Circular 13/2023 — Modifies Circular 4/2016

Wednesday, November 22, 2023 OFFICIAL GAZETTE 199 BANCO DE MEXICO CIRCULAR 13/2023 addressed to participants in the Dollar Interbank Payment System, regarding Modifications to Circular 4/2016 (Strengthening of Provisions on Cybersecurity and Information Technology of the Dollar Interbank Payment System). At the margin, a logo that says: Bank of Mexico.- “2023, Year of Francisco Villa, the revolutionary of the people”. CIRCULAR 13/2023 TO PARTICIPANTS IN THE DOLLAR INTERBANK PAYMENT SYSTEM: SUBJECT: MODIFICATIONS TO CIRCULAR 4/2016 (STRENGTHENING OF PROVISIONS ON CYBERSECURITY AND INFORMATION TECHNOLOGY OF THE DOLLAR INTERBANK PAYMENT SYSTEM) The Bank of Mexico, with the purpose of continuing to promote the sound development of the financial system, protect the interests of the public and foster the proper functioning of payment systems, has resolved to modify the cybersecurity frameworks applicable to the Rules of the Dollar Interbank Payment System (SPID), with the purpose of providing greater clarity regarding the element of technological infrastructure on which compliance with the aforementioned frameworks must be observed, clarifying the obligatory elements that the participants of the systems must fulfill regarding the computer security requirements currently included in the Rules, and establishing the obligations of participants in the SPID related to the designation of information security officers and the activities that such officers will perform. Likewise, additional elements are included that allow strengthening the cybersecurity and cyber resilience framework of the SPID participants. For the above, based on articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 2, sections I, IV and VIII, and 6, of the Payment Systems Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, paragraphs fourth and eighth, 10, first paragraph, 15 Bis 1, first paragraph, in relation with 28 Bis 1, section IX, 17, section I, 20 Quáter, section IV and 29 Bis, section VIII, of the Internal Regulations of the Bank of Mexico, which grant the attribution to issue provisions through the General Directorate of Information Technologies, the Directorate of Central Bank Regulations, the Directorate of Policy and Studies of Payment Systems and Market Infrastructures and the Directorate of Cybersecurity, respectively, as well as Second, sections II, IX, X and XVII, of the Agreement on the Attachment of Administrative Units of the Bank of Mexico, has resolved to modify the definition “Technological Infrastructure”, contained in the 2nd., the 42nd., first paragraph, section I, first paragraph, as well as subsections a), b) and their numbers 1, 2, 3, 4, 6 and 7, b Bis) and their numbers 1, 3, 4, 5 and 6, c), d), and e) and its number 1, as well as section II, subsection b), number 3, section III, first paragraph and its subsections a) and b), the denomination of Section II of Chapter VI and the 44th., as well as adding the definitions “SPID Application”, “Data Center”, “Cyber Resilience”, “Computing Infrastructure” and “Telecommunications Infrastructure” to the 2nd., the numbers 2 Bis, 4 Bis and 6 Bis to subsection b), the numbers 3, 4, 5, 6, 7, 8, 9 and 10 to subsection e), subsection f) and the second and third paragraphs to section I of the 42nd., as well as the 43rd. Bis. and 43rd. Bis 1., of the “Rules of the Dollar Interbank Payment System”, issued through Circular 4/2016, to remain in the following terms: RULES OF THE DOLLAR INTERBANK PAYMENT SYSTEM “2nd. Definitions. - For the purposes of these Rules, the following shall be understood: … I Bis. SPID Application: the computer program used by Participants to interact with the SPID and which is part of the Technological Infrastructure. …

200 OFFICIAL GAZETTE Wednesday, November 22, 2023 III Bis. Data Center: the physical hosting site for computer, telecommunications equipment and information storage used by the Participant to operate with the SPID. … IV Bis. Cyber Resilience: the capacity of the Participant to prevent, adapt, respond or recover its operation in the SPID in the face of cyberattacks or incidents that could affect the confidentiality, integrity, availability or operational continuity of the Technological Infrastructure, as well as of the information it uses. This, through the implementation of technological tools, controls, structures, strategies, policies, processes and practices. … XIX Bis. Computing Infrastructure: the computing elements, whether physical or virtual, whose purpose is the processing and storage of data used by the Participants to operate with the SPID. XIX Ter. Telecommunications Infrastructure: the physical or logical network elements, which provide the service of connectivity and transport data from different computer programs, and that are used by Participants to interconnect and operate with the SPID. XX. Technological Infrastructure: the Computing Infrastructure, Telecommunications Infrastructure and applications used by Participants to interconnect and operate with the SPID. …” “42nd. Requirements for admission as a Participant. - The Credit Institution that presents a request for admission in terms of the previous Rule must prove, to the satisfaction of the Administrator, that it complies with the requirements indicated below, in terms of the specifications included in the Appendix E, Annex C, of the Manual. I. Computer security requirements: In the Technological Infrastructure, the Credit Institution must have documented and implemented policies and procedures that, at least, include the following: a) Have in its organizational structure a designated area, responsible for ensuring that computer security in the Technological Infrastructure is carried out in accordance with the Internal Rules of the SPID, as well as for that area to carry out monitoring of compliance with said Internal Rules. b) Establish and maintain computer security controls, as well as Cyber Resilience controls in the Technological Infrastructure, which at least incorporate the following:

1. Use secure communication protocols in the Computing Infrastructure used in the Technological Infrastructure and dispense with those that are considered insecure, as specified in Appendix E, Annex C, of the Manual;
2. Use technological tools and have procedures to carry out detection of computer viruses and malicious code in the Computing Infrastructure, as well as keep said tools and procedures updated. This, as specified in Appendix E, Annex C, of the Manual; 2 Bis. Use tools for monitoring the integrity of information in the Computing Infrastructure, as specified in Appendix E, Annex C, of the Manual;

Wednesday, November 22, 2023 OFFICIAL GAZETTE 201 3. Use technological tools and have procedures for the detection and management of computer vulnerabilities in the Computing Infrastructure. The above, as specified in Appendix E, Annex C, of the Manual; 4. Inhibit both the activation of any service, as well as the installation of applications or software in the Computing Infrastructure that are not indispensable for operation with the SPID. The above, as specified in Appendix E, Annex C, of the Manual; 4 Bis. Prevent the execution of unauthorized files in the Computing Infrastructure through technological tools. The above, as specified in Appendix E, Annex C, of the Manual; 5. … 6. Detect and manage computer security incidents in the Technological Infrastructure, as well as in any other technological infrastructure used by the Participant that could result in an impact on its operation in the SPID. The above, in accordance with what is specified in Appendix E, Annex C, of the Manual; 6 Bis. Use technological tools that carry out centralized logging of logs of the different components of the Technological Infrastructure, as well as identify anomalous patterns and detect computer security incidents. The above, in accordance with what is specified in Appendix E, Annex C of the Manual, and 7. Perform penetration tests on the Technological Infrastructure, as well as draft work plans and reports derived from the results of said tests. The frequency of penetration tests, the reports and work plans that must be issued as a result of them, as well as the characteristics that the persons who execute the aforementioned penetration tests must meet, will be those specified in Appendix E, Annex C, of the Manual; b Bis) Have a policy for the implementation of the SPID Application, either by the Participant or through an external specialized company in the development of computer programs (software) contracted by the latter, which contain the following procedures:

1. Procedures that ensure that a formal and documented development process is followed for the implementation of its SPID Application. The development process must consider, at least, the following stages: i. Design of the SPID Application. ii. Development of the SPID Application according to the previous design. iii. Validation of functionalities, purpose, capacity and quality of the SPID Application. iv. Implementation of the SPID Application. v. Formal monitoring of changes in the SPID Application.
2. Procedures that ensure that computer security is considered during the different stages of its development process;
3. Procedures that ensure that the components or mechanisms that provide security to its SPID Application are valid and that their validity is reviewed in the terms and deadlines indicated in Appendix E, Annex C, of the Manual;
4. Procedures that ensure that the security of the SPID Application is reviewed statically and dynamically;

202 OFFICIAL GAZETTE Wednesday, November 22, 2023 5. Procedures that allow monitoring, auditing and tracking the accesses and activities carried out by the different users of the SPID Application regardless of the level of privileges established for its access and the medium or protocol of access. These procedures must consider the safeguarding of the information collected for a period of at least six months, and 6. Procedures that allow monitoring, auditing and tracking all operations carried out in the SPID Application. These procedures must consider the safeguarding of the information collected for a period of at least six months; c) Establish and maintain controls in accordance with its policies and procedures for the secure handling of electronic information, to which Appendix E, Annex C, of the Manual refers and in which the following is referred, at least:

1. Use technological tools to securely delete information in the Computing Infrastructure and in the Telecommunications Infrastructure. The above, as specified in Appendix E, Annex C, of the Manual;
2. Inhibit, through logical mechanisms, access to physical connection ports, as well as the use of removable storage devices and peripherals of the Computing Infrastructure. The above, as specified in Appendix E, Annex C, of the Manual;
3. Generate and safeguard logs of audit events regarding the activity of the operating system accounts of the Computing Infrastructure in accordance with its procedures. The above, as specified in Appendix E, Annex C, of the Manual;
4. Procedures that allow detecting the alteration or falsification of information contained in the SPID Application;
5. Procedures that allow encrypting sensitive information in the SPID Application, and d) Implement access controls to the Technological Infrastructure, which are robust and secure, in accordance with its policies and procedures, in which the following is referred, at least,
6. Control logical access to the Computing Infrastructure in accordance with its procedures. The above, as specified in Appendix E, Annex C, of the Manual;
7. Manage access to user accounts of the Computing Infrastructure and their passwords, in accordance with its procedures. The above, as specified in Appendix E, Annex C, of the Manual;
8. Manually and automatically block the Computing Infrastructure upon registering inactivity. The above, as specified in Appendix E, Annex C, of the Manual;
9. Procedures for the management of access privileges to the SPID Application, and
10. Procedures that allow monitoring and auditing the accesses and activities carried out by users of the SPID Application. These procedures must consider the safeguarding of the information collected for a period of at least six months, as well as the attention and follow-up to possible fraud events related to transfers; e) Document and implement the controls of the Computing Infrastructure and of the Telecommunications Infrastructure following, in terms of the specifications established in Appendix E, Annex C, of the Manual:
11. Inhibit through logical mechanisms access to the internet from the Computing Infrastructure in accordance with its procedures. The above, as specified in Appendix E, Annex C, of the Manual;

Wednesday, November 22, 2023 OFFICIAL GAZETTE 203 2. Procedures for the management of a Telecommunications network that allows communication with the Bank of Mexico in an efficient and secure manner; 3. Physically or logically segment the Telecommunications Infrastructure network into different domains and subnets; 4. Have documentation showing the components that make up the Computing Infrastructure and the Telecommunications Infrastructure, as well as the interconnection between them, such as network diagrams, schemes or maps. The above, in accordance with the information with which each component of the Telecommunications Infrastructure has to determine the flow of data packets; 5. Implement and store logs of events generated by the Telecommunications Infrastructure. Such logs must contain the timestamp of the clock of the components of the Telecommunications Infrastructure, which must be synchronized against a time reference; 6. Generate and implement data filtering policies in the Telecommunications Infrastructure to control and specify information flows. In the event that the implementation of IP address reassignment protocols is required in one or more components of the Telecommunications Infrastructure, these must be configured in a one-to-one format; 7. Generate and store backups of the configuration of the Telecommunications Infrastructure through one or more tools; 8. Administer the Telecommunications Infrastructure through protocols and mechanisms that allow controlling, authenticating, authorizing and registering the activities of administrators; 9. Secure the information transmitted through the interconnection links of the Telecommunications Infrastructure, through protocols and algorithms of data encryption, and 10. Monitor the Telecommunications Infrastructure through tools and specific protocols for that function. f) Implement controls and policies that must be followed regarding the Infrastructure Technological, which must establish, as specified in Appendix E, Annex C, of the Manual, the following:

1. Procedures that allow having an inventory of the Technological Infrastructure available as specified in Appendix E, Annex C, of the Manual;
2. Process for managing the entry and exit of computer and telecommunications equipment to the Data Center;
3. Electromechanical systems and fire protection systems of the Data Center;
4. Process for the maintenance of the Computing Infrastructure;
5. Process for managing physical access to the media used for backup of information, and
6. Process for managing remote access. The Administrator may authorize the use of control mechanisms alternative to those referred to in numbers 2, 2 bis, 3, 4 bis) and 6 bis of subsection b), 1 and 2 of subsection c), as well as 1 of subsection e), corresponding to section I, subsection A, of this Rule 42nd., and whose characteristics are established in the Appendix E, Annex C, of the Manual.

204 OFFICIAL GAZETTE Wednesday, November 22, 2023 For the effect of what is stated in the previous paragraph, the Participant in question must send previously a communication, with the characteristics provided in Annex D of Appendix E of the Manual, to the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, which proves that the alternative control mechanisms it intends to implement allow producing conditions of security equivalent or greater to those produced by the elements described in numbers 2, 2 bis, 3, 4 bis) and 6 bis of subsection b), 1 and 2 of subsection c), as well as 1 of subsection e), corresponding to section I, subsection A, of this Rule 42nd., and are aligned with best practices established on the matter by entities of recognized prestige in said matter in the country or other jurisdictions, such as the National Institute of Standards and Technology of the United States of America or the International Organization for Standardization (NIST and ISO by their English abbreviations, respectively), as well as those that the Bank of Mexico itself determines as equivalent. II. Operational risk management requirements: a) … b) The Credit Institution must ensure that mitigation measures are established for the risks referred to in this section, which consider the following:

1. and 2. …
2. Have policies and guidelines for the management of access privileges to the operational sites from which operation with the SPID is carried out and to the Data Centers that host the Technological Infrastructure available to operate in SPID, and c) … III. SPID Application certification requirements. The Credit Institution must carry out, in accordance with Appendix F of the Manual, the following: a) Prove that the SPID Application complies with the SPID communication protocol; b) Prove that the SPID Application processes Transfer Orders adequately, even when a high volume of them is presented in a short period of time, and c) … IV. …” “Section II SPID Information Security and Compliance Officers” … “43rd. Bis. SPID Information Security Officer.- Each interested party requesting admission as a Participant must designate, in accordance with the model established for these purposes in Appendix P of the Manual, a person to serve as SPID information security officer and their respective substitute, which the Participant must ratify annually during May, through a written addressed to the Administrator, through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures in terms of said Appendix P, who must have independence with respect to the business units and the areas of computer systems and audit of said subject, as well as be in charge of the following: I. Participate in the definition and verify the implementation and continuous compliance of the policies and computer security procedures indicated in Rule 42nd., section I, of these Rules, with respect to Participants. II. Verify, at least quarterly or earlier, in the event that the events or irregular circumstances or threats referred to in the previous Rule 29th. occur, that the activities carried out in the different components of the Technological Infrastructure of the

Participant, including those of the technical staff who have high privileges, such as operating system and database administrators, in order to detect unusual or unauthorized activities.

III. Approve and verify compliance with the measures adopted to remedy deficiencies detected in connection with the functions referred to in the preceding subsections I and II, as well as with the findings of both internal and external audits related to the Technological Infrastructure and information security.

IV. Validate the management of events, circumstances, or irregular threats referred to in the preceding Rule 29a, considering the stages of identification, protection, detection, response, and recovery, as well as the aspects of governance, preparation, testing, awareness, and evaluation and learning.

V. Report to the audit committee and the risk committee of the Participant or to the bodies exercising such functions, in the session immediately following the verification of the event, circumstance, or irregular threat referred to in the preceding Rule 29a, regarding the actions taken and the follow-up on measures to prevent or avoid the recurrence of the aforementioned incidents.

The information security officers of the SPID referred to in the preceding paragraph shall be designated by the General Director of the Credit Institution.

Participants shall ensure that the information security officer has available to them the updated list of persons who have access to information related to the operations in which the Participant itself is involved, both those located abroad and the users of the Technological Infrastructure who have high privileges, such as administration of operating systems and databases, as well as their service providers. Such list shall include the level of access and the privileges associated with such accesses to the Participant's own Technological Infrastructure, as well as any other third-party technological infrastructure involved in the operation of the SPID, corresponding to each of said persons.”

“43a. Bis 1. Exclusivity of functions of the SPID information security officers.- Persons designated as SPID information security officers, and their respective alternates, shall devote themselves exclusively to the activities set forth in the preceding 43a. Bis, as well as to those complementary activities to their functions within the internal operations of each Participant, provided that such activities are of an analogous nature to those described in the 43a. Bis of these Rules.”

“44a. Registration with the Administrator.- Each Credit Institution shall inform, in writing addressed to the Administrator, through the Directorate of Payment Systems and Market Infrastructures Operation and Continuity, the names of the persons designated as responsible for the regulatory compliance of the SPID and as the SPID information security officer.”

TRANSITIONAL PROVISIONS

FIRST.- The provisions of this Circular shall enter into force on December 19, 2023, with the exception of what is stated in the following transitional rules.

SECOND.- The modifications to subsection b) and its items 1 and 4, to subsection c) and its item 2, to subsection d) and its items 1 and 3, to subsection e) and its item 1, of fraction I of Rule 42a, as well as the additions of items 3, 4, 5, 6, 7, 8, 9, and 10 to subsection e) of fraction I of Rule 42a, shall enter into force on December 19, 2024.

THIRD.- The modifications to subsection a), to items 2, 3, 6, and 7 of subsection b), to items 1 and 3 of subsection c), and to item 2 of subsection d) of fraction I of Rule 42a, as well as the additions of items 2 Bis, 4 Bis, and 6 Bis to subsection b) and of subsection f) to fraction I of Rule 42a, shall enter into force on December 19, 2025.

FOURTH.- The modifications to Rule 44a, as well as the provisions in Rules 43a. Bis and 43a. Bis 1 of this Circular, shall enter into force on November 22, 2023. Notwithstanding the foregoing, those subjects who, on the date of publication of this Circular, have been admitted as Participants of the SPID in accordance with the Rules referred to in this same Circular, shall designate the person who shall serve as

206 DIARIO OFICIAL Wednesday, November 22, 2023 information security officer of the SPID for each Participant, in accordance with the provisions of Rule 43a. Bis of the Rules contained in this Circular, as well as inform the Bank of Mexico of the names of said persons in accordance with what is established in Rule 44a of said Rules, no later than April 4, 2024.

Mexico City, November 9, 2023.- BANK OF MEXICO: General Director of Information Technologies, Octavio Bergés Bastida.- Initials.- Director of Central Banking Regulations, María Teresa Muñoz Arámburu.- Initials.- Director of Payment Systems and Market Infrastructures Policy and Studies, Othón Martino Moreno González.- Initials.- Director of Cybersecurity, Alejandro de los Santos Santos.- Initials.

For any inquiries regarding the content of this Circular, the Bank of Mexico is available through the Directorate of Central Banking Authorizations and Sanctions at telephone (55) 5237-2000 extension 3200.