Circular 14/2017 — Interbank Electronic Payments System (SPEI)

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 53 BANK OF MEXICO CIRCULAR 14/2017 addressed to the participants of the Interbank Electronic Payments System and other interested parties in acting with such character.

A logo appears on the margin, which says: Bank of Mexico.

CIRCULAR 14/2017 TO THE PARTICIPANTS OF THE INTERBANK ELECTRONIC PAYMENTS SYSTEM AND OTHER INTERESTED PARTIES IN ACTING WITH SUCH CHARACTER:

SUBJECT: RULES OF THE INTERBANK ELECTRONIC PAYMENTS SYSTEM (SPEI).

The innovation of modalities for providing payment services, as well as the growing use of electronic media, has led the Bank of Mexico, in its capacity as administrator of the Interbank Electronic Payments System (SPEI), to strengthen the legal framework applicable to said system. As part of the foregoing, the Bank of Mexico, in said capacity, considers it convenient to robustly secure the cited system in an integral manner, as well as to promote greater benefits to the general population, by allowing the inclusion in the SPEI of new payment service providers and generating appropriate conditions for a competitive environment and adequate risk control that provides certainty and confidence to both participants and users.

In view of the foregoing, the Bank of Mexico, in its capacity as administrator of the Interbank Electronic Payments System, with the purpose of continuing to foster the proper functioning of payment systems, as well as the healthy development of the financial system, has determined to establish the terms and conditions that must be observed in the SPEI, and that allow access to this system to more sectors of the population, as well as measures aimed at strengthening operational continuity, risk mitigation, user protection, and participant controls in matters of information security, operational continuity, and threats of illicit operations that allow users to make their transfers in a safer, faster, and low-cost manner.

Therefore, the Bank of Mexico, based on articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 2, fractions I, IV and VIII, and 6, of the Payment Systems Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, paragraphs fourth and seventh, 10, first paragraph, 14 Bis, first paragraph, in relation to 17, fraction I, and 20, fraction XI, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Legal Directorate and the Payment Systems Directorate, respectively, as well as Article Second, fractions VIII and X, of the Agreement on the Assignment of Administrative Units of the Bank of Mexico, has resolved to issue the following rules:

RULES OF THE INTERBANK ELECTRONIC PAYMENTS SYSTEM

CHAPTER I Preliminary Provisions

1a. Internal Norms.- For the purposes of what is provided in article 6 of the Payment Systems Law, these Rules and the Manual constitute the internal norms of the SPEI.

Participants must observe, at all times, in their operation in the SPEI, the technical requirements, protocols, procedures, forms, terms, conditions, deadlines, schedules, and other aspects and characteristics of the operations provided for in the internal norms of the SPEI.

2a. Definitions.- For the purposes of these Rules, the following shall be understood:

I. Administrator: the Bank of Mexico, in its capacity as administrator of the SPEI in terms of article 2, fraction I, of the Payment Systems Law.

II. SPEI Application: the computer program used by Participants to interact with the SPEI and which forms part of the Technological Infrastructure.

III. Independent External Auditor: the competent professional qualified to perform audit work on the requirements that Participants must comply with in accordance with these Rules and other applicable regulations to the SPEI, who is external to the Participant regarding whom such work is carried out and who meets, in the applicable part, the characteristics and requirements provided for in Rule 77 of these Rules and in Appendix N of the Manual.

IV. Settlement Notice: the message that the Administrator makes available to the Issuing Participant and the Receiving Participant of a Transfer Order through the electronic communication means established in the Manual, to notify them that said Transfer Order was settled and that the respective charges and credits were made in the SPEI Accounts corresponding to such Participants.

V. Clearing House for Transfers Through Mobile Devices: the clearing house that the Bank of Mexico authorizes with such character in accordance with the “Rules for the Organization, Functioning and Operation of Clearing Houses for Transfers Through Mobile Devices”, contained in Circular 3/2013 of the Bank of Mexico, or those that, if any, replace them.

VI. Electronic Channels: the electronic or computer means that the Participant makes available to its Issuing Clients for the presentation of Sending Requests, which may include internet, automated teller machines, telecommunications mobile devices, and electronic links between the Participant and its Clients.

VII. Digital Certificate: that data message in digital format generated in terms of the “Rules for Operating as a Registration Agency and/or Certification Agency in the Extended Security Infrastructure”, contained in Circular-Telefax 6/2005 of the Bank of Mexico, or those that, if any, replace them.

VIII. CLABE: the unique identifier called “Basic Standardized Key”, which can be assigned to each of the Clients' Accounts with the characteristics established for this purpose in section 6 of the Manual.

IX. Tracking Key: the alphanumeric data that the Issuing Participant assigns to each Transfer Order, in accordance with what is established in Rule 14 of these Rules.

X. Beneficiary Client: the holder of the Client Account opened at the Receiving Participant that is indicated in the respective Transfer Order received by the latter as the one in which the final credit of the resources subject to said Transfer Order must be made.

XI. Issuing Client: the holder of the Client Account opened at the Participant with whom they have agreed to process their Sending Requests charged to said account.

XII. Clients: the Issuing Clients and Beneficiary Clients, jointly or indistinctly.

XIII. CLS: the financial institution constituted in the United States of America, called “CLS Bank International”.

XIV. CNBV: the National Banking and Securities Commission.

XV. Electronic Payment Receipt: the digital document that attests to the credit of the amount corresponding to the Transfer Order in question in the Client Account corresponding to the Beneficiary Client, which is generated by the SPEI with the information sent by the Receiving Participant in accordance with these Rules and Appendix D of the Manual, and which the Administrator places and maintains on the internet site established for this purpose to make it available to the Issuing Client and the Beneficiary Client involved in said Transfer Order, as well as to the Issuing Participant and the Receiving Participant, so that said Participants, in turn, also make it available to the Issuing Client and the Beneficiary Client, in accordance with what is established in these Rules.

XVI. Payment Concept: the alphanumeric data that the Issuing Client, in terms of Rule 12 of these Rules and section 8 of the Manual, may include in their Sending Request to describe the reason for the corresponding Transfer Order.

XVII. Credit Confirmation: the message that the Receiving Participant of a Transfer Order Accepted by SPEI generates and sends to the Administrator in accordance with these Rules and the specifications established in Appendix D of the Manual, to inform that the resources subject to said Transfer Order were credited to the Client Account corresponding to the Beneficiary Client.

XVIII. Contract: the agreement entered into between the Administrator and the entities that have been admitted by the latter so that they may act as Participants in the SPEI in the terms and subject to the conditions established in these Rules, the Manual, and said agreement.

XIX. Collaboration Agreement for the Protection of Issuing Clients: the instrument by which Participants who maintain demand deposit accounts agree on collaboration measures to protect their Issuing Clients against Transfer Orders Accepted by SPEI not instructed by them, drawn up in the terms provided for in Rule 43 of these Rules.

XX. Alternative SPEI Account: that SPEI Account that the Administrator maintains for the Participant, through the SPEI, for the Participant who has the character of a Credit Institution that has so requested, in order to carry out the corresponding charges and credits for Scheduled Payments in terms of these Rules.

XXI. Client Account: the uniquely identified accounting record that a Participant maintains for an Issuing Client or Beneficiary Client, for each financial product in terms of Appendix D of the Manual, to record the charges and credits of the amounts corresponding to the Transfer Orders that the Participant sends or receives on behalf of said Clients.

XXII. SPEI Account: that account denominated in national currency that the Administrator maintains for each Participant to operate in the SPEI on each operating day.

XXIII. Single Account: that corresponding to the national currency money deposit that those Participants authorized to do so maintain at the Bank of Mexico in terms of article 113 of the Provisions.

XXIV. DALÍ: the System for Deposit, Administration and Settlement of Securities administered by the company called S.D. INDEVAL, Securities Deposit Institution, S.A. de C.V.

XXV. Firm: the legal entity whose object is the provision of evaluation services referred to in these Rules, through which the respective Independent External Auditors provide the services.

XXVI. Banking Business Day: the days of the calendar year other than those indicated by the CNBV in the general character provisions it issues, as those on which Credit Institutions must close their doors and suspend operations.

XXVII. Provisions: the “Provisions applicable to the operations of credit institutions and of the National Financial Development Institution for Agriculture, Rural, Forestry and Fisheries” contained in Circular 3/2012 of the Bank of Mexico, or those that, if any, replace them.

XXVIII. Technological Infrastructure: the computing, telecommunications, and application infrastructure used by Participants to interconnect and operate with the SPEI.

XXIX. Credit Institution: multiple banking institutions and development banking institutions.

XXX. Manual: the document called “SPEI Operation Manual”, which the Administrator prepares and makes available to Participants, to describe in it the operational processes and the technical requirements and conditions that Participants need to observe to carry out actions related to operation in the SPEI, as well as in terms of the modifications that, if any, the Administrator makes to said document and makes known to the Participants.

XXXI. Operator: the person designated and registered by the Participant with the Administrator so that, through the SPEI, they instruct the operations of that Participant corresponding to the SPEI itself in terms of Rule 53 of these Rules.

XXXII. Transfer Order: the unconditional instruction that a Participant, on their own behalf or, if applicable, on behalf of the Issuing Client specified in said instruction, sends to another Participant through the SPEI in terms of these Rules, so that the latter, once the conditions established for this purpose are met, credits the amount in national currency determined in said instruction to the Client Account opened in the name of the Beneficiary Client designated in said instruction.

XXXIII. Transfer Order Accepted by SPEI: that Transfer Order that has been settled in accordance with Rule 18 of these Rules.

XXXIV. Low-Value Transfer Order: the Transfer Order directed to a Participant who has the character of a Credit Institution or that is sent or received by a Clearing House for Transfers Through Mobile Devices, for an amount of up to eight thousand pesos.

XXXV. Scheduled Payment: the Transfer Order that the Bank of Mexico, as Issuing Participant, sends in terms of what is stated in these Rules to credit the respective resources to the Alternative SPEI Account specified for this effect.

XXXVI. Participant: any of the interested parties referred to in these Rules who meet the requirements established in these to send and receive Transfer Orders.

Additionally, the Bank of Mexico may carry out all those actions related to the operation in the SPEI that are permitted to Participants in terms of these Rules subject to applicable resolutions.

XXXVII. Issuing Participant: the Participant that sends a Transfer Order in the SPEI.

XXXVIII. Receiving Participant: the Participant that receives a Transfer Order Accepted by SPEI.

XXXIX. Calculation Period: the period of twelve consecutive months prior to the month of November of the calendar year in question.

XL. Numeric Reference: the numeric data that, if applicable, the Issuing Client of the Issuing Participant indicates in the Sending Request they present to this, with the purpose of identifying the respective Transfer Order.

XLI. Additional Risks: the risks related to the use of the SPEI in the commission of illicit activities.

XLII. Reserved Balance: the part of the total balance of the SPEI Account that each Participant specifies with that character through the SPEI, in order for the resources corresponding to that part of the balance to be destined for the settlement in the SPEI of those Transfer Orders marked with high priority, in accordance with what is established in section 4 of the Manual.

XLIII. SIAC-BANXICO: the System for Attention to Account Holders of Bank of Mexico that the Bank itself makes available to its account holders, in accordance with the applicable provisions and stipulations, for the management of the money accounts that they maintain in the Bank of Mexico itself.

XLIV. Sending Request: the instruction that the Issuing Client presents to the Issuing Participant of the respective Participant, for this to send the corresponding Transfer Order in accordance with said instruction.

XLV. SPEI: the payment system called “Interbank Electronic Payments System”.

XLVI. UDIS: the accounting units, whose value in national currency is published by the Bank of Mexico in the Official Gazette of the Federation, in accordance with articles Third of the “Decree by which the obligations that may be denominated in investment units are established and reform and add various provisions of the Federal Tax Code and of the Income Tax Law” published in the Official Gazette of the Federation on April 1, 1995, and 20 Ter of the Federal Tax Code.

The terms mentioned above may be used in singular or plural, without it being understood that their meaning changes.

CHAPTER II Description of the Operational Scheme

3a. Object of the SPEI.- The SPEI is a payment system that allows Participants to send and receive fund transfers in national currency, on behalf and for their own account or that of their Clients, through Transfer Orders settled through the system itself after their sending.

4a. Requirements to be a Participant.- Interested parties in obtaining the character of Participant referred to in Rule 56 of these Rules must present to the Administrator an application for admission to the SPEI, which meets the requirements referred to in Chapters VI and VII of these Rules.

5a. Types of Transfer Orders.- Participants may, in the terms and under the conditions established in these Rules and in the Manual, send through the SPEI the types of Transfer Orders defined in section 8 of the Manual.

6a. Liquidity Management.- The balance that each Participant maintains in their SPEI Account will be used to settle, through the SPEI, the Transfer Orders that said Participant sends through the SPEI itself in accordance with these Rules. The settlement of Transfer Orders sent by a Participant for amounts greater than the balance of their respective SPEI Account at the time of said settlement cannot be carried out, so that Participants cannot incur overdrafts in their respective SPEI Accounts.

Each Participant may increase the balance of their SPEI Account that is not an Alternative SPEI Account, through fund transfers made from their Single Account in the SIAC-BANXICO or from their account in the DALÍ, or by crediting the amounts corresponding to Transfer Orders Accepted by SPEI that they receive from other Participants. The operations referred to in this paragraph must be carried out in accordance with what is established in Chapter IV of these Rules and, if applicable, in the applicable Provisions.

At the close of SPEI operations, the balances of the SPEI Accounts, including those corresponding to Alternative SPEI Accounts, of Participants who have the character of Credit Institutions will be transferred to their respective Single Accounts.

Regarding Participants other than Credit Institutions, the balances of their SPEI Accounts at the close of operations will be maintained in a concentrator account in the SIAC-BANXICO, without generating interest, and will be credited to the same SPEI Accounts from which they were taken in the schedule determined in section 3 of the Manual on the next immediate operating day of the SPEI.

7a. Operational Process.- The operational process of transfers of amounts denominated in national currency between Clients' Accounts through the SPEI will be carried out based on Transfer Orders of the third-party to third-party type, in accordance with Chapter III of these Rules and sections 4 and 5 of the Manual, in the following steps:

I. The Issuing Participant receives from their Issuing Client a Sending Request to credit the corresponding amount in the Client Account in national currency administered by another Participant, which is indicated in said Sending Request;

II. The Issuing Participant carries out the corresponding verifications in accordance with Rule 13 of these Rules and, based on them, determines whether they accept the Sending Request, in which case, they process said Sending Request in accordance with what is provided in these Rules. In this case, the Participant

58 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017 The Issuer carries out the referred processing by sending the respective Transfer Order to the Administrator through SPEI. Otherwise, it rejects the Submission Request and notifies the Issuing Client of the fact and the cause; III. The Administrator, once it receives, in an automated manner in SPEI, the Transfer Order from the Issuing Participant, carries out the corresponding validations and the verification of the sufficiency of funds in the SPEI Account of said Participant. If said validations and verification confirm compliance with the conditions established for the Transfer Order, the Administrator will carry out its settlement through the automated processes of SPEI. On the contrary, if according to said validations, the stated conditions are not met, the Administrator, in an automated manner in SPEI, will reject the Transfer Order or, if the referred balance is insufficient to settle the Transfer Order, it will continue verifying the sufficiency of funds in each clearing cycle until the operation can be settled, and if at the close of the SPEI operation day it cannot carry out said settlement, it will cancel the Transfer Order; IV. Once the Administrator carries out the settlement of the Transfer Order, it makes available, in an automated manner, the Settlement Notice to the Issuing Participant and the Receiving Participant. In this case, the corresponding Transfer Order will be considered a Transfer Order Accepted by SPEI; V. Once the Receiving Participant has access to the Settlement Notice that the Administrator has generated and made available to it through SPEI itself, it carries out the corresponding verifications and determines whether it accepts the Transfer Order Accepted by SPEI according to the respective Settlement Notice or if it rejects it, in which case it sends the Transfer Order of the corresponding type for the return provided for in these Rules. Upon receipt of a return, the Issuing Participant must notify the Issuing Client of said return and the cause thereof, and VI. The Receiving Participant that accepts the Transfer Order Accepted by SPEI carries out the credit to the Account of the Client corresponding to the Beneficiary Client, sends the corresponding Credit Confirmation to the Administrator and notifies the Receiving Client according to the mechanisms it has agreed upon with this. CHAPTER III Operation Section I General Obligations 8a. Types of Mandatory Receipt Transfer Orders.- The Participant to whom the Transfer Orders corresponding to any of the types indicated in section 9 of the Manual as mandatory are directed will be obliged to process them in accordance with what is provided in these Rules. 9a. Assignment of CLABE.- Participants must, in accordance with what is established to that effect in section 6 of the Manual, assign a CLABE to each of the Client Accounts that they hold for their Clients and that correspond to the financial products indicated in the catalog of said products included in Appendix D of the Manual. Participants must ensure that each CLABE is distinct for each Client Account. Section II Submission Requests 10a. Submission Request.- Participants must allow their Issuing Clients to submit the Submission Requests they formulate to said Participants as follows: I. For any amount, provided it does not exceed the balance of available resources in the respective Client Account to be charged. Participants may establish limits on the amounts of Submission Requests, provided that, through a procedure previously established by the Participant, the Issuing Client can formulate Submission Requests without being subject to such limits. II. For their submission to any of the Participants included in the list that the Administrator informs daily to all Participants at the start of SPEI operations, which they must make available to their Issuing Clients. The list that Participants make available to their Issuing Clients must exclude the identifiers corresponding to Alternative SPEI Accounts of the Participants. III. At least, by the following means, provided that the Participant has them:

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 59 a) In all its branches, and b) In the case that the Participant in question has the status of a Credit Institution, those Electronic Channels corresponding to the internet electronic banking service. 11a. Schedule for submitting Submission Requests.- Participants must allow their Issuing Clients to submit Submission Requests within the following schedules: I. Regarding Submission Requests that do not correspond to Low-Value Transfer Orders formulated through Electronic Channels, including those corresponding to the internet electronic banking service: on any Banking Business Day from 06:00:00 to 17:30:00 hours; II. Regarding Submission Requests formulated in the Participant's branches: during the hours that the Participant keeps its branches open, and III. Regarding Submission Requests from Issuing Clients of Participants that have the status of a Credit Institution or are sent through Clearing Chambers for Transfers via Mobile Devices, in both cases, corresponding to Low-Value Transfer Orders formulated through Electronic Channels, including those corresponding to the internet electronic banking service: 24 hours of all days of the year. The Participant that has the status of a Credit Institution and that maintains fewer than three thousand demand deposit accounts for its Clients, will be exempt from the schedule established in the previous paragraph and will only have to receive and process the referred Submission Requests on any Banking Business Day during the hours of 06:00:00 to 17:30:00 hours. 12a. Information contained in the Submission Request.- Regarding Submission Requests, the Issuing Participant that agrees to receive them from its respective Issuing Clients must observe the following: I. The Issuing Participant must require its Issuing Clients to provide the following data in the respective fields of the Submission Request forms that it makes available to them, as a necessary condition to be able to process said Submission Requests: a) Any of the following data to identify the Client Account corresponding to the Beneficiary Client: i. The eighteen digits of the respective CLABE; ii. The sixteen digits of the debit card that, if applicable, corresponds, or iii. The last ten digits of the mobile phone line number that, if applicable, has been associated with the respective Client Account, which corresponds to a deposit of money in the respective Participant that has the status of a Credit Institution. b) The amount of the transfer object of the respective Submission Request. II. The Issuing Participant must allow its Issuing Clients to include, in the respective fields of the form of each Submission Request that it makes available to them, the following data that they decide to specify in relation to the Submission Request in question: a) The Payment Concept, and b) The Numeric Reference. Both data created under the structure that, to that effect, section 8 of the Manual provides, for which the Participant must establish the applicable parameters that allow adding this data in the Submission Request according to said structure and up to the maximum length established for each of these data in said section of the Manual. As an exception to what is provided in this fraction, in case that the Transfer Orders are sent through Clearing Chambers for Transfers via Mobile Devices, the Participants referred to in this fraction may abstain from allowing their Clients to include the Numeric Reference field. 13a. Verification of the Submission Request.- The Issuing Participant will consider valid that Submission Request transmitted by its Issuing Client through the use of Electronic Channels, once said Participant has followed the identification and authentication procedures of that Issuing Client, in accordance with the applicable provisions issued by the CNBV in the case that said Participant has the status of a Credit Institution, or with Rule 71a of these Rules, in any other case.

60 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017 In the event that the identification and authentication referred to in the previous paragraph is appropriate, the Participant must carry out the necessary verifications, including the availability of sufficient resources in the Client Account corresponding to the Issuing Client that it has designated to carry out charges for the amounts of the Submission Requests that it presents to the Participant. Once the Participant has verified the above, it must accept the referred Submission Request. The Issuing Participant that receives a Submission Request must inform the respective Issuing Client, within ten seconds following that in which said reception occurs, that said Submission Request is in the process of verification, or that it has been accepted or rejected, in case this has occurred in that time period. The Participant must inform the above to its Issuing Client by the means they have agreed upon to that effect and by the same means by which the latter presented the respective Submission Request. The Participant must provide the information referred to in this paragraph free of charge for the Issuing Client. 14a. Information on the status of the Submission Request.- The Participant that receives a Submission Request from its Issuing Client must inform this, through the means agreed upon for it and by the same means by which the latter presented the respective Submission Request, the status it holds and include at least the following information: I. Regarding Submission Requests that said Participant has accepted to process as a result of the validation and verification referred to in Rule 13a. above, at the moment when the referred Submission Request has been accepted: a) The Tracking Key that the Participant has assigned to said Submission Request, in accordance with what is established to that effect in section 6 of the Manual, to identify it uniquely among all those other ones accepted by the Participant on the same day of SPEI operation; b) The hour, minutes and seconds of the day in which the respective Submission Request has been accepted; c) The last three digits of the identifier of the Client Account corresponding to the Beneficiary Client, and d) An electronic link built in accordance with what is established in Appendix E of the Manual, which must be enabled no later than within five minutes following the acceptance of the Submission Request and must be accompanied by the legend "This link will be activated no later than within five minutes following the acceptance of the operation", or II. Regarding that Submission Request that, as a result of the validation and verification referred to in the previous Rule, has been rejected by the Participant, it must inform the Issuing Client of this fact, no later than five seconds immediately following that in which the Participant has decided to reject the referred Submission Request. In said information, the Issuing Participant must indicate the cause of the rejection of the Submission Request. The information that is provided to the Issuing Client in compliance with what is provided in this Rule must be delivered free of charge for the Issuing Client. 15a. Calculation of the number of deposit accounts.- For the purposes of those cases that refer to numbers of demand deposit accounts provided for in 11a., fraction III, second paragraph, 19a., fraction II, second paragraph, and fraction IV, and 25a., fraction III, second paragraph, of these Rules, said number of accounts that Participants that have the status of a Credit Institution maintain open in favor of their Clients will correspond to those that said Participants register at the close of the calendar quarter in question, based on the information they report to the Bank of Mexico in attention to the information requirements made by the Financial System Information Directorate or, if applicable, to those that the Bank of Mexico corroborates derived from the verification it carries out in exercise of its supervisory attributes. In the event that any of the Participants referred to in the previous paragraph exceeds the limit of three thousand demand deposit accounts, in accordance with what is provided in said paragraph, it must comply with what is established for this case in the Rules cited in the same paragraph no later than the last day of the following calendar semester to the quarter in which the Participant exceeded the limit. Section III Transfer Orders

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 61 16a. Transfer Orders.- The Issuing Participant must include, in the Transfer Order it sends to the Administrator in accordance with these Rules, the information corresponding to the Tracking Key field, as well as that of the Numeric Reference and Payment Concept fields that, if applicable, the Issuing Client has specified in the Submission Request that said Issuing Participant has accepted in accordance with 13a. of these Rules. Likewise, in the Client Account field, the Issuing Participant must include only the CLABE of the Client Account corresponding to the Issuing Client. In the case that said Transfer Order is instructed by an Issuing Client, the Issuing Participant must include the information of the Unique Population Registry Key (CURP) or the Federal Taxpayer Registry (RFC) with homoclave for individuals and the RFC with homoclave for legal entities in accordance with 72a., fraction I, of these Rules. Additionally, the Issuing Participant must indicate for each Transfer Order if its priority is normal or high in accordance with what is provided in section 2 of the Manual. The Issuing Participant will only send Transfer Orders that it issues: I. In the name and on behalf of those Issuing Clients that have transmitted the respective Submission Requests to it, or II. In the name and on behalf of the Issuing Participant itself, only in those cases where there are no Submission Requests from its Issuing Clients. Participants must abstain from sending Transfer Orders in their own name that are requested by an Issuing Client or, sending Transfer Orders in the name of an Issuing Client when said Participants act on their own behalf. Likewise, Participants that have the status of a Credit Institution must abstain from sending Transfer Orders by instructions from users who are not Issuing Clients. 17a. Sending of Transfer Orders.- The Issuing Participant must send to the Administrator, through the automated processes of SPEI, the Transfer Order corresponding to the Submission Request accepted by said Participant, during the thirty seconds counted from the moment that the Participant itself has informed its Issuing Client that the Submission Request was validated and accepted in accordance with what is stated in 13a. of these Rules. The Issuing Participant must comply with the above, except in case that it has agreed with its Issuing Client that it will carry out the sending of the Transfer Order at a later hour or date than that of the reception of the Submission Request and, in this last case, the thirty-second term mentioned will begin to count from the agreed hour to that effect or if no specific hour is agreed, from 06:00:00 hours of the day that, if applicable, has been agreed upon in accordance with the above. In case of not agreeing on a specific hour, the Issuing Participant must inform its Issuing Client that the payment will be made at 06:00:00 hours of the agreed date. The thirty-second term referred to in the previous paragraph will not be applicable regarding Transfer Orders that are sent by those Participants that have the status of a Clearing Chamber for Transfers via Mobile Devices, or a Credit Institution. In these cases, the Issuing Participants referred to in this paragraph must send the referred Transfer Orders no later than five seconds counted from the moment that the Participants themselves have informed their Issuing Clients that the Submission Requests were validated and accepted in accordance with what is stated in 13a. of these Rules. The Issuing Participant may send to the Administrator, through SPEI, instructions to cancel Transfer Orders that it has previously sent. Transfer Orders can only be cancelled when they have not been settled through SPEI in terms of 18a. of these Rules. Additionally, the Administrator will cancel, in an automated manner through SPEI, those Transfer Orders that have not been settled at the close of SPEI operation. 18a. Settlement of Transfer Orders.- Once the Administrator carries out, in an automated manner through SPEI, the validations of the Transfer Orders, it will carry out the settlement of said orders starting from the process described in section 4 of the Manual to carry out clearing in terms of the Law of Payment Systems, which will consider the balance of the SPEI Accounts, the Transfer Orders that are pending settlement, as well as the priority that has been indicated in said Transfer Orders. Once the settlement of the Transfer Orders has been carried out and that the Administrator through SPEI has made available to the Issuing Participants and Receiving Participants the Settlement Notices

62 (Primera Sección) DIARIO OFICIAL Martes 4 de julio de 2017

of Settlement, the corresponding Transfer Orders shall be considered Accepted Transfer Orders by SPEI.

Transfer Orders that have met the validations referred to in the first paragraph of this Rule and for which the Settlement Notices indicated in the preceding paragraph have been made available, shall correspond to the accepted transfer orders referred to in the Payments Systems Law. In virtue thereof, the transfer orders referred to in this paragraph, as well as their clearing and settlement contemplated in these Rules and Section 4 of the Manual, shall be firm, irrevocable, enforceable, and opposable against third parties.

19a. Crediting of Accepted Transfer Orders by SPEI.- The Receiving Participant shall be obligated to credit, in the respective Client Account corresponding to the Beneficiary Client indicated in the Sending Request, the amount of the Accepted Transfer Order by SPEI as follows:

I. Within thirty seconds following the moment in which the Administrator has made available to it through SPEI the Settlement Notice regarding the Accepted Transfer Order by SPEI in question, on the corresponding Banking Business Day, during the hours from 06:00:00 to 17:59:59.

The thirty-second period specified in the preceding paragraph shall not apply to any Participant that has the status of a Credit Institution regarding the Accepted Transfer Order by SPEI it receives for an amount greater than eight thousand pesos, in which case the period shall be five seconds following the moment in which the Administrator has made available to it through SPEI the aforementioned Settlement Notice;

II. Regarding Participants that have the status of a Credit Institution or of a Clearing House for Transfers Through Mobile Devices, within five seconds following the moment in which the Administrator has made available to it through SPEI the Settlement Notice regarding the Accepted Transfer Order by SPEI in question corresponding to a Low-Value Transfer Order, 24 hours a day, all days of the year.

The Participant that has the status of a Credit Institution and that maintains fewer than three thousand demand deposit accounts shall be exempt from the schedule established in this subsection and shall credit the Accepted Transfer Orders by SPEI within five seconds following the moment in which the Administrator has made available to it through SPEI the Settlement Notice regarding the Accepted Transfer Order by SPEI in question corresponding to a Low-Value Transfer Order, on the corresponding Banking Business Day, during the hours from 06:00:00 to 17:59:59;

III. No later than 06:00:30 hours of the Banking Business Day corresponding to the date of operation of SPEI, provided that they are Accepted Transfer Orders by SPEI received by those Participants that have a status other than that of a Credit Institution or of a Clearing House for Transfers Through Mobile Devices between the opening hours of SPEI specified in Rule 35a of these Rules and 05:59:59 hours of the said Banking Business Day corresponding to the date of operation of SPEI;

IV. No later than 06:00:05 hours of the Banking Business Day corresponding to the date of operation of SPEI, in the event that:

a) They are Accepted Transfer Orders by SPEI corresponding to Low-Value Transfer Orders that those Participants indicated in the second paragraph of subsection II above receive between the opening hours of SPEI specified in Rule 35a of these Rules and 05:59:59 hours of the said Banking Business Day corresponding to the date of operation of SPEI, or

b) They are Accepted Transfer Orders by SPEI for amounts greater than eight thousand pesos, that those Participants that have the status of a Credit Institution or of a Clearing House for Transfers Through Mobile Devices receive between the opening hours of SPEI specified in Rule 35a of these Rules and 05:59:59 hours of the said Banking Business Day corresponding to the date of operation of SPEI;

V. No later than 06:00:05 hours of the Banking Business Day corresponding to the date of operation of SPEI, provided that they are Accepted Transfer Orders by SPEI corresponding to Scheduled Payments, received between the opening hours of SPEI provided for in Rule 35a of these Rules and 05:59:59 hours.

For the purposes of the times specified in subsections I and II of this Rule, the hour in which the Administrator makes available to the Receiving Participant the Settlement Notice of Accepted Transfer Orders by SPEI shall be that indicated in the "credit notice message" specified in Section 5 of the Manual.

The Receiving Participant shall inform its Beneficiary Client, at no cost to the latter, about the crediting of the resources corresponding to the Accepted Transfer Order by SPEI in question, through the means they have agreed upon, no later than five seconds immediately following the moment in which it has carried out said crediting and shall provide, at least, the following data:

a) The Tracking Key; b) The last three digits of the identifier of the Client Account corresponding to the Beneficiary Client, and c) An electronic link constructed in accordance with what is established in Appendix E of the Manual, which shall be enabled no later than within five minutes following the carrying out of the crediting and shall be accompanied by the legend "This link will be activated no later than within five minutes following the carrying out of the crediting".

20a. Confirmation of Crediting.- The Receiving Participant that processes an Accepted Transfer Order by SPEI sent by a Sender Client of the Sending Participant or directed to a Beneficiary Client of the Receiving Participant, shall generate and send through SPEI a Confirmation of Crediting to the Administrator in terms of Appendix D of the Manual, within five minutes counted from the moment in which it has carried out the crediting in the Client Account corresponding to the Beneficiary Client of the amount of the respective Accepted Transfer Order by SPEI.

The Receiving Participant that credits a Client Account corresponding to a Beneficiary Client shall include in the Confirmation of Crediting the information of the Unique Population Registry Key (CURP) or the Federal Taxpayer Registry (RFC) with homoclave for natural persons and the RFC with homoclave for legal entities of its Beneficiary Client in accordance with Rule 72a, subsection I, of these Rules.

The provisions of this Rule shall not be applicable in the case where the Receiving Participant is the Bank of Mexico, in its capacity as trustee of any trust, a securities depository institution, or an operator of an international settlement system for foreign exchange transactions that includes the peso as one of the participating currencies.

21a. Rejection of Confirmation of Crediting.- The Administrator may reject those Confirmations of Crediting when it detects that they do not meet the assumptions and specifications established in these Rules and Appendix D of the Manual.

Receiving Participants shall correct the Confirmations of Crediting rejected by the Administrator, as well as send to it, through the mechanisms indicated in Appendix D of the Manual, the corrected Confirmations of Crediting.

22a. Liability of the Administrator.- The Administrator shall be released from all liability towards the Participants and their Clients for the carrying out of those actions through SPEI that are indicated in these Rules and that are carried out in terms of what is indicated in the Manual, including those carried out in an automated manner.

Section IV Return of Accepted Transfer Orders by SPEI

23a. Causes for return of Accepted Transfer Orders by SPEI.- The Receiving Participant shall send a new Transfer Order of the return type regarding an Accepted Transfer Order by SPEI in any of the following situations:

I. When the information contained in the Accepted Transfer Order by SPEI does not meet what is specified in Section 8 of the Manual;

II. If the respective Transfer Order is directed to a non-existent Client Account in the Receiving Participant;

III. In the case that the respective Transfer Order is identified as presumably fraudulent in terms of the Collaboration Agreement for the Protection of the Sender Client;

IV. When, by mandate of a competent judicial or administrative authority, it is prevented that the Client Account corresponding to the Beneficiary Client receives deposits;

V. In the case that the Transfer Order received by the Receiving Participant corresponds to any of the types indicated in Section 9 of the Manual as Optional Transfer Orders and with respect to which said Participant has previously notified the Administrator of its decision not to receive them;

64 (Primera Sección) DIARIO OFICIAL Martes 4 de julio de 2017

VI. In the case that the Receiving Participant receives in its Alternative Account of SPEI Accepted Transfer Orders by SPEI that do not correspond to Scheduled Payments, except those Transfer Orders of the return type sent by a Participant from its Alternative Account of SPEI;

VII. In the case that the Participant has not previously established with the Client corresponding the Client Accounts of the Beneficiary Clients to where the Participants shall credit the resources when the balance per Client reaches the limit established in Rule 70a, subsection I, of these Rules, or

VIII. In the case that it is not possible to credit the amount of the Accepted Transfer Order by SPEI in the Client Account corresponding to the Beneficiary Client, for any of the causes established in Section 9 of the Manual.

24a. Return of Accepted Transfer Orders by SPEI.- In the situations referred to in the preceding Rule 23a, the Receiving Participant shall send the Transfer Order of the respective return type, in accordance with Section 8 of the Manual and shall indicate the cause of the return in accordance with the catalog contained in Section 9 of the Manual, as well as ensure that the amount included corresponds:

I. To that of the original Accepted Transfer Order by SPEI that is the subject of said return, or

II. To that of the original Accepted Transfer Order by SPEI that is the subject of said return, plus the amount corresponding to the compensation specified in Rule 86a of these Rules, for late returns.

25a. Deadlines for the return of Accepted Transfer Orders by SPEI.- The Receiving Participant that falls under any of the situations referred to in Rule 23a of these Rules shall send the Transfer Order of the return type in question in accordance with what is provided in Rule 24a of these Rules, no later than during the sixty seconds following the moment in which the Administrator has made available to it the Settlement Notice of the Accepted Transfer Order by SPEI subject to the return.

The period indicated in the preceding paragraph shall not be mandatory for the following Accepted Transfer Orders by SPEI:

I. Of the Transfer Order type specified in the Manual as "Participant to Participant";

II. Those that are received by Participants that do not have the status of a Credit Institution or of a Clearing House for Transfers Through Mobile Devices between the opening hours of SPEI specified in Rule 35a of these Rules and 05:59:00 hours of the Banking Business Day corresponding to the date of operation of SPEI. In this case, the Receiving Participant shall send the Transfer Order of the return type no later than 06:01:00 hours corresponding to said day;

III. Those that correspond to Accepted Transfer Orders by SPEI, corresponding to Low-Value Transfer Orders, received by Participants that have the status of a Credit Institution or of a Clearing House for Transfers Through Mobile Devices. In this case, the period to send the Transfer Order of the return type referred to in this Rule shall be ten seconds counted from when the Administrator has made available to it through SPEI the respective Settlement Notice;

The period referred to in the preceding paragraph shall be applicable only during the hours between 06:00:00 and 17:59:50 hours of the Banking Business Day corresponding, regarding the Settlement Notices of the Accepted Transfer Orders by SPEI regarding Low-Value Transfer Orders that the Administrator has made available through SPEI to Participants that have the status of a Credit Institution that maintain fewer than three thousand banking demand deposit accounts. For the period comprised from 17:59:50 of any Banking Business Day and 05:59:00 of the next Banking Business Day, the Participants referred to in this paragraph shall send the Transfer Order of the return type no later than 06:00:10 hours of the said next Banking Business Day;

IV. Those that correspond to Scheduled Payments. In this case, the Receiving Participant shall send the Transfer Order of the return type referred to in this Rule no later than 06:00:10 hours of the Banking Business Day corresponding to the date of operation of SPEI, or

V. Those that correspond to Accepted Transfer Orders by SPEI other than Scheduled Payments received in the Alternative Account of SPEI. In this situation, the Receiving Participant

Martes 4 de julio de 2017 DIARIO OFICIAL (Primera Sección) 65

shall send the Transfer Orders of the return type referred to in this Rule as follows:

a) Regarding those Accepted Transfer Orders by SPEI that are received between the opening hours of SPEI specified in Rule 35a of these Rules and 05:59:59 hours of each Banking Business Day corresponding to the date of operation of SPEI, the respective Transfer Orders of the return type shall be sent no later than 06:01:00 hours of that same Banking Business Day.

b) Regarding those Accepted Transfer Orders by SPEI that are received between 06:00:00 and the closing hours of SPEI specified in Rule 35a of these Rules, the respective Transfer Orders of the return type shall be sent no later than at the cited closing hours of SPEI.

VI. Those that correspond to Accepted Transfer Orders by SPEI received by Participants that have the status of a Credit Institution or of a Clearing House for Transfers Through Mobile Devices for amounts greater than eight thousand pesos, between the opening hours of SPEI specified in Rule 35a of these Rules and 05:59:59 hours of the said Banking Business Day corresponding to the date of operation of SPEI. In this case, the Transfer Order of the return type shall be sent no later than 06:00:10 hours of the said next Banking Business Day.

26a. Late Return.- In the event that, for any circumstance, the Receiving Participant has not carried out the return of the corresponding Accepted Transfer Order by SPEI in question within the period that is applicable in the situations established in Rule 25a of these Rules, it shall execute the Transfer Order of the late return type, in accordance with Section 8 of the Manual, and shall ensure that the amount included corresponds to the sum of the original Accepted Transfer Order by SPEI that is the subject of said return, plus the amount corresponding to the compensation specified in Rule 86a of these Rules. The foregoing shall be observed provided that said return is carried out on any operating day of SPEI subsequent to that on which said Participant received the respective Transfer Order.

27a. Crediting of the Return Transfer Order or Late Return Transfer Order.- The Sending Participant of the Transfer Order subject to a return or late return shall, within five seconds following the moment in which the Administrator has made available to it through SPEI the Settlement Notice of the Transfer Order of the return type or late return type in question, credit the amount of said Transfer Order in the Client Account corresponding to the Sender Client that transmitted the respective Sending Request.

In the event that the Sending Participant cannot carry out the crediting of the resources referred to in the preceding paragraph, said Participant shall:

I. Refrain from generating a new Transfer Order of the return type or late return type regarding that other Transfer Order of the return type or late return type that, in turn, it has received from the Receiving Participant, and

II. Make the resources corresponding available to the referred Sender Client for withdrawal at the counter, or so that they can be transferred to any other Client Account that said Sender Client indicates, as the case may be.

The Sending Participant of the Transfer Order subject to a return or late return shall inform the Sender Client, at no cost to it, that transmitted the respective Sending Request, through the means they have agreed upon for this purpose, about the re-entry of the respective resources into its Client Account that has been carried out due to the return or late return, as well as the cause thereof in accordance with what was indicated by the Receiving Participant of the Transfer Order subject to a return or late return, no later than five seconds after having carried out the crediting.

Section V Return of Resources

28a. Return of Accepted Transfer Orders by SPEI.- In the event that a Beneficiary Client does not recognize an Accepted Transfer Order by SPEI credited in its Client Account, the respective Receiving Participant shall allow said Beneficiary Client to return the resources by presenting a Sending Request corresponding to a Transfer Order of the return type in accordance with Section 8 of the Manual. Additionally, when the result of the application of the Collaboration Agreement for the Protection of the Sender Client indicates that the resources should

66 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017

returned, the Receiving Participant of this Transfer Order Accepted by SPEI must return the corresponding resources for this Transfer Order Accepted by SPEI by executing a Transfer Order of the return type, in accordance with Section 8 of the Manual.

29a. Late Return.- In the event that, for any circumstance, the Receiving Participant performs the return on any SPEI operating day subsequent to the one on which said Receiving Participant received the original Transfer Order, it must execute the Transfer Order of the late return type, in accordance with Section 8 of the Manual.

30a. Deadlines for the Return of Transfer Orders Accepted by SPEI.- The Receiving Participant must send the Transfer Order of the return or late return type referred to in 28a. and 29a. of these Rules, no later than thirty seconds following the one in which they receive the corresponding Send Request from their Beneficiary Client, or within the deadline agreed upon in the Collaboration Agreement for the Protection of the Issuing Client.

31a. Deadlines for the Crediting of Returns of Transfer Orders Accepted by SPEI.- The Issuing Participant of the Transfer Order subject to a return must, within thirty seconds after the Administrator has made available to it through SPEI the Settlement Notice of the Transfer Order of the return type, credit the amount of said Transfer Order to the Account of the Client corresponding to the Issuing Client who transmitted the Send Request subject to the return.

In the event that the Issuing Participant cannot carry out the crediting of the resources referred to in the previous paragraph, said Participant must:

I. Refrain from generating another Transfer Order of the return or late return type regarding a Transfer Order of the return or late return type that, in turn, it has received from the Receiving Participant, and

II. Make the corresponding resources available to the Issuing Client of the Transfer Order subject to the return for withdrawal at the counter, or so that they can be transferred to the Account of the Client that, if applicable, said Issuing Client indicates.

The Issuing Participant of the Transfer Order that has been subject to a return or late return must inform the Issuing Client, at no cost to this client, who transmitted the respective Send Request, through the means they have agreed upon for this purpose, about the re-entry of the respective resources into their Client Account due to the return or late return, no later than five seconds after having made the credit to their Client Account.

Section VI Operations with CLS

32a. Operations with CLS.- Participating Credit Institutions may send and receive, through the Bank of Mexico, CLS Transfer Orders.

33a. Contingencies in operations with CLS.- When for any circumstance a Participant that has the status of Credit Institution cannot send to CLS or receive from it Transfer Orders, said Participant must adhere to the procedure described in Section 5 of the Manual.

Section VII Schedules

34a. Schedules.- Unless indicated otherwise, the schedules mentioned in these Rules and other applicable provisions are referenced to the time zone governing Mexico City.

35a. SPEI Operating Hours.- The SPEI will have a continuous operation scheme. The operating schedule of the SPEI for a Banking Business Day will start at 18:00:00 hours of the previous Banking Business Day and end at 17:59:59 hours of the Banking Business Day referred to in the first place.

Section VIII Extension of Hours

36a. Extension of Hours.- The Administrator may extend the operating schedule of the SPEI or suspend its service due to fortuitous event or force majeure. The Administrator must inform Participants of the schedule extension it carries out in terms of this Rule, through the electronic or telecommunications medium that the Administrator itself establishes and notifies to Participants for this purpose.

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 67

37a. Request for Extension of Hours.- In the event that a Participant, due to technical or operational problems, estimates that it will not be possible to send all the Transfer Orders it has pending to send to the SPEI before the system's closing of operations on the corresponding operating day in accordance with what is provided in 35a. of these Rules, it may send to the Administrator a request for extension of hours, through the Management of Operation and Business Continuity of the Payment Systems. The interested Participant must send said request at least thirty minutes in advance of the SPEI's closing of operations, in terms of what is provided in 98a. of these Rules.

The request referred to in the previous paragraph must adhere to the form established in Appendix J of the Manual and contain, at least, the estimated number and total amount corresponding to the Transfer Orders that the Participant has pending to send to the SPEI, at the moment of sending the extension request, as well as an explanation of the causes and type of problem for which it makes the request and the requested time expressed in minutes.

38a. Characteristics of the Extension of Hours.- The maximum time for extension of hours will be sixty minutes. The extension of hours that, if applicable, the Administrator authorizes will consider as a minimum one extension period and up to a maximum of four extension periods. Each extension period will consist of fifteen minutes.

The first extension period will start one second after the system's closing of operations schedule, established in 35a. of these Rules.

39a. Resolution of the Request for Extension of Hours.- Once the Administrator has analyzed and evaluated the request for extension of hours presented by the interested Participant, the Administrator will carry out a comparison of: i. the information provided by said Participant, in accordance with what is provided in 37a. of these Rules, with ii. a proportion of the average daily amount operated in the SPEI in the twelve months prior to the month in which the request is made and, on the other hand, it will take into account possible effects on the efficiency and security of the SPEI. Based on the foregoing, the Administrator will resolve whether it is appropriate to grant the extension of hours requested by the interested Participant.

In case the Administrator accepts to extend the hours based on the received request, it will inform the interested Participant and indicate the number of authorized extension periods, through electronic communication addressed to the email addresses that said Participant has made known to the Administrator in accordance with the model contained in Appendix J of the Manual.

The Administrator will inform all Participants of the extension of the operating hours referred to in this Rule, through the electronic or telecommunications means that the Administrator itself establishes for this purpose, in which case Participants must remain connected to the SPEI until the closing of operations schedule that the Administrator informs them, during which they must operate under ordinary conditions in terms of these Rules.

In the event that the Administrator does not communicate its resolution to the interested Participant no later than five minutes prior to the SPEI's closing of operations schedule, established in 35a. of these Rules, it will be understood that the request for extension of hours has been denied.

The Administrator's resolution to extend the operating hours of the SPEI in terms of what is provided in this Rule, will not exempt the Participant who has presented the corresponding request from the sanctions that, if applicable, result applicable.

40a. Modification of the Authorization of the Number of Extension Periods.- During the extension of hours authorized in terms of the previous Rule, the Administrator will verify the capacity of the interested Participant to regularize the sending of Transfer Orders to the SPEI. In case that, at any moment, during the period of the authorized extension, the Administrator observes that the Participant to whom the extension of hours has been granted does not follow an operability that, in the judgment of the Administrator, allows it to regularize the sending of Transfer Orders to the SPEI for which it requested said extension or effects on the efficiency and security of the SPEI are identified, the Administrator may cancel in advance some or all of the authorized extension periods pending to elapse. The Administrator will inform the Participant to whom the extension of hours has been granted of its determination, through electronic communication sent to the email addresses that the Participant has made known to the Administrator in accordance with the model contained in Appendix J of the Manual in accordance with the previous Rule.

68 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017

In case that the Participant to whom the extension of hours has been granted sends the entirety of the pending Transfer Orders in a time less than the authorized extension, it must inform the Administrator, in accordance with what is established in 98a. of these Rules, that it no longer requires the entirety of the authorized extension of hours. The Administrator will consider this notification to conclude with said extension of hours, even if the entirety of said period has not been consumed.

In the cases referred to in this Rule, the Administrator will inform the closing of operations schedule of the SPEI to all Participants with, at least, five minutes of advance to said schedule, through the electronic or telecommunications means that the Administrator itself establishes for this purpose.

41a. Compensation to be paid for Extension of Hours.- The extension of hours of the SPEI authorized in accordance with this Section will oblige the Participant that has requested it to pay the Administrator a compensation for this concept.

The amount of the compensation provided in the previous paragraph will be the quantity that results from adding the amount corresponding to a fixed cost per event plus the variable cost that results from multiplying the cost per minute by the number of minutes that have been effectively consumed during each extension period that corresponds, in accordance with 39a. and 40a. of these Rules.

With respect to the foregoing, the Administrator will inform the Participant that requests an extension of hours the tariffs corresponding to the fixed and variable costs used by the Administrator for the calculation of the compensation referred to in this Rule. Such tariffs will be informed through electronic communication that the Administrator sends to the email addresses that the Participant has made known to it, in accordance with the model contained in Appendix J of the Manual, no later than the last Banking Business Day of the month of November of the year immediately preceding that to which they correspond in accordance with what is provided in 90a. of these Rules.

The Administrator will inform the Participant to whom the extension of hours has been granted, the amount of the compensation corresponding to the authorized extension period, no later than the fifth Banking Business Day of the month immediately following that in which the extension of hours was authorized, through electronic communication that it sends to the email addresses that the Participant has made known to the Administrator in accordance with the model contained in Appendix J of the Manual.

The Participant must cover the compensation no later than the tenth Banking Business Day of the month following that in which the extension of hours was authorized.

Section IX Participant Forum

42a. Participant Forum.- Participants may participate in a Participant Forum that is integrated and functions in the terms and under the conditions indicated in Appendix X of the Manual.

The referred forum will have as its object to facilitate the discussion of topics related to the functioning of the SPEI, as well as the exchange of opinions, suggestions, and comments on the operation of the SPEI between the Administrator and the Participants. For these purposes, this forum, among other activities, will discuss proposals for improvement and innovation, as well as the exchange of experiences in the operation in the SPEI, in order to promote the good functioning, the continuous improvement of the SPEI and strengthen coordination.

The forum referred to in this Rule will not constitute a means for consultations, interpretations, or authorizations on the internal rules of the SPEI.

Section X Collaboration Agreement for the Protection of the Issuing Client

43a. Mechanism of Collaboration for the Protection of Issuing Clients.- Participants that maintain, on behalf of their Clients, Client Accounts corresponding to demand money deposits must conclude a Collaboration Agreement for the Protection of Issuing Clients under which said Participants agree among themselves the procedure that they must follow for the presentation of support requests to Receiving Participants to provide protection to Issuing Clients in the event that Transfer Orders Accepted by SPEI that have not been requested by them are processed. Participants may determine the conditions of the Collaboration Agreement for the Protection of Issuing Clients in the Participant Forum or by any other means that Participants agree upon for this purpose.

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 69

Participants must request the Administrator's prior authorization of the Collaboration Agreement for the Protection of Issuing Clients. For these purposes, they must attach to their request the draft agreement which must contain, at least, the following information:

I. Name of the Participants who sign the agreement;

II. Description of the process that Receiving Participants will follow to: a) Attend to support requests; b) Preserve the documentation that serves as evidence of the receipt of the support request, and c) Follow up on the support requests received from the Issuing Participant;

III. The criteria and times to carry out the corresponding evaluation to determine the acceptance or rejection of a support request;

IV. The mechanisms for the eventual restriction on the Beneficiary Client to dispose of the resources corresponding to the Transfer Order Accepted by SPEI subject to the support request, as well as the maximum duration of this restriction in accordance with the provisions issued for this purpose by the CNBV that, if applicable, result applicable;

V. Description of the procedure for the determination of the release of the resources corresponding to the Transfer Order Accepted by SPEI to the Beneficiary Client or the delivery of the same to the Issuing Participant, for its eventual delivery to the Issuing Client. These procedures must consider the confirmation of the sending of the Transfer Order by the Issuing Participant with its Issuing Client;

VI. The mechanism for the return of resources to the Issuing Client. In case that it is determined that a Transfer Order Accepted by SPEI is the product of fraud, a Transfer Order of the return or late return type must be sent, in accordance with what is provided in 28a. and 29a. of these Rules, respectively, and

VII. If applicable, the characteristics under which a Transfer Order Accepted by SPEI will be considered as part of a possibly fraudulent operation, as well as the obligation that the respective Receiving Participant assumes to return it, through a return or late return type, in accordance with 24a. of these Rules, and

VIII. The procedure to establish the responsibilities of each Participant who signs the agreement, as well as the procedure that will be followed in case of controversies.

The Administrator may require additional documentation and information that it deems necessary to evaluate the appropriateness of granting the requested authorization.

44a. Resolution of the Request for Authorization to Conclude Agreements.- Once the Administrator considers that the request referred to in the previous Rule meets the documentation and information referred to in said Rule, it will have a period not greater than ninety days to determine if, based on that documentation and information, it is appropriate to grant the authorization for the conclusion of the respective Collaboration Agreement for the Protection of Issuing Clients, as well as to inform its resolution through electronic communication that it sends to the email addresses that the Participant has made known to the Administrator, in accordance with the model contained in the Manual.

In the event that the Administrator considers that the Collaboration Agreement for the Protection of Issuing Clients does not provide adequate protection of Issuing Clients against possible fraud by third parties or the period referred to in the previous paragraph has elapsed without a response from the Administrator, it will establish, as part of the internal rules of the SPEI, the terms and conditions on the collaboration for the protection of the Issuing Client to which the Participants referred to in this Section must adhere.

Any modification that Participants make to the Collaboration Agreement for the Protection of Issuing Clients authorized by the Administrator in accordance with this Rule, must be submitted to the prior authorization of the latter, in accordance with what is provided in the previous Rule 43a. In case of making modifications without having the prior authorization of the Administrator, in terms of what is provided in this Rule, the Administrator will establish the terms and conditions on the collaboration for the protection of the Issuing Client to which the Participants referred to in this Section must adhere, as part of the internal rules of the SPEI. The foregoing, regardless of the applicable sanction.

Section XI

70 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017 Contingencies 45a. Contingencies.- In the event that any event occurs that affects the normal operation of the SPEI or puts its integrity or security at risk, the Administrator may: I. Suspend the connection of a Participant; II. Instruct any Participant to suspend the sending of Transfer Orders through the SPEI; III. Instruct Participants to continue the operation of the SPEI through the use of contingency procedures provided for in section 5 of the Manual; IV. Activate the contingency procedure known as “SPEI Alternate Operating Procedure” (POA-SPEI), in accordance with what is provided for in section 5 of the Manual, for which Participants, who have the status of Credit Institution or securities depository institutions, will be obligated to continue the operation of the SPEI through the use of said procedure, or V. Extend the operating hours of the SPEI. 46a. Participant Contingencies.- In the event that a Participant presents any event that affects its operation with the SPEI or detects any irregular circumstance in its operation with it, when the duration of said event is more than thirty minutes, the Participant must notify the Administrator via telephone to the Administrator’s operational contacts established in section 10 of the Manual and subsequently through a digitally signed communication, in terms of what is established in 98a. of the Rules. The digitally signed communication referred to in the previous paragraph must be sent within sixty minutes after the aforementioned event arises or the detection of the irregular circumstance, which must express the date and time of start of the event, the indication of whether it continues or has concluded and its duration, the affected processes, systems and channels, as well as a description of the event that has been registered. Additionally, in the event that a Participant identifies any imminent threat to the operation of the SPEI, such as, among others, the presence of malicious codes, attacks on its Technological Infrastructure, or the commission of acts linked to possible frauds, the Participant must notify these facts to the Administrator immediately upon detection, via telephone to the Administrator’s operational contacts established in section 10 of the Manual and additionally within sixty minutes after the identification of the threat, through a digitally signed communication, in terms of what is established in 98a. of the Rules. In those cases where the SPEI Applications of a Participant that has the status of Credit Institution or securities depository institution present an event that affects its operation or connection with the SPEI, said Participants will be obligated to execute the contingency procedure known as “SPEI Alternate Client” (COA-SPEI), in accordance with the procedures and times provided for in section 5 of the Manual. Section XII Technical elements 47a. Communication with the SPEI.- The messages, notices and other information that the Participant exchanges through the SPEI must be subject to the schedules, protocols, forms, methods of sending and procedures indicated in the Manual. Additionally, the Participant must implement the connection scheme indicated by the Administrator to connect with it and operate with the SPEI. 48a. Connection with the SPEI.- Participants that have the status of Credit Institution and those others that are authorized to carry to their Clients deposit accounts for money, as well as the Clearing Houses for Transfers Through Mobile Devices, must maintain their connection with the SPEI, to comply with the operating schedules established in 19a. of these Rules or, in its defect, that which is determined and informed by the Administrator in accordance with 36a. and 39a. of these Rules. In any case, each Participant must maintain its connection with the SPEI in accordance with the annual availability indices defined in section 5 of the Manual. In the event that, for any circumstance, the Participant loses the connection, it will be obligated to re-establish said connection with the SPEI in terms of what is

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 71 provided for in the Manual, as well as inform the Administrator in accordance with what is established in 46a. of these Rules. 49a. Necessary technical characteristics of clocks.- Participants must ensure that the clocks of their respective Technological Infrastructures that they use to operate in the SPEI, as well as that of the technological and telecommunications infrastructures dedicated to the administration of Client Accounts, comply with the characteristics provided for in section 6 of the Manual. CHAPTER IV Management of funds in the SPEI Account 50a. Funding of the SPEI Account.- The SPEI Account of each Participant, which is not an Alternate SPEI Account, may be credited in the following terms: I. Regarding that SPEI Account of the Participant that is the holder of a Single Account, through transfers instructed by the Participant itself through the SIAC-BANXICO, in terms of the Provisions; II. Regarding that SPEI Account of the Participant that acts as the depositor of the S.D. INDEVAL Securities Depository Institution, S.A. de C.V., through transfers instructed by the depositor itself through the DALÍ system, and III. Regarding that SPEI Account of all Participants, including those indicated in the preceding subsections I and II, through credits resulting from Transfer Orders sent by other Participants in favor of the Participant in question. 51a. Balances at closing.- The amounts corresponding to the balances that result in the SPEI Accounts of Participants that have the status of Credit Institution, as well as the Alternate SPEI Accounts of these, will be transferred, at the closing of SPEI operations, to their Single Account. Regarding the other Participants other than Credit Institutions, the Administrator will maintain the resources corresponding to the balances of their SPEI Accounts at the closing of operations in a concentrator account at the SIAC-BANXICO, without generating interest, and will credit them subsequently in the mentioned SPEI Accounts in accordance with the schedule indicated in section 3 of the Manual. CHAPTER V Operators 52a. Functions of Operators.- For the operation of each Participant in the SPEI, only the Operators that the Participant designates for this effect may perform the following functions: I. Execute the connection of the SPEI Application that the Participant requires to operate in the SPEI; II. Sign and send Transfer Orders on behalf of and for the account of the respective Participant, and III. Modify the Reserved Balance and send any other type of information to the SPEI in accordance with what is specified in the Manual. 53a. Request for registration of Operators.- Only those persons that the respective Participant registers with that status before the Administrator may act as Operators. For this, each Participant must present to the Administrator, through the Management of Operation and Business Continuity of the Payment Systems, a registration request in the terms established in Appendix K of the Manual, which must be digitally signed by the legal representative of the Participant in question who has the authority to perform acts of dominion or to designate those who may act as Operators in the systems administered by the Bank of Mexico. Each Participant must verify and keep a record that the persons designated as Operators comply with the following: I. Have experience in the operation of systems to perform operations in the financial markets, and II. Have a valid Digital Certificate in the name of the person designated as Operator. In addition to what is provided for in the preceding subsections, the Participant must present to the Administrator a letter of no criminal record of the person who intends to register as Operator, issued by the Decentralized Administrative Body for Prevention and Social Readaptation of the National Security Commission or by the federal authority that replaces it, with an issuance date not greater than one year prior to its presentation to the Administrator, as well as a communication signed by the compliance officer or officers of the SPEI in accordance with the form established in Appendix L of the Manual, in which it indicates that the person who

72 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017 intends to be designated as Operator is not disqualified from holding a job, position or commission in the Mexican financial system, with an issuance date not greater than one month prior to its presentation to the Administrator. The registration of the person that the Participant in question has communicated to the Administrator will take effect once the Administrator has verified that the requests comply with the requirements established in this Rule. The sending of the communications referred to in this Rule, by the Participant to the Administrator, must be subject to what is established in 98a. of these Rules. 54a. Number of Operators.- Each Participant must maintain, at all times, at least two Operators. It will be the responsibility of each Participant to verify that, when removing an Operator, it has at least two others to operate in the SPEI. In the event that when removing one or more Operators, a Participant is left with fewer than two Operators, said Participant must register the necessary number of Operators to again have at least two Operators, within a period not greater than five Banking Business Days subsequent to that in which it notified the aforementioned removal. Additionally, each year, the Participant must confirm to the Administrator the validity and update of the Operators in accordance with the procedure established in section 5 of the Manual. 55a. Request for removal of Operators.- The Participant that has registered an Operator before the Administrator may request, at any time, the removal of said person through the presentation of a communication, in the terms established in Appendix K of the Manual. Said communication must be sent to the Administrator in the terms established in 98a. of these Rules. Without prejudice to the foregoing, the Participant must request the removal of its Operator, in terms of what is provided for in the preceding paragraph, within a period not greater than one Banking Business Day counted from the respective date on which: I. The Operator ceases to work for the Participant or to exercise the functions of Operator; II. The Participant detects that the Operator was involved in some incident by which sensitive information related to the operation of the SPEI could be compromised, or III. The Participant has knowledge that the person designated as Operator ceases to comply with the requirements provided for in 53a. of these Rules. The request for removal of an Operator provided for in this Rule will take effect no later than the next Banking Business Day after that in which the Administrator has verified that the request was presented by a person authorized by the Participant for this effect. CHAPTER VI Admission process to act as a Participant Section I Admission requirements 56a. Criteria to be a Participant.- The following may act as Participants: I. Those entities subject to regulation in the federal sphere, in financial matters, as well as to the supervision of the Bank of Mexico, the National Banking and Securities Commission, the National Insurance and Bonding Commission or the National Retirement Savings System Commission; II. The departments or entities of the Federal Public Administration; III. The Bank of Mexico, in its capacity as trustee in the respective trusts, or IV. Any institution other than those in the preceding subsection I, that operates an international system for the settlement of foreign exchange operations that include the peso as one of the participating currencies. In addition to what is provided for above in this Rule, to be admitted as Participants, the interested parties must comply with the requirements, terms and conditions established in these Rules and the Manual, obtain the authorization of the Bank of Mexico in accordance with what is provided for in Circular 13/2017 and, in turn, be admitted by the Administrator in accordance with 64a. of these Rules, as well as celebrate the Contract mentioned in 65a. of these Rules. 57a. Presentation of admission request.- The interested party in being admitted as a Participant must present to the Administrator its admission request, in addition to the request that it must present to the Bank of Mexico to obtain its authorization in terms of what is provided for by Circular 13/2017. The two requests referred to in this Rule may be presented jointly through the Management of Operation and Business Continuity of the Payment Systems. In any case, the admission request must be digitally signed by the general director of the interested party, or by the person who holds the position in the

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 73 interested party that has under its responsibility the functions of administration, or by some official who holds a position of at least two immediate hierarchical levels below that of the aforementioned general director, and must be accompanied by the compliance reports referred to in 62a. of these Rules, which may also be used as the supporting documentation for the authorization request referred to in Circular 13/2017. Prior to the presentation of the admission request, the interested party must present to the Administrator a unilateral confidentiality contract, signed by the legal representative of the interested party itself, in terms of the clauses that the Administrator, through the Management of Operation and Business Continuity of the Payment Systems, makes available to interested parties who request it. By virtue of this contract, the interested party must obligate itself to keep strict confidentiality regarding all information, whether expressed in oral, written, graphic, electronic or any other form, that is provided to it by the Administrator related to the SPEI, and to obligate itself also to use the information exclusively for the effects provided for in these Rules. Likewise, in said contract, the interested party must obligate itself to give access to the information subject to the same only to the necessary persons for the compliance of these Rules and be responsible for the use that its personnel, representatives, administrators, directors, employees, agents, dependents or any person related to the interested party make of the mentioned information. In the same way, the interested party must obligate itself to hold the Administrator harmless from any liability incurred derived from the acts it performs in relation to the SPEI or with reference to it, such as, among others, civil, commercial, or any other, as well as for the damages and losses that it could cause to the Administrator or to third parties. The requests referred to in this Rule, as well as the corresponding supporting documentation of said requests, must be presented to the Administrator in the terms established in 98a. of these Rules. 58a. Requirements for admission as a Participant.- The interested party in acting as a Participant that presents an admission request in terms of 57a. of these Rules must prove, to the satisfaction of the Administrator, that it complies with the requirements indicated below, in terms of the specifications included in Appendix M of the Manual. I. Information security requirements A. In the Technological Infrastructure. The interested party must have a documented policy and procedures that it obligates itself to follow in matters of information security that, at least, include the following: a) Have a designated area, responsible for information security that verifies that the administration of the Technological Infrastructure is carried out in accordance with the established information security policies and procedures. b) Have a written policy that must procure and maintain the solidity of the Technological Infrastructure, which must refer, at least, to the following aspects:

1. Procedures to evaluate the communication protocols used in the Technological Infrastructure and dispense with those that are considered insecure in accordance with what is specified in Appendix M of the Manual;
2. Procedures that contemplate the mandatory use of tools that allow detecting computer viruses and malicious codes in the Technological Infrastructure, as well as procedures that allow their periodic update in accordance with what is specified in Appendix M of the Manual;
3. Procedures that allow managing information security vulnerabilities derived from, among other factors, changes, updates or errors in the Technological Infrastructure;
4. Procedures to inhibit the installation of any service, application and/or software that is not indispensable for the operation with the SPEI in the Technological Infrastructure;
5. Procedures to detect and manage information security incidents in the Technological Infrastructure, ensuring their identification, containment and the adequate collection and safeguarding of information security evidence for notification to senior management, and
6. Procedures to evaluate and/or audit, at least every two years, the information security of the Technological Infrastructure, which include the performance of

74 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017 penetration tests by an independent external auditor specialized in this type of tests. Furthermore, among the work of said evaluation or audit, the presentation of a report that establishes an information security risk level for the Technological Infrastructure must be foreseen, as well as the formation of a documented work plan to address the high and medium criticality risks referred to in said evaluation or audit. c) Policy for the implementation of its computer systems, either by the Participant or by an external specialized company in the development of computer programs (software) contracted by it, which contain the following procedures:

1. Procedures that ensure that a formal and documented development process is followed for the implementation of its computer systems. The development process must consider, at least, the following stages: i. Design of the computer system. ii. Development of the computer system in accordance with the previous design. iii. Validation of functionalities, purpose, capacity and quality of the computer system. iv. Release and/or installation of the computer system. v. Formal follow-up to changes in the computer system.
2. Procedures that ensure that information security is considered during the different stages of its development process;
3. Procedures that ensure that the components that provide security to its computer systems are valid and that their validity is reviewed in accordance with what is specified in Appendix M of the Manual;
4. Procedures that ensure that the security of the computer system is reviewed statically and dynamically;
5. Procedures that allow monitoring, auditing and tracking the accesses and activities performed by the different users of the computer services regardless of the level of privileges established for their access and the medium or communication protocol of access. These procedures must consider the safeguarding of the information collected for a period of at least six months, and
6. Procedures that allow monitoring, auditing and tracking all operations performed by the computer systems. These procedures must consider the safeguarding of the information collected for a period of at least six months. d) Have policies that must be followed for the secure handling of electronic information, which contain the following procedures:
7. Procedures that ensure that when discarding or decommissioning physical components or devices (hardware) of the Technological Infrastructure, the information contained in them is unrecoverable;
8. Procedures to restrict access to the physical connection ports and peripheral devices of the Technological Infrastructure;
9. Procedures for the safeguarding of information of the Technological Infrastructure and operational;
10. Procedures that allow detecting the alteration or falsification of the information contained in the Technological Infrastructure, and
11. Procedures that allow encrypting sensitive information in the Technological Infrastructure. e) Have policies that must be followed to implement access control mechanisms to the Technological Infrastructure, based on criteria that establish for determining that said mechanisms are robust and secure, which include the following procedures:

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 75

1. Procedures that allow for the implementation of robust logical access mechanisms and controls to the Technological Infrastructure;
2. Procedures for user and password management;
3. Procedures that allow for manual and automatic blocking of the Technological Infrastructure to ensure that equipment can only be used by authorized personnel;
4. Procedures for the management of access privileges to the Technological Infrastructure, and
5. Procedures that allow for monitoring and auditing the accesses and activities carried out by users of the Technological Infrastructure. These procedures must consider the safeguarding of collected information for a period of at least six months. As well as the attention and follow-up to possible fraud events related to transfers.

f) Have policies that must be followed for communication with the Bank of Mexico, which include the following procedures:

1. Procedures to restrict internet access from the Technological Infrastructure, and
2. Procedures for the management of a telecommunications network that allows communication with the Bank of Mexico in an efficient and secure manner.

B. In Electronic Channels. Interested parties that offer Electronic Channels to their Issuing Clients must have processes and/or systems duly documented that consider at least:

a) Have an organizational structure that allows for the separation of activities and roles, differentiating between the areas responsible for the development and operation of the Electronic Channels. b) Procedures that allow for the administration of computer security vulnerabilities derived from, among other factors, changes, updates, or errors in the Electronic Channels. c) Have a formal and documented software development process that contemplates at least the tracking and control of software versions for the Electronic Channels. d) Procedures that allow for the safeguarding of detailed logs regarding the operation of Issuing Clients in the Electronic Channels, including incidents. The logs must be safeguarded for a period of at least one year. e) Procedures that establish controls for access to the logs. f) Procedures that contemplate the mandatory use of tools that allow for the detection of computer viruses and malicious code in the Electronic Channels, as well as procedures that allow for their periodic update.

II. Operational Risk Management Requirements

a) The interested party must have documented policies and procedures that must be followed for the administration of operational risks, which include the following:

1. A methodology for the administration of operational risk related to operation with the SPEI that considers the identification, evaluation, monitoring, and mitigation of identified risks, as well as the defined roles and responsibilities for their execution, review, and update;
2. A methodology for business impact analysis, which considers at least: i. Identifying critical processes related to their operation with the SPEI;

76 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017 ii. Identifying and classifying the impacts in time in which the system is available when the identified operational risks materialize, in accordance with the operational risk management methodology defined; iii. Defining a target recovery time for each critical process related to their operation with the SPEI, which must be less than or equal to two hours; iv. Defining a target recovery point in the event of interruption of their operation with the SPEI, which considers reconciliation procedures to recover operation in a consistent state of information prior to the interruption; v. Identifying critical internal and external counterparties related to their operation with the SPEI, and vi. Identifying the critical material and human resources to carry out operation with the SPEI; 3. Hiring and training procedures for personnel to ensure that those related to operation with the SPEI have the skills, competencies, and knowledge required for the position they hold, and 4. Procedure and operation manuals that describe the activities required to carry out their operation with the SPEI and the personnel responsible for the execution of said activities in such a way as to ensure that there is a segregation of functions in the critical processes carried out for the operation of the SPEI and a precise definition of responsibilities.

b) The interested party must establish at least the following risk mitigation measures:

1. Have a list of identified operational risks, indicating the classification of the risk and the result of its evaluation, as well as the associated controls for operation with the SPEI, including technological ones and those associated with external providers;
2. Have a capacity analysis on the technological, human, and material resources available for operation with the SPEI to ensure that it has sufficient resources to handle high volumes of operation and meet its service level objectives, and
3. Have policies and guidelines for the management of physical access privileges to operational sites from which operation with the SPEI is carried out and to the data centers that host the Technological Infrastructure available to operate with the SPEI.

c) The interested party must establish documented procedures that must be followed for the recovery and restoration of operation with the SPEI in the event of the materialization of any of the risks referred to in this subsection, which include:

1. A continuity policy, as well as strategies and procedures that must be followed so that, in the event of the materialization of the contingency scenarios identified in the risk analysis, it can continue with operation with the SPEI at a minimum acceptable level;
2. The actions that must be followed for the attention of incidents that cause an impact on normal operation with the SPEI, which contemplates the phases of identification, diagnosis, attention, recovery, restoration, and documentation, and indicates the corresponding roles and responsibilities;
3. The activities that must be carried out to respond to emergencies in the occurrence of any incident that affects normal operation with the SPEI, in which the activation of implemented continuity strategies and procedures is considered, and the roles and responsibilities, levels and time of escalation, the protocol, and the internal and external communication means available are indicated;

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 77 4. The actions that must be followed for the restoration of normal operation, once any strategy is activated or any continuity procedure is executed due to the occurrence of an incident related to operation with the SPEI, and 5. A test plan to which follow-up must be given to evaluate the implemented continuity strategies and procedures related to operation with the SPEI, indicating the guidelines, type of tests to be carried out, and their periodicity.

III. Certification Requirements for SPEI Applications The interested party must carry out, in accordance with the specifications included in Appendix O of the Manual, the following: a) Accredit that the SPEI Application complies with the SPEI communication protocol; b) Accredit that the SPEI Application processes Transfer Orders adequately, even when a high volume of them is presented in a short period of time; c) Accredit that it has the capacity to comply with Rule 20a. for the generation and sending of the Credit Confirmation; d) Validate that it can operate with the secondary infrastructure that the Administrator has implemented for the SPEI in contingency cases, and e) Accredit that it can continue its operation upon activation of the "SPEI Alternate Operation Procedure" (POA-SPEI), as well as operate through the contingency procedure called "SPEI Alternate Operation Client" (COA-SPEI), in the case of Credit Institutions or institutions for the deposit of securities.

IV. Requirements for the Protection of Issuing Clients of Interested Parties A. The interested party must have systems and control measures that ensure, at least, the following: a) That the processing of Transfer Orders from Issuing Clients will be completely automated and will not contemplate manual processes between the presentations of the Issuing Client's Sending Requests in the Electronic Channels and their sending to the SPEI. b) That the interested party may offer the possibility of making Transfer Orders in the name and on behalf of its Issuing Clients in a non-automated scheme exclusively in contingency situations, provided that it complies with the following conditions:

1. Have mechanisms to certify and validate the identity of the Issuing Client;
2. Make available to its Issuing Clients information on the means and processes of communication in case of contingency, and
3. Have a scheme for the instruction of Transfer Orders that considers the authorization of at least two officials who hold a position of at least two immediate hierarchies below the general director of the interested party.

B. Regarding interested parties other than Credit Institutions, that offer Electronic Channels to their Issuing Clients, must comply with the following requirements: a) Establish, clearly and precisely, in the contract for the celebration of operations through Electronic Channels that they subscribe to with Issuing Clients, at least the following:

1. the operations and services that the Issuing Client can perform through the Electronic Channels;
2. the mechanisms and procedures for the identification of Issuing Clients, as well as the elements of identity verification;
3. the mechanisms, means, and procedures for notifying Issuing Clients of operations carried out in Electronic Channels;
4. the limits of individual and aggregate daily amounts corresponding to the operations that Issuing Clients can perform through Electronic Channels, if any exist;

78 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017 5. the mechanisms to report the loss or theft of any identity verification element used by the Issuing Client to authenticate, in order for the interested party to prevent access to Electronic Channels, as well as to report unrecognized operations; 6. the mechanisms and procedures for the cancellation of the contracting of Electronic Channels, and 7. the responsibilities of the interested party regarding the services it offers through Electronic Channels;

b) Have mechanisms and controls that ensure the safe and robust safeguarding of identity verification elements and Issuing Client identifiers; c) Generate a digital fingerprint that proves the authenticity of each Sending Request from its Issuing Clients, in accordance with Appendix Y of the Manual. d) In addition to what is provided in subsection I, letter B, item d), of this Rule, have detailed logs of all activity related to Transfer Orders and Sending Requests instructed by its Issuing Client through the Electronic Channels of the interested party. Interested parties must store at least the following information:

1. Electronic Channel used;
2. Date and time of access and session end in the Electronic Channel;
3. Identity verification elements used by Clients;
4. Date and time of presentation of Sending Requests;
5. For the case of Transfer Orders Accepted by SPEI, the information referred to in Rule 83a. of these Rules;
6. The generated in accordance with item c) of this subsection;

e) Have procedures to review, at least once a year, the logs mentioned in the previous item d) and so that in case any unusual event is detected, it is notified to the internal audit committee, if it has such a committee, or if the interested party does not have an audit committee, the notification must be presented to the general director or equivalent. f) Have procedures that allow its Issuing Clients to perform through the Electronic Channels, with the exception of ATMs, the following acts:

1. Establish limits on the amounts of Transfer Orders for the aggregate amount in a day, the amount of any Transfer Order, and the amount transferred in a day to an Account of the Client corresponding to the Beneficiary Client;
2. Pre-register Beneficiary Client Accounts, provided that the regulation applicable to the interested party allows it, and
3. Establish the maximum amount for the pre-registration of Beneficiary Client Accounts.

g) Have procedures that allow delivering to its Issuing Clients, through the means established for such effect, notifications without cost to the Issuing Clients and in a period no greater than 10 seconds from the occurrence of the following events:

1. Operations sent and received;
2. Change of identity verification elements, and
3. Change in the notification reception channel (to the new one and to the one being replaced).

h) Processes that allow monitoring the transactional behavior patterns of Issuing Clients and having documented procedures of the actions that the interested party will carry out in case of fraud indicators; i) Have mechanisms and procedures so that Issuing Clients can:

1. Report the loss or theft of any identity verification element so that the interested party prevents access to Electronic Channels, and
2. Report and follow up on unrecognized operations by Issuing Clients carried out through Electronic Channels.

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 79 j) Have automatic processes and mechanisms to block access to Electronic Channels when attempting to access Electronic Channels with incorrect information on at most five consecutive occasions, and k) Have procedures and mechanisms that allow the interested party to terminate the session in Electronic Channels when there is inactivity for a maximum of twenty minutes or when during the course of a session the interested party identifies relevant changes in the communication parameters of the Electronic Channel, such as identification of the access device, range of addresses of communication protocols, or geographic location.

C. Interested parties that maintain, in the name of their Clients, demand deposit accounts, must have celebrated a Collaboration Agreement for the Protection of the Issuing Client authorized by the Administrator, in accordance with what is provided in Rule 43a. of these Rules.

V. Requirements in Matter of Additional Risks for Admission as a Participant Interested parties that are subject to regulation and supervision in matters of prevention and detection of acts, omissions, or operations that could favor, provide help, aid, or cooperation of any kind for the commission of any of the crimes provided in articles 139 and 148 Bis of the Federal Penal Code or that could be located in the circumstances of article 400 Bis of the same Code must satisfy the following requirements: a) They must not have been subject to the imposition of a final sanction for infractions to said regulation for at least the last three years prior to the date on which they request their admission as participants in the SPEI. b) In case of having been sanctioned in accordance with the previous item a), they must accredit before the Administrator that they have carried out the necessary actions to correct the causes that would have given rise to the respective infractions. Such accreditation could be resolved through the result of the follow-up visit that the competent supervisory commission would have carried out to verify such situation, or by means of the presentation of a report prepared by an Independent External Auditor. c) In the event that the entity in question has been notified by the respective supervisory commission about a possible or presumed infraction to the regulation referred to in this subsection V, said entity must inform about this situation to the Administrator and present a report from an Independent External Auditor on the causes that have given rise to such notification, as well as on the viability of the correction plan that it must present for such effects, in the event that the supervisory commission has required it. d) In the case of entities that have the status of Credit Institution and that have not been subject to supervision and inspection by the competent authority in the matter referred to in this subsection during the two immediate years prior to the date of their application, they must accredit, by means of a report prepared by an Independent External Auditor, that they have the capacity to comply with the regulation contemplated in this same subsection that are applicable to them. Entities that do not have the status of Credit Institution must obtain the accreditation provided in the previous paragraph independently of the supervision to which they have been subject in the matter referred to in this subsection.

VI. Interoperability Requirements Interested parties that have the status of Clearing House for Transfers Through Mobile Devices must offer their services to their Clients independently of the telecommunications companies with which their Clients have contracted their services.

Section II SPEI Compliance Officers 59a. SPEI Compliance Officers.- Each interested party that requests its admission as a Participant must designate a compliance officer for the SPEI, in charge of verifying compliance with the applicable regulations to the SPEI. The interested party must verify that the person designated as the responsible person complies with the following requirements:

80 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017 I. Have a certificate of no criminal record issued by the Decentralized Administrative Body for Prevention and Social Readaptation of the National Security Commission or, in its case, the federal authority that replaces it, with an issuance date no greater than one year prior to their designation as the SPEI compliance officer, and II. Report directly to the compliance officer of the interested party or that this position falls on the same responsible person.

The provisions of this Rule are excepted for trusts in which the Bank of Mexico acts as trustee and for operators of international systems for the settlement of foreign exchange operations that include the peso as one of the participating currencies.

60a. Registration with the Administrator.- Each interested party must inform, by written document addressed to the Administrator through the Business Operation and Continuity Management of the Payment Systems, the name of the person designated as the SPEI compliance officer. The SPEI compliance officer referred to in the previous paragraph must be designated by the general director of the interested party or by the person who holds the position in the interested party that has under their responsibility the functions of administration, or by any official who holds a position of at least two immediate hierarchies below that of the cited general director. Such written document must be delivered to the Administrator in the terms established in Rule 98a. of these Rules.

Section III Hiring of Third Parties 61a. Provision of services by third parties.- The interested party that intends to agree with third parties that provide it with an interface that allows it to connect with the SPEI or any other service that is essential for the operation of the SPEI, must obtain the authorization of the Bank of Mexico in the terms of what is provided in Circular 13/2017.

Section IV Accreditation of Compliance with Requirements to be Admitted as a Participant and Signing of the Contract 62a. Compliance Evaluation.- The interested party that presents the application for admission to act as a Participant, in accordance with what is provided in Rule 57a. of these Rules, must accredit in said application the compliance with the requirements of computer security, operational risk management, protection of Issuing Clients of interested parties, management of Additional Risks, and interoperability to operate with the SPEI established in subsections I, II, IV, V, and VI of Rule 58a., as well as in Rule 68a. of these Rules. For such effects, the interested party must attach to the aforementioned application for admission, in the terms established in Appendix N of the Manual, the following documentation: I. A compliance report signed by the compliance officer, or equivalent, of the interested party, indicating that the interested party complies with the requirements provided in these Rules; II. A compliance report signed by the head of the internal audit area, when it has one, of the interested party indicating how compliance is given to each requirement referred to in this Rule, the findings, and, in its case, the irregularities or non-compliances detected, and III. A compliance report signed by an Independent External Auditor in which it indicates the level of compliance by that interested party of each one of the requirements referred to in this Rule.

The reports referred to in this Rule must be sent to the Business Operation and Continuity Management of the Payment Systems in the terms established in Appendix N of the Manual. The provisions of this Rule are excepted for trusts in which the Bank of Mexico acts as trustee and for operators of international systems for the settlement of foreign exchange operations that include the peso as one of the participating currencies.

63a. Review by the Administrator.- To verify compliance with the requirements to operate with the SPEI established in Rule 58a. of these Rules, the Administrator may require the documentation, information, execution of tests, and additional reports that it deems necessary. Likewise, the Administrator

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 81

may conduct visits to the facilities and systems of the interested party in question, for the purpose of verifying compliance with the aforementioned requirements.

64a. Administrator's Resolution.- Once the application referred to in Rule 57a. of these Rules has gathered the documentation and information referred to in this Chapter, and the Administrator has also carried out the tests referred to in this Chapter and, if applicable, has conducted the visit mentioned in the previous Rule, said Administrator, based on the aforementioned documentation and information, as well as the results of the tests and visits, will determine whether it is appropriate to admit the applicant as a Participant in the SPEI. The Administrator will inform its resolution to the applicant so that they may celebrate the Contract referred to in the following Rule.

65a. Contract.- The interested party that receives a favorable resolution from the Administrator regarding its admission as a Participant referred to in the previous Rule, must celebrate the Contract, for which it will provide the Administrator, through the Operations Instrumentation Management, the names of the persons who intend to sign it, as well as a simple copy of their official identification and a certified and simple copy of the public deed in which the powers to exercise acts of dominion or to designate the persons who may act as operators in the payment systems administered by the Bank of Mexico are stated.

66a. Alternate Account Agreement.- Credit Institutions that have celebrated the Contract to operate in the SPEI may sign the corresponding agreement with the Administrator to operate an Alternate Account of the SPEI, provided that they satisfy the Administrator with the requirements established in fractions I, II, and III of Rule 58a. of these Rules. Such Credit Institutions must communicate their interest in operating an Alternate Account of the SPEI through the Operations and Business Continuity Management of the Payment Systems, in accordance with what is established in Rule 98a. of the Rules.

CHAPTER VII Permanence Requirements

67a. Permanent Compliance with Requirements for Admission as a Participant.- Participants must comply at all times with the requirements referred to in Rules 58a., 68a., 70a., 71a., and 72a. of these Rules.

Compliance with the requirements established in fractions I and II of Rule 58a. of these Rules will not exempt the Participant from responsibility for any damage or impact on the operation of the SPEI derived from attacks on its Technological Infrastructure.

68a. Resources Dedicated to the Protection of Sender Clients.- Participants must maintain at all times their own resources so that, in the event of Transfer Orders Accepted by SPEI that have not been requested by the Sender Clients, they can cover the corresponding losses to these clients, when such losses are determined as the responsibility of the Participant. The amount of resources that Participants must maintain according to this Rule will be calculated and made known in accordance with Annex I of these Rules, for which the capital that Participants maintain in compliance with the provisions that, if applicable, are applicable to them for those effects will be taken into account.

To comply with the obligation referred to in the preceding paragraph, the resources that Participants must maintain in accordance with this Rule must correspond to one or a combination of the following: i) the allocation of resources in an administration trust constituted for these effects, ii) maintenance of the corresponding resources in those corresponding to their capital and capital reserves, or iii) those covered by an insurance policy contracted by the respective Participant that covers it against the events indicated in the same paragraph. The sum of the amounts that Participants maintain in the items indicated in the three previous subsections must be at least equal to the respective amount of resources calculated in accordance with this Rule.

Participants that have the status of securities depository institutions, as well as those referred to in Rule 56a., fractions II, III, and IV of these Rules, are exempt from what is provided in this Rule.

69a. Request for Reduction of Resource Requirement.- Participants whose resource requirement referred to in Rule 68a. of these Rules results in greater than zero may request the Administrator to authorize a lower amount corresponding to said requirement. Participants interested in obtaining the authorization for the aforementioned reduction must present their request to the Administrator through the Operations and Business Continuity Management of the Payment Systems, in accordance with what is established in Rule 98a. of these Rules and with the form established in Appendix W of the Manual.

82 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017

Participants interested in requesting the reduction referred to in the preceding paragraph must accompany their request with the information and documentation they deem sufficient to prove that, derived from: i) the prudential requirements established by the supervisory commissions and those applicable to the operations they carry out by virtue of their nature as a financial entity; ii) the additional technological and operational controls that the participant has implemented, or iii) the capital reserves or additional hedging instruments that the Participant has to face events such as those provided for in Rule 68a. of these Rules, they have sufficient resources to face events of losses, which are determined as the responsibility of the Participant derived from Transfer Orders Accepted by SPEI that have not been requested by the aforementioned Sender Clients.

The Administrator may require additional documentation and information it deems necessary to evaluate the appropriateness of granting the requested authorization.

The Administrator will analyze whether, based on that documentation and information, it is appropriate to grant any reduction in the resource requirement of the Participants and must inform its resolution to the promoting Participants within a period not exceeding thirty Banking Business Days.

In the event that, after the period indicated in the preceding paragraph, the Administrator does not communicate its resolution to the promoting Participants, it will be understood that said request for resource reduction has been denied.

70a. Balances in Client Accounts.- Participants whose financial resources required in terms of Rule 68a. and, if applicable, Rule 69a. of these Rules are greater than zero, who receive resources from their Clients with the sole purpose that these be transferred to Client Accounts in other Participants and who, in accordance with the provisions of the regulation applicable to them, cannot maintain a balance in their Client Accounts, must implement the following scheme regarding balances in Client Accounts:

I. Balance per Client. When the resources that a Client maintains in their Client Account held by the Participant exceed the limit for each Client, the latter must send through the SPEI, in a maximum time of two minutes from when the indicated limit was exceeded, the Sender Client's resources to the accounts of the Beneficiary Clients that this Client has established.

For the purposes of what is provided in the preceding paragraph, the Participant must, prior to being in a position to receive Transfer Orders Accepted by SPEI in a Client Account, collect the information of the Client's Accounts corresponding to Beneficiary Clients to which the Participant must send the corresponding resources to the Transfer Orders Accepted by SPEI that it receives for credit to the Client Account of one of its Clients when the balance per Client referred to is reached.

II. The limit for each Client cited in the previous fraction will be obtained by dividing the amount of financial resources for the protection of Sender Clients that it maintains in terms of Rule 68a. of these Rules by the number of Sender Clients of the Participant.

For the purposes of this Rule, the Participant must send, quarterly to the Administrator, a report of the number of Sender Clients who can instruct Transfer Orders, which will be used for the aforementioned calculation. Said report must be signed by the SPEI compliance officer, addressed to the Operations and Business Continuity Management of the Payment Systems and sent to the Administrator in terms of what is established in Rule 98a. of the Rules.

71a. SPEI Transfer Services.- Participants other than Credit Institutions that offer their Sender Clients the service of electronic transfers through the SPEI, through Electronic Channels, must comply with the requirements provided in this Rule.

I. They must require and provide their Sender Clients with identity verification elements for the execution of operations through Electronic Channels. These elements must be the following:

a) Based on data known only to the Client. They consist of Client data collected by the Participant that are only known to the Client, including biographical information and passwords. Passwords must have a minimum length of: i) four characters for operations instructed through ATMs; and ii) eight characters for operations instructed through the internet;

b) Based on objects possessed only by the Client. They consist of information obtained from, for example, dynamic one-time password generator devices, the chip of a card, or mobile devices pre-registered with the Participant. In case

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 83

that Participants decide to use these identity verification elements through devices whose main function is the generation of dynamic one-time passwords, they must provide said devices to the Clients with whom they agree to carry out Transfer Orders through Electronic Channels;

c) Based on the inherent characteristics of the Client: They consist of information derived from the Client's own (biometric) characteristics, such as live retina scans, live fingerprint scans, facial recognition, among others.

II. To allow the start of a session in Electronic Channels, Participants other than Credit Institutions must request and validate, at least: i. the Sender Client's identifier, which must be unique for each Sender Client and have a minimum length of 6 characters, in the case of the presentation of Transfer Orders through ATMs, the Client identifier may be the debit card delivered by the Participant to the Sender Client; and ii. at least one verification element included in subsections a), b), or c) of fraction I of this Rule.

III. Participants must prevent the screen reading of the identity verification elements used by the Client in Electronic Channels.

IV. Each time the Sender Client intends to instruct a Send Request, they must be asked for a second identity verification element corresponding to those provided in the previous fraction I, in addition to those used for logging into Electronic Channels, with the exception of Send Request instructions for an amount of up to eight thousand pesos, in which the Participant may not require its Sender Clients to use a second verification element.

For the purposes of this Rule, Participants may only provide and require their Sender Clients the identity verification elements provided in Appendix P of the Manual. In the event that any Participant intends to require and provide elements different from those provided in the Manual, it must obtain prior and written authorization from the Administrator, in accordance with the form contained in Annex 1 of said Appendix.

72a. Permanence Requirements in Matters of Additional Risks.- SPEI Participants must observe the following requirements:

I. Collect from Clients who carry out operations through the SPEI, at least, the name, trade name or corporate name, as well as the Unique Population Registry Key (CURP) or the Federal Taxpayer Registry (RFC) with homoclave for natural persons and the RFC with homoclave for legal entities, the latter except in the case that Clients by their nature cannot have these data, and must include this information in the Send Requests that Sender Clients present, and

II. Notify the Administrator regarding the imposition of any sanction provided for in Rule 58a., fraction V, first paragraph, subsection a), of these Rules, by its supervisory commission, no later than the fifth Banking Business Day following that in which the Participant receives the notification of said sanction. The notification to the Administrator must indicate the impact that the conduct observed by said commission could cause in the compliance with the requirements established in these Rules and must be signed by the SPEI compliance officer. The Participant must send the notification in the terms established in Rule 98a. of these Rules.

What is specified in fraction I of this Rule will not be applicable to those Client Accounts in which the Provisions do not require Participants to collect the aforementioned information.

73a. Functions of the SPEI Compliance Officer.- Each Participant, while maintaining said status, must maintain at all times the SPEI compliance officer referred to in Rule 59a. of these Rules, to whom it must entrust, at least, the following functions:

I. Submit an annual written report, in the month of July, to the audit committee if the Participant has such a committee, containing the findings and, if applicable, irregularities and non-compliance with the internal SPEI rules, as well as with the other applicable SPEI regulations, the actions adopted to correct them and the degree of progress and efficiency of such actions. Additionally, it must send a copy of the report referred to in this fraction and the receipt confirmation by the Participant's audit committee to the Administrator, through the Operations and Business Continuity Management of the Payment Systems, no later than the fifteenth Banking Business Day following that in which it has submitted the mentioned report to said committee. The obligation to deliver the report referred to in this fraction will begin after one hundred eighty natural days have passed from the date on which they were admitted as Participants, in accordance with Rule 64a. of these Rules, and

II. Prepare a written report when it detects any irregularity or non-compliance with the internal SPEI rules, no later than the Banking Business Day following that in which said irregularity or non-compliance is detected. In the event that the SPEI compliance officer reports directly to the Participant's compliance officer, it must present said report to the latter. In case that, in accordance with what is provided in Rule 59a. of these Rules, the SPEI compliance officer is the same as the Participant's compliance officer, the mentioned report must be presented to the audit committee. In the latter case, if the Participant does not have an audit committee, the report must be presented to the general director or equivalent and to the Administrator in the terms established in Rule 98a. of these Rules.

In case any Participant replaces the person it has designated as the SPEI compliance officer, said Participant must make the Administrator aware of this situation, through a written document sent to the Operations and Business Continuity Management of the Payment Systems, no later than the fifth Banking Business Day counted from that in which the situation occurs. Likewise, the Participant must inform the Administrator about the designation of the new responsible person no later than the tenth Banking Business Day following this appointment, in terms of what is established in Rule 60a. of these Rules.

The reports and notifications referred to in this Rule must be presented to the Administrator in the terms established in Rule 98a. of these Rules.

74a. Periodic Report and Evaluation.- Each Participant must verify compliance with the information security, operational risk management, and protection of Sender Clients, Additional Risks, and interoperability requirements to operate in the SPEI established in Rule 58a. of these Rules, through reviews carried out every two years in an alternating manner by the head of the internal audit area of the Participant itself and the Independent External Auditor(s) in the immediate next evaluation period. Such reviews must observe what is provided in fractions II and III of Rule 62a. of these Rules. In case the Participant does not have an internal audit area, it must carry out the aforementioned reviews in all cases by Independent External Auditors.

The report must be delivered to the Administrator and presented to the Participant's audit committee, when it has one, in which case it must also send the Administrator the confirmation of the presentation of the report to this committee.

The report and confirmation referred to in the preceding paragraph must be sent through the Operations and Business Continuity Management of the Payment Systems in terms of what is established in Appendix N of the Manual, within sixty natural days following the closing of the exercise in question.

The Participant may not contract the services of an Independent External Auditor or Firm to obtain the evaluation referred to in this Rule for more than three consecutive evaluation periods. Without prejudice to the foregoing, the Participant may designate the same Independent External Auditor and/or Firm again after a minimum interruption of five years counted from the last evaluation it had granted regarding said Participant.

What is provided in this Rule is exempted for trusts in which the Bank of Mexico acts as trustee and international systems for the settlement of foreign exchange operations that include the peso as one of the participating currencies.

75a. Compulsory Compliance Plan.- In case that, derived from the review that the Administrator carries out on a Participant or from the results of the Independent External Auditor, the Administrator detects irregularities or non-compliance with the internal SPEI rules, it may require the Participant to present a compulsory compliance plan in which the actions that the Participant obligates itself to adopt to correct the detected irregularities or non-compliance are provided, as well as the period in which they will be carried out and the responsible persons for the attention of each of them. To this effect, the Participant must submit the compulsory compliance plan for the approval of the Administrator, through the Authorizations, Regulation and Sanctions Management.

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 85

In the plan referred to in this Rule, the Participant must designate the Independent External Auditor to whom it will entrust following up on actions aimed at correcting the irregularities or non-compliance referred to in the previous paragraph, as well as to inform the Administrator, in the terms established in the compulsory compliance plan itself, of the degree of progress and efficiency of the adopted actions.

The Administrator may request the Participant to modify the compulsory compliance plan project presented by the Participant and will grant a period not exceeding ten Banking Business Days to attend to them.

When the Administrator determines that the modifications were not attended to, the compulsory compliance plan will be considered not presented and the corresponding sanctions will be imposed.

Once the compulsory compliance plan is approved, the Administrator may request the Participant, at any time, additional information regarding the compliance with the mentioned plan and, if applicable, request adjustments to said plan when it detects that any of the measures contained in this present have deviations, that they are not achieving an effective correction of the irregularity or non-compliance, or that the Participant could incur in another irregularity or non-compliance or in a possible affectation to the payment systems, the financial system or the users of the SPEI services.

In the event that the compulsory compliance plan is not carried out in the terms approved by the Administrator, the Participant must, until it complies, to the satisfaction of the Administrator, with what is provided in said plan, comply with the resolution that, if applicable, is issued by the Bank of Mexico, in which it may restrict the making of withdrawals and credits of the Client Accounts that the Participant holds for its Clients, through Electronic Interbank Fund Transfer Orders through the SPEI, suspend the Participant's operations in the SPEI, or revoke the authorization granted to said Participant to act with such character.

What is provided in this Rule will be applicable without prejudice to the sanctions that correspond in terms of the applicable provisions.

CHAPTER VIII Independent External Auditors

76a. Hiring of Independent External Auditors.- Interested parties must hire the services of an Independent External Auditor, for the evaluation of the level of compliance that they give to the requirements referred to in the 58a. of these Rules.

What is provided in this rule is excepted for trusts administered by the Bank of Mexico and international systems for the settlement of foreign exchange operations that include the peso as one of the participating currencies.

77a. Independence Requirements.- Independent External Auditors that evaluate the level of compliance that interested parties and Participants give to the requirements referred to in these Rules, as well as the respective Firms to which they belong, must be independent on the date of celebration of the service provision contract and during the development of the audit. It will be considered that there is no independence when the person or the Firm in question is located in any of the scenarios referred to in article 189, fractions I to VI, IX and X, of the "General provisions applicable to credit institutions", issued by the CNBV, as well as in the following:

I. The Independent External Auditor, the Firm in which it works or any partner or employee thereof, provides to the interested party or Participant, in addition to the evaluation, any of the following services:

a) Consulting on the elaboration of processes, procedures, policies and criteria, as well as the systems that the interested party or Participant must have to comply with the requirements referred to in these Rules;

b) Direct or indirect operation of the financial information systems of the interested party or Participant, respectively, or administration of its local network;

c) Supervision, design or implementation of the computer systems (hardware and software) of the entity, which carry out activities for the operations that the interested party or the Participant carry out through the SPEI;

d) Administration, temporary or permanent, participating in the decisions of the interested party or Participant;

e) Internal audit relative to the evaluation of the level of compliance of the requirements referred to in these Rules;

86 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017

f) Recruitment and selection of personnel of the interested party or Participant to occupy positions of general director or of the two immediate lower levels to the latter, and

g) Any other that implies or could imply conflicts of interest with respect to the external audit work, and

II. The income that the Independent External Auditor receives or will receive for carrying out the evaluation of the interested party or Participant, depends on the result of the evaluation itself or on the success of any operation carried out by the interested party or Participant itself that has as support the certification of the Independent External Auditor.

CHAPTER IX Disincorporation

78a. Voluntary Disincorporation.- The Participant may request the Administrator, through the Business Operation and Continuity Management of the Payment Systems, its authorization to cease acting as a Participant. The said request must be presented in writing to the Business Operation and Continuity Management of the Payment Systems, at least one Banking Business Day in advance of the date on which the Participant intends for its disincorporation as a Participant to take effect.

Such writing must be presented in terms of what is established in the 98a. of these Rules.

79a. Mergers.- When two or more Participants carry out or decide to merge into a single legal entity, the rights and obligations of each of the merged Participants will be maintained by the legal entity constituted as a Participant of the SPEI.

80a. Disincorporation derived from authority action.- Upon the revocation of the authorization or total suspension of the activities carried out by a legal entity that acts as a Participant in the SPEI that is dictated by the competent financial or judicial authorities, the Administrator will initiate the disincorporation procedure of said legal entity from the SPEI.

81a. Suspension or revocation.- The Administrator may suspend a Participant from the SPEI, prior to the evaluation it carries out of the severity of the non-compliance in which it has incurred; of the potential effects of its suspension on the correct functioning of the payment systems and the stability of the financial system, as well as the probable relevant affectations to the users of the SPEI services. In addition, in the event that the Bank of Mexico determines to revoke the authorization granted in terms of Circular 13/2017, the Administrator will revoke the admission granted to said Participant in terms of these Rules.

CHAPTER X Obligations on service levels, information and compensation for Clients

82a. Service Availability.- Participants who hold Client Accounts and who, in turn, have agreed with said Clients to process, as Issuing Participants and charged to said accounts, the Send Requests that they transmit to such Clients, must provide the service at least in the annual availability indices defined in section 5 of the Manual.

83a. Information of Transfer Orders Accepted by SPEI.- The Issuing Participant and the Receiving Participant of the same Transfer Order Accepted by SPEI must provide to the Clients, in accordance with what is established in the 84a. of these Rules, the following information regarding said Transfer Order Accepted by SPEI:

I. Regarding the Issuing Participant, it must provide to the Issuing Client who transmitted the Send Request the following information.

a) The denomination of the Receiving Participant that corresponds according to the SPEI catalog in force at the moment when the Transfer Order was settled;

b) The calendar date and time when the Transfer Order was settled, including minutes and seconds;

c) The amount of the Transfer Order;

d) The CLABE, the debit card number or the mobile phone line number indicated in the Transfer Order to identify the respective Client Account corresponding to the Beneficiary Client;

e) Name, denomination or corporate name of the respective beneficiary, as it remained indicated by the Issuing Client in the respective Send Request, followed by the following phrase: "(Data not verified by this institution)";

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 87

f) The information of the Tracking Key field indicated for the Transfer Order, presented in the same format in which the Issuing Participant sent it to the Administrator;

g) The information of the Numerical Reference field indicated for the Send Request that, if applicable, was provided by the Issuing Client, and

h) If applicable, the information of the Payment Concept field indicated for the Send Request.

II. Regarding the Receiving Participant, it must provide to the Beneficiary Client the information indicated in letters b), c), f), g) and h) of the previous fraction I, as well as the following information:

a) The denomination of the Issuing Participant that corresponds according to the SPEI catalog in force at the moment when the Transfer Order Accepted by SPEI is received;

b) The CLABE, corresponding to the Client Account corresponding to the Issuing Client who presented the Send Request to the Issuing Participant, and

c) The name, denomination or corporate name of the person that the Issuing Participant indicated in the Transfer Order Accepted by SPEI as the holder of the Client Account referred to in the previous letter b).

III. Participants must present the information provided in fractions I and II of this Rule in an identical manner to that presented in terms of these Rules.

84a. Form of making information relative to Transfer Orders Accepted by SPEI known.- The Issuing Participants and the Receiving Participants referred to in the previous Rule must make known to the Clients the information indicated in said Rule, in accordance with the following:

I. During the first fifteen natural days following that in which each calendar month concludes, Participants must send to Issuing Clients or Beneficiary Clients, respectively, free of charge, to the respective domiciles that they have provided, the information referred to in the previous Rule for each of the Transfer Orders Accepted by SPEI that have been carried out during said month;

II. As an exception to what is provided in the previous fraction, Participants will not be obliged to send the information in the form indicated in said fraction in case they include that same information in the account statement that they periodically issue to their Clients in accordance with the applicable provisions;

III. In addition to what is provided in the previous fractions, Participants must include the information referred to in the previous Rule in the same means that they have made available to their respective Clients so that they present Send Requests and said means, in turn, allow them to consult the detail of the movements of the respective Client Accounts that they hold. Regarding this, Participants must include said information in the referred means, at the latest at the close of the SPEI operation day, determined in accordance with section 3 of the Manual, the immediate next one to that in which the Transfer Order in question has been settled, as well as keep it for consultation in said means for a period not less than two months subsequent to that in which the mentioned settlement has been carried out. Participants will be exempted from including the referred information when Issuing Clients have presented the Send Requests through automated teller machines;

IV. In case the Transfer Order Accepted by SPEI has not been credited, the Receiving Participant must make available to the Beneficiary Client the information referred to in fraction II of the 83a. of these Rules through a means accessible to the Beneficiary Client;

V. The Receiving Participant must establish a means to attend to information requests from its Beneficiary Clients of Transfer Orders Accepted by SPEI on which the Administrator has made available to it through the SPEI the respective Settlement Notice. In this means the Participant must inform its Beneficiary Clients, if applicable, the reasons why the amounts corresponding to the cited Transfer Orders Accepted by SPEI have not been credited in their respective Client Accounts. The Participant must provide this information free of charge for the referred Client, and

88 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017

VI. They must include on their website a page, and put an electronic link to it through the Electronic Channels, with the exception of automated teller machines, that they make available to their Clients, in which they detail the procedure that their Clients must follow for the purpose of presenting clarification requests, queries on the status or complaints related to a Send Request or Transfer Order Accepted by the SPEI.

85a. Access to Electronic Payment Receipts.- The Participants referred to in the 82a. of these Rules who have agreed with those Clients referred to in the mentioned Rule to carry out operations through Electronic Channels, must include on the website of the internet portals that they make available to them for the consultation of movements of the corresponding accounts, as well as in the Electronic Channels corresponding to a telecommunications mobile device, for each Transfer Order Accepted by SPEI and in all the consultations that provide for these Transfer Orders, the electronic link built in accordance with Appendix E of the Manual, so that their Clients can consult, either the status of their respective Transfer Orders or, in case these have been credited to the corresponding Beneficiary Clients, generate the Electronic Payment Receipts of said Transfer Orders.

Participants must put the electronic link referred to in the previous paragraph at the disposal of the corresponding Clients at the latest five minutes following that in which the Administrator has made available to them through the SPEI the Settlement Notice regarding the Transfer Order Accepted by SPEI in question.

With respect to each Transfer Order Accepted by SPEI that the Participant shows to its respective Clients in accordance with what is provided in this Rule, said Participant must include directly on the Bank of Mexico portal, in case the Client in question accesses said portal through the link provided by the Participant itself in accordance with the first paragraph of this Rule, the following information:

I. The calendar date on which the respective Transfer Order was settled;

II. The information of the Tracking Key or Numerical Reference field, if applicable, specified by the Client, that corresponded to the Transfer Order Accepted by SPEI in question;

III. The denomination of the Issuing Participant and the Receiving Participant that corresponds according to the SPEI catalog in force at the moment when the Transfer Order Accepted by SPEI was settled;

IV. The CLABE, the debit card number or the mobile phone line number indicated in the Transfer Order Accepted by SPEI to identify the respective Client Account corresponding to the Beneficiary Client, and

V. The amount of the Transfer Order Accepted by SPEI.

86a. Payment of compensation for delay.- Each Participant must pay the Client the amounts referred to in the following fractions, without prejudice to the other payments it must make in accordance with these Rules, when it is located in the following scenarios:

I. In case the Issuing Participant fails to comply with any of the deadlines indicated in the 17a., 27a. or 31a. of these Rules, it must pay the amount that results in accordance with what is provided in the 87a. of these Rules. The Participant must credit, at the latest at the close of the operation day of the SPEI immediate next to that in which the non-compliance in question occurred, said amount in the same Client Account corresponding to the Issuing Client who presented the Send Request of the Transfer Order in question;

II. In case the Receiving Participant has failed to comply with the deadline provided in the 19a. and 30a. of these Rules, said Participant must pay the amount that results in accordance with what is provided in the 87a. of these Rules. In this scenario the Participant must credit, at the latest at the close of the operation day of the SPEI immediate next to that in which the non-compliance in question occurred, said amount in the same Client Account corresponding to the Beneficiary Client of the Transfer Order in question, and

III. In case the Receiving Participant has failed to comply with the deadline provided in the 25a. of these Rules, said Participant must pay to the Issuing Participant of the Transfer Order subject to the

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 89

return, the amount that results in accordance with what is provided in the 87a. of these Rules. In this scenario, the Receiving Participant must send a Transfer Order of the return type to the Issuing Participant, for an amount equal to the sum of the original amount plus the amount resulting in accordance with what is provided in the 87a. of these Rules. The Issuing Participant will be obliged to credit the amount of the cited Transfer Order of the extemporaneous return type to the Issuing Client who instructed the Transfer Order subject to the return.

In the event that any non-compliance provided in this Rule prolongs, at least, to the operation day of the SPEI that is subsequent to that in which the applicable deadline has expired in each scenario, said Participant must pay the amount that results greater between:

I. Two hundred ninety pesos, or

II. The result that is obtained by multiplying by two the quantity that results from the calculation of the reference amount referred to in the first paragraph of the 87a. of these Rules.

87a. Calculation of amounts.- To calculate the amount referred to in the previous Rule, the Participant must first calculate a reference amount in the following way: i. multiply the Bank of Mexico Weighted Funding Rate, closed to four decimals, made known by the Bank of Mexico on the Banking Business Day previous to that in which the non-compliance occurs, by the amount of the Transfer Order in question, including cents; ii. multiply the result by the number of minutes of delay, excluding seconds, and iii. divide the obtained result by 518,400. The amount will be the result of closing to two decimals the quantity obtained from this division.

88a. Collection of commissions.- Participants may not charge each other commissions for the sending, receiving, return or crediting of Transfer Orders. Likewise, Receiving Participants are prohibited from charging Beneficiary Clients any commission.

89a. Information relative to Participant failures.- In those cases where the Technological Infrastructure of a Participant presents an event that affects the services related to the SPEI that it provides to its Clients, Participants must notify their respective affected Clients, by the means that the Participant has agreed with these Clients or, in case of not having agreed on any means, by the means through which Issuing Clients instruct Send Requests during said event, that the failure originated in its Technological Infrastructure at the latest within sixty seconds following that the referred event occurs, the above subject to the fact that the failure has not affected the communication channels necessary to carry out the mentioned notification. In case the mentioned channels have been affected, the notification must be carried out as soon as the respective channels are restored.

CHAPTER XI SPEI Fees

90a. Fee for use of SPEI.- The Participant must pay the Administrator for the use of the SPEI, in each month, at the latest on the tenth Banking Business Day of the immediate next month to that to which it corresponds, a fixed fee described in this Rule that will allow it to send any amount of Transfer Orders and receive any amount of Transfer Orders Accepted by the SPEI, provided that this does not affect the good functioning of the system. Likewise, it must pay, in each month, at the latest on the tenth Banking Business Day of the immediate next month to that to which it corresponds, a fee for operations related to the number of transfer requests sent, returns received, Transfer Orders sent to the CLS and bytes retransmitted.

The fee for operations referred to in the previous paragraph that each Participant must pay to the Administrator, will be that which the Administrator calculates based on the number of said operations carried out in the SPEI by the Participant during the month that corresponds, according to the tariffs for operation that the Administrator informs it through electronic communication that it directs to the email addresses that the Participant has made known to the Administrator in accordance with the model contained in the Manual at the latest on the last Banking Business Day of the month of November of the immediate next year to that in which Participants must carry out the payment of the fees.

The Administrator will inform each Participant through electronic communication that it directs to the email addresses that the Participant has made known to the Administrator in accordance with the model contained in the Manual, the amount corresponding to the fee for operations that will result for it

90 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017 applicable in accordance with what is provided in this Rule, no later than the fifth Banking Business Day of the month in which it made the calculation of said fee. Except for what is provided in rules 92a. and 93a. of these Rules, the fixed fee that each Participant, in accordance with what is provided in the first paragraph of this Rule, must pay during the same calendar year will be equivalent to the result of dividing by twelve the amount of the annual fixed fee corresponding to each Participant that the Administrator calculates and makes known in the previous year, as follows: I. The annual fixed fee referred to in the previous paragraph will be equivalent to the result of applying the percentage corresponding to the relative participation of each Participant to the amount determined by the Administrator, based on its own criteria and forecasts, as the global cost of operation and maintenance of the SPEI, plus provisions for investments in new SPEI projects and renewal of equipment and programs, for the year immediately following that in which the calculation is made. For the purposes of the previous paragraph, the Administrator will calculate the relative participation of each Participant, as the proportion, expressed as a percentage, that represents: i. the number of Transfer Orders Accepted by SPEI sent by the corresponding Participant during the five Calculation Periods prior to the month in which the calculation is made, with respect to ii. the total number of Transfer Orders Accepted by SPEI sent by all Participants during those same Calculation Periods, and II. The Administrator will inform each Participant, through electronic communication addressed to the email addresses that the Participant has made known to the Administrator in accordance with the model contained in the Manual, the amount corresponding to the annual fixed fee that will be applicable to it in accordance with what is provided in this Rule, no later than the last Banking Business Day of the month of November of the year immediately preceding that in which the Participants must make the payment of the fixed monthly fees. The Participant will be obliged to confirm to the Administrator the receipt of the communications referred to in this Rule, no later than the second Banking Business Day following the receipt of the corresponding communications and through the means by which the Administrator has made the respective communications known to it. In the event that the Participant does not make the confirmation in the terms described, it will be obliged to send a duly authorized representative to pick up the communication at the office of the Business Operation and Continuity Management of the Payment Systems. 91a. Payment of fixed fee in case of merger.- In the event that two or more Participants carry out a merger, the Participant resulting from said merger must pay to the Administrator, from the date on which the merger takes effect until the last day of the corresponding calendar year, the fixed fees corresponding to each of the Participants that have merged. The Administrator will calculate the relative participation of the Participant resulting from the merger referred to in the previous paragraph, corresponding to the year immediately following that in which the merger took effect, in accordance with what is provided by rule 90a. of these Rules and for said calculation it will use the total number of Transfer Orders Accepted by the SPEI sent by the Participants that have merged. 92a. Fee for use of SPEI for new Participants.- In the event that an interested party acquires the status of Participant after the start of a calendar year, it must pay to the Administrator for the use of the SPEI in each month, during that year and until the month of December immediately following the conclusion of the first Calculation Period in which such person has maintained the status of Participant, the fee that results from adding: i. the fee for operations determined in accordance with the second paragraph of rule 90a. of the Rules, plus ii. the fee that results from the following calculation: I. The Administrator will calculate, during the first ten Banking Business Days of each month, the relative monthly participation of said Participant in the month immediately preceding, as the proportion, expressed as a percentage, that represents: i. the number of Transfer Orders Accepted by SPEI sent by the corresponding Participant during the month immediately preceding that in which the calculation in question is made, with respect to ii. the total number of Transfer Orders Accepted by SPEI sent by all Participants during that same month, and II. The percentage obtained as a result of the calculation referred to in the previous subsection will be applied to the result of dividing by twelve the amount determined by the Administrator, based on its own tue july 4 2017 official gazette (first section) 91 criteria and forecasts, as the global cost of operation and maintenance of the SPEI, plus provisions for investments in new SPEI projects and renewal of equipment and programs, for the year corresponding to that in which the calculation is made. The Administrator will inform each Participant through electronic communication addressed to the email addresses that the Participant has made known to the Administrator in accordance with the model contained in the Manual, the amount corresponding to the fee that will be applicable to it in accordance with what is provided in this Rule, no later than the fifth Banking Business Day of the month in which it made the calculation of said fee, and the Participant must pay the Administrator the referred fee no later than the tenth Banking Business Day of the month in which the Administrator has informed it. The Participant will be obliged to confirm to the Administrator the receipt of the communications referred to in this Rule, no later than the second Banking Business Day following the receipt of the corresponding communications and through the means by which the Administrator has made the respective communications known to it. In the event that the Participant does not make the confirmation in the terms described, it will be obliged to send a duly authorized representative to pick up the communication at the office of the Business Operation and Continuity Management of the Payment Systems. 93a. Transitional fee for Participants in the SPEI.- With respect to those Participants that maintain that status in the SPEI during the first four Calculation Periods, they must pay to the Administrator, from the start of the year following the conclusion of the first Calculation Period during which they have maintained the status of Participant and until the month of December corresponding to the fourth Calculation Period, the fee that results from adding: i. the fee for operations performed determined in accordance with the second paragraph of rule 90a. of the Rules, plus ii. the fee for operations performed resulting from dividing by twelve the amount of the annual fixed fee calculated in accordance with the following: I. The result of applying the percentage corresponding to the relative participation of each Participant to the amount determined by the Administrator, based on its own criteria and forecasts, as the global cost of operation and maintenance of the SPEI, plus provisions for investments in new SPEI projects and renewal of equipment and programs, for the year immediately following that in which the calculation is made. II. For the purposes of the previous subsection, the Administrator will calculate the relative participation of each Participant, as the proportion, expressed as a percentage, that represents: i. the number of Transfer Orders Accepted by SPEI sent by the corresponding Participant during the Calculation Periods from when it acquired the status of Participant until the month prior to that in which the calculation of the annual fixed fee in question is made, with respect to ii. the total number of Transfer Orders Accepted by SPEI sent by all Participants during that same period. The Administrator will inform the amount equivalent to the annual fixed fee applicable to each Participant in the terms provided in rule 90a., subsection II of these Rules. The Administrator will inform each Participant, through electronic communication addressed to the email addresses that the Participant has made known to the Administrator in accordance with the model contained in the Manual, the amount corresponding to the monthly variable fee that will be applicable to it in accordance with what is provided in this Rule, no later than the fifth Banking Business Day of the month in which it made the calculation of said fee. The Participant will be obliged to confirm to the Administrator the receipt of the communications referred to in this Rule, no later than the second Banking Business Day following the receipt of the corresponding communications and through the means by which the Administrator has made the respective communications known to it. In the event that the Participant does not make the confirmation in the terms described, it will be obliged to send a duly authorized representative to pick up the communication at the office of the Business Operation and Continuity Management of the Payment Systems. 94a. Adjustment of fees for surpluses.- In the event that, as a result of the calculation and payment of the fees referred to in rules 90a., 92a. and 93a. of these Rules, the sum of the fees paid by all Participants is greater than the global cost of operation and maintenance of the SPEI, the Administrator will deduct the corresponding excess amount from the global cost of operation and maintenance of the SPEI for the next Calculation Period. 95a. Payment of the annual fixed fee in a single payment.- A Participant may, at its option, make the payment of the fixed fee as indicated in the first paragraph of rule 90a. of these Rules, or rather, 92 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017 make the payment of said fee in a single annual payment no later than the tenth Banking Business Day of the month of February of the year to which the Calculation Period corresponds. To this effect, the Participant must send a communication addressed to the Business Operation and Continuity Management of the Payment Systems, no later than the last business day of the month of January of the year to which the annual fixed fee corresponds, in accordance with the form established in Appendix S of the Manual and in the terms described in rule 98a. of these Rules. 96a. Participants who withdraw during the current year.- The fees pending to be applied to Participants who withdraw during the course of a calendar year, which have not been covered, will be considered in the fee calculation of the following period. 97a. General considerations for the collection of fees.- The fees that the Administrator charges Participants for Transfer Orders of the type return and late return, will be borne by the Issuing Participant of the original Transfer Order. CHAPTER XII Sending communications to the Administrator 98a. Sending digital communications to the Administrator.- The communications referred to in rules 37a., 40a., 46a., 53a., 55a., 57a., 60a., 66a., 69a., 70a., 72a., 73a., 74a., 78a., 95a., and Annex I of these Rules must be sent by Participants via email to the Payment Systems Service Center in accordance with what is established in section 5 of the Manual. Such communications must be digitally signed by the persons corresponding in accordance with what is stated in each Rule, which must be registered in the catalog of personnel that the Participant authorizes to carry out the management of operations and various requests to operate with the Bank of Mexico, in accordance with the procedure established in Appendix T of the Manual. It is the responsibility of Participants to keep the catalog referred to in the previous paragraph updated at all times. The persons who sign the communications must: I. Have a valid Digital Certificate issued in their name, and II. Sign the communications digitally using the tool that the Administrator determines for these purposes and which it makes known to Participants, as well as the Digital Certificate referred to in subsection I of this Rule. In cases where the Participant does not have access to the necessary elements to send the digitally signed requests, it may deliver to the Business Operation and Continuity Management of the Payment Systems the communications in original, in duplicate, and signed by persons whose signature has been previously registered with said Management for the management of operations and various requests to operate with the Bank of Mexico, adding a communication in which they specify the reason why they find themselves in the need to send communications by this alternative means. 99a. Providing information to the Administrator.- Participants must provide to the Administrator, in the terms and deadlines that it indicates, the information and documentation related to any aspect related to the operation of the SPEI that the Administrator requires from it in writing. CHAPTER XIII Confidentiality of information 100a. Confidentiality of information by the Participant.- Participants must keep strict confidentiality regarding all information, whether expressed in oral, written, graphic, electronic or any other form, that is provided to them by the Administrator by reason of their operation in the SPEI. Participants must use the information exclusively for the purposes provided in these Rules. Likewise, Participants are obliged to give access to the information only to the persons necessary for the compliance with these Rules and will be responsible for the use that their personnel, representatives, administrators, directors, employees, agents, dependents or any person related to the Participant, make of the aforementioned information. The obligation provided in this Rule will continue to be applicable to Participants even if they cease to act with such status. tue july 4 2017 official gazette (first section) 93 The Participant will be obliged to hold the Administrator harmless from any liability in which it incurs, which could be, among others, civil, commercial, or any other, as well as for the damages and losses that it could cause to the Administrator or to third parties. ANNEX I DETERMINATION OF THE AMOUNT OF RESOURCES FOR THE PROTECTION OF ISSUING CLIENTS The amount of resources that each Participant “p” must maintain in accordance with what is provided in rule 68a. of these Rules must be equal to the value of the element denoted as Yp that results from the calculation made in terms in the following equation: Yp = max {kp * α * GTp – CapRelp, 0} The elements of the previous equation will be calculated in accordance with the following: kp: is equivalent to the factor related to the probability of default and the severity of the loss of a fraud event of Participant “p”, calculated in accordance with the following equation: k p = max {Reg j , Op p } In turn, the elements of the previous equation will be calculated in accordance with the following: Regj : is equivalent to the factor determined by the Administrator for each type of Participant (denoted “j”), taking into account the regulatory requirements applicable to the Participant in question, relative to corporate governance, investments, external audits, operation by electronic means, operational risk, information security and accounting standards, which could mitigate the fraud risk to which said Participant could be exposed. To this effect, the values of the factor Regj corresponding to each type of Participant will correspond to those specified in Appendix U of the Manual. Opp : corresponds to the value calculated in accordance with the following equation: Opp = min {Mp , 1} In turn, the elements of the previous equation will be calculated in accordance with the following: Mp : is equivalent to the value calculated in accordance with the following equation: Mp = GTp / Participant p Assets In turn, the elements of the previous equation will correspond to the following: GTp: is equivalent to the daily average of the amounts of all transfers instructed by the Issuing Clients of Participant “p” during the calendar year immediately preceding that in which the calculation of the amount of own resources referred to in rule 68a. of these Rules is made. Participant p Assets: is equivalent to the sum of the assets of Participant p” registered in its most recent financial statements at the date on which the calculation of the amount of own resources referred to in this Annex is made. α: is equivalent to the factor specified in Appendix U of the Manual. GTp: is equivalent to the respective value calculated in accordance with what is established above. CapRelp: corresponds to the amount of the net capital of Participant “p”, or the equivalent according to the type of Participant, denominated as “Relevant Capital” for the purposes of the calculation provided in this Annex. Regarding this, the calculation of the amount corresponding to the Relevant Capital referred to must be carried out in accordance with the following equation: CapRelp = CapRegp – ReqCapp + CapRiesgoOpp The elements of the previous equation will be calculated in accordance with the following: CapRegp : is equivalent to the amount of net capital of Participant “p” or that other particular type of capital that, according to the type of Participant, it must maintain in accordance with the applicable provisions. 94 (First Section) OFFICIAL GAZETTE Tuesday, July 4, 2017 ReqCapp: is equivalent to the sum of amounts corresponding to the capital requirements that, in its case, Participant “p” must maintain in accordance with the applicable provisions to that effect. CapRiesgoOpp: is equivalent to the amount corresponding to the capital requirements for operational risk that, in its case, Participant “p” must maintain in accordance with the applicable provisions to that effect. For the purposes of the calculation of the amount of own resources referred to in rule 68a. of these Rules, Participants must report to the Administrator the following information in the deadlines indicated below: I. The amount of its net capital or that other particular type of capital that, according to the type of Participant, it must maintain in accordance with the applicable provisions that, in its case, the Participant in question reports to the decentralized body of the Ministry of Finance and Public Credit in charge of its supervision (supervisory commission) at the close of the last day of the calendar quarter preceding that which corresponds to the calculation of the own amounts referred to in this Annex. In case the Participant modifies and retransmits said data to its supervisory commission, it must retransmit the new information to the Administrator. When the Participant is not obliged to report to any supervisory commission the referred information, it must report to the Administrator the amount of capital corresponding to the most recent financial statements of the Participant at the month in which the calculation of the own amounts referred to in this Annex is made. II. The amounts corresponding to the capital requirements for operational risk, credit, market and the others that, in its case, result applicable to the Participant in question in accordance with the applicable provisions, corresponding to those that the Participant is obliged to maintain at the close of the last day of the calendar quarter in question. III. The amount of its total assets, which will correspond to that which the respective Participant reports to its supervisory commission at the close of the last day of the calendar quarter in question. In the event that the Participant modifies or retransmits said data to its supervisory commission, it must retransmit the new information to the Administrator. When the Participant is not obliged to report to any supervisory commission the referred information, it must report to the Administrator the respective amount registered in the most recent financial statements of the Participant at the month in which the calculation of the own amounts referred to in this Annex is made. Participants must present to the Administrator the information previously referred to within the first fifteen Banking Business Days following the expiration of the immediately preceding calendar quarter, through the Business Operation and Continuity Management of the Payment Systems in the terms established in rule 98a. of these Rules and in accordance with the form established in Appendix V of the Manual. The Administrator will perform, for each Participant, the calculation of the value Yq on a quarterly basis. In the event that said value results greater than zero, the Administrator will inform it to the Participant in question, through electronic communication addressed to the email addresses that the Participant has made known to the Administrator in accordance with the model contained in the Manual, the amount corresponding to the financial resource requirement that will be applicable to it in accordance with what is provided in rule 68a. of these Rules, calculated in terms of this Annex, no later than the twentieth Banking Business Day of the month in which it made the calculation of said amount. The Participant must prove to the Administrator, within a maximum period of five Banking Business Days from the receipt of the notification from this, that it complies with the amount of resources referred to. To this effect, the Participant must send to the Administrator, through the Business Operation and Continuity Management of the Payment Systems in the terms established in rule 98a. of these Rules, the documentation in which the constitution of the required resources is demonstrated, by means of the instruments mentioned in the second paragraph of Rule 68a. TRANSITIONAL PROVISIONS FIRST. These Rules will enter into force on the tenth Banking Business Day following the date of their publication in the Official Gazette of the Federation, except for what is provided in the following Transitional Articles. Upon the entry into force of these Rules, the “Rules of the Interbank Electronic Payment System”, issued by

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 95

the Bank of Mexico by means of Circular 17/2010 published in the Official Gazette of the Federation on June 15, 2010 and its modifications made known through Circulars 24/2011, 4/2013, 6/2014, 20/2014, 2/2015, 4/2015 and 13/2015, published in said Gazette on December 2, 2011, December 6, 2013, April 29, 2014, December 12, 2014, January 16, 2015, March 6, 2015 and August 31, 2015, respectively.

The references contained in other provisions or rules of the Bank of Mexico or of any other authority to the Rules cited in the preceding paragraph shall be understood as made to the Rules contained in this Circular.

SECOND.- The provisions of the 11th, fraction III, first paragraph, of these Rules regarding the obligation of Participants to allow their Issuer Clients to submit Sending Requests 24 hours a day, 365 days a year, with respect to Sending Requests from Issuer Clients of Participants that have the status of Credit Institutions or that are sent through Clearing Houses for Transfers via Mobile Devices, corresponding to Low-Value Transfer Orders formulated through Electronic Channels, including those corresponding to the internet electronic banking service, shall enter into force on December 29, 2017.

From the entry into force of these Rules until the date indicated in the preceding paragraph, those entities that retain the status of Participant pursuant to the Tenth Transitory Article and that fall under the scenario contemplated in subsection c Bis) of numeral 3.1 of the 3rd of the Rules indicated in the second paragraph of the First Transitory Article shall observe the provisions of said subsection in terms of the provisions of these Rules in force during the referred period that are applicable to that effect.

THIRD.- The provisions of the 19th, fraction II, first paragraph, of these Rules, regarding the obligation of the Receiving Participant, which has the status of a Credit Institution or a Clearing House for Transfers via Mobile Devices, to credit Accepted Transfer Orders by SPEI corresponding to a Low-Value Transfer Order, 24 hours a day, 365 days a year, within the timeframes indicated in said fraction, shall enter into force on December 29, 2017.

From the entry into force of these Rules until the date indicated in the preceding paragraph, those entities that retain the status of Participant pursuant to the Tenth Transitory Article and that fall under the scenario contemplated in subsection a), fraction II, of the 6th of the Rules indicated in the second paragraph of the First Transitory Article above shall observe the provisions of said fraction in terms of the provisions of these Rules in force during the referred period that are applicable to that effect.

FOURTH.- The provisions of the 25th, fraction III, first paragraph, of these Rules, regarding the obligation of Receiving Participants that have the status of a Credit Institution or a Clearing House for Transfers via Mobile Devices to send the Transfer Order of the type of return in question no later than within a period of ten seconds counted from the time the Administrator has made the respective Settlement Notice available to them through SPEI, shall enter into force on December 29, 2017.

From the entry into force of these Rules until the date indicated in the preceding paragraph, those entities that retain the status of Participant pursuant to the Tenth Transitory Article and that fall under the scenario contemplated in subsection A), sub-subsection d Bis), of numeral 7.2 of the 7th of the Rules indicated in the second paragraph of the First Transitory Article above shall observe the provisions of said sub-subsection in terms of the provisions of these Rules in force during the referred period that are applicable to that effect.

FIFTH.- The provisions of the 13th, first paragraph, of these Rules regarding the obligation of Issuer Participants, other than Credit Institutions, to follow identification and authentication procedures for their respective Issuer Clients in accordance with the provisions of the 71st of these Rules, shall enter into force on February 28, 2018.

SIXTH.- The provisions of the 20th of these Rules, regarding the obligation of Receiving Participants to generate and send to the Administrator a Credit Confirmation in the terms provided in said Rule, shall enter into force on July 31, 2018.

Without prejudice to the provisions of the preceding paragraph, those entities referred to in the Tenth Transitory Article, which have the status of Credit Institutions, shall observe the following:

I. From the date of entry into force of these Rules until February 27, 2018, they shall generate and send to the Administrator the Credit Confirmation relative to the Transfer Order Accepted by SPEI of the payment types Third Party to Third Party, Payroll and Invoice, specified in the Manual, within thirty minutes counted from the moment they have carried out the credit to the Account of the Client corresponding to the Beneficiary Client of the amount of the respective Transfer Order Accepted by SPEI.

The thirty-minute period referred to in the preceding paragraph shall not apply with respect to Transfer Orders Accepted by SPEI corresponding to “Transfers via Mobile Devices” referred to in the Rules indicated in the second paragraph of the First Transitory Article. In this case, the aforementioned Credit Institutions shall generate and send to the Administrator the Credit Confirmation relative to the Transfer Order Accepted by SPEI of the types indicated above, within five minutes counted from the moment they have carried out the credit to the Account of the Client corresponding to the Beneficiary Client of the amount of the respective Transfer Order Accepted by SPEI.

II. From February 28, 2018 until July 30, 2018, they shall generate and send to the Administrator the Credit Confirmation relative to the Transfer Order Accepted by SPEI of the payment types Third Party to Third Party, Payroll and Invoice, specified in the Manual, within five minutes counted from the moment they have carried out the credit to the Account of the Client corresponding to the Beneficiary Client of the amount of the respective Transfer Order Accepted by SPEI.

SEVENTH.- The provisions of the 60th of these Rules, regarding the obligation of Participants to inform the Administrator of the name of the person designated as responsible for SPEI regulatory compliance in terms of the 59th of these Rules, shall enter into force on September 25, 2017.

EIGHTH.- The provisions of the 53rd, second paragraph, of these Rules, regarding the obligation of Participants to present, together with the registration application for their Operators, a communication signed by the SPEI regulatory compliance responsible person(s), shall enter into force on September 25, 2017.

NINTH.- With respect to the entities referred to in the Tenth Transitory Article, the Operators who have registered with the Bank of Mexico prior to the date of entry into force of these Rules shall retain such status, and their operation shall adhere to the terms in these Rules and the Manual.

In the event that the entities referred to in the preceding paragraph decide to register or deregister an Operator on a date subsequent to the entry into force of these Rules, such registration and deregistration shall be carried out in terms of the 53rd of these Rules.

Without prejudice to the provisions of the first paragraph of this Transitory Article, Participants shall present the communications provided for in the 53rd, second paragraph, of these Rules no later than November 21, 2017. In case of failure to do so, the Administrator shall proceed to deregister the Operators registered prior to that date.

TENTH.- With respect to those entities that on the date of entry into force of these Rules have the status of SPEI Participants pursuant to the “Rules of the Interbank Electronic Payments System”, issued by the Bank of Mexico by means of Circular 17/2010 published in the Official Gazette of the Federation on June 15, 2010, in terms of the corresponding modifications made known through Circulars 24/2011, 4/2013, 6/2014, 20/2014, 2/2015, 4/2015 and 13/2015, published in said Gazette on December 2, 2011, December 6, 2013, April 29, 2014, December 12, 2014, January 16, 2015, March 6, 2015 and August 31, 2015, respectively, they shall be considered as Participants in terms of these Rules until the Administrator issues a resolution. Likewise, only those aforementioned entities that obtain the favorable resolution of the Administrator regarding their admission as Participants and celebrate the Contract referred to in these Rules shall retain the aforementioned Participant status. For the purposes of the foregoing, interested Participants shall present the documentation established in the 74th of these Rules, in accordance with what is established in fraction IV, of the Eleventh Transitory Article of these Rules no later than February 28, 2018.

ELEVENTH.- The entities referred to in the preceding Transitory Article shall comply with the following provisions within the respective timeframes established below:

I. The provisions of the 54th of these Rules, regarding the obligation to maintain, at all times, at least two Operators, no later than August 25, 2017.

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 97

II. The provisions of the 58th, fractions I, II, IV, letters A and B, regarding the obligation to comply with requirements in matters of information security, operational risk management, protection of Issuer Clients, no later than January 31, 2018.

III. The provisions of the 61st of these Rules regarding the obligation to obtain authorization from the Bank of Mexico to agree with third parties that provide an interface to allow connection with SPEI, no later than December 29, 2017.

IV. The provisions of the 74th of these Rules regarding the obligation to present the first report and certificate provided for in said Rule no later than February 28, 2018. Such report and certificate shall refer to information regarding compliance with the obligations applicable to the respective Participant starting from January 31, 2018.

V. The provisions of the 16th of these Rules regarding the obligation of the Issuer Participant to include in the Transfer Order sent to the Administrator in the Client Account field only the CLABE of the Client Account corresponding to the Issuer Client, no later than July 31, 2018.

VI. The provisions of the 9th of these Rules regarding the obligation of Participants to assign a CLABE to each of the Client Accounts they hold for their Clients and that correspond to the financial products indicated in the catalog of said products included in Appendix D of the Manual, no later than April 30, 2018.

TWELFTH.- With respect to the entities referred to in the Tenth Transitory Article:

I. As an exception to the provisions of the 90th of these Rules regarding the obligation of Participants to pay the Administrator the fee for the use of SPEI, from the entry into force of these Rules until December 31, 2017, the aforementioned entities shall pay those fees that the Administrator informs them via electronic communication sent on the date of entry into force of these Rules.

II. As an exception to the provisions of the 92nd, fractions I and II, and 93rd, fractions I and II, of these Rules regarding the obligation of Participants to pay the Administrator the amounts of the fixed tariffs provided for in said Rules, Participants shall consider that tariff that the Administrator informed them of on November 30, 2016.

THIRTEENTH.- With respect to those entities that on the date of entry into force of these Rules do not have the status of SPEI Participants pursuant to the “Rules of the Interbank Electronic Payments System”, issued by the Bank of Mexico by means of Circular 17/2010 published in the Official Gazette of the Federation on June 15, 2010 and its modifications made known through Circulars 24/2011, 4/2013, 6/2014, 20/2014, 2/2015, 4/2015 and 13/2015, published in said Gazette on December 2, 2011, December 6, 2013, April 29, 2014, December 12, 2014, January 16, 2015, March 6, 2015 and August 31, 2015, respectively, and are admitted as Participants on a date prior to the dates indicated in fractions I and II of this Transitory Article, they shall comply with the following timeframes:

I. The provisions of the 16th of these Rules regarding the obligation of the Issuer Participant to include in the Transfer Order sent to the Administrator in the Client Account field only the CLABE of the Client Account corresponding to the Issuer Client, no later than December 29, 2017.

II. The provisions of the 9th of these Rules regarding the obligation of Participants to assign a CLABE to each of the Client Accounts they hold for their Clients and that correspond to the financial products indicated in the catalog of said products included in Appendix D of the Manual, no later than October 31, 2017.

FOURTEENTH.- With respect to those entities referred to in the Tenth Transitory Article that do not have the status of Credit Institutions, they shall comply with the timeframes established below:

I. The provisions of the 58th, fractions I, II, IV, letter A and B, of these Rules, regarding the obligation to comply with requirements in matters of information security, operational risk management, protection of Issuer Clients, in the latter case, with respect to entities other than Credit Institutions that offer Electronic Channels to their Issuer Clients, no later than January 31, 2018.

II. The provisions of the 82nd, 83rd, 84th and 85th, of these Rules, regarding the following obligations:

i. provide the service at least at the availability indices defined in the Manual in accordance with the 82nd; ii. provide the information corresponding to Transfer Orders Accepted by SPEI to their Clients in accordance with the 83rd; iii. make the information known to their Clients in the form and terms defined in accordance with the 84th, and iv. provide the link to their Clients for access to Electronic Payment Receipts as well as to consult the status of their respective Transfer Orders in accordance with the 85th, no later than June 29, 2018.

FIFTEENTH.- With respect to those entities other than Credit Institutions that on the date of entry into force of these Rules do not have the status of SPEI Participants pursuant to the “Rules of the Interbank Electronic Payments System”, issued by the Bank of Mexico by means of Circular 17/2010 published in the Official Gazette of the Federation on June 15, 2010 and its modifications made known through Circulars 24/2011, 4/2013, 6/2014, 20/2014, 2/2015, 4/2015 and 13/2015, published in said Gazette on December 2, 2011, December 6, 2013, April 29, 2014, December 12, 2014, January 16, 2015, March 6, 2015 and August 31, 2015, respectively, and are admitted as Participants on a date prior to December 29, 2017, they shall observe the provisions of the 82nd, 83rd, 84th and 85th, of these Rules regarding the following obligations: i. provide the service at least at the availability indices defined in the Manual; ii. provide the information corresponding to Transfer Orders Accepted by SPEI to their Clients in accordance with the 83rd; iii. make the information known to their Clients in the form and terms defined in accordance with the 84th; and iv. provide the link to their Clients for access to Electronic Payment Receipts as well as to consult the status of their respective Transfer Orders in accordance with the 85th, no later than December 29, 2017.

SIXTEENTH.- The provisions of the 58th, fraction IV, letter C, and 43rd of these Rules, regarding the obligation of Participants who maintain, on behalf of their Clients, Client Accounts corresponding to demand money deposits, to celebrate a Collaboration Agreement for the Protection of Issuer Clients, shall enter into force on December 29, 2017.

From the entry into force of these Rules until the date indicated in the preceding paragraph, those entities that retain the status of Participants pursuant to the Tenth Transitory Article and who maintain, on behalf of their Clients, Client Accounts corresponding to demand money deposits that prior to the entry into force of these Rules have celebrated an agreement with the same object as that provided for in the Collaboration Agreement for the Protection of Issuers referred to in these Rules, may continue to operate under the terms and conditions contemplated in said instrument.

SEVENTEENTH.- The provisions of the 28th, 29th, 30th, 31st and 43rd, fraction VI, of these Rules, regarding the obligation of Participants who maintain, on behalf of their Clients, Client Accounts corresponding to demand money deposits to submit a Transfer Order of the return or late return type, as well as the timeframes provided for the return and credit of said Orders, shall enter into force on November 28, 2018. Until then, the return of the resources provided for in the aforementioned Rules shall be carried out through any other type of Transfer Orders provided for in the Manual for these purposes.

EIGHTEENTH.- The provisions of the 68th and 70th of these Rules, regarding the obligations to maintain resources destined for the protection of Issuer Clients and to implement the schemes relative to balances in Client Accounts, shall enter into force on July 31, 2018.

NINETEENTH.- The provisions of the 72nd, fraction I, of these Rules, regarding the obligation of Participants to collect from Clients who carry out operations through SPEI the information referred to in said fraction, shall enter into force on July 31, 2018.

Likewise, the provisions of the 16th, second paragraph and 20th, second paragraph, regarding the obligation of the Issuer Participant to include in the Transfer Order and of the Receiving Participant to include in the Credit Confirmation, respectively, the information referred to in the preceding paragraph, shall enter into force on July 31, 2018.

TWENTIETH.- As an exception to the provisions of the 41st of these Rules, regarding the obligation of Participants to use, to determine the amount to be paid as consideration to the Administrator for the extension of hours, the tariffs that the Administrator makes known no later than the last Banking Business Day of the month of November of the year immediately preceding that to which they correspond, from the entry into force of these Rules until December 31, 2017, it shall correspond to those tariffs that the Administrator informs them of via electronic communication sent on the date of entry into force of these Rules.

TWENTY-FIRST.- The provisions of the 14th, fraction I, 19th, last paragraph, and 27th, last paragraph, of these Rules, regarding the obligation: i. of the Issuer Participant who receives from their Issuer Client a Sending Request

Tuesday, July 4, 2017 OFFICIAL GAZETTE (First Section) 99 of Sending to inform this body of the status of said application and to include the information provided in item 14, subsection I, cited above; ii. of the Receiving Participant to inform its Beneficiary Client about the crediting of the corresponding resources for the Transfer Order Accepted by SPEI in question, through the means they have agreed upon, no later than five seconds immediately following the moment the credit was made, and iii. of the Sending Participant of the Transfer Order subject to a return or late return to inform the Sending Client who transmitted the respective Sending Application, through the means they have agreed upon for this purpose, regarding the re-entry of the respective resources into their Client Account that occurred due to the Transfer Order of the return or late return type, no later than five seconds after the credit was made, shall enter into force on December 29, 2017.

TWENTY-SECOND.- The provisions of item 84, subsections V and VI, of these Rules, regarding the obligation of Participants to: i. establish a means to address information requests from their Beneficiary Clients regarding Transfer Orders Accepted by SPEI for which the Administrator has made the respective Liquidation Notice available through SPEI, and ii. include on their website a page and place an electronic link to it through the Electronic Channels made available to their Clients, detailing the procedure they must follow to submit requests for clarification, inquiries about the status or complaints related to a Sending Application or Transfer Order Accepted by SPEI, shall enter into force on February 28, 2018.

TWENTY-THIRD.- The provisions of item 24 of these Rules, regarding the obligation of Receiving Participants to indicate the cause of the return of a Transfer Order Accepted by SPEI in accordance with the catalog contained in section 9 of the Manual for the causes provided in item 23, subsections I and III, of these Rules, shall enter into force on December 29, 2017.

TWENTY-FOURTH.- The provisions of item 98 of these Rules, regarding the obligation of Participants to send, communications as stipulated in the Rules cited for this purpose in the Rule itself, to the Administrator via email to the Payment Systems Service Center as established in section 5 of the Manual, shall enter into force on August 28, 2017. Until then, Participants must send the aforementioned communications in accordance with the fourth paragraph of the aforementioned Rule, without the need to specify the reason for using said means for sending communications.

TWENTY-FIFTH.- The provisions of item 48, second paragraph, of these Rules, regarding the obligation of the Participants referred to in the Tenth Transitory Article and of those securities depository institutions acting as Participants to maintain their connection to SPEI in accordance with the annual availability indices defined in section 5 of the Manual, shall enter into force on December 29, 2017.

TWENTY-SIXTH.- The provisions of item 19, subsection V, and item 25, subsection V, letters a) and b), of these Rules, regarding the obligation of Participants to credit or return, respectively, the Transfer Orders Accepted by SPEI corresponding to Scheduled Payments within the timeframes established in said Rules, shall enter into force on December 29, 2017.

Without prejudice to the foregoing, from the entry into force of these Rules until December 28, 2017, Participants must observe the following timeframes: I. Regarding the crediting referred to in item 19, subsection V: no later than 08:35:00 hours on the Banking Business Day corresponding to the SPEI operation date, provided that they are Transfer Orders Accepted by SPEI corresponding to Scheduled Payments, received between the SPEI opening time specified in the Manual and 08:30:00 hours. II. Regarding the Transfer Order of the return type referred to in item 25, subsection V, letter a), it must be carried out no later than 08:35:00 hours on the Banking Business Day corresponding to the SPEI operation date. III. Regarding the Transfer Order of the return type referred to in item 25, subsection V, letter b), it must be carried out for those received between the SPEI opening time specified in the Manual and 08:30:00 hours of each Banking Business Day; the return must be carried out no later than 08:35:00 hours on the Banking Business Day corresponding to the SPEI operation date, and with respect to those received between 08:30:01 hours of each Banking Business Day and the closing of SPEI operations specified in the Manual, the Transfer Order of the return type must be carried out no later than the closing of SPEI operations.

TWENTY-SEVENTH.- Interested parties wishing to act as Participants, who prior to the entry into force of these Rules, have submitted an application to the Bank of Mexico in accordance with the Rules referred to in the First Transitory Article, second paragraph, which are repealed by these Rules, and which are pending resolution, the accreditation that they possess the necessary technical elements to operate in SPEI will be evaluated by the Bank of Mexico in accordance with the provisions contained in the aforementioned Rules and that were in force at the time of the submission of their application.

The interested parties referred to in the previous paragraph that are subject to regulation and supervision in matters of prevention and detection of acts, omissions or operations that could favor, assist, aid or cooperate in any manner for the commission of any of the crimes provided for in articles 139 and 148 Bis of the Federal Penal Code or that could fall under the circumstances of article 400 Bis of the same Code, must submit to the Bank of Mexico, no later than within one hundred twenty Banking Business Days following the entry into force of these Rules, a report in which they state the following: I. If they have been subject to the imposition of a final sanction for infractions to the regulation referred to at least in the last three years prior to the date on which they communicated their interest in acting as participants in SPEI. II. In the event of having been sanctioned in accordance with the previous subsection, they must provide evidence that they have taken the necessary actions to correct the causes that gave rise to the respective infractions. Such accreditation could be resolved through the result of the follow-up visit that the competent supervisory commission has carried out to verify such situation or, alternatively, through the submission of a report prepared by an Independent External Auditor. III. In the event that the entity in question has been notified by the respective supervisory commission about a possible or alleged infringement to the regulation referred to in this paragraph, such entity must inform about this situation and submit a report from an Independent External Auditor on the causes that led to such notification, as well as on the viability of the correction plan that it must present for such purposes, in the event that it has been required by the supervisory commission. IV. In the case of entities that have not been supervised by the competent authority in the matter referred to in this paragraph during the two years immediately preceding the date of their application, they must provide evidence, through a report prepared by an Independent External Auditor, that they have the capacity to comply with the regulation contemplated in this same subsection that applies to them.

In the event that the Bank of Mexico determines that the interested party complies with the technical elements contained in the Rules referred to in the first paragraph of this Transitory Article and that it accredited the elements indicated in the previous paragraph, it will issue a resolution in accordance with item 64 of these Rules. From the date on which the interested parties obtain admission to act as Participants referred to in this paragraph, they will be subject to the provisions of the Eleventh and Fourteenth Transitory Articles, depending on whether or not they have the status of Credit Institution.

In the event that the interested party does not deliver the report referred to in the second paragraph of this Transitory Article within the specified timeframe, the application will be understood to be resolved negatively, without the need for notification from the Administrator regarding this matter.

TWENTY-EIGHTH.- The provisions of item 89 of these Rules regarding the obligation of Participants to notify their affected Clients, in those cases where the Participant's Technological Infrastructure presents an event that affects the services related to SPEI that it provides to its Clients, through ATMs made available to Sending Clients in order to submit Sending Applications, shall enter into force on June 29, 2018.

Mexico City, June 30, 2017.- The General Legal Director, Luis Urrutia Corral.- Rubric.- The Director of Payment Systems, Manuel Miguel Ángel Díaz Díaz.- Rubric. For any inquiries regarding the content of this Circular, please contact the Authorization, Consultations and Legal Control Department, at the phones (55) 5237-2308, (55) 5237-2317 or (55) 5237-2000 Ext. 3200.