or any other that they have made available to their respective Clients so that they can present Sending Requests and said means, in turn, allow them to consult the details of the movements of the respective Client Accounts that they hold. Regarding this, Participants must include said information in the referred means, at the latest sixty seconds after the Administrator has made the respective Settlement Notice of the Transfer Order in question available to the Participant, as well as keep it for consultation in said means for a period of no less than three months after that in which the aforementioned settlement was carried out. Participants will be exempt from including the referred information when the Issuing Clients have presented the Sending Requests through automated teller machines;

IV. ...

V. The Receiving Participant must establish a means to attend to the information requests of its Beneficiary Clients of Transfer Orders Accepted by SPEI on which the Administrator has made available to it through the SPEI the respective Settlement Notice. In this means, the Participant must inform its Beneficiary Clients, if applicable, the reasons why the amounts corresponding to said Transfer Orders Accepted by SPEI have not been credited to their respective Client Accounts. The Participant must provide this information free of charge to the referred Client;

VI. They must include on their website a page, and place an electronic link to it through the Electronic Channels, with the exception of automated teller machines, that they make available to their Clients, in which they detail the procedure that their Clients must follow for the purpose of presenting requests for clarification, queries on the status or complaints related to a Sending Request or Transfer Order Accepted by the SPEI, and

VII. Participants must enable, in their computer programs, a section in which their Clients can consult the status of the CoDi Transfer Orders they have made, at least, in the last three months, listed in the order indicated by the Client, in accordance with what is provided in Appendix AD of the Manual.”

“85a. Access to Electronic Payment Receipts.- The Participants referred to in Rule 83a of these Rules who have agreed with those Clients referred to in said Rule to carry out operations through Electronic Channels, must include on the site of the internet portals that they make available to them for the consultation of movements of the corresponding accounts, as well as in the Electronic Channels corresponding to a telecommunications mobile device, for each Transfer Order Accepted by SPEI and in all the queries that they provide for these Transfer Orders, the electronic link constructed in accordance with Appendix E of the Manual, in order for their Clients to consult, either the status of their respective Transfer Orders or, in case these have been credited to the corresponding Beneficiary Clients, generate the Electronic Payment Receipts of said Transfer Orders.

Participants must make the electronic link referred to in the previous paragraph available to the corresponding Clients at the latest five minutes after the Administrator has made available to them, through the SPEI, the Settlement Notice regarding the Transfer Order Accepted by SPEI in question.

...

I. to III. ...

IV. The CLABE, the debit card number or electronic payment fund number or the ten digits of the mobile phone line number indicated in the Transfer Order Accepted by SPEI to identify the respective Client Account corresponding to the Beneficiary Client, and

V. ...”

“86a. Payment of compensation for delay.- Each Participant must pay to the Client or, in its case, verify, in accordance with the Indirect Participation Service Contract that it has celebrated with the Client to whom it provides Indirect Participation Services, that this, in its capacity as Indirect Participant, pays the respective Indirect Client, the amounts referred to in the following subsections, without prejudice to the other payments that must be made in accordance with these Rules, when they fall under the following circumstances:

I. ...

I. Bis. In the event that the Issuing Client fails to comply with any of the deadlines indicated in Rule 27a or 31a of these Rules, the corresponding Participant must verify that said Issuing Client, in its capacity as Indirect Participant and in accordance with the obligation referred to in subsection XXV of Rule 9a Bis 4 of these Rules that it has assumed through the signing of the Indirect Participation Service Contract, pays the Indirect Issuing Client the amount resulting in accordance with Rule 87a of these Rules. The Client must pay, at the latest by the close of the business day of the SPEI immediately following that in which the breach in question occurred, said amount in the same Client Account of the Indirect Client of the Indirect Issuing Client that presented the transfer instruction of the Transfer Order in question;

II. In the event that the Receiving Participant or the Beneficiary Client, in its capacity as Indirect Participant, have failed to comply with the deadline provided for in Rule 19a of these Rules, the Participant must pay, in accordance with what is provided in this Rule, the amount resulting in accordance with what is provided in Rule 87a of these Rules or, in its case, verify that said Beneficiary Client, in its capacity as Indirect Participant, pays said amount to the Indirect Beneficiary Client, which must be provided for in the Indirect Participation Service Contract. In this case, the Participant must pay or, in its case, verify that the Indirect Participant pays, at the latest by the close of the business day of the SPEI immediately following that in which the breach in question occurred, the amount referred to in this subsection in the same Client Account corresponding to the Beneficiary Client or in the Client Account of the Indirect Client corresponding to the Indirect Beneficiary Client, of the Transfer Order in question;

III. In the event that the Receiving Participant has failed to comply with any of the deadlines provided for in Rules 25a and 30a of these Rules, said Participant must pay to the Issuing Participant of the Transfer Order subject to the return referred to in said Rules, the amount resulting in accordance with what is provided in Rule 87a of these Rules. In this case, the Receiving Participant must send to the Issuing Participant the Transfer Order of the type of return not credited to the Client Account late or, as the case may be, the type of return credited to the Client Account late, for an amount equal to the sum of the original amount plus the amount resulting in accordance with what is provided in Rule 87a of these Rules. The Issuing Participant will be obliged to carry out the payment of the amount of said Transfer Order of the respective return type, within the same deadline established for these effects in these Rules, in the Client Account corresponding to the Issuing Client who instructed the Transfer Order subject to the return, and

III Bis. In the event that the Beneficiary Client, in its capacity as Indirect Participant, has failed to comply with any of the deadlines provided for in Rules 25a and 30a of these Rules, the Participant with which it has formalized an Indirect Participation Service Contract must verify that said Client, in accordance with the obligation referred to in subsection XXVII of Rule 9a Bis 4 of these Rules that it has assumed through the signing of the Indirect Participation Service Contract, pays to the Issuing Participant of the Transfer Order subject to the return referred to in said Rules, the amount resulting in accordance with what is provided in Rule 87a of these Rules. In this case, the Beneficiary Client must request from the Receiving Participant, the sending to the Issuing Participant of the Transfer Order of the type of return not credited to the Client Account late or, as the case may be, the type of return credited to the Client Account late, for an amount equal to the sum of the original amount plus the amount resulting in accordance with what is provided in Rule 87a of these Rules. The Issuing Participant will be obliged to carry out the payment of the amount of said Transfer Order of the respective return type, within the same deadline established for these effects in these Rules, in the Client Account corresponding to the Issuing Client who instructed the Transfer Order subject to the return and, in case said Transfer Order derives from a transfer instruction by an Indirect Issuing Client to the Issuing Client, this must carry out the payment in the account or record corresponding to said Indirect Issuing Client.

64 OFFICIAL GAZETTE Wednesday, March 23, 2022

In the event that any non-compliance foreseen in these Rules persists for at least until the SPEI operation day following the one in which the applicable deadline for each case has expired, such Participant must pay or, where applicable, verify that the Client pays, in its capacity as an Indirect Participant with which it has formalized an Indirect Participation Service Contract, the amount resulting from the greater of:

I. The amount corresponding to 3.5 times the daily value of the Measurement and Update Unit, in effect at the time of the non-compliance, or

II. ...

...

Regarding Participants that process CoDi Transfer Orders and are located in the non-compliances referred to in fractions I, I Bis, II, III, and III Bis of these Rules, such Participants must pay compensation starting from the non-compliance and pay it, no later than the close of the SPEI operation day immediately following the one in which the non-compliance in question occurred; the compensation will be the amount resulting from the greater of:

A. The amount corresponding to the daily value of the Measurement and Update Unit in effect at the time of the non-compliance, or

B. The result obtained by multiplying by two the quantity resulting from the calculation of the reference amount referred to in the first paragraph of Rule 87a of these Rules.”

“87a. Calculation of amounts.- To calculate the amount referred to in the previous Rule, the Participant must first calculate a reference amount in the following manner: i. multiply the Bank Weighted Funding Rate, closed to four decimal places, announced by the Bank of Mexico on the Banking Business Day prior to the one in which the non-compliance occurs, by the amount of the Transfer Order in question, including cents; ii. multiply the result by the number of seconds of delay, counted from the first second following the non-compliance, and iii. divide the obtained result by 31,104,000. The amount will be the result of closing to two decimal places the quantity obtained from this division.”

“88a. Collection of commissions.- ...

Likewise, Issuer Participants must refrain from charging commissions to their Issuer Clients for the sending of Transfer Orders that have been deleted from the SPEI. However, Participants may charge a commission to their Clients for the retry of sending Transfer Orders other than return types, as well as for CoDi Transfer Orders, only when such retry is successful.”

“89a. Information regarding Participant failures.- In those cases where a Participant’s Technological Infrastructure presents an event that affects the services related to the SPEI provided to its Clients or where any event occurs that affects the ordinary operation of the Participant in question in the SPEI, Participants must notify their respective affected Clients, through the means by which Issuer Clients instruct or attempt to instruct Sending Requests during such event, as well as through the means agreed upon by the Participant with these Clients, that the failure originated in the Participant’s Technological Infrastructure, or that an event occurred that affected the ordinary operation of the Participant in question in the SPEI, as applicable, no later than within sixty seconds following the one in which the referred event occurs. The foregoing will be subject to the failure not having affected the communication channels necessary to carry out said notification. In case the mentioned channels have been affected, the notification must be carried out as soon as the respective channels are restored.

Likewise, in the cases referred to in the preceding paragraph, Participants must ensure that those Clients to whom they provide Indirect Participation Services notify their respective Indirect Clients, through the means by which Indirect Issuer Clients instruct or attempt to instruct Sending Requests during such event, as well as through the means agreed upon by the Indirect Participant with its Indirect Clients, that the failure originated in the Participant’s Technological Infrastructure, in the systems of the Indirect Participant, or that an event occurred that affected the ordinary operation of the Participant in the SPEI or of the Indirect Participant, as applicable, no later than within sixty seconds following the one in which the event occurs. The foregoing will be subject to the failure not having affected the communication channels necessary to carry out said notification. In case the mentioned channels have been affected, the notification must be carried out as soon as the respective channels are restored.

Wednesday, March 23, 2022 OFFICIAL GAZETTE 65

Participants must refrain from allowing their Clients to submit Sending Requests on their own behalf, as well as those submitted by their Clients as Indirect Participants on behalf of the respective Indirect Issuer Clients, including those operations belonging to the CoDi scheme, when any of the circumstances referred to in the preceding paragraph occurs and during the entire period in which the Participant is unable to operate in an ordinary manner in the SPEI. Regarding this, Participants must ensure that Clients acting as Indirect Participants also refrain from allowing Indirect Issuer Clients to submit instructions that generate Sending Requests. The foregoing, unless the submission of Scheduled Sending Requests or instructions that generate Scheduled Sending Requests is allowed in terms of what is established in the second and third paragraphs of Rule 10a and fraction III of Rule 14a of these present Rules.”

“90a. Fee for use of the SPEI.- Each Participant must pay the Administrator, for the use of the SPEI in each month, no later than the tenth Banking Business Day of the month immediately following the one to which it corresponds, the fixed fee determined in accordance with what is provided in these Rules, which will allow it to send any quantity of Transfer Orders and receive any quantity of Transfer Orders Accepted by the SPEI, provided that this does not affect the proper functioning of the system. Likewise, each Participant must pay, for each month, no later than the tenth Banking Business Day of the month immediately following the one to which it corresponds, a fee for operations related to the number of transfer requests sent, returns received of Transfer Orders Accepted by SPEI not credited in Client Accounts, whether late or not, Transfer Orders sent to the CLS, and bytes retransmitted. Participants will not be obligated to pay any fee for the returns of CoDi Transfer Orders accepted by the SPEI not credited in Client Accounts.

...

I. and II. ...

The Participant will be obligated to confirm to the Administrator the receipt of the communications referred to in these Rules, no later than the second Banking Business Day following the receipt of the corresponding communications and through the means by which the Administrator has made the respective communications known to it. In case the Participant does not carry out the confirmation in the terms described, it will be obligated to send a representative, duly authorized, to pick up the communication at the office of the Directorate of Operations and Continuity of Payment Systems and Market Infrastructures.

In cases where a Participant has paid the annual fixed fee in a single payment and this Participant withdraws from the SPEI before the corresponding year ends, the Administrator will return to the Participant in question, the proportional part of the said fee corresponding to the remaining time counted from the withdrawal of the respective Participant.”

“92a. Fee for use of the SPEI for new Participants.- ...

The Participant will be obligated to confirm to the Administrator the receipt of the communications referred to in these Rules, no later than the second Banking Business Day following the receipt of the corresponding communications and through the means by which the Administrator has made the respective communications known to it. In case the Participant does not carry out the confirmation in the terms described, it will be obligated to send a representative, duly authorized, to pick up the communication at the office of the Directorate of Operations and Continuity of Payment Systems and Market Infrastructures.”

“93a. Transitional fee for Participants in the SPEI.- ...

The Participant will be obligated to confirm to the Administrator the receipt of the communications referred to in these Rules, no later than the second Banking Business Day following the receipt of the corresponding communications and through the means by which the Administrator has made the respective communications known to it. In case the Participant does not carry out the confirmation in the terms described, it will be obligated to send a representative, duly authorized, to pick up the communication at the office of the Directorate of Operations and Continuity of Payment Systems and Market Infrastructures.”

“95a. Payment of the annual fixed fee in a single payment.- ...

For such purpose, the Participant must send a communication addressed to the Directorate of Operations and Continuity of Payment Systems and Market Infrastructures, no later than the last banking day of the month of January of the year to which the annual fixed fee corresponds, in accordance with the form established in Appendix S of the Manual and in the terms described in Rule 98a of these Rules.”

66 OFFICIAL GAZETTE Wednesday, March 23, 2022

“98a. Sending of digital communications to the Administrator.- The communications referred to in Rules 9a. Bis 3., 9a. Bis 7., 15a., 37a., 40a., 46a., 46a. Bis., 53a., 54a., 55a., 57a., 58a. Bis., 59a. Bis., 60a., 66a., 69a., 70a., 72a., 73a., 74a., 78a., 95a., and Annex I of these Rules must be sent by Participants via email to the Payment Systems Service Center in accordance with what is established in section 5 of the Manual.

...

In cases where the Participant does not have access to the necessary elements to send digitally signed requests, it may deliver to the Directorate of Operations and Continuity of Payment Systems and Market Infrastructures the communications in original, in duplicate, and signed by persons whose signature has been previously registered before the said Directorate for the management of operations and various requests to operate with the Bank of Mexico, adding a communication in which they specify the reason why they are in the need to send communications by this alternative means, as well as the date on which they will remedy the situation that prevents them from sending digital communications in terms of the first and second paragraphs of these present Rules.”

“CHAPTER XIII Confidentiality and permitted use of information”

“100a. Confidentiality of information by the Participant.- Participants must keep strict confidentiality regarding all information, whether expressed orally, in writing, graphically, electronically, or in any other form, that is provided to them by their Clients, any other Participant, or the Administrator by reason of their operation in the SPEI. Likewise, Participants must keep strict confidentiality of the content of the Manual that the Administrator makes available to them.

Participants must use the information referred to in the preceding paragraph exclusively for the effects provided in these Rules. Likewise, as an exception to what is provided in the preceding paragraph, Participants are obligated to give access to the information only to the persons necessary for the compliance with these Rules and will be responsible for the use that their personnel, representatives, administrators, directors, employees, agents, dependents, or any person related to the Participant, make of the mentioned information. The obligation provided in these Rules will continue to be applicable to Participants even if they cease to act with such character.

Clients to whom the respective Participant provides Indirect Participation Services will not be understood to be included within the exception referred to in the preceding paragraph, so with respect to them, Participants must keep strict confidentiality of all information referred to in the first paragraph of these present Rules. However, Participants may request authorization from the Administrator to share information with such Clients when they consider it strictly necessary, which may only be shared partially in the terms established by the Administrator in the authorization that, if applicable, is granted.

The request for authorization referred to in the preceding paragraph must be made in writing, in which the information referred to in the first paragraph of these Rules that is intended to be shared will be indicated, the name of the Client with whom it is intended to share said information, as well as the names, telephone numbers, and email addresses of the persons designated by the Participant as contact to attend any matter that may arise in relation to the authorization and the use or handling of the shared information. The request for authorization must be presented to the Administrator through the Directorate of Operations and Continuity of Payment Systems and Market Infrastructures, and must be signed by the General Director of the Participant, by the person occupying the position in the interested party that has under their responsibility the functions of administration, or by any official occupying a position of at least two immediate lower hierarchies below that of the said General Director or equivalent, as well as by the responsible for SPEI regulatory compliance.

The Administrator may require additional documentation and information it deems necessary to evaluate the appropriateness of granting the requested authorization.

...”

“101a. Use of information provided to Clients.- Participants must agree with their Clients that the fund transfers that they offer to these are made for legitimate purposes and cannot be carried out with the purpose of obtaining information on Beneficiary Clients or Indirect Beneficiary Clients. For these purposes, as part of the constant monitoring that Participants carry out on the transfers sent at the request of their Clients, if Participants detect operations that could be carried out with the purpose of obtaining information on a universe of Beneficiary Clients and Indirect Beneficiary Clients, such Participants must carry out the actions they deem pertinent to determine the purpose of such operations and, if applicable, close the corresponding Client Accounts of those who do not comply with the above.”

“ANNEX I DETERMINATION OF THE AMOUNT OF RESOURCES FOR THE PROTECTION OF ISSUER CLIENTS

The amount of resources that each Participant “p” must maintain in accordance with what is provided in Rule 68a of these present Rules must be equal to the value of the element denoted as Yp that results from the calculation carried out in terms of the following equation:

Yp = max {kp * α * GTp – CapRelp, 0}

The elements of the previous equation will be calculated in accordance with the following:

kp: is equivalent to the factor related to the probability of non-compliance and the severity of the loss of a fraud event of Participant “p”, calculated in accordance with the following equation:

kp = max {Regj, Opp}

In turn, the elements of the previous equation will be calculated in accordance with the following:

Regj: is equivalent to the factor determined by the Administrator for each type of Participant (denoted “j”), taking into account the regulatory requirements applicable to the Participant in question, relative to corporate governance, investments, external audits, operation by electronic means, operational risk, information security, and accounting standards, which could mitigate the fraud risk to which said Participant could be exposed. To this effect, the values of the factor Regj corresponding to each type of Participant will correspond to those specified in Appendix U of the Manual.

Opp: corresponds to the value calculated in accordance with the following equation:

Opp = min {Mp, 1}

In turn, the elements of the previous equation will be calculated in accordance with the following:

Mp: is equivalent to the value calculated in accordance with the following equation:

Mp = GTp Participant p’s Assets

In turn, the elements of the previous equation will correspond to the following:

GTp: is equivalent to the daily average of the amounts of all transfers instructed by the Issuer Clients of Participant “p” during the calendar year immediately preceding the one in which the calculation of the own resources amount referred to in Rule 68a of these present Rules is carried out.

Participant p’s Assets: is equivalent to the sum of the assets of Participant “p” registered in its most recent financial statements at the date on which the calculation of the own resources amount referred to in this Annex is carried out.

α: is equivalent to the factor specified in Appendix U of the Manual.

GTp: is equivalent to the respective value calculated in accordance with what is established above.

CapRelp: corresponds to the amount of the net capital of Participant “p”, or the equivalent according to the type of Participant, denominated as “Relevant Capital” for the purposes of the calculation provided in this Annex. Regarding this, the calculation of the amount corresponding to the Relevant Capital referred to must be carried out in accordance with the following equation:

CapRelp = CapRegp – ReqCapp + CapRiesgoOpp

The elements of the previous equation will be calculated in accordance with the following:

CapRegp: is equivalent to the amount of net capital of Participant “p” or that other particular type of capital that, according to the type of Participant, it must maintain in accordance with the applicable provisions.

68 OFFICIAL GAZETTE Wednesday, March 23, 2022

ReqCapp: is equivalent to the sum of amounts corresponding to the capital requirements that, where applicable, Participant “p” must maintain in accordance with the applicable provisions to that effect.

CapRiesgoOpp: is equivalent to the amount corresponding to the capital requirements for operational risk that, where applicable, Participant “p” must maintain in accordance with the applicable provisions to that effect.

For the purposes of calculating the amount of own resources referred to in Rule 68a of these Rules, Participants must report the following information to the Administrator within the timeframes indicated below:

I. The amount of their net capital or that other particular type of capital that, according to the type of Participant, they must maintain in accordance with the applicable provisions that, where applicable, the Participant in question reports to the decentralized body of the Ministry of Finance and Public Credit in charge of its supervision (supervisory commission) at the close of the last day of the calendar quarter prior to that corresponding to the calculation of the own amounts referred to in this Annex. In the event that the Participant modifies and retransmits said data to their supervisory commission, they must retransmit the new information to the Administrator. When the Participant is not obliged to report such information to any supervisory commission, they must report to the Administrator the amount of capital corresponding to the most recent financial statements of the Participant as of the month in which the calculation of the own amounts referred to in this Annex is carried out.

II. The amounts corresponding to the capital requirements for operational risk, credit risk, market risk, and any others that, where applicable, result applicable to the Participant in question in accordance with the applicable provisions, corresponding to those that the Participant is obliged to maintain at the close of the last day of the calendar quarter in question.

III. The amount of their total assets, which shall correspond to that which the respective Participant reports to their supervisory commission at the close of the last day of the calendar quarter in question. In the event that the Participant modifies or retransmits said data to their supervisory commission, they must retransmit the new information to the Administrator. When the Participant is not obliged to report such information to any supervisory commission, they must report to the Administrator the respective amount registered in the most recent financial statements of the Participant as of the month in which the calculation of the own amounts referred to in this Annex is carried out.

Participants must present the aforementioned information to the Administrator within the first fifteen Banking Business Days following the expiration of the immediately preceding calendar quarter, through the Department of Operation and Continuity of Payment Systems and Market Infrastructures, in the terms established in Rule 98a of these Rules and in accordance with the form established in Appendix V of the Manual.

The Administrator will carry out, for each Participant, the calculation of the value Yq on a quarterly basis. In the event that said value results in greater than zero, the Administrator will inform the Participant in question, by electronic communication addressed to the email addresses that the Participant has made known to the Administrator in accordance with the model contained in the Manual, the amount corresponding to the financial resource requirement that will be applicable to them in accordance with what is provided in Rule 68a of these Rules, calculated in terms of this Annex. The notification referred to in this paragraph will be carried out within twenty Banking Business Days following, counted from the first Banking Business Day of the month in which the calculation of said amount was made. The Participant must prove to the Administrator, within a maximum period of five Banking Business Days from the receipt of the notification from this, that they comply with the amount of resources referred to. To this end, the Participant must send to the Administrator, through the Department of Operation and Continuity of Payment Systems and Market Infrastructures, in the terms established in Rule 98a of these Rules, the documentation demonstrating the constitution of the required resources, by means of the instruments mentioned in the second paragraph of Rule 68a. The period of twenty Banking Business Days referred to in this paragraph will be suspended in cases where the Administrator notifies the respective Participant that they have not sent the necessary information and documentation to carry out the calculation, or that it does not meet the requirements established in these Rules. Said period will resume from the Banking Business Day immediately following that in which the Participant satisfactorily resolves the information or documentation required by the Administrator through the aforementioned notification.”

TRANSITIONAL PROVISIONS

Wednesday, March 23, 2022 OFFICIAL GAZETTE 69

FIRST.- This Circular will enter into force the day following its publication in the Official Gazette of the Federation, with the exception of what is stated in the following transitional rules.

SECOND.- The modifications to Rule 5a., 6a., first and second paragraphs, 7a., fractions II and III, 7a. Bis., second paragraph of fraction VIII, 9a. Bis., fraction V, subclause g), first paragraph, 17a., first and third paragraphs, as well as fraction II, 18a., first paragraph, 19a., first paragraph, 24a., first paragraph, 25a. Bis., fractions I and II, 35a., 37a., first and second paragraphs, 39a., first and third paragraphs, 45a., first paragraph, as well as fractions I and II, 46a., fifth and penultimate paragraphs, 46a. Bis., first paragraph, 47a., second paragraph, 48a., second paragraph, 50a., first paragraph and fraction III, 51a., 53a., second paragraph, 55a., first paragraph, and 58a., fraction III, subclauses a) and b), as well as the additions provided in Rule 5a. Bis., first and third paragraphs, as well as fractions I and II, 17a., sixth paragraph, 26a., second paragraph, 33a., second paragraph, 50a., fraction IV, 50a. Bis., and 53a., third paragraph, will enter into force on May 4, 2022.

THIRD.- The additions provided in Rule 10a., second, third, and fourth paragraphs, as well as fraction III to Rule 14a., will enter into force on May 12, 2022.

FOURTH.- The additions of the third, fourth, and fifth paragraphs to Rule 9a. will enter into force on May 24, 2022.

Regarding Participants who, upon the entry into force of the modifications provided in the preceding paragraph, materially provide or offer Indirect Participation Services to their Clients, they will have until December 15, 2022, to adjust the assignment of CLABEs to Client Accounts opened at the time of said publication and of which Clients to whom they provide such services are the holders, in accordance with what is established in the third, fourth, and fifth paragraphs of Rule 9a. of the SPEI Rules, with the aim that these Clients, in turn, assign each of these CLABEs to the accounts that said Clients hold.

FIFTH.- The modifications to Rule 21a., second paragraph, 84a., fraction III, and 85a., first paragraph, as well as the additions to Rule 9a. Bis., fraction III, subclause g), and 84a., fraction VII, will enter into force on June 23, 2022.

SIXTH.- The additions to Rule 9a., seventh paragraph, as well as fractions I and II, and to Rule 9a. Bis., fraction IV, subclause a), second paragraph, will enter into force on June 23, 2022.

Without prejudice to the foregoing, from the entry into force of this Circular and until June 22, 2022, Participants may obtain the consent referred to in Rule 9a. Bis., fraction IV, subclause a), second paragraph, from Clients who, prior to the entry into force of the additions indicated in the preceding paragraph, have enabled the software programs for the generation and processing of CoDi Collection Messages or Transfer Orders, in accordance with what is provided in said Rule 9a. Bis., fraction IV, subclause a), second paragraph, and must inform the Administrator, no later than June 23, 2022, the information referred to in Rule 9a., seventh paragraph, in accordance with the aforementioned rule. Participants must send the consent referred to in this paragraph upon the entry into force of the modifications referred to in the preceding paragraph, in accordance with the specifications provided in Appendix AR of the Manual.

SEVENTH.- The modifications to Rule 2a., fraction XXXIV, 9a. Bis., fraction IV, first paragraph of subclause b), and fraction V, subclause a), 19a., second paragraph of fraction I and subclause b) of fraction IV, 25a., fraction VI, 46a., subclause e) of fraction III, and 71a., fraction IV, will enter into force on September 20, 2022.

EIGHTH.- The additions of Rule 5a. Bis., second paragraph, 45a., fraction VIII, and 46a., subclause II of the fifth paragraph, will enter into force on September 20, 2022. Without prejudice to the foregoing, Participants other than those indicated in Rule 5a. Bis., fraction I, will have until December 15, 2022, to comply with the aforementioned modifications.

NINTH.- The modifications to Rule 7a. Bis., fractions I, third and fourth paragraphs, II, III, IV, V, VI, and XI, 9a. Bis., fourth paragraph of fraction II, first paragraph of fraction III, subclauses c), d), and e) of fraction IV, 10a., fraction I, 12a., first paragraph, 16a., first paragraph, as well as fractions I and II, 20a., first and fifth paragraphs, 23a., first paragraph, as well as fractions II, IV, VIII, and IX, 27a., fraction II, and last paragraph, 43a., first paragraphs, as well as subclause a) of fraction II, 46a., eleventh paragraph, 51a. Bis., first paragraph, 59a. Bis, fraction I, 73a., first paragraph of fraction II, and 86a., first and second paragraphs and fraction II, as well as the additions of Rule 6a., last paragraph, 7a. Bis., second and fifth paragraphs of fraction I, 7a. Ter., 9a. Bis., second, third, and fifth paragraphs of fraction II, fraction II Bis, second paragraph of subclause a), last paragraph of fraction III, third paragraph of subclause a), second paragraph of subclause b) and second paragraph of subclause e) of fraction IV, subclause a Bis) with its numerals 1 and 2, last paragraph of subclause d), second paragraph of subclause e), second paragraph of subclause f), second and fourth paragraphs of subclause g), second paragraph of subclause h), and second paragraph of subclause i), as well as the last paragraph of fraction V, 9a. Bis 1., 9a. Bis 2., 9a. Bis 3., 9a. Bis 4., 9a. Bis 5., 9a. Bis 6., 9a. Bis 7., fractions II, III, IV

70 OFFICIAL GAZETTE Wednesday, March 23, 2022

and V, 9a. Bis 8., 9a. Bis 9., Section I Bis 2 Transfer Instructions corresponding to the provision of Indirect Participation Services, 9a. Bis 10., 12a., last paragraph, 16a. Bis., 19a., second and penultimate paragraphs, 20a., last paragraph, 20a. Bis., 27a., second paragraph, 31a., second paragraph, 43a., second paragraph, 46a., fourth paragraph, 72a., second paragraph of fraction I, as well as fractions I Ter, II Bis, and V, 73a., third paragraph of fraction I, 74a., second paragraph, 86a., fractions I Bis and III Bis, 89a., second paragraph, and 100a., third, fourth, and fifth paragraphs, will enter into force on December 15, 2022.

TENTH.- The addition to Rule 58a., fraction I, section A, subclause d), numeral 6, will enter into force on March 23, 2023.

ELEVENTH.- The addition of Rule 46a. Bis 1., first paragraph, will enter into force on May 4, 2022. Without prejudice to the foregoing, from the entry into force of this Circular and until May 3, 2022, Rule 46a. Bis 1., first paragraph, is added, to remain, solely during said transitional period, in the following terms:

“46a. Bis 1. Restoration of operation.- The Participant who restores normal operation with the SPEI, after any event that affected said operation or its connection to the SPEI, must synchronize its systems with the SPEI starting from the position of the last complete message received. In addition, said Participant may perform the synchronization at an earlier position, in case the Participant itself so determines.

...”

TWELFTH.- The modifications to Rule 12a., subclause iii of subclause a) of fraction I, 20a., second and third paragraphs, as well as fractions I and II, 28a., second paragraph, 30a., first paragraph, 31a., fraction II, and last paragraph, 73a., first paragraph of fraction I, 74a., first paragraph, 98a., first paragraph, as well as the additions to Rule 9a. Bis., subclause f) of fraction III, 15a., second paragraph, as well as fractions I and II, 16a., last paragraph, 28a., last paragraph, 30a., third paragraph, 86a., fourth paragraph, and 89a., third paragraph, will enter into force on December 15, 2022. Without prejudice to the foregoing, from the entry into force of this Circular and until December 14, 2022, Rule 12a., subclause iii of subclause a) of fraction I, 20a., second and third paragraphs, as well as fractions I and II, 28a., second paragraph, 30a., first paragraph, 31a., fraction II, and last paragraph, 73a., first paragraph of fraction I, 74a., first paragraph, 98a., first paragraph, are modified, and Rule 9a. Bis., subclause f) of fraction III, 15a., second paragraph, as well as fractions I and II, 16a., last paragraph, 28a., last paragraph, 30a., third paragraph, 86a., fourth paragraph, and 89a., third paragraph, are added, to remain, solely during said transitional period, in the following terms:

“9a. Bis. Obligations related to CoDi Transfer Orders.- ... I. to II Bis. ... III. ... a) to e) ... f) Refrain from conditioning the receipt and sending of CoDi Transfer Orders to the contracting of any other value-added service that the Participant might offer to its Clients. For these purposes, the offering of internet electronic banking or the carrying out, via internet, of acts related to operations contracted by Participants, other than Credit Institutions, with its Clients, will not be considered as a value-added service. ...”

“12a. Information that the Submission Request must contain.- ... I. ... a) ... i. and ii. ... iii. The ten digits of the mobile phone line number that, where applicable, has been associated with the respective Client Account, which corresponds to a deposit of money or electronic payment funds in the respective Participant.

Wednesday, March 23, 2022 OFFICIAL GAZETTE 71

...”

“15a. Calculation of the number of financial product accounts.- ... Likewise, for the purposes of what is provided in the preceding paragraph, Participants that have the status of payment fund institutions must observe the following: I. Inform the Administrator, within the first twenty-five days of January, April, July, and October, the information on the number and amount of electronic payment fund accounts that said institutions have maintained in the previous quarter, using the form included in Appendix AN of the Manual, and II. Inform the Bank of Mexico if they fall under the circumstances provided in Rule 5a. Bis., 9a. Bis., fraction II, 11a., fraction IV, second paragraph, 19a., fraction II, second paragraph, and fraction IV, 25a., fraction III, second paragraph, and 46a., fraction III, subclause b), of these Rules, during the calendar month immediately following the conclusion of the period indicated in the previous fraction, by means of an electronically signed communication by the SPEI regulatory compliance officer and sent to the Bank of Mexico in the terms established in Rule 98a of these Rules. ...”

“16a. Transfer Orders.- ... With respect to Transfer Orders originated by Submission Requests in which only the ten digits of the mobile phone line number have been included to identify the Beneficiary Client's Client Account, in accordance with what is stated in Rule 12a. Bis of these Rules, said Transfer Orders must be processed through the messaging, terms and conditions applicable to the respective Transfer Orders with the technical and operational specifications indicated in Appendix AP of the Manual.”

“20a. Confirmation of Credit.- ... The Receiving Participant who carries out the credit of the amount of the Transfer Order Accepted by the respective SPEI in a Client Account corresponding to a Beneficiary Client, must include in the Confirmation of Credit the Unique Population Registry Key (CURP) or the Federal Taxpayer Registry key (RFC), in the case of natural persons, or the Federal Taxpayer Registry key with the respective homoclave in the case of legal entities, corresponding to its Beneficiary Client, in accordance with Rule 72a., fraction I, of these Rules. In addition to the Confirmation of Credit provided in the preceding paragraph, in the case of CoDi Transfer Orders, the Receiving Participant must generate a processing notice, in accordance with the terms and characteristics specified in Appendix AD of the Manual, by which it confirms the credit of the amount indicated in the Transfer Order Accepted by SPEI corresponding to the CoDi Transfer Order in question, which said Receiving Participant has made, in accordance with Rule 19a of these Rules, in the Client Account corresponding to the Beneficiary Client. With respect to this, said Participant must send the referred notice to the Administrator, no later than six seconds after that in which the Administrator has made available to it, through the SPEI, the Settlement Notice regarding the Transfer Order Accepted by SPEI corresponding to the CoDi Transfer Order in question. In the event that the Receiving Participant has not made the credit in the Client Account corresponding to the Beneficiary Client, within the four-second period indicated in fraction VI of Rule 19a of these Rules, it will be exempt from sending the processing notice referred to in this paragraph. ... I. If the Receiving Participant in question does not make the credit in the Beneficiary Client's Account, within the four-second period indicated in fraction VI of Rule 19a of these Rules, said Receiving Participant must send a Transfer Order of the type non-credited transfer return in Client Accounts, in accordance with what is provided in Rule 24a of these Rules, no later than eight seconds after that in which the Administrator has made available to it, through the SPEI, the Settlement Notice regarding the Transfer Order Accepted by SPEI in question, and II. If the Receiving Participant in question does not send the processing notice specified in the third paragraph of this Rule, in accordance with the terms established herein, it must send a Transfer Order of the type credited transfer return in Client Accounts referred to in Rule 28a of these Rules, no later than eight seconds after that in which the Administrator has made available to it, through the SPEI, the Settlement Notice regarding the Transfer Order Accepted by SPEI derived from the CoDi Transfer Order in question, regardless of whether the amount corresponding to said Transfer Order Accepted by SPEI has been credited in the Client Account corresponding to the respective Beneficiary Client, in accordance with what is established in Rule 19a of these Rules. In this last case, the Participant holding the Client Account in which the aforementioned amount has been credited, must charge the respective account resulting from said case, subject to what they have agreed to that effect with the respective Client.”

“28a. Return of Transfer Orders Accepted by SPEI credited in Client Accounts.- ... Receiving Participants must make available to their Beneficiary Clients, by means of the software programs installed on the mobile devices referred to in Rule 9a. Bis., fraction I, of these Rules, the information regarding the sending of the Transfer Orders referred to in the preceding paragraph, in accordance with what is specified in Appendix AD of the Manual, and within the period established in Rule 84a of these Rules. ... Regarding Transfer Orders of the type return or late return of CoDi Transfer Orders, provided for in this Rule and in the following Rule 29a, respectively, in which the Participant receives from the Beneficiary Client, the Submission Request corresponding to the return, the Receiving Participant must send a notification to the Administrator, with the specifications indicated in Appendix AD of the Manual, within a maximum period of two seconds following that in which it has sent the Transfer Order of the type credited transfer return in Client Accounts.”

“30a. Deadlines for the return of Transfer Orders Accepted by SPEI credited in Client Accounts.- The Receiving Participant that falls under any of the circumstances referred to in Rules 28a and 29a of these Rules must send the Transfer Order of the type credited transfer return in the Client Account or of the type late credited transfer return in the Client Account, as the case may be, no later than thirty seconds following that in which it receives the Submission Request corresponding from its Beneficiary Client. ... Regarding Transfer Orders of the type return or late return referred to in this Rule, with respect to CoDi Transfer Orders, the maximum period provided in the first paragraph of this Rule will be four seconds following that in which the Receiving Participant receives from the Beneficiary Client, the Submission Request. Likewise, in the event that the Receiving Participant of a CoDi Transfer Order credited in the Client Account has not sent the processing notice to the Administrator confirming the credit of the respective amount in the Client Account, the maximum period referred to will be eight seconds following that in which the Administrator has made available to it, through the SPEI, the Settlement Notice”

Wednesday, March 23, 2022 OFFICIAL GAZETTE 73

regarding the Transfer Order Accepted by SPEI. In the cases previously referred to in this paragraph, the Receiving Participant must send a notification to the Administrator, in which it reports on the sending that said Receiving Participant has made, through the SPEI, of the Transfer Order of the type refund of transfer credited to Client Accounts, in accordance with the terms and characteristics specified in Appendix AD of the Manual and within the timeframe established in Rule 28 of these Rules.

...

“31a. Timeframes for crediting refunds of Transfer Orders Accepted by SPEI credited to Client Accounts.- ... I. ... II. Make the corresponding funds available to the Issuing Client of the Transfer Order subject to the refund for withdrawal at the counter, or so that they can be transferred to the Client Account that, if applicable, said Issuing Client indicates. The Issuing Participant of the Transfer Order that has been subject to a refund or a late refund must inform the Issuing Client who made the respective Sending Request, at no cost to them and through the means by which the Issuing Client sends the Sending Requests and through the additional means that they must have agreed upon for this purpose, regarding the re-entry of the respective funds into their Client Account due to the refund or late refund, no later than five seconds after the credit has been made to their Client Account.”

“73a. Functions of the SPEI compliance officer.- ... I. Submit an annual written report, in the month of July, to the audit committee of the Participant in case it has such a committee, which contains the findings and, if applicable, irregularities and non-compliance with the internal SPEI norms identified in the period from June of the previous year to June of the current year, as well as other applicable regulations for the SPEI, the actions taken to correct them and the degree of progress and efficiency of such actions. Additionally, the Participant must send the Administrator a copy of the report referred to in this subsection and of the receipt confirmation by the Participant's audit committee, through the Directorate of Payment Systems and Market Infrastructures Operations and Continuity, no later than the fifteenth Banking Business Day following that on which it submitted the aforementioned report to said committee. ...”

“74a. Periodic report and evaluation.- Each Participant must verify the compliance that it must give to the requirements of information security, operational risk management and protection of the Participant's Issuing Clients, of Additional Risks, of interoperability to operate in the SPEI established in Rule 58 of these Rules, as well as the business model or scheme provided for in Rule 58 Bis., respectively. Likewise, each Participant must inform the Administrator about any other risk identified, through reviews that must be carried out every two years, alternately, by the head of the internal audit area of the Participant itself and the Independent External Auditors, in the immediate next evaluation period. Such reviews must observe what is provided in subsections II and III of Rule 62 of these Rules. In the event that the Participant does not have an internal audit area, the respective Independent External Auditors must carry out the aforementioned reviews in all cases, in the two-year periods referred to. ...”

“86a. Payment of compensation for delay.- ... Regarding Participants that process CoDi Transfer Orders that fall under the non-compliances referred to in subsections I, II and III of this Rule,

74 OFFICIAL GAZETTE Wednesday, March 23, 2022

such Participants must pay a compensation starting from the non-compliance and pay it, no later than the close of the next SPEI operation day following that on which the non-compliance in question occurred, the compensation will be for the amount resulting from the greater of: ...”

“89a.- Information regarding Participant failures.- ... Participants must refrain from allowing their Clients to submit Sending Requests, including those operations belonging to the CoDi scheme, when any of the circumstances referred to in the previous paragraph occurs and during the entire period in which the Participant is unable to operate in an ordinary manner in the SPEI. This is without prejudice to allowing the submission of scheduled Sending Requests in terms of what is established in the second and third paragraphs of Rule 10 and subsection III of Rule 14 of these Rules.”

“98a.- Sending of digital communications to the Administrator.- The communications referred to in Rules 15a., 37a., 40a., 46a., 46a. Bis., 53a., 54a., 55a., 57a., 58a. Bis., 59a. Bis., 60a., 66a., 69a., 70a., 72a., 73a., 74a., 78a., 95a., and Annex I of these Rules must be sent by Participants via email to the Payment Systems Help Center in accordance with what is established in section 5 of the Manual.”

THIRTEENTH.- The modifications to Rule 28, first paragraph, and Rule 51a. Bis, second paragraph, as well as the addition of the second paragraph to Rule 30, will enter into force on December 15, 2022. Without prejudice to the foregoing, Rule 28, first paragraph, and Rule 51a. Bis, second paragraph, are modified, and the second paragraph is added to Rule 30, only during the transitional periods indicated below: I. From the entry into force of this Circular until May 3, 2022, Rule 28, first paragraph, is modified as follows: “28a. Refund of Transfer Orders Accepted by SPEI credited to Client Accounts.- In the event that a Beneficiary Client does not recognize a Transfer Order Accepted by SPEI whose funds have been credited to their Client Account, the respective Receiving Participant must allow said Beneficiary Client to return the funds by submitting a Sending Request corresponding to a Transfer Order of the type refund of transfer credited to Client Accounts, in accordance with the format detailed in section 8 of the Manual. Additionally, when the result of the application of the Collaboration Agreement for the Protection of the Issuing Client indicates that the funds should be returned, or in the case where the Receiving Participant of a CoDi Transfer Order credited to the Client Account has not sent the processing notice to the Administrator confirming the credit of the amount corresponding to the CoDi Transfer Order in question to the Client Account corresponding to the Beneficiary Client of the amount of the respective Transfer Order Accepted by SPEI in terms of what is established in Rule 20 of these Rules, the Receiving Participant of this Transfer Order Accepted by SPEI must carry out the refund of the funds corresponding to this Transfer Order Accepted by SPEI by sending a Transfer Order of the type refund of transfer credited to Client Accounts, in accordance with the format included in section 8 of the Manual.” II. From May 4, 2022 until December 14, 2022, Rule 28, first paragraph, Rule 51a. Bis, second paragraph, and the second paragraph of Rule 30 are modified, and the second paragraph is added to Rule 30, as follows: “28a. Refund of Transfer Orders Accepted by SPEI credited to Client Accounts.- In the event that a Beneficiary Client does not recognize a Transfer Order Accepted by SPEI, whose funds have been credited to their Client Account, the respective Receiving Participant must allow said Beneficiary Client to return the funds by submitting a Sending Request corresponding to a Transfer Order of the type refund of transfer credited to Client Accounts, in accordance with the format detailed in section 8 of the Manual. Additionally, when the result of the application of the Collaboration Agreement for the Protection of the Issuing Client indicates that the funds should be returned, or in the case where the Receiving Participant of a CoDi Transfer Order credited to the Client Account has not sent the processing notice to the Administrator confirming the credit of the amount corresponding to the CoDi Transfer Order in question to the Client Account corresponding to the Beneficiary Client of the amount of the respective Transfer Order Accepted by SPEI in terms of what is established in Rule 20 of these Rules, the Receiving Participant of this Transfer Order Accepted by SPEI must carry out the refund of the funds corresponding to this Transfer Order Accepted by SPEI by sending a Transfer Order of the type refund of transfer credited to Client Accounts, in accordance with the format included in section 8 of the Manual, through the same SPEI Instance through which the respective Transfer Order Accepted by SPEI was processed. ...” “30a. Timeframes for refunding Transfer Orders Accepted by SPEI credited to Client Accounts.- ... In the cases referred to in the previous paragraph, the Receiving Participant must send the Transfer Order of the corresponding refund type, through the same SPEI Instance through which the Transfer Order Accepted by SPEI referred to in the refund was processed, except in the circumstances indicated in section 5.16.4 of the Manual for late refunds of Transfer Orders Accepted by SPEI credited to Client Accounts, in which case such refunds may be processed through any SPEI Instance. ...” “51a. Bis. Accounts for CoDi Transfers.- ... For the purposes of what is provided in the previous paragraph, the Administrator will keep the aforementioned funds in the SPEI Accounts corresponding to the SPEI Instance that, solely for the purpose of using said funds to generate, on behalf of the Administrator itself, the aforementioned Transfer Order for one centavo, in order to verify the Client Account corresponding to the respective Beneficiary Client that has been registered through the computer program for the generation of Payment Collection Messages, in accordance with the data included in the respective Electronic Payment Receipt that has been obtained as a result of said Transfer Order. ...”

FOURTEENTH.- The Collaboration Agreements for the Protection of Issuing Clients referred to in Rule 43 of the SPEI Rules that have been formalized prior to the entry into force of this Circular will retain their validity and effectiveness. Notwithstanding the foregoing, modifications to said agreements or those entered into after the entry into force of this Circular must comply with the new requirements provided for in Rule 43 of these Rules.

FIFTEENTH.- The Participants referred to in Rule 5a. Bis, subsection I, must submit a report with the characteristics provided for in Rule 74 of the SPEI Rules, through which compliance with the information security, operational risk management and certification requirements established in Rule 58, subsections I, II and III, of the Technological Infrastructure necessary for the operation of the SPEI Instances in accordance with the Rules cited in the TRANSITIONAL Rule SECOND is verified. The submission of the aforementioned report must be made no later than June 3, 2022. Those Participants other than those referred to in the previous paragraph must submit a report with the characteristics provided for in Rule 74 of the SPEI Rules, through which compliance with the information security, operational risk management and certification requirements established in Rule 58, subsections I, II and III, of the Technological Infrastructure necessary for the operation of the SPEI Instances in accordance with the Rules cited in the TRANSITIONAL Rules SECOND and EIGHTH is verified, which they must present to the Administrator no later than March 15, 2023.

SIXTEENTH.- During the period between May 12, 2022 and December 14, 2022, Participants must send Transfer Orders derived from indirect participation schemes referred to in the TRANSITIONAL Rule NINTH using the payment type format specifically established for said period within section 8 of the Manual.

SEVENTEENTH.- Participants have until May 24, 2022 to designate, in accordance with what is provided in Rules 59a., 59a. Bis. and 59a. Bis 1. of the SPEI Rules, the substitutes for the SPEI compliance officers and the SPEI information security officers, respectively.

EIGHTEENTH.- Participants who, at the close of the Calculation Periods for the years 2019, 2020 and 2021 prior to the entry into force of this Circular, have fallen under the circumstance provided for in the eighth paragraph of Rule 46a., must submit a report to the Administrator, with the characteristics provided for in Rule 74 of these Rules, through which compliance with the information security, operational risk management and certification requirements established in subsections I, II and III of Rule 58 of these Rules, of only the infrastructure they have implemented to execute the contingency procedures they have established, is verified, no later than September 14, 2023.

NINETEENTH.- The report referred to in Rule 9a. Bis 7., subsection VII, must be submitted, for the first time, no later than December 15, 2022 and, subsequently, in accordance with the timeframe established in said subsection.

TWENTIETH.- CoDi Transfer Orders, from the entry into force of this Circular until December 14, 2022, will be subject to the following timeframes: I. The timeframes provided for in Rule 20a., subsections I and II, Rule 25a., first paragraph of subsection VII, and Rule 30a., third paragraph, regarding the sending of refunds, will be twelve seconds. II. The timeframes provided for in Rule 20a., sixth paragraph, Rule 25a., second paragraph of subsection VII, and Rule 28a., third paragraph, regarding the sending of the processing notice corresponding to the refund, will be fourteen seconds. From December 15, 2022, CoDi Transfer Orders will be subject to the timeframes provided for in the cited Rules.

TWENTY-FIRST.- CoDi Transfer Orders that are processed through indirect participation schemes, from December 15, 2022 to September 20, 2023, will be subject to the following timeframes: I. The timeframe provided for in the last paragraph of Rule 17a. of the Rules will be ten seconds for Indirect Issuing Clients. II. The timeframes provided for in Rule 9a. Bis., third and fifth paragraphs, Rule 19a., subsection VI, Rule 27a., third paragraph, and Rule 31a., third paragraph, will be ten seconds for Indirect Beneficiary Clients. III. The timeframes provided for in Rule 20a., subsections I and II and Rule 25a., first paragraph of subsection VII, regarding the sending of refunds, will be twenty seconds for Indirect Beneficiary Clients of the original Transfer Order that generated the refund. IV. The timeframe provided for in Rule 30a., third paragraph, regarding the sending of refunds, will be ten seconds for Indirect Beneficiary Clients of the original Transfer Order that generated the refund. V. The timeframe provided for in Rule 20a., sixth paragraph, second paragraph of subsection VII of Rule 25a., and Rule 28a., third paragraph, regarding the sending of the processing notice corresponding to the refund, will be twenty-two seconds for Indirect Beneficiary Clients. From September 21, 2023, CoDi Transfer Orders that are processed through indirect participation schemes will be subject to the timeframes provided for in the cited Rules.

Wednesday, March 23, 2022 OFFICIAL GAZETTE 77

TWENTY-SECOND.- Participants have until December 15, 2022 to identify their Clients that offer transfer services through the SPEI and notify them that, within said timeframe, they must sign an Indirect Participation Service Contract in accordance with what is provided for in Rule 9a. Bis 4. of the SPEI Rules. The parties may determine the signing of a new contract or a modifying agreement that includes the elements established in the SPEI Rules for the Indirect Participation Service Contract. In the event that the Participant's Client decides not to enter into said contract or modifying agreement, the Participant must cease operations regarding the provision of transfer services through the SPEI that said Client offers or provides. Likewise, in the event that the Participant decides not to provide Indirect Participation Services within the timeframe provided for in the previous paragraph, it must notify its Clients that offer transfer services through the SPEI so that, no later than July 21, 2022, they cease operations of said services.

TWENTY-THIRD.- The Participants referred to in Rule 9a. Bis 1., first paragraph, must obtain authorization from the Bank of Mexico to operate as a clearing house for indirect participation fund transfers within a period of one hundred eighty calendar days counted from the entry into force of the general provisions referred to in said Rule 9a. Bis 1., first paragraph, that the Bank of Mexico issues.

TWENTY-FOURTH.- Regardless of what is established in this Circular, without prejudice to the mechanisms that are established for the exchange and discussion of opinions, ideas and projects between the Bank of Mexico and the sector corresponding to the subject matter of these Rules, any person may submit to the Bank of Mexico, within the period of twenty Banking Business Days following the publication of this Circular in the Official Gazette of the Federation, their comments or suggestions regarding what is established in Rule 2a., subsections XXXIV and XL Bis, Rule 9a., seventh paragraph and subsections I and II, Rule 9a. Bis., second paragraph of subsection a) and first paragraph of subsection b), of subsection IV, subsection a) of subsection V and numeral 1 of subsection a Bis) of subsection V, Rule 9a. Bis 1, first paragraph, Rule 9a. Bis 5., subsection III, Rule 12a. Bis, Rule 16a., last paragraph, Rule 16a. Bis, Rule 19a., second paragraph of subsection I and subsection b) of subsection IV, Rule 20a., last paragraph, Rule 25a., subsection VI, Rule 46a., subsection e) of subsection III, Rule 58a. Bis., Rule 71a., subsection IV, and Rule 83a., subsection I, subsection e), of this Circular. The comments and suggestions that the persons indicated in this transitional Rule present to the Bank of Mexico will be public. For these purposes, said persons must present their comments and suggestions through the public consultation portal established by the Bank of Mexico on its website, located at the following address: https://www.banxico.org.mx/ConsultaRegulacionWeb/ The Bank of Mexico will consider the comments and suggestions presented in accordance with the foregoing and, within sixty Banking Business Days following the conclusion of the timeframe indicated in the first paragraph of this Provision, will publish on its website a report on the recommendations and suggestions received, without prejudice to the powers that it may exercise as a result of the foregoing. Mexico City, March 15, 2022.- BANK OF MEXICO: General Legal Director, Luis Urrutia Corral.- Initials.- Director of Payment Systems and Market Infrastructures Policy and Studies, Othón Martino Moreno González.- Initials. For any queries regarding the content of this Circular, the Bank of Mexico is at your disposal through the Directorate of Central Bank Authorizations and Sanctions at telephone (55) 5237-2000 extension 3200.