Circular 11/2016 — Modifications to the SPID Rules (Transitional Regime and Peso Accounts)

(First Section) OFFICIAL GAZETTE Thursday, November 3, 2016 BANCO DE MEXICO CIRCULAR 11/2016, addressed to participants in the SPID, regarding Modifications to the SPID Rules (Transitional Regime and Peso Accounts).

At the margin, a logo that says: Banco de México.

CIRCULAR 11/2016 TO THE PARTICIPANTS IN THE SPID: SUBJECT: MODIFICATIONS TO THE SPID RULES (TRANSITIONAL REGIME AND PESO ACCOUNTS)

Banco de México has decided to modify the Rules applicable to the Interbank Payments System in Dollars (SPID) in order to provide for a transitional regime so that participating credit institutions can collect customer information in the terms provided in these Rules, as well as to have a risk model prepared based on the requirements established in Annex 2 of these Rules.

On the other hand, these Rules are modified in order to allow legal entities constituted and domiciled in the country, which have peso, national currency accounts, in the participating credit institutions, to send dollar transfers through the SPID, once their bank has carried out the corresponding foreign exchange operation, provided that they comply with the same information requirements to which dollar account holders are subject.

For the above, based on articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 2, sections I, IV and VIII, and 6, of the Payments Systems Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, paragraphs fourth and seventh, 10, first paragraph, 17, section I, 20, section XI and 25 Bis 1, section IV, of the Internal Regulations of Banco de México, which grant it the authority to issue provisions through the Directorate of Central Bank Regulations, Directorate of Payments Systems and Directorate of Regulation and Supervision, respectively, as well as Second, sections I, VIII and X, of the Agreement on the Affiliation of the Administrative Units of Banco de México, has resolved to modify rules 2nd in the definitions “Issuing Customer”, “Credit Institutions”, “Transfer Order” and “SPID”, 3rd, 4th, 7th, section II, 9th, first paragraph, 12th, section I, subsections d) and e), 13th, second paragraph, 15th, second paragraph, 18th, first and second paragraphs, 22nd, section I, 25th, first paragraph and second paragraph, section II, 26th, 38th, first and second paragraphs, 39th, first paragraph, 42nd, section I, first paragraph, subsection b), numerals 1, 2, 3 and 7, subsection c), numeral 2, , subsection d), numerals 2, 3, 4 and 5, section II, subsection a), numerals 2, 3 and 4, subsection b), numerals 1, 2 and 3, subsection c), numeral 2 and section IV, subsection e), 43rd, first and second paragraphs, 46th, first paragraph, sections I to III, 50th, second paragraph, sections I, subsections a), b) and c), numerals 1 and 2, d), e), f) and penultimate and last paragraphs of section I, section II, section III, last paragraph and section IV, subsections a) and b), 51, section I, 52nd, paragraphs second to fourth, 53rd, first paragraph, 57th, section I, 59th section I, subsection d), 62nd, first paragraph, sections I and III, 63rd, first paragraph, the name of the “Annex” to remain as “Annex 1” and the transitional articles fifth, sixth, eleventh, twelfth and thirteenth, of Circular 4/2016 published in the Official Gazette of the Federation on March 11, 2016, add a third paragraph to Rule 15th, a third paragraph to the 25th, a subsection b) Bis, to section I, numerals 4 and 5, to subsection c), of Rule 42nd, a section V to the second paragraph and a third paragraph to the 50th, a section IV to the 51st and an “Annex 2”, as well as repeal numeral 5, of subsection b), of section I of the 42nd, and numerals 1 and 2, of subsection d), of section I, of the second paragraph of the 50th, of the “Rules of the Interbank Payments System in Dollars”, contained in Circular 4/2016, to remain in the following terms:

RULES OF THE INTERBANK PAYMENTS SYSTEM IN DOLLARS

“2nd. Definitions.- … … VII. Issuing Customer: the legal entity constituted in accordance with the laws of the United Mexican States, which has its domicile in the national territory, and which is the holder of any of the following deposit accounts at that Participant with whom it has agreed to present Sending Requests: (i) an account denominated in Dollars or (ii) an account denominated in pesos, national currency, with respect to which the referred Participant has chosen to offer the service of sending fund transfers in Dollars through the SPID.

Thursday, November 3, 2016 OFFICIAL GAZETTE (First Section) … XXI. Credit Institutions: the multiple banking and development banking institutions that, in terms of the Provisions, receive any or all of the following types of demand money deposits in accounts, with or without checkbooks, opened in the name of legal entities that have their domicile in national territory: (i) those denominated in Dollars, and (ii) those denominated in pesos, national currency, with respect to which said institutions have chosen to offer to the respective account holders, according to the agreement they enter into for this purpose, the service of sending electronic fund transfers denominated in Dollars through the SPID in accordance with these Rules. … XXIV. Transfer Order: the unconditional instruction that a Participant issues on behalf and for the account of its Issuing Customer that specifies in the same or, if applicable, on behalf and for its own account when there is no request from any Issuing Customer, and sends it to another Participant, through the SPID, in terms of these Rules, so that the latter carries out the corresponding crediting of a determined amount in Dollars to the account of the Beneficiary Customer designated in said instruction. … XXXIV: SPID: the payment system named “Interbank Payments System in Dollars” that allows the sending, processing and settlement of Interbank Transfer Orders, in order to transfer, through electronic means, determined amounts in Dollars to demand deposit accounts denominated in that currency, with or without checkbooks, payable in the Mexican Republic, opened only in the name of legal entities that have their domicile in national territory. …”

“3rd. Purpose of the SPID.- The SPID aims to provide Participants with a means to process, securely and efficiently, interbank electronic transfers between demand deposit accounts denominated in Dollars of legal entities that are customers of the Participants. In the same way, the SPID allows Participants who choose to offer to their customers legal entities that are holders of demand deposit accounts denominated in pesos, national currency, to carry out such transfers to the same type of accounts denominated in Dollars opened at other Participants, once the respective Participants carry out the charges of the referred peso, national currency accounts for the amounts equivalent to those in Dollars subject to the transfers, to acquire said amounts in Dollars through operations outside the SPID and at the exchange rate they determine for this purpose.”

“4th. Requirements to be a Participant.- Credit Institutions that present their application for admission to act as Participants must comply with the requirements referred to in Chapters VI and VII of these Rules.”

“7th. Operational Flow.- … I. … II. “The Issuing Participant carries out the corresponding verifications in accordance with the 13th of these Rules, including those related to Additional Risk management, and determines whether to proceed to process such Sending Request. In this case, the Issuing Participant sends the respective Transfer Order to the Administrator through the SPID. If the Issuing Participant determines that it is not appropriate to process the Sending Request, it rejects the Sending Request and notifies the Issuing Customer of the fact and the cause. In the case of that Sending Request presented against the peso, national currency account of the respective Issuing Customer, the corresponding Issuing Participant will carry out, prior to the sending of the referred Transfer Order, the charge of the amount equivalent to that in Dollars corresponding to the transfer in question in accordance with the exchange rate agreed with said customer, in order for the Issuing Participant to acquire said amount in Dollars through operations outside the SPID that it determines for this purpose;”

(First Section) OFFICIAL GAZETTE Thursday, November 3, 2016 III. to VI. …

“9th. Sending Request.- The Participant who has agreed with its Issuing Customers to process, as Issuing Participant, the Sending Requests that they transmit to it, must carry out such processing, against the respective deposit accounts of these latter denominated in Dollars. Likewise, that Participant who has chosen to offer the carrying out of transfers through the SPID to those customers who are holders of deposit accounts denominated in pesos, national currency, opened at the Participant itself, must carry out the charge in said accounts of the amounts equivalent to those in Dollars that correspond to such Sending Requests, in accordance with the exchange rate agreed with said holders, in order to acquire said amounts in Dollars through operations outside the SPID that it determines for this purpose. In all cases, the referred Participant must allow said customers to transmit their Sending Requests through the following channels: …

12th. Information contained in Sending Requests.-… I. … a) to c) … d) Any of the following data to identify the Beneficiary Customer's account: the eighteen digits that make up the Standardized Basic Key determined in accordance with what is specified in the Manual, or the sixteen digits of the debit card that, if applicable, corresponds; e) The Federal Taxpayer Registry key (with homoclave) corresponding to the Beneficiary Customer, and f) … II. …

13th. Verification of Sending Requests.- … “In the event that the authentication referred to in the previous paragraph is appropriate, the Participant must carry out the necessary verifications, including the availability of resources of the Issuing Customer's account to be charged, as well as those of Additional Risks specified in these Rules, in the terms of Chapter 11 of the Manual. In particular, the Issuing Participant must carry out the verification of the data of its Issuing Customer referred to in section IV of the 50th of these Rules, as well as those corresponding to the Beneficiary Customers in accordance with the information indicated in the respective Sending Requests in accordance with the 12th of these Rules.” ...

15th. Transfer Orders.- … “The Issuing Participant will only send Transfer Orders that it issues: I. On behalf and for the account of those Issuing Customers who have transmitted the respective Sending Requests, provided that they act on behalf and for their own account, or II. On behalf and for the account of the Issuing Participant itself, only in those cases where there are no Sending Requests from its Issuing Customers. In all cases, Participants must refrain from sending Transfer Orders on their own behalf that are requested by third parties.”

“18th. Verification of Transfer Orders Accepted by SPID.- The Receiving Participant to whom the Settlement Notice of a Transfer Order Accepted by SPID is delivered, through the SPID, must: I. Verify that it has the information of the Beneficiary Customer indicated in the Transfer Order Accepted, in accordance with the applicable provisions of section I of the 50th of these Rules, and, II. Carry out the verification of the data of the Beneficiary Customer referred to in section IV of the 50th of these Rules in accordance with the Additional Risk controls indicated in Chapter 11 of the Manual and in accordance with the technical specifications indicated in numeral 11.2 of the Manual. In the event that, as a result of the verification carried out by the Receiving Participant in terms of this Rule, it finds that it does not have the information referred to in the previous section I or that its Beneficiary Customer, any of its direct shareholders, partners, associates or members of the equivalent governing body of said customer, is listed in the lists and resolutions referred to in section IV of the 50th of these Rules, it must return the Transfer Order Accepted by SPID, without prejudice to the other actions that the Receiving Participant and, if applicable, the Issuing Participant must take in accordance with their internal policies and the legal provisions applicable to them.” …

22nd. Return of Transfer Orders Accepted by SPID.- … I. “If, as a result of the verification referred to in the 18th of these Rules, any of the circumstances indicated in the penultimate paragraph of said Rule occurs; II. to III. … …”

“25th. Crediting of the Return or Late Return Type Transfer Order.- The Issuing Participant of the Transfer Order subject to a return or late return referred to in the 22nd to 24th of these Rules must, within thirty seconds after the one in which it receives the Settlement Notice of the Transfer Order corresponding to the type of return or late return in question, credit the amount of said Transfer Order in the same demand deposit account denominated in Dollars of the Issuing Customer who transmitted the respective Sending Request. … I. … II. Make the corresponding resources available to the referred Issuing Customer, in accordance with the agreement entered into for this purpose, in the currency in question, for withdrawal at the counter or so that they can be transferred to the account that, if applicable, said Issuing Customer indicates. In the event that the Transfer Order referred to in this Rule has been carried out with resources derived from a demand deposit account denominated in pesos, national currency, of the Issuing Customer in question in accordance with what is provided in the 9th of these Rules, the Issuing Participant must, in accordance with what is stipulated for this purpose with the Issuing Customer, (i) credit in said account the amount of the respective Transfer Order equivalent to pesos, national currency, in accordance with the agreed exchange rate, (ii) transfer the amount in Dollars of the referred Transfer Order to the account in the Participant itself denominated in that currency that the Issuing Customer has indicated or to any other account in that same currency at another Participant through a transfer carried out through the SPID, or (iii) credit the amount of the indicated Transfer Order in a Dollar account that the Participant opens in the name of the Issuing Customer for this purpose. ”

“26th. Schedules.- Unless otherwise indicated, the schedules mentioned in these Rules and other applicable provisions are referenced to the time zone that governs in Mexico City.”

“38th. Application for Registration of Operators.- Each Participant must maintain, at all times, at least one Operator. Only those persons that the respective Participant registers with the Administrator may act as Operators. For this, each Participant must present to the Administrator, through the Operations and Business Continuity Management of the Payments Systems, a communication in the same terms as those included in the format attached as Annex 1 of these Rules, signed by the legal representative of the Participant in question who has the authority to exercise acts of dominion, as well as those necessary to designate those who may act as Operators in the payment systems administered by Banco de México. Each Participant must verify and keep a record that the persons designated as Operators comply with the following: I and II. … In addition to what is provided in the previous subsections, the person that the Participant intends to register as an Operator must present to the Administrator a letter of no criminal record with an issue date not greater than one year prior to its presentation to the Administrator, as well as a communication signed by the person or persons responsible for SPID compliance, in which it indicates that the person intended to be designated as an SPID Operator is not disqualified from holding an employment, position or commission in the Mexican financial system based on the available public information provided by the CNBV. …”

“39th. Application for De-registration of Operators.- The Participant who has registered an Operator with the Administrator may request, at any time, the de-registration of said person by presenting a

(First Section) OFFICIAL GAZETTE Thursday, November 3, 2016 communication in the same terms as those included in the format attached as Annex 1 of these Rules, addressed to the Administrator, through the Operations and Business Continuity Management of the Payments Systems, and signed by those persons whose signature has been previously registered with the Sub-directorate of Payments Systems Operations for the management of operations and various requests to operate with Banco de México. … …”

42nd. Requirements for Admission as a Participant.- … I. … “The Credit Institution must elaborate and document a policy that it is obliged to follow in the matter of information security that, at least, includes the following: a) … b) Have a written policy that it is obliged to follow to procure and maintain the solidity of the Technological Infrastructure, which must refer, at least, to the following aspects:

1. Procedures to evaluate the communication protocols used in the Technological Infrastructure and dispense with those considered insecure;
2. Procedures that contemplate the mandatory use of tools that allow detecting computer viruses and malicious codes in the Technological Infrastructure, as well as procedures that allow their periodic update;
3. Procedures that allow managing information security vulnerabilities derived from, among other factors, changes, updates or errors in the Technological Infrastructure;
4. …
5. Repealed.
6. …
7. Procedures to evaluate and/or audit, at least every two years, the information security of the Technological Infrastructure, which include the carrying out of penetration tests by the Participant itself or an Independent External Auditor specialized in this type of tests. Also among the work of this evaluation or audit, it must provide for the presentation of a report that establishes an information risk level for the Technological Infrastructure, as well as the formation of a documented work plan to address the high and medium criticality risks referred to in said evaluation or audit; b Bis) Have a policy that it is obliged to follow for the implementation of its information systems, either by the Participant or through an external company specialized in the development of computer programs (software), which contain the following procedures:
8. Procedures that ensure that a formal and documented development process is followed for the implementation of its information systems. The development process must consider, at least, the following stages: i. Design of the information system. ii. Development of the information system according to the previous design. iii. Validation of functionalities, purpose, capacity and quality of the information system. iv. Release and/or installation of the information system. v. Formal follow-up to changes in the information system.
9. Procedures that ensure that information security is considered during the different stages of its development process;
10. Procedures that ensure that the components that provide security to its information systems are valid and that their validity is reviewed in the terms and deadlines indicated in the Manual;

Thursday, November 3, 2016 OFFICIAL GAZETTE (First Section)

4. Procedures that ensure that the security of the computer system is reviewed in a static and dynamic manner;
5. Procedures that allow monitoring, auditing, and tracking of accesses and activities carried out by the different users of the computer services, regardless of the level of privileges established for their access and the medium or communication protocol of access. These procedures must consider the safeguarding of the information collected for a period of at least 6 months;
6. Procedures that allow monitoring, auditing, and tracking of all operations carried out by the computer systems. These procedures must consider the safeguarding of the information collected for a period of at least 6 months; c) …
7. …
8. Procedures to restrict access to physical connection ports and peripheral devices of the Technological Infrastructure;
9. …
10. Procedures that allow detecting the alteration or falsification of the information contained in the Technological Infrastructure, and
11. Procedures that allow encrypting sensitive information in the Technological Infrastructure. d) Have policies that must be followed to implement access control mechanisms to the Technological Infrastructure, based on criteria that establish to determine that these mechanisms are robust and secure, which include the following procedures:
12. …
13. Procedures for user and password management;
14. Procedures that allow manual and automatic locking of the Technological Infrastructure to ensure that equipment can only be used by authorized personnel, and Procedures for the management of access privileges to the Technological Infrastructure;
15. Procedures for the management of access privileges to the Technological Infrastructure, and
16. Procedures that allow monitoring and auditing the accesses and activities carried out by users of the Technological Infrastructure. These procedures must consider the safeguarding of the information collected for a period of at least 6 months; e) … II. … a) …
17. …
18. A methodology for business impact analysis, which considers at least: i. to vi. …
19. Hiring and training procedures that ensure that personnel related to the operation of the SPID have the skills, competencies, and knowledge required for the position they hold, and
20. Operation procedure manuals that describe the activities required to carry out their operation with the SPID and the personnel responsible for executing said activities, in such a way as to ensure that there is segregation of functions in the critical processes carried out for the operation of the SPID and that there is a precise definition of responsibilities. b) The Credit Institution must ensure that mitigation measures are established for the risks referred to in this subsection, which consider the following:
21. Have a list of identified operational risks and associated controls for operation with the SPID, indicating the risk classification and the result of its evaluation, including technological risks and those associated with external providers, as well as the list of controls implemented for the mitigation of operational risks;
22. Have a capacity analysis of the technological, human, and material resources available for operation with the SPID to ensure that it has sufficient resources to handle high volumes of operation and meet its service level objectives, and
23. Have policies and guidelines for the management of access privileges to the operational sites from which operation with the SPID is carried out and to the data centers that host the Technological Infrastructure available to operate in SPID, and c) …
24. …
25. Document the actions that must be followed for the handling of incidents that cause an impact on normal operation with the SPID, which contemplates the phases of identification, diagnosis, handling, recovery, restoration, and documentation, and indicates the corresponding roles and responsibilities;
26. to 5. … III. … IV. … … a) to d) … e) Have an Additional Risks Evaluation Model, which is mandatory to apply to all its clients who are holders of dollar deposit accounts and who, therefore, are susceptible to becoming Beneficiary Clients of Transfer Orders that the Credit Institution in question receives from its admission to the SPID, as well as its Issuing Clients with whom it agrees to process Sending Requests. Said Additional Risks Model must meet the characteristics established in Annex 2 of these Rules and must be approved by the Risk Committee based on the proposal made to that effect by the Communication and Control Committee, which must be reported by said Risk Committee to the Board of Directors or Board of Directors of the Credit Institution, as applicable. Likewise, the Credit Institution must send to the Bank of Mexico, through the Management of Operation and Business Continuity of Payment Systems, no later than 30 Banking Business Days after the referred model has been reported to the Board of Directors or Board of Directors in question, a document that describes, in terms of Annex 2, the referred Additional Risks Model that complies with what is stated above in this subsection.” “43a. Designation of two SPID compliance officers.- Each Credit Institution that requests its admission as a Participant must have an SPID compliance officer in charge of ensuring compliance with the applicable SPID regulations regarding Additional Risks and a responsible person in charge of ensuring compliance with the rest of the applicable SPID regulations on matters that do not involve Additional Risks. The SPID compliance officers referred to in the previous paragraph must be designated by the general director of the Credit Institution prior to approval by its Audit Committee.” … “46a. Compliance evaluation.- The Credit Institution that submits the admission request to act as a Participant, in accordance with what is provided in the 4th of these Rules, must certify in said request compliance with the computer security, operational risk management, and Additional Risks management requirements to operate with the SPID established in subsections I, II, and IV of the 42nd of these Rules, in terms of the Manual and, in particular, Appendices E and G. For these purposes, the Credit Institution must attach the following documentation to the referred admission request:

Thursday, November 3, 2016 OFFICIAL GAZETTE (First Section) I. A compliance report signed by the compliance officer and the compliance officer of the Credit Institution indicating how compliance is given to each of the Additional Risks management requirements, as well as the other requirements mentioned in these Rules, the findings and, if applicable, the irregularities or non-compliances detected, respectively; II. A compliance report signed by the head of the internal audit area of the Credit Institution indicating how compliance is given to each requirement referred to in this Rule, the findings and, if applicable, the irregularities or non-compliances detected, and III. A compliance report signed by an Independent External Auditor indicating how compliance is given to each of the requirements referred to in this Rule, the findings and, if applicable, the irregularities detected.” 50a. Permanent compliance with the requirements for admission as a Participant.- … … I. “Collect and conserve, without prejudice to the other identification and customer knowledge information that must be collected in accordance with applicable provisions, regarding each of its clients who are holders of dollar-denominated deposit accounts and who, therefore, are susceptible to becoming Beneficiary Clients, as well as its Issuing Clients with whom they have agreed to process Sending Requests, the following data and information: a) Digital Certificate of the advanced electronic signature issued by the Tax Administration Service in the name of the respective client, called e.firma (formerly FIEL) or any other that substitutes it; b) Purpose, declared by the client, of the use intended for the dollar-denominated deposit account or, if applicable, the peso-denominated deposit account, national currency, that he has opened with the respective Participant and, in particular, the reasons why it is convenient to send and, if applicable, receive fund transfers in Dollars through the SPID; c) Information that allows Participants to know the transactional profile regarding the operations that their clients carry out through said Participants, in accordance with the corresponding assumption among the following:

1. Regarding clients who keep their dollar-denominated or peso-denominated deposit accounts, as applicable, open for periods greater than 6 months, the information referred to in this subsection c) must include, at least: the amount, number, and frequency of Dollar transfers that clients commonly make, without prejudice to any other information that the Participant considers convenient to collect to determine the degree of Additional Risk that the client in question may represent, and
2. Regarding clients who keep their dollar-denominated or peso-denominated deposit accounts, as applicable, open for periods of up to 6 months counted from their opening, the information referred to in this subsection c) must include, at least: the amount, number, and approximate frequency of Dollar transfers that said clients estimate they commonly send; d) Regarding those Issuing Clients with whom Participants have agreed to process Sending Requests, said Participants must include the information of the corresponding Beneficiary Clients referred to in subsection I, subsections b), c), d), and e), of the 12th of these Rules, taken from the respective Sending Requests that said Issuing Clients transmit to them. Participants must only conserve the information referred to in this subsection for the purposes of what is provided in this subsection I, provided that the referred Sending Requests have generated alerts in the monitoring systems referred to in subsection IV, subsection c) of the 42nd of these Rules and that, to issue the respective Transfer Orders, in accordance with the actions of the processes indicated in said subsection c) of subsection IV of the 42nd of these Rules, said Participants have obtained additional information from the Issuing Clients about those Beneficiary Clients, in particular, the relationship they have, which must also be conserved in accordance with what is provided in this subsection;”
3. and 2. Are repealed.

(First Section) OFFICIAL GAZETTE Thursday, November 3, 2016 e) The following information of each of the persons who are direct holders of twenty-five percent or more of the social capital of the client in question: (i) name, paternal surname and, if applicable, maternal surname, for natural persons, or denomination or corporate name, for legal entities, and (ii) their Federal Taxpayer Registry key (with homoclave), or, in case that person does not need to obtain that key in accordance with applicable regulations, their date of birth or constitution, as applicable, and f) Regarding those clients who, in accordance with the client Additional Risks Evaluation Model in use in the SPID referred to in subsection IV, subsection e), of the 42nd of these Rules, are classified in a high Additional Risk category, the respective Participants must include the following information:

1. and 2. … The information and documentation collected by the Participants must be complete and up to date in such a way that it allows them, on the one hand, to form an understanding of the normal transactional activity of their respective clients, based on their economic activity or business operations, as well as to determine the degree of Additional Risk based on their transactional activity at the opening of the account and, on the other hand, to have the necessary information that justifies the use of the SPID and, if applicable, dollar-denominated accounts by their clients. Likewise, each Participant must document and conserve the reasons for the change in the transactional profile or account activity, if applicable, which must be reflected in the automated monitoring system referred to in subsection IV, subsection c), of the 42nd of these Rules. Participants will not be obligated to comply with what is established in subsection e) of this subsection I, regarding the following clients: (i) federal, state, and municipal public departments and entities, as well as other Mexican legal entities of public law, (ii) legal entities whose titles representing their social capital or securities representing said shares trade on any stock exchange in the country or in recognized foreign securities markets in terms of the General Provisions applicable to stock exchanges published in the Official Gazette on May 30, 2014 and their respective modifications, and (iii) credit institutions in general; II. Update all client information and documentation in periods not greater than three years, under the criteria established by the Participants themselves. Regarding those clients who, in accordance with the Additional Risks Evaluation Model referred to in subsection IV, subsection e), of the 42nd of these Rules, are classified in a high Additional Risk category, the update referred to in said paragraph must be annual. III. … a. and b. … The data referred to in the subsections above must be included in the respective fields of each Transfer Order in a manner consistent with the Digital Certificate of the e.firma (formerly FIEL) of said Issuing Client; IV. Verify if their Issuing Clients or Beneficiary Clients, as applicable, as well as the persons referred to in subsections e) and f), numeral 2, of subsection I of this Rule, are part of: a) General lists or particular resolutions issued by competent authorities regarding persons regarding which Credit Institutions in general are obliged by law to suspend their operations, and b) Official lists regarding persons regarding which financial institutions are obliged by law to suspend their operations, issued by the competent authorities that the Correspondent with whom the Participant in question holds a dollar deposit account to operate in the SPID must observe, and V. Refrain from issuing Transfer Orders or accepting those Accepted Transfer Orders issued by the SPID, referred to the Issuing Client or Beneficiary Client, as applicable, that has sent or received any transfer previously through the SPID regarding which any alert has been generated in the automated systems available to the Participant itself, in order to detect unusualness in said transfer or inconsistencies of these with the information that is known to the Participant, without the latter having carried out the review and, if applicable, obtained the additional necessary information to verify the Additional Risk that said transfer entails. VI. Submit an annual written report to the Bank of Mexico, containing the result of the application that the Participant carries out of the Additional Risks Evaluation Model referred to in subsection IV, subsection e), of the 42nd of these Rules. If applicable, the Communication and Control Committee must submit to the approval of its Risk Committee the modifications made to the Additional Risks Evaluation Model of its clients referred to in subsection IV, subsection e), of the 42nd of these Rules, and inform this fact to the Board of Directors or Board of Directors of the Institution as applicable so that it presents it to the Bank of Mexico, through the Management of Operation and Business Continuity of Payment Systems, within fifteen Banking Business Days following the date of that approval, the result of the application of said modified model to the respective clients. The annual report referred to in the first paragraph of this subsection must be presented to the Bank of Mexico within sixty natural days following the closing of the exercise in question.” Under no circumstances may Participants issue Transfer Orders or accept those Accepted Transfer Orders issued by the SPID, referred to their Issuing Clients or Beneficiary Clients, as applicable, without said Participants having complied with what is established in subsections I to IV of this Rule. 51a. Functions of the SPID compliance officers.- … I. “Submit a semi-annual written report to the audit committee of the Participant, in the month of January and in the month of July, containing the findings and, if applicable, irregularities and non-compliances with the internal SPID regulations, as well as with the rest of the applicable SPID regulations, the actions adopted to correct them and the degree of progress and efficiency of such actions. Additionally, it must send a copy of the report referred to in this subsection and the receipt confirmation by the Participant's audit committee to the Administrator, through the Management of Operation and Business Continuity of Payment Systems, no later than the fifteenth Banking Business Day following that in which it submitted the mentioned report to said committee. The obligation to deliver the reports referred to in this subsection will begin from 180 natural days after the date of admission in accordance with the 48th of these Rules; II. and III. … IV. Submit the annual report referred to in subsection VI, of the 50th of these Rules.” 52a. Periodic report and certification.- … “The compliance reports corresponding to the verifications referred to in the previous paragraph must be delivered to the Participant's audit committee and to the Administrator, through the Management of Operation and Business Continuity of Payment Systems, within sixty natural days following the closing of the exercise. Regarding the audit compliance report related to the compliance with the Additional Risks management requirements, the provisions of this Rule may be considered fulfilled when the Participant sends a copy of the audit opinion established in the 60th of the “General Provisions referred to in article 115 of the Law of Credit Institutions” to the Administrator, if applicable, which includes the review of Additional Risks. The Participant may not contract the services of an Independent External Auditor or Firm to obtain the certification referred to in this Rule for more than three consecutive certification periods. Without prejudice to the foregoing, the Participant may designate the same Independent External Auditor and/or Firm again after a minimum interruption of five years counted from the last certification that had been granted regarding said Participant. Additionally, each time a new version of the application used to connect to the SPID is generated, the Participant must inform the Administrator, who will determine if accreditation tests must be carried out in accordance with what is established in subsection III of the 42nd of these Rules and in the terms established in the Manual.”

(First Section) OFFICIAL GAZLETT Thursday, November 3, 2016

“53a. Forced Compliance Plan.- In the event that, derived from the review carried out by the Administrator on a Participant or from the results of the Independent External Auditor, the Administrator detects irregularities or non-compliance with the internal rules of the SPID, it may require the Participant to present a forced compliance plan in which the actions that the Participant undertakes to adopt to correct the detected irregularities or non-compliance are provided, as well as the deadline by which they will be carried out and the persons responsible for addressing each of them. To this effect, the Participant must submit the forced compliance plan for approval by the Administrator, through the Management of Authorizations, Regulation and Sanctions.”

…

57a. Expulsion.- …

I. “The Participant fails to comply with any of the obligations indicated in Rule 50a. of these Rules or with any of the requirements provided in these Rules to act as a Participant in the SPID provided in these Rules, or with the policies and procedures that it has become obliged to follow in terms of the same, and”

II. …

59a. Information on Accepted Transfer Orders.- …

I. …

a) to c) …

d) “The account number indicated in the Transfer Order corresponding to the respective account of the Beneficiary Client;”

…

II. …

62a. Payment of compensation for delay.- Each Participant must pay its respective client the amounts referred to in the following subsections, without prejudice to other payments it must make in accordance with these Rules, when it falls under any of the following circumstances:

I. In the event that the Issuing Participant fails to comply with any of the deadlines indicated in Rule 16a. or 25a. of these Rules, and said non-compliance persists, at least until the SPID operation day that is subsequent to the one in which the applicable deadline expired, said Participant must pay the amount resulting in accordance with the provisions of Rule 63a. of these Rules. The Issuing Participant referred to in this subsection must pay, no later than the close of the SPID operation day immediately following the one in which the non-compliance in question concluded, said amount in the same deposit account denominated in Dollars of the Issuing Client that transmitted the Send Request in question. In the event that the Transfer Order corresponding to the circumstance that applies in accordance with this subsection has been made with resources derived from a deposit account denominated in pesos, national currency, of the Issuing Client in question in accordance with the provisions of Rule 9a. of these Rules, the Issuing Participant must pay in said account the amount of said Transfer Order equivalent to pesos, national currency, as determined by the Bank of Mexico in terms of the Provisions for the day on which the Issuing Participant makes the payment referred to in this paragraph;

II. …

III. In the event that the Receiving Participant has failed to comply with the deadline provided in Rule 23a. of these Rules, and said non-compliance persists, at least until the SPID operation day that is subsequent to the one in which the applicable deadline expired, said Participant must pay to the Issuing Participant of the Transfer Order subject to the return, the amount resulting in accordance with the provisions of Rule 63a. of these Rules. In this case, the Receiving Participant must send a Transfer Order corresponding to the type of late return to the Issuing Participant, for an amount equal to the sum of the original amount plus the amount resulting in accordance with the provisions of Rule 63a. of these Rules. The Issuing Participant is obliged to pay the amount of the said late return type Transfer Order to the Issuing Client who instructed the Transfer Order subject to the return, in the same deposit account denominated in Dollars of the Issuing Client that transmitted the Send Request in question. In the event that the Transfer Order corresponding to the circumstance that applies in accordance with this subsection has been made with resources derived from a deposit account denominated in pesos, national currency, of the Issuing Client in question in accordance with the provisions of Rule 9a. of these Rules, the Issuing Participant must pay in said account the amount of said Transfer Order equivalent to pesos, national currency, at the exchange rate determined by the Bank of

Thursday, November 3, 2016 OFFICIAL GAZETTE (First Section)

Mexico in terms of the Provisions for the day on which the Issuing Participant makes the payment referred to in this paragraph.”

“63a. Calculation of amounts.- To calculate the amount referred to in the previous Rule, the Participant must first calculate a reference amount in the following way: I. Multiply the effective federal funds interest rate, rounded to two decimal places, announced for each day by the Federal Reserve of the United States of America on the Banking Business Day previous in the United States of America to the one in which the non-compliance occurred, by the amount of the Transfer Order in question, including cents; II. Multiply the result by the number of natural days of delay, and III. Divide the obtained result by 360. The reference amount will be the result of rounding to two decimal places the quantity obtained from this division.

…”

“Annex 1”

…

“Annex 2 CHARACTERISTICS THAT THE ADDITIONAL RISK ASSESSMENT MODELS MUST COMPLY WITH The objective of this annex is to indicate the minimum aspects that Credit Institutions intending to be admitted as Participants and Participants (Subjects to the Risk Model) must consider in order to present their money laundering (ML) and terrorist financing (TF) risk assessment model that they must apply to clients using said system. The Additional Risk Model (Risk Model) is a methodology through which Subjects to the Risk Model must carry out the process of identification, measurement, classification and mitigation of client risks operating in said system. The design and details of the methodology as well as the processes for the use and validation of the Risk Model must be documented. Subjects to the Risk Model must demonstrate that the data used for the development of the Risk Model are representative of the universe of their clients who can use the SPID.

Subjects to the Risk Model that have global models for the assessment of ML and TF risks must demonstrate that said models have incorporated the SPID as a service within their classification criteria. Likewise, Subjects to the Risk Model that have Risk Models developed specifically for the use of the SPID must demonstrate that they have incorporated into their risk classification process, the client risk classification in other services or products contracted in order to reflect the client's degree of risk consistently. Without prejudice to the foregoing, the Risk Model must comply with the aspects indicated as minimum in this Annex.

I. Risk Model Criteria

i. Identification of risk factors Risk factors are those indicators that explain how and to what extent each client using the SPID represents ML/TF risk for Subjects to the Risk Model. The identification of risk factors for clients performing operations in the SPID is the process by which the necessary information is collected, processed and generated for the development and use of the Risk Model. Risk factors may be qualitative or quantitative and must reflect the attributes of clients -at least in the following dimensions:

a) Inherent characteristics:

• Date of incorporation
• Business or activity
• Geographic location
• Products and services (if applicable)

b) Transactional profile:

• Volume of operation
• Frequency of operation
• Type of Counterparties

(First Section) OFFICIAL GAZETTE Thursday, November 3, 2016

• Origin and destination of resources
• Cash handling in the account

ii. Measurement of risks Subjects to the Risk Model must have an exhaustive method, which may be statistical, for the effective measurement of client risks, for which they must consider the risk factors identified in each of their dimensions. Said method will establish the relationship between the attributes or parameters associated with the risk factors and will provide the elements for the assignment of the weight of each of them according to their suitability for measuring the risk of clients using the SPID.

iii. Client classification system. Subjects to the Risk Model based on the risk measurement they carry out, must classify their clients into various degrees of risk that allow them to be significantly differentiated. In the event that the Risk Model shows degrees of risk with excessive concentrations of clients, they can only be justifiable when such clients present homogeneous attributes or parameters derived from the evaluation of the risk factors. Each established degree of risk must result from a clear and detailed set of classification criteria from which the corresponding degree of risk will be assigned to each client. The classification system may incorporate expert criterion components, provided they have extensive documentation of the definition and justification of their consistency as well as the assignment of the attributes considered by said criterion. The classification system may incorporate as many intermediate risk degrees as Subjects to the Risk Model consider necessary. Likewise, they must justify through the documentation of the Risk Model the suitability of the number of risk degrees considered in their classification system.

a) Classification criteria Classification criteria refer to the specific definitions and processes that allow classifying clients operating in the SPID into degrees of risk. These criteria must be credible and facilitate significant risk differentiation, for which they must:

• Have a sufficient level of detail so that the personnel responsible for classifying clients by risk degree do so consistently, that is, assign the same degree to clients representing similar risk.
• Provide the necessary clarity and detail so that a third party can understand the client classification process, be able to reproduce said classification and evaluate its suitability.
• Be consistent with the Policies and Procedures Manuals of Subjects to the Risk Model.

b) Invalidations Subjects to the Risk Model must describe the circumstances in which their personnel may invalidate the results of the classification process, specifying who, how and to what extent they will be authorized to do so. In all cases, Subjects to the Risk Model must have guidelines and processes that allow them to study those cases that update the described circumstances. For the purposes of the above, Subjects to the Risk Model must document in a register or log the assignment of classifications, including at least the identification of the personnel responsible for approving such invalidations and follow up on them. Subjects to the Risk Model must not have unclassified clients in any of the risk degrees established in the classification system.

iv. Risk mitigants Subjects to the Risk Model in their process of classifying each of their clients into degrees of risk must carry out reviews and, if applicable, updates of the risk factors taking into consideration the following criteria:

II. Use of the Risk Model

Thursday, November 3, 2016 OFFICIAL GAZETTE (First Section)

Subjects to the Risk Model in their process of classifying each of their clients into degrees of risk must carry out reviews and, if applicable, updates of the risk factors taking into consideration the following criteria:

o Change in the dimension of inherent characteristics of the client. o Change in the dimension of the client's transactional profile. o In case, when changes occur in any other dimension defined by Subjects to the Risk Model.

For such purposes, Subjects to the Risk Model must carry out the risk assessment with a frequency not greater than 6 months, in order to determine whether it is necessary or not to modify the client's risk degree. For this, they must have a periodic and effective process for obtaining and updating the information used to evaluate the risk factors.

Without prejudice to the foregoing, when Subjects to the Risk Model obtain new relevant data about a client, they must review and, if applicable, classify it into a new degree of risk.

In any case, when the risk degree assigned to the client increases, the Subject to the Risk Model must intensify the review of the risk factors.

Additionally, Subjects to the Risk Model must have procedures for human review of the classification based on Risk Models such that all relevant information not contemplated in said models can be taken into account. The Subject to the Risk Model must have written guidelines describing how human criterion and the results of Risk Models will be combined.

Subjects to the Risk Model must preserve the classification history of their clients, including the classifications in the risk degrees assigned for the first time and the dates on which new classifications were made.

III. Validation of the Risk Model

Subjects to the Risk Model must periodically validate their Risk Model considering the following:

• Controlling their results and stability, examining the relationships of the risk factors considered, and • Contrasting the results predicted by the models with the results observed in practice.

To carry out the validation of the Risk Models, Subjects to the Risk Model must:

a) Ensure that the internal validation process is carried out by an area independent from that which developed the Risk Model and demonstrate the functioning of the processes for identification, measurement, classification and mitigation of risks. The Subject to the Risk Model may also rely on external auditors or consultants, understanding that their responsibility is non-delegable. b) Periodically examine the classification criteria and procedures to guarantee their validity and full applicability to clients or operations they perform in the SPID. c) Compare at least annually, the classification criteria considered to establish the degrees of risk and demonstrate that these are within the expected ranges. The methods and data used in such comparisons must be documented. d) Have review procedures whose purpose is the detection and limitation of what is known to be a potential limitation of the Risk Model and to continuously improve its results. e) Carry out continuous verification of the operational processes for risk measurement and the classification system to ensure their correct implementation.

IV. Documentation

The documentation of the Risk Models must consider the criteria for their elaboration, use and validation, including their operational details. Likewise, the main modifications made to the risk classification system and the areas responsible for carrying them out must be documented, as well as the areas involved in its operation, including the internal control structure.

(First Section) OFFICIAL GAZETTE Thursday, November 3, 2016

The documentation must prove compliance with the minimum requirements by the Subject to the Risk Model and must include the description of the criteria for the classification of its clients demonstrating that such criteria are capable of differentiating risk significantly, the responsibilities of the areas involved in the operation of the classification system, the definition of what constitutes an invalidation of the classification, the personnel authorized to approve invalidations, the frequency with which reviews of classifications are carried out and the supervision of the classification process by the Risk Committee.

In addition to the foregoing, for the statistical models used in the risk measurement stage and, if applicable, the classification system, Subjects to the Risk Model must include in their documentation:

a) A detailed description of the theory, assumptions or mathematical and empirical bases used for the correlation of risk factors and their weighting, as well as the data sources used. b) A rigorous statistical process, which proves the goodness of fit of the statistical model used for risk measurement, including validations both out of sample and out of the sample period, with the objective of validating said model. c) An analysis of the circumstances that prevent the effective functioning of the statistical model and the solution criteria implemented by the Institutions.

Each degree of risk of the classification system must be well defined. These definitions must describe all quantitative and qualitative classification criteria that are used to consistently apply the degrees of risk and, if applicable, the criteria for assigning a particular degree to clients. The documentation on the classification criteria in the degrees of risk and the mitigants associated with each of them, must be sufficiently detailed so as to allow replication by a third party. The use of a model acquired from a third party, which operates with its own technology, does not justify exemption from compliance with the documentation, nor with other requirements for the risk model.

a) Monitoring of the Use of Risk Models

The Subject to the Risk Model must deliver to the Bank of Mexico, in accordance with subsection IV, letter e), of Rule 42a. of these Rules, the documentation on the results of the use of the Risk Model mentioned below:

i. The Risk Model Classification Cards in which the assignment of its clients to the degrees of risk established in its classification system will be reflected, as well as the criteria describing said degrees of risk. ii. If applicable, a report regarding any change made to the Risk Model. iii. The conclusions of Subjects to the Risk Model on the performance of the Risk Model, in which they must reflect at least the following: a. A measure of the level of effectiveness of the results of the application of the model. b. The deficiencies or areas of opportunity detected when reviewing the results of its application. c. The actions that will be carried out to remedy said deficiencies.”

“TRANSITORY PROVISIONS

FIRST. TO FOURTH. …

“FIFTH. The obligation on Participants to have the Additional Risk Assessment Model provided for in letter e), of subsection IV, of Rule 42a. of these Rules, approved by their respective Risk Committees, will enter into force on May 3, 2017.

Without prejudice to the provisions of the preceding paragraph, Participants must present to the Bank of Mexico, no later than February 3, 2017, a document in which they describe the following:

I. The scheme according to which the Participant will classify its clients into differentiated segments based on the Additional Risk they represent, and

II. The identification of the relevant factors and other variables used by the Participant to determine each segment of the clients indicated in subsection I.

SIXTH. Participants must have in their respective systems and files the data and information referred to in letters b), c) and e) of subsection I of Rule 50a. of these Rules from August 31, 2017.

Thursday, November 3, 2016 OFFICIAL GAZETTE (First Section)

Without prejudice to what is provided in the preceding paragraph, Participants shall comply with the following obligations within the timeframes indicated below:

I. Starting from November 4, 2016, Participants shall obtain the data and information referred to in the subsections cited in the first paragraph of this transitional article, with respect to the following clients:

a) Beneficiary Clients indicated in Transfer Orders that the respective Receiving Participants must return, in accordance with item I of Rule 22 of these Rules, due to lacking the Beneficiary Client information referred to in item I of Rule 18 of these same Rules. In this case, while the respective Beneficiary Client's account remains open, the corresponding Receiving Participant shall obtain the information referred to in this subsection during the first fifteen Banking Business Days following the day on which the respective return must be made in accordance with these Rules. If the aforementioned Receiving Participant does not obtain the information within the timeframe indicated in this subsection, they must refrain from making or receiving fund transfers to the respective accounts through any other channel;

b) Clients who have requested to open deposit accounts denominated in Dollars starting from the date indicated in the first paragraph of this subsection I, and

c) Clients who are holders of deposit accounts denominated in Dollars, regardless of the date on which they opened said accounts, and who request to make, for the first time starting from the date indicated in the first paragraph of this subsection I, a fund transfer from those accounts to other accounts of the same type opened at any Credit Institution.

II. Starting from May 31, 2017, Participants shall have in their respective systems and files the data and information referred to in the subsections cited in the first paragraph of this transitional article, with respect to the following clients:

a) Clients who are holders of deposit accounts denominated in Dollars, regardless of the date on which they opened said accounts, and who have made one or more fund transfers from those accounts to other accounts of the same type opened at any Credit Institution, and

b) Clients who are holders of demand deposit accounts denominated in Dollars against which checks have been drawn that have been presented for collection starting from January 1, 2016.”

SEVENTH. TO TENTH. …

“ELEVENTH. The provision contained in item IV and the last paragraph of Rule 29a of these Rules shall enter into force on June 1, 2018.

TWELFTH. Regarding the provision contained in Rule 12 of these Rules, concerning the eighteen digits that make up the Standardized Basic Key referred to in item d), of item I, shall enter into force on April 3, 2017. Until then, Participants may use an identification of up to twenty digits to identify the Beneficiary Client's account.

THIRTEENTH. Credit Institutions, to comply with what is provided in item III of Rule 46a of these Rules, may present to the Administrator the compliance report provided for in Provision 60 of the “General Provisions referred to in Article 115 of the Law of Credit Institutions” that includes the review of these risks in the SPID within the 60 natural days following the close of the 2016 fiscal year.”

TRANSITIONAL PROVISIONS

FIRST. This Circular shall enter into force on the Banking Business Day following its publication in the Official Gazette of the Federation.

As an exception to what is provided in the preceding paragraph, Participants may offer, only starting from May 31, 2017, the execution of electronic fund transfers denominated in Dollars through the SPID, in accordance with these Rules, to those legal entities that are holders of demand deposit accounts in pesos, national currency, that they open at said Participants.

(First Section) OFFICIAL GAZETTE Thursday, November 3, 2016

SECOND. The obligation incumbent on Participants to document, in a policy that they must follow in matters of information security, the elements provided for in items c) and numerals 4 and 5 of item I of Rule 42a of these Rules, shall enter into force on January 3, 2017.

THIRD. Notwithstanding what is provided in the Sixth Transitional Provision of Circular 4/2016, Participants may only issue Transfer Orders corresponding to Send Requests transmitted to them by their Sending Clients, provided that the Participants themselves obtain and retain the information regarding said Sending Clients referred to in Rule 50a of the Rules in terms of this Circular.

Mexico City, October 28, 2016.- The Director of Regulation and Supervision, Viviana Garza Salazar.- Signature.- The Director of Central Bank Dispositions, Mario Ladislao Tamez López Negrete.- Signature.- The Director of Payment Systems, Miguel Ángel Díaz Díaz.- Signature.

For any inquiries regarding the content of this Circular, please contact the Department of Authorizations, Consultations and Legal Control, at the phones (55) 5237-2308, (55) 5237-2317 or (55) 5237-2000 Ext. 3200.200.