Circular 11/2018 — Modifications to Circular 14/2017

Friday, July 27, 2018 OFFICIAL GAZETTE (First Section) BANK OF MEXICO CIRCULAR 11/2018 addressed to the participants of the Interbank Electronic Payments System and other interested parties acting with such status, regarding the Reforms to the Rules of the Interbank Electronic Payments System (SPEI), in matters of Risk Mitigation.

At the margin, a logo stating: Bank of Mexico.

CIRCULAR 11/2018 TO THE PARTICIPANTS OF THE INTERBANK ELECTRONIC PAYMENTS SYSTEM AND OTHER INTERESTED PARTIES ACTING WITH SUCH STATUS:

SUBJECT: REFORMS TO THE RULES OF THE INTERBANK ELECTRONIC PAYMENTS SYSTEM (SPEI), IN MATTERS OF RISK MITIGATION.

The Bank of Mexico, in its capacity as administrator of the Interbank Electronic Payments System (SPEI), with the purpose of continuing to promote the proper functioning of payment systems and the sound development of the financial system, as well as the protection of the public's interests, has considered it necessary for participants in said system to establish intensified measures for the prevention of risks related to the handling of resources derived from transfers of funds not legitimately authorized.

In particular, it is advisable to increase attention to those resources that may be used in the acquisition of virtual assets carried out without the full identification of the clients associated with said operations. Likewise, derived from the operation of the participants in the SPEI observed since the issuance of the rules of said payment system through Circular 14/2017, published in the Official Gazette of the Federation on July 4, 2017, it is advisable to establish additional requirements for said participants in matters of information security. In this way, the referred measures seek to strengthen the objectives pointed out by the cited rules, consisting of strengthening the security of the participants in the SPEI, in an integral manner, as well as promoting greater benefits to the general population, by establishing homogeneous practices on the treatment that must be given to client accounts that may imply a higher risk, with the purpose of promoting appropriate conditions for an adequate risk control environment that provides certainty and confidence to both participants and users.

For the above, the Bank of Mexico, based on articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 2, sections I, IV and VIII, and 6, of the Payment Systems Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, paragraphs fourth and seventh, 10, first paragraph, 12, first paragraph in relation to 20, section XI, and 14 Bis, first paragraph in relation to 17, section I, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Directorate of Operations and Payment Systems and the General Legal Directorate, respectively, as well as Second, sections VI and X, of the Agreement on the Affiliation of the Administrative Units of the Bank of Mexico, has resolved to modify sections IV and V of article 45a., the first paragraph of article 58a., the title of Section II of Chapter VI, the first and second paragraphs of article 60a., and sections I and II of article 72a., as well as add a fourth paragraph to section I of article 19a., a section VI to article 45a., a subsection a Bis) to Section A of section I, a subsection g) and a final paragraph to Section B of section I and a final paragraph to section V of article 58a., a fourth paragraph to article 59a., article 59a. Bis, and sections I Bis, III and IV to article 72a., of the Rules of the Interbank Electronic Payments System, contained in Circular 14/2017, to remain in the following terms:

RULES OF THE INTERBANK ELECTRONIC PAYMENTS SYSTEM

“19a. Crediting of Transfer Orders Accepted by SPEI.- … I. …

(First Section) OFFICIAL GAZETTE Friday, July 27, 2018 …. …. Additionally, regarding those fund transfers directed to Beneficiary Client Accounts indicated in Rule 58a., section V, last paragraph, the respective Receiving Participants must carry out additional validations to those provided in these Rules before carrying out the crediting referred to in this section, to determine if they accept the respective Transfer Orders Accepted by SPEI and, regarding said validations, they must take into account, among other aspects they determine, the opening date of the corresponding Client Accounts, as well as the transactional patterns of these in comparison with those considered unusual. In this case, the referred Participants will not be obliged to comply with the deadlines indicated in the first and second paragraphs of this section, as applicable, and may carry out the corresponding credits within the time frame that, for this purpose, the Administrator authorizes each Participant in response to the request submitted through the Operations and Business Continuity Management of the Payment Systems.

Until the Participants have the authorization from the Bank of Mexico referred to in this paragraph, they must carry out each of the aforementioned credits on the next Banking Business Day following that on which they receive the respective Transfer Order. …”

“45a. Contingencies.- … I. to III. … IV. Put into operation the contingency procedure called “SPEI Alternative Operation Procedure” (POA-SPEI), in accordance with what is provided in section 5 of the Manual, for which Participants, who have the status of Credit Institution or institutions for the deposit of securities, will be obliged to continue with the operation of the SPEI through the use of said procedure; V. Extend the operating hours of the SPEI, or VI. Notify all Participants, through the electronic communication means established in the Manual, notices on situations in which they must elevate their monitoring and alert mechanisms with respect to the fund transfers they process through the SPEI, under the terms and subject to the conditions that, for this purpose, the Manual establishes.”

“58a. Requirements for Admission as a Participant.- The interested party wishing to act as a Participant who submits an application for admission in accordance with 57a. of these Rules must prove, to the satisfaction of the Administrator, that it meets the requirements indicated below, in terms of the specifications included in Appendix M of the Manual. I. … A. … … a) … a Bis) The measures and actions that must be adopted, in accordance with what is established in the Manual, for the attention of information security incidents in its Technological Infrastructure or in the technological infrastructure of any third party that could have an impact on the operation or in the Technological Infrastructure of the interested party. … B. … … a) to f) …

Friday, July 27, 2018 OFFICIAL GAZETTE (First Section) g) The measures and actions that must be adopted, in accordance with what is established in the Manual, for the attention of information security incidents in its Electronic Channels.

In addition to what is previously established in this section, the interested party wishing to act as a Participant must have a documented policy and procedures that it is obliged to follow in matters of trust and integrity testing that it must apply to those members of its personnel, as well as to third parties that provide services in matters of information and communication technologies, who have access to relevant information and systems in the operation with the SPEI. … V. … … … In addition to what is previously established in this section, the interested party wishing to act as a Participant must have a documented policy and procedures that it is obliged to follow in the matter indicated in the second paragraph of this section, in which it includes, at least, the activities it will carry out to identify Client Accounts corresponding to subjects other than financial entities that habitually and professionally offer exchanges or buying and selling of virtual assets referred to in article 17, section XVI, of the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin.”

“Section II Compliance and Information Security Officers of the SPEI”

“59a. Compliance Officers of the SPEI.- … … I. and II. … … The above shall be applicable without prejudice to the responsibility corresponding to the Participant for violations committed to these Rules.”

“59a. Bis. Information Security Officer of the SPEI.- The subject requesting admission as a Participant must designate a person to serve as the Information Security Officer of the SPEI, who must have independence with respect to the business units and the systems and audit areas of said subject, as well as be in charge of the following: I. Participate in the definition and verify the implementation and continuous compliance of the computer security policies and procedures indicated in Rule 58a., section I, sections A and B. II. Verify, at least quarterly or earlier, in case events or irregular circumstances or threats referred to in the previous Rule 46a. occur or are detected, that the activities carried out in the different components of the Participant's Technological Infrastructure or in the Electronic Channels in case the subject referred to in this Rule offers them to its Clients, including those of technical personnel with high privileges, such as operating system and database administrators, in order to detect unusual or unauthorized activities. III. Approve and verify compliance with the measures adopted to remedy deficiencies detected in connection with the functions referred to in the previous sections I and II, as well as the findings of both internal and external audits related to the Technological Infrastructure and information security.

(First Section) OFFICIAL GAZETTE Friday, July 27, 2018 IV. Validate the management of events, circumstances or irregular threats referred to in the previous Rule 46a., considering the stages of identification, protection, detection, response and recovery, as well as governance, preparation, testing, awareness and evaluation and learning aspects. VI. Inform the audit committee and the risk committee of the Participant or the bodies exercising such functions, in the session immediately following the verification of the event, circumstance or irregular threat referred to in the previous Rule 46a., regarding the actions taken and the follow-up to measures to prevent or avoid the recurrence of the mentioned incidents.

Participants must ensure that the information security officer has at their disposal the updated list of persons who have access to information related to the operations in which the Participant itself intervenes, both those located abroad and users of the Technological Infrastructure with high privileges, such as operating system and database administration, as well as their service providers. Said list must include the level of access and privileges associated with said accesses to the own Technological Infrastructure, as well as other third-party technological infrastructure involved in the operation of the SPEI, corresponding to each of said persons.”

“60a. Registration with the Administrator.- Each interested party must inform, in writing addressed to the Administrator through the Operations and Business Continuity Management of the Payment Systems, the name of the persons designated as the compliance officer of the SPEI and the information security officer of the SPEI.

The compliance officer of the SPEI and the information security officer of the SPEI referred to in the previous paragraph must be designated by the general director of the interested party or by the person occupying the position in the interested party that has under their responsibility the administration functions. …”

“72a. Requirements for Permanence in Matters of Additional Risks.- … I. Collect from Clients who carry out operations through the SPEI, at least, the name, trade name or corporate name, as well as the Unique Population Registry Key (CURP) or the Federal Taxpayer Registry (RFC) with homoclave for individuals and the RFC with homoclave for legal entities, the latter except in the case that Clients by their nature cannot have these data, and must include this information in the Send Requests presented by the Sending Clients; I Bis. Identify, among its Clients, those subjects referred to in Rule 58a., section V, last paragraph.

Regarding the Clients referred to in this section, the Client Accounts that Participants hold for them may only correspond to demand deposit accounts opened in credit institutions, popular financial societies, community financial societies, savings and loan cooperatives, regarding which Participants collect the same documentation and identification data that the general provisions referred to in article 115 of the Credit Institutions Law establish for level 4 accounts offered by said institutions. Likewise, Participants must abstain from opening Client Accounts that these Clients, in turn, may offer to their users for the sending or receiving of fund transfers through the SPEI in favor of said Clients; II. Notify the Administrator regarding the imposition of any sanction provided for in 58a., section V, first paragraph, subsection a), of these Rules, by its supervisory commission, no later than the fifth Banking Business Day following that on which the Participant receives the

Friday, July 27, 2018 OFFICIAL GAZETTE (First Section) notification of said sanction. The notification to the Administrator must indicate the impact that the conduct observed by said commission could cause in the compliance with the requirements established in these Rules and must be signed by the compliance officer of the SPEI. The Participant must send the notification in the terms established in 98a. of these Rules; III. In case the Administrator issues the notice referred to in section VI, of the previous Rule 45a., relative to situations that oblige Participants to elevate their monitoring and alert mechanisms, the Receiving Participant holding any of the Client Accounts indicated in the previous section I Bis and who receives, from the moment of the issuance of said notice, any Transfer Order Accepted by SPEI directed to said account, must abstain from making the corresponding resources available on the same Banking Business Day on which it received said Transfer Order, so it must make said resources available from the next Banking Business Day after concluding the validations referred to in the last paragraph of section I of the previous Rule 19a., as well as those other validations it must carry out as part of said monitoring and alert mechanisms that must be elevated. Receiving Participants must observe what is provided in this section during the time frame that the Administrator indicates regarding this in the communication it issues in accordance with section VI, of the previous Rule 45a. or in any other subsequent communication, and IV. Abstain, as part of the services offered to those Clients provided for in the previous section I Bis, from issuing Transfer Orders in the name of the Participant in question and on behalf of third parties, for the crediting of the corresponding resources in any of the Accounts of said Clients opened in the same Participant or in any other. …”

TRANSITORY PROVISIONS

FIRST. The provisions of Rules 19a., 45a., 58a., 59a., 59a. Bis, 60a. and 72a. of this Circular will enter into force on the next Banking Business Day following the date of publication of this same Circular in the Official Gazette of the Federation.

Notwithstanding the above, those subjects who, on the date of publication of this Circular, have been admitted as Participants of the SPEI in accordance with the Rules referred to in this same Circular, will be subject to the following: I. They must comply with the requirements referred to in Rules 58a., section V, last paragraph, and 72a. of this Circular starting from three Banking Business Days after the date of publication of this same Circular in the Official Gazette of the Federation; II. They must designate the person who will serve as the information security officer of the SPEI of each Participant, in terms of what is provided in 59a. Bis of the Rules contained in this Circular, as well as inform the Bank of Mexico of the name of said persons in accordance with what is established in 60a. of said Rules, no later than twenty Banking Business Days after the date of publication of this same Circular in the Official Gazette of the Federation, and III. They must comply with the requirements referred to in Rules 58a., section I, section A, subsection a Bis), and section B, subsection g) and last paragraph, of this Circular, starting from sixty Banking Business Days after the date of publication of this same Circular in the Official Gazette of the Federation.

SECOND. Notwithstanding what is provided by the previous transitory rule, those SPEI Participants who are subject to a material impossibility to comply with the requirements referred to in Rules 58a., section V, last paragraph and 72a., sections I Bis, III and IV of this Circular, in the time frames indicated in said transitory rule, must notify said situation to the Administrator, through the Authorizations, Queries and Legal Control Management, in order for the Administrator to resolve what is appropriate in each case.

Mexico City, July 24, 2018.- The General Director of Operations and Payment Systems, Jaime José Cortina Morfín.- Initials.- The General Legal Director, Luis Urrutia Corral.- Initials.

For any queries regarding the content of this Circular, please contact the Authorizations, Queries and Legal Control Management, at phones (55) 5237-2308, (55) 5237-2317 or (55) 5237-2000 Ext. 3200.