Circular 13/2018 — Modifications to Circular 34/2010 (Card Protection)

Wednesday, October 3, 2018 OFFICIAL GAZETTE (First Section) 107 BANCO DE MEXICO CIRCULAR 13/2018 addressed to Multiple Banking Institutions and Regulated Multiple-Object Financial Companies Regulated, regarding Modifications to Circular 34/2010 (Card Protection).

At the margin a logo, which says: Bank of Mexico.

CIRCULAR 13/2018 TO MULTIPLE BANKING INSTITUTIONS AND REGULATED MULTIPLE-OBJECT FINANCIAL COMPANIES: SUBJECT: MODIFICATIONS TO CIRCULAR 34/2010 (CARD PROTECTION).

The Bank of Mexico, with the objective of improving the functioning of payment systems, particularly with regard to the use of cards in businesses and other payment receivers, has identified some areas for regulatory improvement in order to achieve a more efficient and secure scheme for the functioning of the card payment market. The environment in which the card market develops is characterized by accelerated technological change, something that can leave some market practices and even some regulatory elements behind. Likewise, the country's card market is exposed to possible frauds that could generate losses for consumers, payment receivers, and participating institutions. In light of this situation, the Bank of Mexico has decided to modify its regulation for the benefit of users of these payment methods in the following four specific topics: (i) improve and expand the security elements of card operations; (ii) incentivize the use of new technologies that allow greater efficiency and security in the system; (iii) establish minimum protection criteria for card users, and (iv) prohibit differentiated practices by card type that are not justified.

With the aforementioned reforms, it is sought to continue promoting: i) the protection of users' interests; ii) the adoption of electronic payment methods; iii) competition in this market, and iv) the proper functioning of payment systems and the healthy development of the financial system.

For the above, based on articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 24 and 26, of the Bank of Mexico Law, 48 of the Credit Institutions Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, paragraphs fourth and seventh, 10, first paragraph, 12, first paragraph in relation to 20, fraction XI, 14 Bis, first paragraph in relation to 17, fraction I, and 14 Bis 1, first paragraph in relation to 25 Bis 1, fraction IV, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Directorate of Operations and Payment Systems, the General Legal Directorate, and the General Directorate of Affairs of the Financial System, respectively, as well as Second, fractions I, VI and X, of the Agreement on the Affiliation of the Administrative Units of the Bank of Mexico, it has resolved to modify the definitions of Acquirer, Contract, Credit Card, and Cardholder contained in numeral 1, the first paragraph of numeral 2.3, numeral 2.6, the second paragraph of numeral 3.1, as well as numerales 3.3, 3.4, 3.6, 3.7 and 3.8; add a second paragraph to fraction iv. of the first paragraph and paragraphs second, third and fourth to numeral 2.3, as well as numeral 2.3 Bis and repeal numerales 2.7, 2.8 and 3.5 of the "Credit Card Rules", contained in Circular 34/2010, to remain in the following terms:

CREDIT CARD RULES

1. DEFINITIONS For brevity, singular or plural shall be understood as:

"Acquirer: the institution that, in accordance with the contract it has entered into with a clearing house for card payments, provides payment services to Establishments and, where applicable, provides the infrastructure of point-of-sale terminals connected to these latter networks. Likewise, it commits, under the terms agreed, among others, i) to receive from Establishments requests for payment authorization with cards; ii) to process and direct to Issuers said requests through the clearing house for card payments; iii) to receive payment authorizations, payment rejections, returns and adjustments processed by Issuers to deliver them to the Establishment, and iv) to settle with the Establishment the amount of card payments that have the payment authorization granted by the corresponding Issuer."

"Contract: the legal act that documents any financing based on which Credit Cards are issued."

...

"Credit Card: the set of data that, when processed through determined systems, allows initiating a charge instruction to the Account to which they are associated or, where applicable, a credit resulting from the return related to said charge for claims under the terms of these Rules."

"Cardholder: that person in whose name the Issuer issues a Credit Card corresponding to an Account, whether it is the Holder or a third party duly authorized by the latter as holder of an additional card corresponding to said Holder."

...

2. GENERAL PROVISIONS

"2.3 Credit Cards shall always be issued in the name of a natural person and shall contain, at least, the following: i. ... ii. ... iii. ... iv. ... If the issuer intends to authorize operations with autograph signature, it must include the space for the same in the Credit Card. v. ... vi. ... vii. ... Issuers, in order to allow Cardholders to use the Credit Card to perform operations, must make available to Cardholders, through the means they have agreed upon with them for this purpose, at least the following information corresponding to the Credit Card: a) The unique identification digits of the Credit Card; b) The expiration date; c) The commercial brand under which the credit institution issues the respective card, in accordance with the agreement entered into with the company holding said brand as provided in the General Provisions Applicable to Disposition Means Networks, and d) The card security code, assigned as an additional security data in the performance of non-presence operations with the card. The Issuer that issues Credit Cards with integrated circuit or chip must observe the security and processing standards established by the company constituted under the legislation of the United States of America, called EMVCo, LLC or, where applicable, those others that the Bank of Mexico determines as equivalent in relation to the use and functioning of said integrated circuit or chip, in those cases where the card operation implies obtaining the information of the card directly from said integrated circuit or chip.

In the event that any Issuer intends to use any standard different from that mentioned in the previous paragraph, it must previously obtain the authorization of the Bank of Mexico, for which it must present the respective request to the Department of Authorizations, Queries and Legal Control."

"2.3 Bis The Acquirer must observe the security and processing standards established with respect to by the company constituted under the legislation of the United States of America, called EMVCo, LLC or, where applicable, those others that the Bank of Mexico determines as equivalent that guarantee the secure transmission of information in those cases where the Credit Card operation implies obtaining the information of this directly from an integrated circuit or chip in the same Credit Card.

In the event that the Acquirer intends to use any standard different from that mentioned in the previous paragraph, it must previously obtain the authorization of the Bank of Mexico, for which it must present the respective request to the Department of Authorizations, Queries and Legal Control.

Additionally, the Acquirer that, as part of the service referred to in this article, has generated the payment instructions referred to in the last paragraph of numeral 3.4 may require the Establishment to return the resources related to the charge, provided that it has agreed with it to provide it with the necessary elements to request the use of authentication factors in the processing of operations carried out with a Credit Card for which charges are made to the Account as established in numeral 2.6, item a), and said Establishment has not requested the use of authentication factors as established in numeral 2.6, item a), in the processing of the operation related to the charge to the Account that has been the subject of the notice in question.

Likewise, in the event that, in the case indicated in numeral 3.6, the Acquirer obtains from the Issuer the resources corresponding to the return provided for in that same numeral, it must credit said resources to the Account held by the Establishment in question, no later than the next Business Day after it has received the resources from the Issuer."

"2.6 The Issuer must make charges to the Account for the amount of payments for goods, services, contributions, Recurring Charges and cash withdrawals, as follows: a) For operations in which, for their performance, the Cardholder is required to use at least two independent elements to authenticate the operations as authorized by the latter, whether the two factors are used at the time of performing the operation, or only one of said factors is used at the time of performing the operation and another of said factors at the time of delivering the good or service acquired by virtue of said operation. The referred factors must be among those listed below: i. Information that the Issuer provides to the Cardholder or allows this to generate, under the understanding that only he knows it, so that he can enter it into the system authorized by the Issuer to initiate the operation in question, such as password or personal identification number. ii. Information contained, received or generated by electronic means or devices that only the Cardholder possesses, including that stored in an integrated circuit or chip that is processed in accordance with the security and processing standards established by the company constituted under the legislation of the United States of America, called EMVCo, LLC or, where applicable, those others that the Bank of Mexico determines correspond to the use and functioning of said integrated circuit or chip with the same degree of security, as well as that obtained by dynamic password generator devices that the Issuer provides to the Cardholder. The above shall be subject to the condition that said information is generated with properties that prevent its duplication or alteration and meets one of the following characteristics: A. It is dynamic information that cannot be used more than once, or B. It is dynamic information generated for the performance of an operation, as well as subsequent operations without any modification, in which case it will be considered, for the purposes of this item, as an independent element to authenticate the operations as authorized by the Cardholder only for the first operation in which it is used. iii. Information derived from the Cardholder's own characteristics such as those of a biometric nature, such as fingerprints, hand or face geometry, patterns in iris or retina, among others. iv. Any other information authorized by the Bank of Mexico. b) For operations in which, for their performance, the Issuer does not require the Cardholder to use two of the authentication elements referred to in the previous item a). c) Repealed. d) For the agreed interest and commissions established in the Contract. Commissions for collection expenses cannot be charged more than once a month. The Issuer must establish procedures and mechanisms so that the information referred to in item a) is not known by any of its officials, employees or representatives or by any third party, prior to its generation and use by the Cardholder. Issuers are prohibited from blocking the processing of transactions carried out with Credit Cards, based on the type of access medium involved in said processing. As an exception to the foregoing, in accordance with the criteria established by the Issuers, Cardholders may instruct this, through electronic, computing or telecommunication means that they have agreed upon for this purpose, that: (i) block the processing of payments with their Credit Card or, where applicable, with those additional Credit Cards linked to the same Contract of the Cardholder, referred to certain access media involved in said processing, and (ii) establish maximum limits regarding the amount for which operations can be carried out with said Credit Cards or, where applicable, with those additional Credit Cards linked to the same Contract of the Cardholder, or with respect to their exclusive use in operations carried out in national territory. The blocks or limits referred to in this paragraph shall be understood for an indefinite period, unless there is an express instruction from the Cardholder indicating otherwise. The Issuer may only block operations or Establishments based on a risk analysis. In the event that a Credit Card Issuer issues debit cards and blocks the operations carried out with any type of said cards in a particular Establishment, resulting from the risk analysis carried out by said Issuer, it must carry out the corresponding blocking for the two types of cards it has issued in favor of all its Cardholders."

2.7 Repealed 2.8 Repealed

3. CARDHOLDER PROTECTION

"3.1 ...

Issuers must deliver to Cardholders all deactivated Credit Cards and, for their activation, the latter must expressly request it through the mechanisms that Issuers have available for this purpose, either in one of their branches, or through a commissioned agent, by comparing the autograph signature of the Cardholder himself with respect to any identification indicated in the General Provisions referred to in article 115 of the Credit Institutions Law or through the presence authentication schemes used by the Issuer in question, such as biometric elements, through the use of ATMs, point-of-sale terminals, by telephone, remote authentication schemes used by the Issuer itself, or through other secure electronic channels.

... ..."

Wednesday, October 3, 2018 OFFICIAL GAZETTE (First Section) 111

"3.3 Notice of theft or loss of Credit Cards and claim of charges The Issuer must allow the Cardholder to present: notices of: (i) theft or loss of the corresponding Credit Card, or (ii) claims for charges to the Account that they do not recognize as their own.

For the purposes of the provisions in the previous paragraph, the Issuer must allow the Cardholder to present it in one of the following forms, at the latter's choice: a) Personally, in any of the Issuer's branches or by communication given through the customer service channels that the Issuer itself has enabled to attend matters related to Credit Cards, or b) Through electronic channels or any other means of communication that they have agreed upon with the Cardholder for this purpose. The Issuer may in no case require the Cardholder to carry out any additional procedure to the presentation of the notices referred to in this numeral. The Issuer that receives any of the aforementioned notices must provide the Cardholder, at the latter's choice, in writing or by electronic or telecommunication means, at least, a reference number of the notice, as well as the date and time at which it was received. The Issuer must deliver the Cardholder the information referred to at the moment he has presented the corresponding notice in the manner referred to in item a) above, or within twenty-four hours after he has presented the notice in any of the manners provided for in item b). The Issuer must preserve evidence of the information that the Cardholder has provided in terms of this numeral. The Issuer must inform the Holder in the Contracts, the means by which the aforementioned notices can be presented. The Holder, his solidary obligors and subsidiary obligors, will not be responsible for the charges that are made by reason of the use of the Credit Card from said notice. Notwithstanding the foregoing, the Issuer may demand payment of Recurring Charges or others previously authorized by the Cardholder.

In the event that the Holder or, where applicable, the additional Cardholder has presented any of the notices provided for in this numeral, the Issuer that receives it must make available to the Holder, within a maximum period of two Business Days counted from the date on which the aforementioned notice was presented, through its internet page, in any communication attached to the respective statement of account or by means of any other mechanism agreed with the Holder, a report that includes, at least the following information: a) The scope of the Holder's responsibility for charges to the Account, recorded before and after the presentation of the referred notice; b) The date and time when the notice was received, and c) The status of the investigation carried out in attention to the notice presented.

In the case indicated in the previous paragraph, the Issuer must specify to the Holder that he will not be responsible for the charges that are made to the respective Account by reason of the use of the Credit Card from the presentation of the notice referred to in this numeral, when this is for theft or loss, as well as the right of the Issuer to demand payment of the charges to said Account that have been previously authorized by the Holder or, where applicable, the additional Cardholder."

"3.4 Responsibility for unrecognized charges made with the Credit Card The Issuer that receives any of the notices referred to in the first paragraph of numeral 3.3, will be obliged to credit, in the respective Account, no later than the second Business Day following the receipt of said notice, the amount equivalent to those charges to that Account that are the subject of the notice in question, provided that: a) The referred charges correspond to operations carried out during the forty-eight hours prior to the presentation of the notice referred to in numeral 3.3, first paragraph, item (i) and at the same time said charges are not recognized by the Cardholder, nor have been carried out in the terms of item a) of numeral 2.6, or

---

112 (First Section) OFFICIAL GAZETTE Wednesday, October 3, 2018

b) If the notice corresponds to that indicated in paragraph 3.3, first paragraph, item (ii), relating to the claim for charges that the Cardholder does not recognize as their own, this has been presented to the Issuer within a period of ninety (90) natural days following the date on which the unrecognized charge was made.

The Issuer shall not be obligated to make the credit referred to in the preceding paragraph if it, within the period indicated in said paragraph, delivers to the Cardholder a report in which it proves that the charges subject to the respective notice correspond to operations with the Credit Card and were carried out in terms of item a) of paragraph 2.6, unless there is evidence that the charge was the result of an operational failure attributable to the Issuer or the Acquirer, in accordance with the inter-institutional agreement entered into for this purpose, as would be the case of an improperly duplicated charge.

The Issuer shall deliver to the Holder the report referred to in the preceding paragraph in terms of paragraph 3.6.

The period of ninety (90) natural days referred to in item b) of this paragraph shall begin to run from the date on which the unrecognized charge was made to the respective Account.

To make the credits referred to in this paragraph, the Issuer shall refrain from requiring the Cardholder or the Holder to carry out any additional procedure other than the presentation of the notices indicated.

In the event that the charges subject to any of the notices referred to in the first paragraph of paragraph 3.3 have been made as a result of instructions generated by a credit institution or entity that, in accordance with the inter-institutional agreement entered into for this purpose, has processed such instructions in favor of the recipients of the corresponding resources, the Issuer of the respective Credit Card shall require that other institution or entity to return the corresponding resources for said charges, no later than the second Business Day following that on which the Issuer so requires. In this case, the Issuer may only obtain the aforementioned return provided that it has required, for the generation of the charge instructions referred to, the use of at least two authentication factors in accordance with what is established in paragraph 2.6 of these Rules, and the credit institution or entity that generated said instructions has not provided the Issuer with sufficient elements to validate said factors in terms of the agreement entered into for this purpose.”

3.5 Repealed

“3.6 The Issuer may only obtain the return of the amount corresponding to the credit it has made in terms of paragraph 3.4, when it proves to the Cardholder that the charge with respect to which it has made said credit derived from an operation executed in accordance with what is provided in item a) of paragraph 2.6.

In the event that the return of the amount indicated in the preceding paragraph is appropriate and this, in turn, corresponds to a charge derived from an instruction issued by another credit institution or entity that provides the card acceptance service to the payment recipient that, in accordance with the inter-institutional agreement entered into for this purpose, has processed said instruction in favor of the recipient of the corresponding resources, the credit institution that obtains said return from the Cardholder shall transfer in favor of that other institution or entity the resources equivalent to said amount no later than the second Business Day following that on which that other institution or entity has requested said transfer, the foregoing only in cases where the Cardholder’s institution has previously received said resources from the other institution or entity.

The institution that has the right to the return of the amount credited in terms of the case provided for in the first paragraph of this paragraph may only charge interest on said amount, equivalent to a rate that in no case may be higher than the interest rate applicable to the credit line corresponding to the card in question, for a maximum period of two (2) Business Days following the credit referred to in paragraph 3.4.

For the purposes of the first paragraph of this present paragraph, the Issuer shall make available to the Cardholder, in any branch, or through the means agreed upon for this purpose with the Cardholder, at the latter’s choice, within a period of forty-five (45) Days counted from the date on which the notice referred to in paragraph 3.3 was received, a report in simple and clear language, signed by Issuer personnel authorized to do so, which shall contain, at least, the following information:

Wednesday, October 3, 2018 OFFICIAL GAZETTE (First Section) 113

a) Evidence of the authentication factors used in accordance with what is established in item a) of paragraph 2.6, as well as the explanation in simple and clear language of said factors and the manner in which their verification was carried out in accordance with the procedures applicable to said authentication factors.

b) Hour and minute in which the operation was carried out.

c) Name of the Acquirer and the Establishment where the operation originated.

d) If available, the physical address where the device on which the operation was carried out is located or, in its case, the internet protocol address (IP, by its initials in English) through which said device was connected to the internet.

In the event of claims relating to operations carried out abroad, the period provided for in the preceding paragraph shall be one hundred eighty (180) natural days. Additionally, the Issuer shall, at the request of the Cardholder, make available and deliver, free of charge, within the period of forty-five (45) natural days following the delivery of said report in the branch indicated by the Cardholder, or in the specialized unit of the institution that it has established for the attention of users, products and financial services in accordance with the Law for the Protection and Defense of Users of Financial Services, a copy of the file generated by reason of the notice referred to in paragraph 3.3, in which the documentation and information that relates directly to said request is incorporated.

In these cases, the charging of late interest or other accessories other than ordinary interest, generated by the failure to pay the charge whose credit has been made by the Issuer in accordance with the aforementioned paragraph 3.4, shall not proceed.

If the period referred to in the fourth or fifth paragraph of this paragraph, as applicable, has elapsed and the Issuer does not deliver said report in the terms indicated, the credit previously made by it shall remain firm, so it cannot be reversed.”

“3.7 The Bank of Mexico may request changes to the inter-institutional agreement referred to in paragraphs 3.4, last paragraph, and 3.6, second paragraph, when in the exercise of its functions it finds that said agreement does not comply with what is established in these Rules.”

“3.8 The Issuer shall include in the correspondence for the delivery of the Credit Card, the telephone number and other electronic means provided to carry out the communications referred to in the first paragraph of paragraph 3.3, as well as recommendations relating to the storage and use of the identification elements referred to in these Rules.”

TRANSITIONAL PROVISIONS

FIRST.- This Circular shall enter into force on March 26, 2019, without prejudice to what is stated in the following transitional provisions.

SECOND.- What is provided in paragraph 3.4, regarding the obligation of Issuers that receive any of the notices referred to in the first paragraph of paragraph 3.3, to credit in the respective Account, no later than the second Business Day following the receipt of said notice, the amount equivalent to those charges made in that Account that are the subject of the notice in question, shall enter into force on September 26, 2019. Until then, Issuers shall be obligated to make the respective credit no later than the fourth Business Day following the receipt of the aforementioned notice.

THIRD.- What is provided in paragraph 3.3, regarding the obligation of Issuers that have processed any charge to the Account that has been the subject of the notice referred to in paragraph 3.3, to carry out the return of the amount in question to the Acquirer no later than the second Business Day following that on which so required, shall enter into force on September 26, 2019. Until then, Issuers shall be obligated to make the aforementioned return no later than the fourth Business Day following the receipt of the aforementioned notice.

FOURTH.- What is provided in paragraph 3.6, item d), regarding the obligation of the Issuer to provide the Cardholder with the internet protocol address (IP, by its initials in English), through which the device on which the operation was carried out was connected to the internet, shall enter into force on September 26, 2019.

114 (First Section) OFFICIAL GAZETTE Wednesday, October 3, 2018

Mexico City, September 26, 2018.- The General Director of Operations and Payment Systems, Jaime José Cortina Morfín.- Rubric.- The General Legal Director, Luis Urrutia Corral.- Rubric.- The General Director of Financial System Affairs, Jesús Alan Elizondo Flores.- Rubric.

For any inquiry regarding the content of this Circular, please contact the Department of Authorizations, Inquiries and Legal Control, at the phones (55) 5237-2308, (55) 5237-2317 or (55) 5237-2000 Ext. 3200. or (55) 5237-2000 Ext. 3200.