Circular 12/2023 — Modifies Circular 14/2017

Wednesday, November 22, 2023 OFFICIAL GAZETTE 199 BANK OF MEXICO CIRCULAR 12/2023 addressed to participants in the Interbank Electronic Payments System and other interested parties acting with such status, regarding the Modifications to Circular 14/2017 (Strengthening of Provisions on Cybersecurity and Information Technology of the Interbank Electronic Payments System).

At the margin, a logo that says: Bank of Mexico. - “2023, Year of Francisco Villa, the revolutionary of the people”.

CIRCULAR 12/2023 TO THE PARTICIPANTS OF THE INTERBANK ELECTRONIC PAYMENTS SYSTEM AND OTHERS INTERESTED IN ACTING WITH SUCH STATUS:

SUBJECT: MODIFICATIONS TO CIRCULAR 14/2017 (STRENGTHENING OF PROVISIONS ON CYBERSECURITY AND INFORMATION TECHNOLOGY OF THE INTERBANK ELECTRONIC PAYMENTS SYSTEM)

The Bank of Mexico, with the purpose of continuing to promote the sound development of the financial system, protect the interests of the public, and foster the proper functioning of payment systems, has resolved to modify the cybersecurity frameworks applicable to the Rules of the Interbank Electronic Payments System (SPEI), with the purpose of providing greater clarity regarding the technological infrastructure element upon which compliance with the aforementioned frameworks must be observed, and to specify the obligatory elements that participants in the SPEI must comply with regarding the computer security requirements currently included in the Rules. Likewise, additional elements are included that allow strengthening the cybersecurity and cyber resilience framework of SPEI participants.

For the above, based on articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 2, fractions I, IV and VIII, and 6 of the Payment Systems Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, paragraphs fourth and eighth, 10, first paragraph, 15 Bis 1, first paragraph, in relation to 28 Bis 1, fraction IX, 17, fraction I, 20 Quáter, fraction IV and 29 Bis, fraction VIII, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Directorate of Information Technology, the Directorate of Central Banking Provisions, the Directorate of Policy and Studies on Payment Systems and Market Infrastructures, and the Directorate of Cybersecurity, respectively, as well as Second, fractions II, IX, X and XVII, of the Agreement on the Attachment of Administrative Units of the Bank of Mexico, has resolved to modify the definition “Technological Infrastructure”, contained in the 2nd, the 46th, paragraphs eighth and ninth, the 58th, fraction I, section A, first paragraph, as well as subclauses a), b) and its numerals 1, 2, 3, 4, 5 and 6, d) and its numerals 1, 2 and 3, e) and its numerals 1, 2, 3, f) and its numeral 1, fraction II, subclause b), numeral 3, as well as fraction IV, section B, subclause g); add the definitions “Data Center”, “Cyber Resilience”, “Computing Infrastructure” and “Telecommunications Infrastructure” to the 2nd, the numerals 2 bis, 4 bis and 5 bis to subclause b), the numerals 3, 4, 5, 6, 7, 8, 9 and 10 to subclause f), subclause g), and the second and third paragraphs, of section A of fraction I of the 58th, as well as repeal subclause a Bis) and numeral 6 of subclause d) of section A of fraction I of the 58th, of the “Rules of the Interbank Electronic Payments System”, issued through Circular 14/2017, to remain in the following terms:

RULES OF THE INTERBANK ELECTRONIC PAYMENTS SYSTEM

“2nd. Definitions.- … …

200 OFFICIAL GAZETTE Wednesday, November 22, 2023

VI Bis. Data Center: the physical hosting site of computing, telecommunications and information storage equipment used by the Participant to operate with the SPEI. …

VII Bis. Cyber Resilience: the Participant’s capacity to prevent, adapt, respond or recover its operation in the SPEI against cyberattacks or incidents that may affect the confidentiality, integrity, availability or operational continuity of the Technological Infrastructure, as well as the information it uses. This, through the implementation of technological tools, controls, structures, strategies, policies, processes and practices. …

XXVII Quater. Computing Infrastructure: to the computing elements, whether physical or virtual, whose purpose is the processing and storage of data used by Participants to operate with the SPEI. XXVII Quinquies. Telecommunications Infrastructure: to the physical or logical network elements, which provide the connectivity service and transport the data of the different computing programs, and which are used by Participants to interconnect and operate with the SPEI. XXVIII. Technological Infrastructure: to the Computing Infrastructure, Telecommunications Infrastructure and applications used by Participants to interconnect and operate with the SPEI. …”

“46th. Participant Contingencies. - … …

The Participant that, in accordance with Rule 90th of these Rules, at the close of the Calculation Period prior to the one in which it finds itself, has observed a relative participation percentage, determined in accordance with said Rule, greater than three percent, in order to be able to face an event that affects the processing of Transfer Orders, shall execute contingency procedures in accordance with the specifications provided in Appendix AI of the Manual, starting from three hundred sixty-five natural days counted from the day immediately following that in which it is located in the situation stated in this paragraph. Likewise, the Participant that has the status of securities depository institution shall execute the aforementioned contingency procedures, starting from three hundred sixty-five natural days counted from the day immediately following that in which it has been admitted as a Participant.

Additionally, the Participants referred to in the preceding paragraph shall deliver to the Administrator, within the one hundred eighty natural days following the expiration of the three hundred sixty-five natural day period stated in that same paragraph, a report with the characteristics provided in Rule 74th of these Rules, which certifies compliance with the computer security requirements, operational risk management and certification established in fractions I, II and III of Rule 58th of these Rules, applicable to the infrastructure used by the Participant in question, to execute the contingency procedures established in accordance with the preceding paragraph. …”

“58th. Requirements for Admission as a Participant.- … I. Computer Security Requirements: A. In the Technological Infrastructure. The interested party must have documented and implemented policies and procedures that, at least, include the following:

Wednesday, November 22, 2023 OFFICIAL GAZETTE 201

a) Have in its organizational structure an area designated as responsible for ensuring that computer security in the Technological Infrastructure is carried out in accordance with the Internal SPEI Rules, as well as for that area to monitor compliance with said Internal Rules. a Bis) Repealed. b) Establish and maintain computer security controls, as well as Cyber Resilience controls in the Technological Infrastructure that, at least, incorporate the following:

1. Use secure communication protocols in the Computing Infrastructure used in the Technological Infrastructure and dispense with those considered insecure, in accordance with what is specified in Appendix M of the Manual;
2. Use technological tools and have procedures to carry out the detection of computer viruses and malicious code in the Computing Infrastructure, as well as keep said tools and procedures updated. This, in accordance with what is specified in Appendix M of the Manual; 2 bis. Use tools for monitoring the integrity of information in the Computing Infrastructure, in accordance with what is specified in Appendix M of the Manual;
3. Use technological tools and have procedures for the detection and management of computer vulnerabilities in the Computing Infrastructure. This, in accordance with what is specified in Appendix M of the Manual;
4. Inhibit both the activation of any service, as well as the installation of applications or software in the Computing Infrastructure, that are not indispensable for operation with the SPEI. This, in accordance with what is specified in Appendix M of the Manual; 4 bis. Prevent the execution of unauthorized files in the Computing Infrastructure through technological tools. This, in accordance with what is specified in Appendix M of the Manual;
5. Detect and manage computer security incidents in the Technological Infrastructure, as well as in any other technological infrastructure used by the Participant that could result in an impact on its operation in the SPEI. This, in accordance with what is specified in Appendix M of the Manual, and
6. Conduct penetration tests on the Technological Infrastructure, as well as prepare work plans and reports derived from the results of said tests. The frequency of the penetration tests, the reports and work plans that must be issued as a result of them, as well as the characteristics that the persons executing said penetration tests must meet, will be those specified in Appendix M of the Manual. c) …

202 OFFICIAL GAZETTE Wednesday, November 22, 2023

d) Establish and maintain controls in accordance with its policies and procedures for the secure handling of electronic information, to which Appendix M of the Manual refers, and in which the following is referred to, at least:

1. Use technological tools to securely delete information in the Computing Infrastructure and in the Telecommunications Infrastructure. This, in accordance with what is specified in Appendix M of the Manual;
2. Inhibit, through logical mechanisms, access to physical connection ports, as well as the use of removable storage devices and peripherals of the Computing Infrastructure. This, in accordance with what is specified in Appendix M of the Manual;
3. Generate and safeguard logs of audit events regarding the activity of system account users of the Computing Infrastructure, in accordance with its procedures. This, in accordance with what is specified in Appendix M of the Manual;
4. and 5. …
5. Repealed. e) Implement access controls to the Technological Infrastructure, which are robust and secure, in accordance with its policies and procedures, in which the following is referred to, at least:
6. Control logical access to the Computing Infrastructure in accordance with its procedures. This, in accordance with what is specified in Appendix M of the Manual;
7. Manage access to user accounts of the Computing Infrastructure and their passwords, in accordance with its procedures. This, in accordance with what is specified in Appendix M of the Manual;
8. Manually and automatically block the Computing Infrastructure upon registering inactivity. This, in accordance with what is specified in Appendix M of the Manual;
9. and 5. … f) Document and implement the controls of the Computing Infrastructure and of the Telecommunications Infrastructure as follows, in terms of the specifications established in Appendix M of the Manual:
10. Inhibit through logical mechanisms access to the internet from the Computing Infrastructure in accordance with its procedures. This, in accordance with what is specified in Appendix M of the Manual;
11. Procedures for the management of a telecommunications network that allows communication with the Bank of Mexico in an efficient and secure manner;
12. Physically or logically segment the Telecommunications Infrastructure network into different domains and subnets;
13. Have documentation showing the components that make up the Computing Infrastructure and the Telecommunications Infrastructure, as well as the interconnection between them, such as network diagrams, schematics or maps. This, in accordance with the information with which each component of the Telecommunications Infrastructure has to determine the flow of data packets;

Wednesday, November 22, 2023 OFFICIAL GAZETTE 203

5. Implement and store logs of events generated by the Telecommunications Infrastructure. Such logs must contain the timestamp of the clocks of the components of the Telecommunications Infrastructure, which must be synchronized against a time reference;
6. Generate and implement data filtering policies in the Telecommunications Infrastructure to control and specify information flows. In the event that the implementation of IP address reassignment protocols is required in one or more components of the Telecommunications Infrastructure, these must be configured in a one-to-one format;
7. Generate and store backups of the Telecommunications Infrastructure configuration through one or more tools;
8. Administer the Telecommunications Infrastructure through protocols and mechanisms that allow controlling, authenticating, authorizing and registering the activities of administrators;
9. Secure the information transmitted through the interconnection links of the Telecommunications Infrastructure, through protocols and data encryption algorithms, and
10. Monitor the Telecommunications Infrastructure through specific tools and protocols for this function. g) Implement controls and policies that must be followed regarding the Technological Infrastructure, which must establish, in accordance with what is specified in Appendix M of the Manual, the following:
11. Procedures that allow having an inventory of the Technological Infrastructure available in accordance with what is specified in Appendix M of the Manual;
12. Process for managing the entry and exit of computing and telecommunications equipment to the Data Center;
13. Electromechanical systems and fire protection systems of the Data Center;
14. Computing Infrastructure maintenance process;
15. Process for managing access to media used for information backup, and
16. Process for managing remote access. The Administrator may authorize the use of control mechanisms alternative to those referred to in numerals 2, 2 bis, 3, 4 bis, and 5 bis, of subclause b), 1 and 2 of subclause d), as well as 1 of subclause f), corresponding to fraction I, section A, of this Rule 58th, and whose characteristics are established in Appendix M of the Manual. For the purpose of what is stated in the preceding paragraph, the Participant in question must previously send a communication, with the characteristics provided in Annex C of Appendix M of the Manual, to the Directorate of Payment Systems and Market Infrastructure Operation and Continuity, in terms of Rule 98th of these Rules, which certifies that the alternative control mechanisms it intends to implement allow producing security conditions equivalent or greater to those produced by the elements described in numerals 2, 2 bis, 3, 4 bis and 5 bis of subclause b), 1 and 2 of subclause d), as well as 1 of subclause f), corresponding to fraction I, section A, of this Rule 58th, and are aligned with best practices

204 OFFICIAL GAZETTE Wednesday, November 22, 2023 established on the matter by entities of recognized prestige in said matter in the country or other jurisdictions, such as the National Institute of Standards and Technology of the United States of America or the International Organization for Standardization (NIST and ISO by their English acronyms, respectively), as well as those that the Bank of Mexico itself determines as equivalent. … II. … a) … b) …

1. and 2. …
2. Have policies and guidelines for the management of physical access privileges to the operational sites from which operation with the SPEI is carried out and to the Data Centers that host the Technological Infrastructure available to operate with the SPEI. c) … III. … IV. … A. … B. … a) to f) … g) Have procedures that allow delivering to its Issuing Clients, through the means they establish for such purpose, notifications at no cost to the Issuing Clients and in a period not greater than ten seconds from the occurrence of the following events: …”

TRANSITIONAL PROVISIONS

FIRST.- What is provided in this Circular shall enter into force on December 19, 2023, with the exception of what is stated in the following transitional rules.

SECOND.- The modifications to subclause b) and its numerals 1 and 4, to subclause d) and its numeral 2, to subclause e) and its numerals 1 and 3, to subclause f) and its numeral 1, of section A of fraction I of the 58th, as well as the additions of numerals 3, 4, 5, 6, 7, 8, 9 and 10 to subclause f) of section A of fraction I of the 58th, shall enter into force on December 19, 2024.

THIRD.- The modifications to subclause a), to numerals 2, 3, 5 and 6 of subclause b), to numerals 1 and 3 of subclause d) and to numeral 2 of subclause e) of section A of fraction I of the 58th, as well as the additions of numerals 2 bis, 4 bis and 5 bis to subclause b) and of subclause g) to section A of fraction I of the 58th, shall enter into force on December 19, 2025.

FOURTH.- Securities depository institutions that have been admitted as Participants at the time of entry into force of this Circular, shall execute the contingency procedures referred to in the eighth paragraph of Rule 46th of the Rules of the Interbank Electronic Payments System, issued through Circular 14/2017 of the Bank of Mexico, starting from November 20, 2024. Likewise, they shall deliver to the Administrator a report, with the characteristics provided in Rule 74th of these Rules, through which compliance with the computer security requirements, operational risk management and certification established in fractions I, II and III of Rule 58th of these Rules is verified, of only the infrastructure they have implemented to execute the contingency procedures referred to in this paragraph, no later than May 19, 2025.

Wednesday, November 22, 2023 OFFICIAL GAZETTE 205

FIFTH.- The repeals of subclause a) Bis and numeral 6 of subclause d) of section A of fraction I of the 58th, shall enter into force on December 19, 2025.

Mexico City, November 9, 2023.- BANK OF MEXICO: Director General of Information Technology, Octavio Bergés Bastida.- Rubric.- Director of Central Banking Provisions, María Teresa Muñoz Arámburu.- Rubric.- Director of Policy and Studies on Payment Systems and Market Infrastructures, Othón Martino Moreno González.- Rubric.- Director of Cybersecurity, Alejandro de los Santos Santos.- Rubric.

For any queries regarding the content of this Circular, the Bank of Mexico is at your disposal through the Directorate of Central Banking Authorizations and Sanctions at phone (55) 5237-2000 extension 3200.