Circular 13/2012 — Electronic Attention Module (MAE)

(First Section) OFFICIAL GAZETTE Monday, September 17, 2012 BANK OF MEXICO CIRCULAR 13/2012 addressed to Credit Institutions, the Rural Financial Institution, and Brokerage Houses, regarding the Electronic Attention Module. At the margin a logo, which says: Bank of Mexico. CIRCULAR 13/2012 TO CREDIT INSTITUTIONS, THE RURAL FINANCIAL INSTITUTION AND BROKERAGE HOUSES: SUBJECT: ELECTRONIC ATTENTION MODULE The Bank of Mexico, with the object of continuing to promote the sound development of the financial system, considers it convenient: a) To expand the scope of application of the Electronic Attention Module (MAE), with the purpose that it be used by more participants in the financial system, as well as by financial authorities and organizations that request it; b) To allow participating entities in the MAE, through their general manager, the heads of the legal areas or the heads of the areas related to the submission of documents to which this Circular refers, to sign a written statement to designate the persons who, through the MAE, will be able to appoint and revoke those who will sign the communications that said entities present to the Bank of Mexico, as well as know the responses and requirements that this formulates to them; c) To make more efficient and secure, among others, the procedures for: i) receipt of requests for authorizations and consultations; ii) response to such requests; iii) notification to entities of possible non-compliance with the provisions of the Bank of Mexico, and iv) resolution regarding the reply to such notifications, and d) Continue the automation of the procedure for exchanging information through the MAE. For the above reason, based on articles 28 of the Political Constitution of the United Mexican States, paragraphs sixth and seventh; 24 and 36 of the Bank of Mexico Law; 97 of the Credit Institutions Law; 22 of the Law for Transparency and Orderly Regulation of Financial Services; 49 of the Organic Law of the Rural Financial Institution; 4th, first paragraph, 8th, fourth and seventh paragraphs, 10, first paragraph, 14 Bis, first paragraph, in relation with 17, fraction I, and 14 Bis 1, first paragraph, in relation with 25 Bis 1, fraction IV, and 25 Bis 2, fraction II, of the Internal Regulations of the Bank of Mexico, which provide for its attributes to issue provisions through the General Legal Directorate and the General Directorate of Affairs of the Financial System, respectively, as well as Second of the Agreement on the Attachment of Administrative Units of the Bank of Mexico, fractions III and XI; has resolved to issue the following: RULES OF THE ELECTRONIC ATTENTION MODULE

1. DEFINITIONS For brevity, singular or plural, shall be understood as follows: Certifying Agency: the institution, decentralized body or company, authorized by the Bank of Mexico to provide certification services in the ESI through the issuance of Digital Certificates. Digital Certificate: the Data Message electronically signed by the Certifying Agency that issued it, which confirms the link between the identity of the holder and the corresponding Electronic Signature Verification Data. Commissions: the National Banking and Securities Commission, as well as the National Commission for the Protection and Defense of Users of Financial Services. Receipt: the Data Message generated by the Bank of Mexico and made known through the MAE, to record that: a) it has delivered to the Entity in question: i) a Notification; ii) a Resolution; iii) a Response; iv) an information request, or v) information in general, or b) it has received from the respective Entity: i) a Request; ii) a Reply to Notification, or iii) additional information. The respective Data Message will indicate the folio number, the date and the hour at which the communication in question was made available to the Entity or when it was received by the Bank of Mexico, as applicable.

Monday, September 17, 2012 OFFICIAL GAZETTE (First Section) Reply to Notification: the Data Message with the Electronic Signature of a Representative, sent to the Bank of Mexico through the MAE, to respond to a Notification. Electronic Signature Creation Data: the unique information composed of an asymmetric cryptography private key that the holder generates under his total control and uses personally to create an Electronic Signature. Electronic Signature Verification Data: the unique information composed of an asymmetric cryptography public key that the holder generates under his total control and which is mathematically related to the Electronic Signature Creation Data, which is used to verify Data Messages signed electronically. Business Day: the days on which Entities are not obliged to close their doors or suspend operations, in terms of the general provisions that, for such effect, are issued by the National Banking and Securities Commission . Entity: credit institutions, the Rural Financial Institution and brokerage houses, jointly or separately. Electronic Signature: the set of data that is added or attached to a Data Message, the which is logically associated with this and is attributable to the holder of a Digital Certificate, once the respective Electronic Signature verification device has been used. ESI: the Extended Security Infrastructure, administered and regulated by the Bank of Mexico referred to in Circular-Telefax 6/2005. MAE: the system called “Electronic Attention Module” developed by the Bank of Mexico, through which: a) Entities can: i) submit Requests and additional documentation; ii) consult the additional information requests they receive from the Bank of Mexico; iii) submit the Reply to Notifications; iv) certify or revoke before the Bank of Mexico Qualified Representatives, Representatives and Operators, and v) know Resolutions, Notifications and Responses, and b) the Bank of Mexico can communicate to Entities: i) Responses; ii) Notifications; iii) Resolutions; iv) information requests, and v) informational documents. Data Message: information generated, sent, received, archived or communicated through electronic media or other technologies. Notification: the Data Message with the Electronic Signature of authorized officials of the Bank of Mexico, by virtue of which this communicates to Entities, through the MAE, possible non-compliance with the provisions issued by the Bank of Mexico itself, so that said Entities manifest what is in their interest in exercise of their right to be heard. Operator: the natural person designated and authorized by an Entity to have access to the MAE, in order to only: a) enter Requests, information or Reply to Notifications, and b) consult the additional information requests, Notifications, Responses, Resolutions and, if applicable, other acts issued by the Bank of Mexico. Organization: trade associations that integrate Entities, stock exchanges, central counterparties for securities, institutions for the deposit of securities and clearing houses, as well as other societies that the Bank of Mexico authorizes through the Management of Authorizations, Consultations and Legal Control. Representative: the natural person designated and authorized by an Entity to sign electronically, on behalf and for the account of this, the communications that present to the Bank of Mexico through the MAE, who may certify and revoke Operators, as well as carry out the management that corresponds to these, with respect to the use of the MAE.

(First Section) OFFICIAL GAZETTE Monday, September 17, 2012 Qualified Representative: the natural person designated and authorized by an Entity to sign electronically, on behalf and for the account of this, the communications that present to the Bank of Mexico through the MAE, who may certify and revoke Representatives and Operators, as well as carry out the management that corresponds to these, with respect to the use of the MAE. Resolution: the Data Message with the Electronic Signature of the authorized officials of the Bank of Mexico, through which this resolves regarding a Notification made to the Entity that corresponds, given to be known through the MAE. Response: the Data Message with the Electronic Signature of the authorized officials of the Bank of Mexico, through which this responds to a Request formulated by the Entity that corresponds, given to be known through the MAE. Request: the Data Message with the Electronic Signature of a Representative of the Entity in question, through which this requests from the Bank of Mexico an authorization or formulates a consultation, given to be known through the MAE. 2. REQUIREMENTS TO PARTICIPATE IN THE MAE 2.1 Initial Certification of Qualified Representatives, Representatives and Operators Entities through their general manager, the head of the legal area or the heads of the areas related to the submission of Requests and Reply to Notifications, must request from the Bank of Mexico the certification of the persons who can perform functions of Qualified Representatives, Representatives and, if applicable, Operators. To this end, Entities must present to the Bank of Mexico a communication according to the format attached as Annex 1 of these Rules, addressed to the Management of Authorizations, Consultations and Legal Control, signed by officials indicated in the previous paragraph, as applicable and accompanied by: a) certified copy of the deed in which the powers of who signs the aforementioned communication are stated, or a certification of their appointments issued by the secretary or assistant secretary of the board of directors or the board of directors, as applicable, of the Entity in question, and b) a compact disc or electronic device that contains the Digital Certificate of the Qualified Representatives, Representatives and Operators designated. It is the responsibility of Entities to ensure that the persons designated according to the aforementioned Annex 1, have sufficient powers to use the MAE according to the type of certification that corresponds to them. Entities must deliver the communications and information referred to in this section, with at least five Business Days in advance of the date on which they intend to start using the MAE. 2.2 Subsequent Certification of Representatives and Operators Entities may request the certification of additional Representatives and Operators to those designated according to section 2.1, through a request submitted through the MAE by their Qualified Representatives or Representatives, as applicable, according to the format provided in Annex 2 of these Rules and attaching the Digital Certificates of these. It is the responsibility of Entities to ensure that the persons designated according to the aforementioned Annex 2, have sufficient powers to use the MAE according to the type of certification that corresponds to them. 2.3 Revocation of the certification of Representatives and Operators Entities, through their Qualified Representatives, may revoke the certification of Representatives and Operators, through a notice submitted through the MAE, in which they make known the name of the persons whose designation is revoked. In the same way, Representatives may revoke the certification of Operators. The revocation of Qualified Representatives may be carried out by any of the officials of the Entities mentioned in the first paragraph of section 2.1 of these Rules. Entities must maintain, at all times, the certification of at least one Representative. 2.4 Date on which certifications and revocations take effect The certifications referred to in sections 2.1 and 2.2 of these Rules, take effect on the date on which the Bank of Mexico makes known to the respective Entity the user keys and passwords that correspond to the certified persons.

Monday, September 17, 2012 OFFICIAL GAZETTE (First Section) The revocations referred to in section 2.3 of these Rules, take effect from the next Business Day after that on which the respective notice is received by the Bank of Mexico no later than 16:00:00 hours. In case the Bank of Mexico receives said notice after such hour, the corresponding revocation takes effect from the second Business Day following that on which it is received. 3. MAE OPERATING PROCEDURE 3.1 Submission of information by Entities Entities must enter into the MAE their Requests, Reply to Notifications, additional documentation, notices or attention to information requests, incorporating the data and information requested for such effect. Only when such documentation meets the respective requirements, the Bank of Mexico will generate, through the MAE, the Receipt corresponding. Documentation entered into the MAE from 9:00:00 to 16:00:00 hours, will be considered received for the legal effects that apply, on the same Business Day. Documentation entered into the MAE between 16:00:01 hours and 8:59:59 of the next Business Day, will be considered received at 9:00:00 hours of said Business Day. 3.2 Information Requests and Sending of Notifications by the Bank of Mexico The Bank of Mexico may request information from Entities and send them Notifications through the MAE, in which case it will inform thereof to one of the email addresses indicated for such effect by the Entity in question. This without prejudice that Entities must regularly consult the MAE, in order to promptly attend to the requests and Notifications that, if any, are made to them. In the event that the Entity in question does not present to the Bank of Mexico within the established term effect, the information that it has requested in relation to one of its Requests, it will be understood that the Entity withdraws from the respective Request and, consequently, the Bank of Mexico will leave it without effect without any responsibility. Regarding Notifications, when the Bank of Mexico does not receive from an Entity the reply respectively no later than the date indicated in the Notification itself, it will be considered exhausted the term for said Entity to manifest what is in its interest in exercise of its right to be heard. The information requests and Notifications referred to in the previous paragraphs, take effect on the Business Day following the date on which, through the MAE, they are made available to the Entities that correspond, unless a later date is established therein. This, regardless of the date on which recipients consult them. 3.3 Responses and Resolutions by the Bank of Mexico When the Bank of Mexico, through the MAE, communicates to the Entity that corresponds Responses and Resolutions, it will inform thereof through one of the email addresses it has indicated for such effect. Such Responses and Resolutions take effect on the date on which they are made available to the Entity or, if applicable, on the date established therein. 4. GENERAL PROVISIONS 4.1 Entities must formulate their Requests, submit the Reply to Notifications and attend to the additional information requests referred to in these Rules, exclusively through the MAE. The Bank of Mexico may make known through the MAE the Responses, Notifications and Resolutions, as well as carry out information requests for such effects. 4.2 The use of the Electronic Signature in Data Messages will substitute for all legal effects for the handwritten signature, having the same probative value in accordance with the applicable provisions. 4.3 Receipts will have probative value for the legal effects that apply. 4.4 What is provided in sections 3.1, 3.2 and 3.3 must be carried out in accordance with the “External User Manual”, which can be consulted on the electronic page of the Bank of Mexico on the Internet, identified with the domain name www.banxico.org.mx. 4.5 Representatives and Operators will be responsible for updating their Digital Certificates through the MAE, according to the procedure established for such effect in the aforementioned “External User Manual”. 4.6 When Organizations, the Ministry of Finance and Public Credit, the Commissions and financial entities different from Entities wish to send information, Requests or require opinions to the Bank of Mexico through the MAE, they must observe what is provided in these Rules. 4.7 The Bank of Mexico, through the Management of Authorizations, Consultations and Legal Control, may authorize exceptions to what is provided in these Rules.

(First Section) OFFICIAL GAZETTE Monday, September 17, 2012 ANNEX 1 MODEL OF COMMUNICATION “(LETTERHEAD OF THE ENTITY)” Mexico City, ___ of _________ of 20__. BANK OF MEXICO Management of Authorizations, Consultations and Legal Control, Av. 5 de Mayo, number 2, third floor, Col. Centro, C.P. 06059, Mexico City. By this means it is informed that (FULL NAME OF THE ENTITY, INCLUDING, IF ANY, THE FINANCIAL GROUP TO WHICH IT BELONGS) expressly accepts the content of Circular 13/2012 which contains the “Rules of the Electronic Attention Module”. Consequently, it manifests its conformity to submit Requests, formulate the Reply to Notifications and attend to information requests, as well as to access Notifications, Resolutions, Responses and information requests to which such Rules refer, in the terms indicated therein. In compliance with what is provided in said Rules, (FULL NAME OF THE ENTITY, INCLUDING, IF ANY, THE FINANCIAL GROUP TO WHICH IT BELONGS) requests that Institute to certify the persons who will act as Qualified Representatives, Representatives and/or, if applicable, Operators, to enter Requests, additional information and the Reply to Notifications, as well as to access Notifications, Resolutions, Responses, information requests and notices in general, as indicated below: QUALIFIED REPRESENTATIVES Name Email Address Digital Certificate Serial Number (twenty digits) 1.- 2.- ... REPRESENTATIVES Name Email Address Digital Certificate Serial Number (twenty digits) 1.- 2.- ...

Monday, September 17, 2012 OFFICIAL GAZETTE (First Section) OPERATORS Name Email Address Digital Certificate Serial Number (twenty digits) 1.- 2.- ... To this effect, the necessary powers are held in accordance with the referenced Rules, which is evidenced with the certified copy of the public deed(s) in which the respective powers are stated, or with the certification of the appointment issued by the secretary or assistant secretary of the board of directors or board of directors, as applicable, which is attached to this communication. Likewise, it is manifested that the persons requested to be certified in this act have the necessary powers in accordance with what is provided in the aforementioned Rules, to carry out the management that corresponds to the type of certification requested. Additionally, the compact disc or electronic device containing the Digital Certificates of the aforementioned Qualified Representatives, Representatives and/or, if applicable, Operators, which are identified with the ending “.cer” or “.crt”, or those that, if any, replace them, is attached to this communication, who will be responsible for updating said Digital Certificates through the MAE. (FULL NAME OF THE ENTITY INCLUDING, IF ANY, THE FINANCIAL GROUP TO WHICH IT BELONGS) hereby recognizes and accepts that by the fact of entering Requests, Reply to Notifications or additional information, as well as receiving Notifications, Resolutions, Responses or any other documentation in the manner provided in the aforementioned Circular 13/2012; the notices, reports, requests and other acts that the Bank of Mexico communicates through the MAE, will have full legal validity and produce all legal effects that apply. Likewise, (FULL NAME OF THE ENTITY INCLUDING, IF ANY, THE FINANCIAL GROUP TO WHICH IT BELONGS) recognizes and accepts that the Responses, Resolutions, Notifications and information requests that the Bank of Mexico communicates to it, through the MAE, will take effect in the terms indicated in the aforementioned Circular 13/2012, regardless of the date on which they are consulted. Finally, (FULL NAME OF THE ENTITY INCLUDING, IF ANY, THE FINANCIAL GROUP TO WHICH IT BELONGS) hereby releases the Bank of Mexico from all responsibility for the attention that it may give to the Requests, Reply to Notifications, or any other communication entered by the persons that this Entity has requested to be certified to act as Qualified Representatives, Representatives and Operators, until the revocation notice takes effect, if any, presented in terms of what is provided in the aforementioned Circular 13/2012. Sincerely, (NAME AND SIGNATURE OF THE GENERAL MANAGER OR OF THE HEADS OF THE AREAS REFERRED TO IN THESE RULES, SPECIFYING THEIR POSITION OR POST) Attachments: Certified copy of the public deed(s) in which the respective powers are stated or the certification of the appointment issued by the secretary or assistant secretary of the board of directors or board of directors, as applicable, as well as a compact disc or electronic device containing the Digital Certificates of the Qualified Representatives, Representatives and Operators designated in this act. CCP. IT Management of the Bank of Mexico, located at Av. 5 de Mayo, number 1, third floor, Col. Centro, C.P. 06059, Mexico City. For your information and appropriate purposes.

(First Section) OFFICIAL GAZETTE Monday, September 17, 2012 ANNEX 2 MODEL OF COMMUNICATION

"(LETTERHEAD OF THE ENTITY)"

Mexico, D.F., on ___ of _________ of 20__.

BANK OF MEXICO Directorate of Authorizations, Consultations and Legal Control.

My represented entity (FULL NAME OF THE ENTITY INCLUDING, IF APPLICABLE, THE FINANCIAL GROUP TO WHICH IT BELONGS), hereby requests that this Central Institute accredit the persons who will serve as Representatives and, where applicable, Operators, to have access to the Electronic Attention Module (MAE), as indicated below:

REPRESENTATIVES Name Email Address Digital Certificate Serial Number (twenty digits) 1.- 2.- ...

OPERATORS Name Email Address Digital Certificate Serial Number (twenty digits) 1.- 2.- ...

To this effect, I declare that the persons whom I hereby request to be accredited have the necessary powers in accordance with the "Rules of the Electronic Attention Module" contained in Circular 13/2012.

Likewise, the Digital Certificates of the persons whose accreditation is requested are attached, identified by the extension ".cer" or ".crt", who will be responsible for updating said Digital Certificates through the MAE.

Finally, (FULL NAME OF THE ENTITY INCLUDING, IF APPLICABLE, THE FINANCIAL GROUP TO WHICH IT BELONGS), hereby releases the Bank of Mexico from all liability regarding the attention given to communications presented through the MAE by the persons designated in this communication, until such time as the revocation notice takes effect in accordance with the aforementioned Circular 13/2012.

Sincerely,

(NAME OF THE QUALIFIED REPRESENTATIVE OR REPRESENTATIVE, AS APPLICABLE)

TRANSITORY PROVISIONS

FIRST.- This Circular shall enter into force on October 15, 2012. From that date, Circular 26/2008 of June 20, 2008, is repealed.

SECOND.- The Representatives and Operators designated in accordance with the aforementioned Circular 26/2008 will maintain their accreditation for the purposes stated in this Circular, without it being necessary for multiple banking institutions and brokerage houses to confirm their designation.

Therefore, all references to Circular 26/2008 provided in the respective accreditation requests that multiple banking institutions and brokerage houses have submitted to the Bank of Mexico prior to the entry into force of this Circular, shall be understood as references to this Circular.

THIRD.- Entities may continue to use in the MAE the Digital Certificates issued by the Bank of Mexico until their validity expires.

Mexico, D.F., on September 11, 2012.- BANK OF MEXICO: The General Legal Director, Héctor Reynaldo Tinoco Jaramillo.- Initials.- The General Director of Affairs of the Financial System, José Gerardo Quijano León.- Initials.

For any inquiries regarding the content of this Circular, please contact the Directorate of Authorizations, Consultations and Legal Control, at telephone numbers 5237-2308, 5237-2317 or 5237-2000 Ext. 3200, and in the case of any operational problems with the MAE, contact the IT Directorate of the Bank of Mexico at telephone numbers 5237-2281 or 5237-2286.