Circular 14/2018 — Modifications to Circular 3/2012 (Debit Card Protection)

Wednesday, October 3, 2018 OFFICIAL GAZETTE (First Section) 107 BANCO DE MEXICO CIRCULAR 14/2018 addressed to Credit Institutions and the National Agricultural, Rural, Forestry and Fisheries Development Financial Institution, regarding Modifications to Circular 3/2012 (Debit Card Protection).

A logo appears at the margin, stating: Bank of Mexico.

CIRCULAR 14/2018 TO CREDIT INSTITUTIONS AND THE NATIONAL AGRICULTURAL, RURAL, FORESTRY AND FISHERIES DEVELOPMENT FINANCIAL INSTITUTION: SUBJECT: MODIFICATIONS TO CIRCULAR 3/2012 (DEBIT CARD PROTECTION).

The Bank of Mexico, with the objective of improving the functioning of payment systems, particularly regarding the use of cards in commerce and other payment receivers, has identified some areas for regulatory improvement in order to achieve a more efficient and secure scheme for the functioning of the card payment market. The environment in which the card market develops is characterized by accelerated technological change, which can leave some market practices and even some regulatory elements behind. Likewise, the country's card market is exposed to possible fraud that could generate losses for consumers, payment receivers, and participating institutions. In this context, the differences in the protection of credit and debit card users, combined with the possible collateral losses faced by institutions, have led some of these to block various functionalities, such as the acceptance of debit cards in some types of commerce and, in particular, in e-commerce. In light of this situation, the Bank of Mexico has decided to modify its regulation for the benefit of users of these payment methods in the following four specific areas: (i) improve and expand the security elements of card operations; (ii) incentivize the use of new technologies that allow greater efficiency and security in the system; (iii) establish minimum and homogeneous protection criteria for users of different types of cards; and (iv) prohibit differentiated practices by card type that are not justified.

With the aforementioned reforms, it is sought to continue promoting: i) the protection of users' interests; ii) the adoption of electronic payment methods; iii) competition in this market; and iv) the proper functioning of payment systems and the healthy development of the financial system.

Therefore, based on Articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 24 and 26 of the Bank of Mexico Law, 48 of the Credit Institutions Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, paragraphs fourth and seventh, 10, first paragraph, 12, first paragraph in relation to 20, fraction XI, 14 Bis, first paragraph in relation to 17, fraction I, and 14 Bis 1, first paragraph in relation to 25 Bis 1, fraction IV, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Directorate of Operations and Payment Systems, the General Legal Directorate, and the General Directorate of Financial System Affairs, respectively, as well as Second, fractions I, VI and X, of the Agreement on the Assignment of Administrative Units of the Bank of Mexico, it has resolved to modify the index, the title, the first paragraph, as well as fraction I of Article 15, the first paragraph of Article 16, Articles 18 and 19, the title as well as the second paragraph of fraction III of Article 20, the first paragraph of Article 59 and the second and third paragraphs in fractions III and V, subsection f), of Article 60 and add the definition of Debit Card and Cardholder in Article 2, as well as Articles 19 Bis, 19 Bis 1, 19 Bis 2, 19 Bis 3, 19 Bis 4, 19 Bis 5, a third paragraph and a fourth paragraph to Article 60, shifting the current third and fourth paragraphs in order, as well as Article 86 Bis 1 to the “Provisions applicable to the operations of credit institutions and the National Agricultural, Rural, Forestry and Fisheries Development Financial Institution”, contained in Circular 3/2012, to remain in the following terms:

PROVISIONS APPLICABLE TO THE OPERATIONS OF CREDIT INSTITUTIONS AND OF THE NATIONAL AGRICULTURAL, RURAL, FORESTRY AND FISHERIES DEVELOPMENT FINANCIAL INSTITUTION

INDEX ...

SECOND TITLE OPERATIONS WITH THE PUBLIC

CHAPTER I PASSIVE OPERATIONS

108 (First Section) OFFICIAL GAZETTE Wednesday, October 3, 2018

“Article 15.- Charges to Accounts” ...

“Article 18.- Characteristics of Debit Cards” “Article 19.- Use of Debit Cards” “Article 19 Bis.- Charges to the Account for the Use of Debit Cards” “Article 19 Bis 1.- Notice of theft or loss of Debit Cards and claim of charges” “Article 19 Bis 2.- Information on responsibility for charges” “Article 19 Bis 3.- Liability for unrecognized charges made with Debit Cards” “Article 19 Bis 4.- Reversal of credits made to Demand Deposit Accounts for operations with Debit Cards” “Article 19 Bis 5.- Inter-institutional Agreement” “Article 20.- Additional characteristics of level 1 accounts and the Debit Cards associated with them” ...

CHAPTER III SERVICES Section III Other Services

“Article 86 Bis 1.- Payment acceptance services with cards” ...

FIRST TITLE PRELIMINARY PROVISIONS

UNIQUE CHAPTER GENERAL PROVISIONS

Definitions Article 2.- For brevity, in singular or plural, in these Provisions it will be understood by: ...

“Debit Card: the set of data integrated regardless of the medium in which they are stored, which, when processed through determined systems, allow initiating a charge instruction to an Account to which they are associated or, in its case, a credit resulting from the return related to said charge for claims under the terms of these Provisions.”

“Cardholder: that person in whose name the Institution issues a debit card corresponding to a Demand Deposit Account, whether it be the holder of said Account or a third party duly authorized by the latter as the holder of an additional card corresponding to said holder; as well as the holder of a debit card associated with a level 1 account.” ...

SECOND TITLE OPERATIONS WITH THE PUBLIC

CHAPTER I PASSIVE OPERATIONS

Section I Passive operations in national currency

Subsection B Demand Deposits

“Charges to Accounts

Wednesday, October 3, 2018 OFFICIAL GAZETTE (First Section) 109

Article 15.- Institutions that administer Demand Deposit Accounts must allow their holders, as well as third parties duly authorized by them, to make charges in them to dispose of the respective resources, in accordance with the following:

I. Regarding level 1 accounts, exclusively through Debit Cards that meet the following characteristics:

a) Those incorporated in physical media that can only be used to make withdrawals and deposits in ATMs and branches, as well as payment operations at point-of-sale terminals, presencial or remote, connected to networks of disposal means, as referred to in the Law for Transparency and Ordering of Financial Services, or

b) Those issued in digital media that can only be used to make withdrawals and deposits in branches, as well as payment operations at point-of-sale terminals, presencial or remote, indicated in the preceding subsection a).”

II. …

III. …”

Disposal and Payment Means

“Article 16.- Institutions may only offer to the holders of Demand Deposit Accounts the following disposal and payment means:”

I. …

II. …

III. …”

“Characteristics of Debit Cards

Article 18.- The Debit Card issued by the Institution that holds the respective Account will consist of the set of data integrated regardless of the medium in which they are stored, which, when processed through determined systems, allow initiating a charge instruction to said Account.

The Institution, in order to allow the Cardholder to use the Debit Card to carry out the operations referred to in Article 19, must make available to the holder of the respective Account or, in its case, the additional Cardholder, through the means agreed upon for this purpose with said holder, at least the following information corresponding to the card:

I. The unique identification digits of the Debit Card;

II. The expiration date;

III. The commercial brand under which the Institution issues the respective card, in accordance with the agreement celebrated with the company holding said brand and in accordance with what is established in the General Provisions Applicable to Disposal Means Networks, and

IV. The card security code, assigned as an additional security data in the making of non-presencial operations with it.

The Institution that issues Debit Cards with integrated circuit or chip must observe the security and processing standards established by the company constituted under the legislation of the United States of America, known as EMVCo, LLC, or, in its case, those others that the Bank of Mexico determines as equivalent in relation to the use and functioning of said integrated circuit or chip, in those cases where the card operation implies obtaining the information of the card directly from said integrated circuit or chip.

In the event that any Institution intends to use any standard different from that mentioned in the previous paragraph, it must previously obtain the authorization of the Bank of Mexico, for which it must present the respective application to the Department of Authorizations, Queries and Legal Control.”

“Use of Debit Cards

Article 19.- The Institution that administers a Demand Deposit Account must allow the respective Cardholder to use the corresponding Debit Card to:

I. Withdraw cash amounts in: a) the branches of the Institution, b) ATMs enabled for this purpose and to process the card in question, c) banking commissionaires available in accordance with the agreements celebrated for this purpose with the Institution itself or, in its case, with other institutions or d) establishments of payment receivers with cards that provide said service, affiliated to the respective networks through the Institutions or other entities participating in said networks that provide them with the service of reception and processing of payments with cards, and

II. Make payments of any type, such as for acquisitions of goods or services, loan amortizations or tax payments, among others.

The operations referred to in the preceding fractions must be carried out through: i) a clearing chamber for card operations with whom the Institution has celebrated a contract for this purpose, or ii) the Institution's own infrastructure, in the case of those operations where the Institution issuing the Debit Card belongs to the same financial group or consortium of the Institution or entity that provides card acceptance services to the payment receiver made with said card.

For the purposes of what is stated in the previous paragraph, consortium will be understood as indicated in Article 22 Bis, fraction I, of the Credit Institutions Law.

Institutions must deliver to account holders all deactivated Debit Cards and, for their activation, the latter must expressly request it through the mechanisms that the Institutions have available for this purpose, either in one of their branches or through a commissionaire, by comparing the autograph signature of the account holder himself with respect to any identification indicated in the General Provisions referred to in Article 115 of the Credit Institutions Law or through the presencial authentication schemes used by the Institution in question, such as biometric elements, through the use of ATMs, point-of-sale terminals, by telephone, remote authentication schemes used by the Institution itself, or through other secure electronic channels.”

“Charges to the Account for the Use of Debit Cards

Article 19 Bis.- The Institution that administers a Demand Deposit Account must effect in it the charges corresponding to the instructions generated through the use of the respective Debit Card, in accordance with the following:

I. For operations in which, to carry them out, they require the Cardholder to use, at least, two independent factors to authenticate the operations as authorized by the latter, whether the two factors are used at the time of carrying out the operation, or one of said factors is used at the time of carrying out the operation and another of said factors at the time of delivering the good or service acquired by virtue of said operation. The aforementioned factors must be among those indicated below:

a) Information that the Institution provides to the Cardholder or allows this to generate, under the understanding that only he knows it, so that he can enter it into the system authorized by the Institution to initiate the operation in question, such as password or personal identification number.

b) Information contained, received or generated by electronic means or devices that only the Cardholder possesses, including that stored in an integrated circuit or chip that is processed in accordance with the security and processing standards established by the company constituted under the legislation of the United States of America, known as EMVCo, LLC, or, in its case, those others that the Bank of Mexico determines correspond to the use and functioning of said integrated circuit or chip with the same degree of security, as well as that obtained by devices generating dynamic passwords that the Institution provides to the Cardholder. The foregoing will be subject to the condition that said information is generated with properties that prevent its duplication or alteration and meets one of the following characteristics:

i. It is dynamic information that cannot be used more than once, or

ii. It is dynamic information generated for the carrying out of an operation, as well as in subsequent operations without any modification, in which case it will be considered, for the purposes of this subsection, as an independent element to authenticate the operations as authorized by the Cardholder only for the first operation in which it is used.

Wednesday, October 3, 2018 OFFICIAL GAZETTE (First Section) 111

c) Information derived from the Cardholder's own characteristics, such as those of a biometric nature, such as fingerprints, hand or face geometry, patterns in iris or retina, among others.

d) Any other information that the Bank of Mexico authorizes.

II. For operations in which, to carry them out, the Institution does not require the Cardholder to use two of the authentication elements referred to in the preceding fraction.

The Institution must establish procedures and mechanisms in order that the information referred to in fraction I is not known by any of its officials, employees or representatives or by any third party, prior to its generation and use by the Cardholder.

Institutions are prohibited from blocking the processing of transactions made with Debit Cards, based on the type of access medium involved in said processing. As an exception to the foregoing, in accordance with the criteria established by issuing Institutions, account holders may instruct them, through the electronic, computing or telecommunication means that they have agreed upon for this purpose, that: (i) block the processing of payments with their Debit Card or, in its case, with those additional Debit Cards linked to the same Demand Deposit Account of the account holder, referred to certain access media involved in said processing, and (ii) establish maximum limits regarding the amount for which operations may be carried out with said Debit Cards or, in its case, with those additional Debit Cards linked to the same Demand Deposit Account of the account holder, or regarding their exclusive use in operations carried out in national territory. The blocks or limits referred to in this paragraph will be understood to be for an indefinite period, unless there is an express instruction from the account holder indicating otherwise.

Institutions that issue Debit Cards may only block operations or payment receivers based on a risk analysis. In the event that the Institution issues Debit Cards and credit cards and blocks the operations carried out with any type of said cards in a particular payment receiver, derived from the risk analysis carried out by said Institution, it must carry out the corresponding block for the two types of cards it has issued in favor of all its clients.”

“Notice of theft or loss of Debit Cards and claim of charges

Article 19 Bis 1.- The Institution that administers a Demand Deposit Account must allow the Cardholder to present notices of: (i) theft or loss of the corresponding Debit Card, or (ii) claims for charges to said Account that he does not recognize as his own.

For the purposes of what is established in the previous paragraph, the Institution must allow the Cardholder to present the corresponding notice in one of the following forms, at his choice:

I. Personally, in any of the branches of the Institution or by communication given through the customer service channels that the Institution itself has enabled to attend matters related to the Deposit Accounts corresponding to the Debit Cards, or

II. Through electronic channels or any other means of communication that, for this purpose, the Institution has agreed upon with the account holder.

The Institution may in no case require the Cardholder to carry out any additional procedure to the presentation of the notices referred to in this Article.

The Institution that receives any of the aforementioned notices must provide the Cardholder, at his choice, in writing or by electronic or telecommunication means, at least, a reference number of the notice, as well as the date and time when it was received. The Institution must deliver the Cardholder the information referred to at the moment when he has presented the corresponding notice in the manner referred to in the preceding fraction I, or within twenty-four hours after he has presented the notice in any of the manners provided for in fraction II.

Institutions must preserve evidence of the information provided by the Cardholder under the terms of this Article.

Institutions must inform account holders, in the corresponding Demand Deposit contracts for the Accounts to which the respective Debit Cards are associated, the means by which the aforementioned notices may be presented.”

112 (First Section) OFFICIAL GAZETTE Wednesday, October 3, 2018

"Liability Information Regarding Charges Article 19 Bis 2.- In the event that the account holder or, as applicable, the additional cardholder has presented any of the notices provided for in the preceding Article 19 Bis 1, the Institution receiving it must make available to the account holder, within a maximum period of two Banking Business Days counted from the date the aforementioned notice was presented, through its website, in a communication attached to the respective account statement, or by means of any other mechanism agreed upon with the account holder, a report that includes, at a minimum, the following information:

I. The scope of the liability of said account holder for charges to the Account, registered before and after the presentation of the referred notice; II. The date and time when the notice was received, and III. The status of the investigation carried out in response to the notice presented.

In the case mentioned in the preceding paragraph, the Institution must specify to the account holder that they will not be responsible for charges made to the respective Demand Deposit Account due to the use of the Debit Card from the presentation of the notice referred to in the previous article, when this is due to theft or loss, as well as the Institution's right to demand payment of charges to said Account that were previously authorized by the account holder or, as applicable, the additional cardholder."

"Liability for Unrecognized Charges Made with Debit Cards Article 19 Bis 3.- The Institution that receives from the Cardholder any of the notices referred to in the first paragraph of Article 19 Bis 1 is obligated to credit the respective Deposit Account, no later than the second Banking Business Day following the receipt of said notice, the amount equivalent to those charges made in that Account that are the subject of the notice in question, provided that:

I. The referred charges correspond to operations carried out during the forty-eight hours prior to the presentation of the notice referred to in Article 19 Bis 1, first paragraph, item (i), and, in turn, said charges are not recognized by the account holder, nor were they carried out under the terms of fraction I of Article 19 Bis, or

II. If the notice corresponds to that indicated in Article 19 Bis 1, first paragraph, item (ii), relating to the claim for charges that the account holder does not recognize as their own, this was presented to the Institution within a period of ninety Days subsequent to the date on which the unrecognized charge was made.

The Cardholder's Institution will not be obligated to make the credit referred to in the preceding paragraph if it, within the period indicated in said paragraph, delivers to the account holder a ruling that proves that the charges subject to the respective notice correspond to operations with the debit card associated with the Deposit Account that were carried out under the terms of fraction I of Article 19 Bis, unless there is evidence that the charge was the result of an operational failure attributable to the Issuing Institution or the Institution or entity that processed the charge instruction in favor of the recipient of the corresponding funds, in accordance with the inter-institutional agreement celebrated for this purpose, as would be the case of an improperly duplicated charge.

The Issuing Institution must deliver to the account holder the ruling referred to in the preceding paragraph under the terms of Article 19 Bis 4.

The period of ninety Days referred to in fraction II of this article will begin to run from the date on which the unrecognized charge was made to the Demand Deposit Account corresponding to the respective Debit Card.

To make the credits referred to in this article, the Institution must refrain from requiring the account holder to carry out any additional procedure other than the presentation of the notices indicated.

In the case where the account holder does not recognize, through the notice provided for in Article 19 Bis 1, first paragraph, item ii), charges made by the use of a Debit Card linked to a Level 1 Deposit Account, the Issuing Institutions must validate that this corresponds to the owner of the resources of said Account, in accordance with what is established in Article 20 of these Provisions.

In the event that the charges subject to any of the notices referred to in the first paragraph of Article 19 Bis 1 have been made as a result of instructions generated by an Institution or entity that, in accordance with the inter-institutional agreement celebrated for this purpose, has processed such instructions in favor of the

Wednesday, October 3, 2018 OFFICIAL GAZETTE (First Section) 113 recipients of the corresponding resources, the Issuing Institution of the respective Debit Card must require that other Institution or entity to return the resources corresponding to said charges, no later than the second Banking Business Day following that on which the Issuing Institution so requires. In this case, the Issuing Institution may only obtain the referred return provided that it has required, for the generation of the referred charge instructions, the use of, at least, two authentication factors in accordance with what is established in Article 19 Bis, fraction I, of these Provisions, and the Institution or entity that generated said instructions has not provided the Issuing Institution with sufficient elements to validate said factors under the terms of the agreement celebrated for this purpose."

"Reversal of Credits Made to Demand Deposit Accounts for Operations with Debit Cards Article 19 Bis 4.- The Cardholder's Institution may only obtain the return of the amount corresponding to the credit it made under the terms of Article 19 Bis 3, when it proves to the account holder that the charge with respect to which said credit was made derived from an operation executed in accordance with what is provided in fraction I of the preceding Article 19 Bis.

In the event that the return of the amount indicated in the preceding paragraph is applicable and this, in turn, corresponds to a charge derived from an instruction issued by another Institution or entity that provides the card acceptance service to the payment recipient that, in accordance with the inter-institutional agreement celebrated for this purpose, has processed said instruction in favor of the recipient of the corresponding resources, the Institution that obtains said return from the Cardholder must transfer in favor of that other Institution or entity the resources equivalent to said amount no later than the second Banking Business Day following that on which that other Institution or entity has required said transfer, the foregoing only in cases where the Cardholder's Institution has previously received said resources from the other Institution or entity.

The Institution that has the right to the return of the amount credited under the terms of the case provided in the first paragraph of this article may only charge interest on said amount, equivalent to a rate that in no case may be higher than that interest rate, applicable to the credit line corresponding to the card of the category referred to as "classic", which is the lowest of all those cards issued by the respective Institutions, as indicated in the most recent publication of the Bank of Mexico of the indicators of said rates, for a maximum period of two Banking Business Days subsequent to having made the credit referred to in Article 19 Bis 3.

For the purposes of the first paragraph of this article, the Issuing Institution must make available to the account holder, at the branch where the account is located, or through the means agreed upon for this purpose with the account holder, at the latter's choice, within a period of forty-five Days counted from the date on which it received the notice referred to in Article 19 Bis 1, a ruling, in simple and clear language, signed by authorized personnel of the Institution empowered to do so, which contains, at least, the following information:

I. Evidence of the authentication factors used in accordance with what is established in fraction I of Article 19 Bis, as well as the explanation, in simple and clear language, of said factors and the manner in which their verification was carried out in accordance with the procedures applicable to said authentication factors. II. Hour and minute in which the operation was carried out. III. Name of the Institution or entity that processed the operation related to the charge to the Account that was the subject of the notice, as well as the name of the payment recipient where the operation originated. IV. In case of having it, the physical address where the device on which the operation was carried out is located or, as applicable, the internet protocol address (IP, by its initials in English) through which said device was connected to the internet.

Regarding claims related to operations carried out abroad, the period indicated in the preceding paragraph will be one hundred eighty Days.

Institutions must, at the request of the account holder, make available and deliver, free of charge, during the period of forty-five Days following the delivery of the ruling referred to in this article,

114 (First Section) OFFICIAL GAZETTE Wednesday, October 3, 2018 at the branch where the Account is located, or in the specialized unit that the Institution in question has established for the attention of users, products and financial services in accordance with the Law for the Protection and Defense of Users of Financial Services, a copy of the file generated by reason of the notice referred to in Article 19 Bis 1, in which the documentation and information that relates directly to it is incorporated.

If the periods referred to in the third and fourth paragraphs of this article have elapsed and the Institutions do not deliver the mentioned ruling under the terms indicated, the credit previously made under the terms of the preceding article will become final and cannot be reversed."

"Inter-institutional Agreement Article 19 Bis 5.- The Bank of Mexico may request changes to the inter-institutional agreement referred to in Articles 19 Bis 3 and 19 Bis 4, when in the exercise of its functions it finds that the referred agreement does not comply with what is established in these Provisions."

"Additional Characteristics of Level 1 Accounts and Associated Debit Cards Article 20.- … I. … II. … III. … The Debit Cards referred to in this article may only be used within national territory, therefore they cannot be used to withdraw cash or make payments abroad. These cards also cannot be used to make national or international electronic fund transfers. Without prejudice to the foregoing, the referred cards may be used under the terms provided in Article 15 of these Provisions. IV. …"

Section III Passive Operations in Foreign Currency Subsection F Bank Cards Issuance and Use

"Article 59.- Institutions may issue bank cards in Foreign Currency, which will be means of disposal and payment, consisting of the set of data integrated independently of the medium in which they are stored, which, when processed through determined systems, allow initiating a charge instruction or, as applicable, a credit resulting from the return related to said charge for claims under the terms of these Provisions. The resources assigned to such cards will constitute a liability of the Institution itself."

For the acquisition of these cards, the signing of a contract will not be necessary and the provisions of the 19th of the "General Provisions referred to in Article 115 of the Credit Institutions Law" of the Ministry of Finance and Public Credit must be complied with.

The aforementioned cards may be used within national territory and abroad, provided that they are not used to make electronic fund transfers."

Characteristics

Wednesday, October 3, 2018 OFFICIAL GAZETTE (First Section) 115

"Article 60.- Institutions may freely determine the characteristics of bank cards in Foreign Currency, their commercial name and their maximum balance.

Institutions, in order to allow the use of the bank card in Foreign Currency to carry out the operations referred to in this article, must make available to the person acquiring it, through the means agreed upon for this purpose with this person, at least, the following information corresponding to the card:

I. The unique identification digits of the bank card in Foreign Currency; II. The expiration date; III. The commercial brand under which the Institution issues the respective card, in accordance with the agreement celebrated with the company holding said brand and in accordance with what is provided in the General Provisions Applicable to Disposal Means Networks, and IV. The security code of the card, assigned as an additional security data in the performance of non-presence operations with it.

The Institution that issues bank cards in foreign currency with integrated circuit or chip must observe the security and processing standards established by the company constituted under the legislation of the United States of America, called EMVCo, LLC or, as applicable, those others that the Bank of Mexico determines as equivalent in relation to the use and functioning of the referred integrated circuit or chip, in those cases where the card operation implies obtaining the information from the card directly from said integrated circuit or chip.

In the event that any Institution intends to use any standard different from that mentioned in the preceding paragraph, it must previously obtain the authorization of the Bank of Mexico, for which it must present the respective application to the Department of Authorizations, Queries and Legal Control.

Additionally, the following provisions will be applicable to the aforementioned bank cards:

I. The interest rates that, as applicable, Institutions use to calculate the interest corresponding to the resources that remain in the accounts in question, will be applied on the average of the daily balances of the period in which they have been in effect. II. Institutions must allow cash credits, through electronic fund transfers and by means of checks. III. The cards may be used under the terms provided in Articles 19 and 19 Bis of these Provisions. IV. Institutions may offer them: a) In their branches; b) Through their banking commissionaires, and c) Through electronic means made available to their customers. V. The terms and conditions applicable to these cards must be made available to the public on the website of the Issuing Institution, as well as delivered in writing to the persons acquiring them and contain, at least, the following: a) The ways in which they may be used and credited; b) The concepts, amounts, periodicity and validity of the commissions that may be charged, as well as the mechanism by which modifications to such commissions will be made known; c) The expiration date; d) The yield that, as applicable, the balance generates; e) The security measures for their use; f) The procedures to report any malfunction of the card and, as applicable, theft or loss; as well as to request clarifications and to obtain the return of resources by reason of the cancellation or termination of their validity, which must be subject to what is established in Articles 19 Bis 1, 19 Bis 2, 19 Bis 3 and 19 Bis 4 of these Provisions; g) The mechanisms to consult the balance and, as applicable, the movements, and h) The mechanisms and information that must be provided or used to receive credits through electronic fund transfers.

For the purpose of making credits to bank cards in Foreign Currency through electronic fund transfers, the CLABE that, as applicable, Institutions assign to them may be used, or the sixteen identification digits of the corresponding card."

CHAPTER III SERVICES Section III Other Services

"Card Payment Acceptance Services Article 86 Bis 1. The Institution that provides the service of accepting payment operations with Debit and Credit Cards in favor of payment recipients must observe the security and processing standards established for this purpose by the company constituted under the legislation of the United States of America, called EMVCo, LLC or, as applicable, those others that the Bank of Mexico determines as equivalent that guarantee the secure transmission of information in those cases where the card operation implies obtaining the information from it directly from an integrated circuit or chip on the card itself.

In the event that the Institution intends to use any standard different from that mentioned in the preceding paragraph, it must previously obtain the authorization of the Bank of Mexico, for which it must present its respective application to the Department of Authorizations, Queries and Legal Control.

Additionally, the Institution that, as part of the service referred to in this article, has generated the payment instructions referred to in the last paragraph of the preceding Article 19 Bis 3 may require the payment recipient to return the resources related to the charge, provided that it has agreed with this to provide it with the necessary elements to request the use of authentication factors in the processing of operations carried out with a Debit Card by reason of which charges are made to the Account in accordance with what is established in Article 19 Bis, fraction I, and said payment recipient has not requested the use of authentication factors in accordance with what is established in Article 19 Bis, fraction I, in the processing of the operation related to the charge to the Account that was the subject of the notice in question.

Likewise, in the event that, in the case indicated in the preceding Article 19 Bis 4, the Institution obtains from that other Institution the resources corresponding to the return provided for in that same article, it must credit said resources in the Deposit Account that it maintains for the payment recipient in question, no later than the Banking Business Day following that on which it has received the resources from the Issuing Institution."

TRANSITORY PROVISIONS FIRST.- This Circular will enter into force on March 26, 2019, without prejudice to what is stated in the following transitory provisions.

SECOND.- What is provided in Article 19 Bis 3, regarding the obligation of Institutions that receive any of the notices referred to in the first paragraph of Article 19 Bis 1, to credit the respective Deposit Account, no later than the second Banking Business Day following the receipt of said notice, the amount equivalent to those charges made in that Account that are the subject of the notice in question, will enter into force on September 26, 2019. Until then, Institutions will be obligated to make the respective credit no later than the fourth Banking Business Day following the receipt of the aforementioned notice.

THIRD.- What is provided in Article 19 Bis 3, regarding the obligation of Institutions that have processed any charge to the Account that was the subject of the notice referred to in Article 19 Bis 1, to carry out the return of the amount in question to the Institution that maintains the Account no later than the second Banking Business Day following that on which the institution that maintains the Account so requires,

Wednesday, October 3, 2018 OFFICIAL GAZETTE (First Section) 117 will enter into force on September 26, 2019. Until then, institutions will be obligated to carry out the referred return no later than the fourth Banking Business Day following the receipt of the aforementioned notice.

FOURTH.- What is provided in Article 19 Bis 4, fraction V, regarding the obligation of Institutions to provide the account holder with the internet protocol address (IP, by its initials in English), through which the device on which the operation was carried out was connected to the internet, will enter into force on September 26, 2019.

Mexico City, September 26, 2018.- The General Director of Operations and Payment Systems, Jaime José Cortina Morfín.- Rubric.- The General Legal Director, Luis Urrutia Corral.- Rubric.- The General Director of Financial System Affairs, Jesús Alan Elizondo Flores.- Rubric. For any queries regarding the content of this Circular, please contact the Department of Authorizations, Queries and Legal Control, at the phones (55) 5237-2308, (55) 5237-2317 or (55) 5237-2000 Ext. 3200.