Circular 10/2018 — Modification of Circular 13/2017

Friday, July 27, 2018 OFFICIAL GAZETTE (First Section) BANK OF MEXICO CIRCULAR 10/2018 addressed to Credit Institutions and other Companies that professionally provide the Service of Fund Transfers, regarding the Reform to the General Provisions applicable to participants in the Interbank Electronic Payment System (SPEI), in matters of Risk Mitigation.

A logo appears at the margin, which says: Bank of Mexico.

CIRCULAR 10/2018 TO CREDIT INSTITUTIONS AND OTHER COMPANIES THAT PROVIDE PROFESSIONALLY THE SERVICE OF FUND TRANSFERS: SUBJECT: REFORM TO THE GENERAL PROVISIONS APPLICABLE TO PARTICIPANTS IN THE INTERBANK ELECTRONIC PAYMENT SYSTEM (SPEI), IN MATTERS OF RISK MITIGATION.

The Bank of Mexico, with the purpose of continuing to promote the proper functioning of payment systems and the sound development of the financial system, as well as the protection of the public's interests, has considered it necessary to reinforce the measures adopted to prevent risks related to the handling of resources derived from fund transfers from client accounts that may imply a higher risk.

For the above reason, the Bank of Mexico, based on articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 2, 3, fraction I, 24, and 35 Bis, of the Bank of Mexico Law, 10 and 19 of the Payment Systems Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, paragraphs fourth and seventh, 10, first paragraph, 12 first paragraph in relation to 20, fraction XI, and 14 Bis first paragraph in relation to 17, fraction I, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Directorate of Operations and Payment Systems and the General Legal Directorate, respectively, as well as Second, fractions VI and X, of the Agreement on the Affiliation of the Administrative Units of the Bank of Mexico, has resolved to modify fractions IV and V of the 15th, as well as add fractions VI to XVII to the 15th, of the General Provisions applicable to credit institutions and other companies that professionally provide the service of fund transfers, as well as to participants in the payment systems administered by the Bank of Mexico and to other interested parties in acting as participants in said systems, contained in Circular 13/2017, to remain in the following terms:

GENERAL PROVISIONS APPLICABLE TO CREDIT INSTITUTIONS AND OTHER COMPANIES THAT PROVIDE PROFESSIONALLY THE SERVICE OF FUND TRANSFERS, AS WELL AS TO PARTICIPANTS IN THE PAYMENT SYSTEMS ADMINISTERED BY THE BANK OF MEXICO AND TO OTHER INTERESTED PARTIES IN ACTING AS PARTICIPANTS IN SAID SYSTEMS

“15th. Obligations of SPEI Participants.- … I. to III. … IV. Implement the scheme regarding balances in client accounts in terms of the Internal Standards; V. Have systems, procedures, and control measures that allow certifying and validating the identity of the issuing client, the availability of resources in the issuing account, as well as safeguarding the identity verification elements and identifiers of the issuing client; VI. Identify, among its clients, those subjects other than financial entities that offer, in a habitual and professional manner, exchanges or purchase and sale of virtual assets referred to in article 17, fraction XVI, of the Federal Law for Prevention and Identification of Operations with Resources of Illicit Origin; VII. With respect to the clients referred to in the previous fraction, maintain for them only accounts corresponding to demand deposit accounts opened in credit institutions, popular financial societies, community financial societies, savings and loan cooperatives, regarding which the SPEI Participant collects the same documentation and identification data that the general provisions referred to in article 115 of the Law of Credit Institutions establish for level 4 accounts offered by said institutions; VIII. Refrain from opening to the clients referred to in the previous fraction VI, client accounts that these, in turn, can offer to their users for sending or receiving fund transfers through SPEI in favor of said clients; IX. Perform additional validations regarding fund transfers directed to beneficiary client accounts referred to in the previous fraction VI; X. Have a documented policy and procedures in matters of trust and integrity testing that must be applied to those members of its personnel, as well as third parties that provide services in matters of information and communication technologies, who have access to relevant information and systems in the operation with SPEI; XI. Have documented policies and procedures in matters of prevention of operations with resources of illicit origin that include, at least, the activities that will be carried out to identify beneficiary client accounts referred to in the previous fraction VI; XII. Have at all times an information security officer and inform the Administrator of the appointment; XIII. Perform periodic verifications of the compliance of the functions of the information security officer; XIV. Make available to the information security officer the updated list of persons who have access to information related to operations in which the Participant itself intervenes, both those located abroad and users of the technological infrastructure who have high privileges; XV. Perform periodic verifications of compliance with requirements in matters of: i) information security in its technological infrastructure or the technological infrastructure of any third party that could affect the operation or the technological infrastructure of the SPEI Participant, and ii) response to information security incidents in its electronic channels; XVI. Refrain from making available to the clients referred to in the previous fraction VI, on the same banking business day that it receives the Transfer Order accepted by SPEI directed to the account of the mentioned client, the resources corresponding to the credit that has been found to be appropriate, when the Administrator issues a notice on situations where SPEI Participants must elevate their monitoring and alert mechanisms with respect to fund transfers that they process through SPEI, and XVII. Refrain from issuing Transfer Orders in the name of the SPEI Participant in question and on behalf of third parties, for the credit of the corresponding resources in any of the accounts of the clients referred to in the previous fraction VI opened in the same SPEI Participant or in any other.”

TRANSITORY PROVISIONS FIRST. This Circular shall enter into force on the Banking Business Day immediately following the date of publication of this Circular in the Official Gazette of the Federation, except for what is provided in the following transitory articles.

SECOND. What is provided in fractions VI, VII, VIII, XI, XVI and XVII of Provision 15th, shall enter into force three Banking Business Days after the date of publication of this Circular in the Official Gazette of the Federation.

THIRD. What is provided in fractions XII, XIII and XIV of Provision 15th, shall enter into force twenty Banking Business Days after the date of publication of this Circular in the Official Gazette of the Federation.

FOURTH. What is provided in fraction XV of Provision 15th, shall enter into force thirty Banking Business Days after the date of publication of this Circular in the Official Gazette of the Federation.

Mexico City, July 24, 2018.- The General Director of Operations and Payment Systems, Jaime José Cortina Morfín.- Rubric.- The General Legal Director, Luis Urrutia Corral.- Rubric.

Friday, July 27, 2018 OFFICIAL GAZETTE (First Section) For any inquiries regarding the content of this Circular, please contact the Department of Authorizations, Consultations and Legal Control, at the phones (55) 5237-2308, (55) 5237-2317 or (55) 5237-2000 Ext. 3200. Legal Control, at the phones (55) 5237-2308, (55) 5237-2317 or (55) 5237-2000 Ext. 3200.