Circular 15/2022 — Modifications to Circular 14/2017 (Miscellaneous Topics)

Tuesday, December 13, 2022 OFFICIAL GAZETTE 1 BANCO DE MEXICO CIRCULAR 15/2022 addressed to the participants of the Interbank Electronic Payments System and other interested parties in acting with such status, regarding the Modifications to Circular 14/2017 (Miscellaneous Topics).

A logo appears at the margin, stating: Bank of Mexico.- “2022, Year of Ricardo Flores Magón”.

CIRCULAR 15/2022 TO THE PARTICIPANTS OF THE INTERBANK ELECTRONIC PAYMENTS SYSTEM AND OTHER INTERESTED PARTIES IN ACTING WITH SUCH STATUS:

SUBJECT: MODIFICATIONS TO CIRCULAR 14/2017 (MISCELLANEOUS TOPICS)

The Bank of Mexico, with the purpose of continuing to promote the proper functioning of payment systems, as well as promoting the healthy development of the financial system and the protection of the public's interests, with the commitment to continue providing the population with digital payment services in a secure and efficient environment for innovation, has resolved to modify the Rules of the Interbank Electronic Payments System (SPEI), in order to strengthen and clarify the regulatory framework applicable to the provision of indirect participation services in the SPEI, fund transfers identifying the beneficiary solely by the ten digits of the account holder's mobile phone number, and those related to the processing of remittances.

For the above, based on articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 2, sections I, IV and VIII, and 6 of the Payment Systems Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, paragraphs fourth and eighth, 10, first paragraph, 14 Bis, first paragraph, in relation to 17, section I, and 20 Quáter, section IV, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Legal Directorate and the Directorate of Policy and Studies of Payment Systems and Market Infrastructures, respectively, as well as Second, sections X and XVII, of the Agreement on the Assignment of Administrative Units of the Bank of Mexico, has resolved to modify the 2nd., sections XXXIV and XLII Bis, 9a. Bis., sections II, paragraphs second, third and fourth, II Bis, III, paragraph second, IV, subsection b), and V, subsection a) and subsection a Bis), numeral 1, 9a. Bis 1., paragraphs second and third, 9a. Bis 2., paragraph second, 9a. Bis 3., section II, first paragraph, 9a. Bis 4., section VIII, subsection a), 9a. Bis 5., sections I, subsection a) and III, 9a. Bis 9., first paragraph and sections I, II and III, 12a. Bis., first paragraph and section I, second paragraph, 15a., first paragraph, 16a. Bis., 58a. Bis., first paragraph, sections I, II, and III, and second paragraph, 59a. Bis 1., first paragraph, 71a., section IV, and 72a., section I Bis, second paragraph; add the third paragraph to the 1st., the last paragraph to the 9a. Bis. and the third paragraph to the 58a. Bis., as well as repeal sections IV and V of the 58a. Bis. and sections I and II of the 59a. Bis 1., of the “Rules of the Interbank Electronic Payments System”, contained in Circular 14/2017, to remain in the following terms:

RULES OF THE INTERBANK ELECTRONIC PAYMENTS SYSTEM

“1st. Internal Rules.- …

Without prejudice to the foregoing, at the request of the Participants, the Bank of Mexico may establish particular exceptions to the obligations and requirements provided for in these Rules, in those cases where the respective Participants are in situations not contemplated in the respective Rules or due to fortuitous events or duly justified force majeure causes that prevent them from complying with specific obligations or requirements.”

“2nd. Definitions.- …

I. to XXXIII Bis. …

XXXIV. Low-Value Transfer Order: the Transfer Order directed to a Participant that has the status of a Credit Institution or that is sent or received by a Clearing House for Transfers Through Mobile Devices, for an amount up to the equivalent of one thousand five hundred UDIS, calculated according to the value of said accounting unit corresponding to the first day of January of the year in which said order is issued.

XXXV. to XLII. …

XLII Bis. Indirect Participation Services: those services that a Participant agrees to provide to its Client so that the latter acquires the status of Indirect Participant, consisting of: (a) the receipt and processing of Transfer Orders and CoDi Transfer Orders directed to the Indirect Beneficiary Clients of that Client; (b) if applicable, the sending of Transfer Orders generated at the request of said Client by instruction of its Indirect Sender Clients, as well as CoDi Transfer Orders generated as a result of the acceptance, by the respective Indirect Sender Clients, of Payment Messages, and c) the settlement and, if applicable, the compensation of the amounts corresponding to said Transfer Orders and CoDi Transfer Orders, as well as the reconciliation and other acts related to the processing of said orders. The services that the Bank of Mexico, in its capacity as a Participant, provides to its Clients shall not be included in this definition.

XLIII. to XLVII. …

…”

“9a. Bis. Obligations related to CoDi Transfer Orders.- …

I. …

II. …

Likewise, in the event that the Participant provides Indirect Participation Services to any of its Clients, and the latter, in turn, is a Credit Institution or electronic payment fund institution that, as provided in the 15th of these Rules, maintains at least three thousand checking deposit accounts or electronic payment fund accounts, as applicable, and allows its Indirect Sender Clients to generate instructions for the issuance of Send Requests through computer programs installed on mobile devices, said Participant must stipulate, in the respective Indirect Participation Services Contract, the obligation of that Indirect Participant to allow all persons holding the Indirect Client Accounts to generate instructions for the issuance of Send Requests, which must be processed in accordance with these Rules for the sending of CoDi Transfer Orders, as a result of the acceptance by said persons holding of the Payment Messages they receive through computer programs that they install on their respective mobile devices. In this case, the Indirect Participant in question must allow its Indirect Clients to generate the instructions for the sending of CoDi Transfer Orders, as a result of the acceptance of the Payment Messages they receive, as indicated in this paragraph, no later than the last day of the next calendar semester following the end of the calendar quarter in which said situation has occurred.

Additionally, for the purposes of the two preceding paragraphs, the Participant referred to there must certify, in accordance with the procedure established in Appendix O of the Manual, the computer programs that it makes available to the persons holding the Client Accounts opened at said Participant, as well as those computer programs that the referred Indirect Participant makes available to the persons holding the Indirect Client Accounts opened at that Indirect Participant, for the performance of those financial and payment operations, as well as the other acts related to these, such as those corresponding to mobile banking, that the Participant or the Indirect Participant agrees with its Clients or Indirect Clients, as applicable, in order for said Clients and Indirect Clients to be able to generate the Send Requests or the instructions for the issuance of the Send Requests, as applicable, for the sending of the CoDi Transfer Orders corresponding to the Payment Messages they receive in accordance with the above.

Any other Participant that does not fall under the situations of the first two paragraphs of this section may: a) allow its Clients to generate Send Requests, as a result of

Tuesday, December 13, 2022 OFFICIAL GAZETTE 3 the acceptance of Payment Messages they receive through the computer programs offered by the Participant itself or by a third party authorized by said Participant and that said Clients install on their respective mobile devices, and b) agree in the Indirect Participation Services Contract that it may celebrate with the respective Indirect Participant, the faculty of the latter to allow its Indirect Clients to generate instructions for the issuance of Send Requests, as a result of the acceptance of Payment Messages that said Indirect Clients receive through the computer programs offered by the Participant itself or the Indirect Participant, and that said Indirect Clients install on their respective mobile devices. The Participant that falls under the respective situation of this paragraph must present to the Administrator its request to provide these services formulated in accordance with the Model established in Annex 1 of Appendix AE of the Manual and will be subject to the same obligations applicable to the Participant referred to in the first paragraph of this section II.

…

II Bis. The Participant that, on the one hand, allows its Clients to receive resources corresponding to CoDi Transfer Orders issued as a result of the Payment Messages generated by said Clients and, on the other hand, provides Indirect Participation Services, will be obliged to include, in the provision of said services, the receipt of CoDi Transfer Orders in favor of the Indirect Beneficiary Clients of the Indirect Participant to whom it provides the referred services. In this case, said Participant must stipulate, in the Indirect Participation Services Contract, that the Indirect Participant will be obliged to offer to its Indirect Clients, at least, the crediting in the respective Indirect Client Accounts of the resources corresponding to the CoDi Transfer Orders issued as a result of the Payment Messages generated by said Indirect Clients, without prejudice to other related services that may be agreed upon.

Additionally, in the event that a Participant, on the one hand, provides Indirect Participation Services to an Indirect Participant that, in turn, is a Credit Institution or electronic payment fund institution that, as provided in the 15th of these Rules, maintains more than three thousand checking deposit accounts or electronic payment fund accounts, as applicable and, on the other hand, allows its Clients to generate Send Requests as a result of the acceptance of Payment Messages through computer programs installed on the mobile devices of said Clients, said Participant must stipulate, in the Indirect Participation Services Contract, that the Indirect Participant will be obliged to allow its Indirect Clients to receive CoDi Transfer Orders as a result of the acceptance of Payment Messages generated by said Indirect Clients in the same terms as indicated above, without prejudice to other related services that may be agreed upon.

III. …

a) to g) …

Likewise, in the event that the Participant referred to in this section provides Indirect Participation Services that include the sending and receipt of CoDi Transfer Orders, it must stipulate, in the Indirect Participation Services Contract, the obligation of the Indirect Participant to whom it provides said services to comply with the same obligations indicated in this section for the Participant.

IV. …

a) …

b) Allow the persons holding the previously referred Client Accounts to generate Payment Messages for amounts up to the equivalent of one thousand five hundred UDIS, calculated in accordance with what is indicated in the last paragraph of this Rule, per message, or for those higher amounts that, if applicable, said Participant decides to establish.

…

c) to e) …

V. …

a) Allow the respective Sender Clients to receive Payment Messages through the computer programs on the mobile devices enabled in accordance with these Rules, either without amount or up to the equivalent of one thousand five hundred UDIS, calculated in accordance with what is indicated in the last paragraph of this Rule, per Payment Message, or for those higher amounts that, if applicable, said Participant decides to establish.

a Bis) …

1. Allow its Indirect Clients to receive Payment Messages through the computer programs on the mobile devices enabled in accordance with these Rules, either without amount or up to the equivalent of one thousand five hundred UDIS, calculated in accordance with what is indicated in the

4 OFFICIAL GAZETTE Tuesday, December 13, 2022 last paragraph of this Rule, per Payment Message, or for those higher amounts that, if applicable, said Participant decides to establish, and 2. …

b) to j) …

…

To determine the value of the amount of one thousand five hundred UDIS referred to in sections IV, subsection b), and V, subsection a) and a Bis), subsubsection 1, of this Rule, the Participants must take the value of the UDI corresponding to the first day of January of the year in which the respective Payment Messages are generated.”

“9a. Bis 1. Situations for the provision of Indirect Participation Services.- …

The Participants and Indirect Participants, except those Participants that provide Indirect Participation Services to their respective Clients, must refrain from processing Transfer Orders and CoDi Transfer Orders from their Clients or Indirect Clients that derive from services that said Clients and Indirect Clients offer to third parties to carry out the receipt, in favor of said persons, or the sending, at their own request, of funds derived from said Transfer Orders and CoDi Transfer Orders. As an exception to the foregoing, the Participants and Indirect Participants may process Transfer Orders sent by their Clients and Indirect Clients or received in their favor, whose resources are contributed or must be delivered to third parties who have a relationship with said Clients or Indirect Clients, respectively, as part of remittance sending and receiving services that such Clients or Indirect Clients offer to those persons.

Likewise, the Participants and Indirect Participants may offer or provide the public with services for sending and receiving fund transfers through the SPEI using brands, signs or trade names only in those cases where said Participants or Indirect Participants are the holders of said brands, signs or trade names or have been granted the license for their use in accordance with the applicable provisions.”

“9a. Bis 2. Entities excluded from Indirect Participation Services.- …

I. and II. …

The Participants may only provide the Indirect Participation Services that correspond to those operations or services that the respective Participant is authorized to offer to its Clients and to carry out on their behalf or for their account. Likewise, Participants that provide Indirect Participation Services may only offer, as part of said services, other services related to those, such as the reconciliation, compensation and settlement of fund transfers between their respective Indirect Participants with whom they have celebrated Indirect Participation Services Contracts. To this effect, the Participants may provide the referred reconciliation, compensation and settlement services when their Clients that have the status of Indirect Participants have expressly requested them from the respective Participants, in which case said services will be subject to the conditions applicable to the Indirect Participation Services, in accordance with these Rules and the Indirect Participation Services Contract they formalize for such purposes.”

“9a. Bis 3. Requirements for the provision of Indirect Participation Services.- …

…

I. …

II. That it has the technical capacity, in terms of what is established in Appendix AN of the Manual, to:

a) to e) …

…”

“9a. Bis 4. Minimum content of Indirect Participation Services Contracts.- …

I. to VII. …

VIII. …

a) Computer security in its technological infrastructure and the electronic or computer means it uses to process the instructions of the Indirect Clients referred to in section I of the previous Rule 7a. Ter., which must comply with what is provided in section I, Section B, of the 58th, of these Rules;

b) to f) …

IX. to XXVIII. …

…”

Tuesday, December 13, 2022 OFFICIAL GAZETTE 5 “9a. Bis 5. Identification and validation of Indirect Participant information.- …

I. …

a) The holders of the share certificates representing the social capital of the Indirect Participants to whom the respective Indirect Participation Services are to be provided, and

b) …

II. …

III. Identify the business schemes of the Indirect Participant with respect to which it will carry out the SPEI operations derived from the Indirect Participation Services and, as part of this, distinguish the types of said operations it plans to carry out, as well as their relationship with the activities proper to its object. As part of the foregoing, the Participant must obtain the express declaration of the interested Client wishing to act as an Indirect Participant specifying whether, through the Indirect Participation Service, it will offer its Indirect Clients the carrying out of transfers for the sending or receiving of Remittances.

…”

“9a. Bis 9. Termination of Indirect Participation Services.- The Participant must terminate in advance the Indirect Participation Services Contract it has celebrated with an Indirect Participant, in the event that the latter falls under any of the following situations and does not present to the Administrator the admission request as a Participant referred to in the 57th of these Rules, within the following nine calendar months counted from the one in which the corresponding situation has occurred, or does not obtain the authorization to act as a Participant within the period of six calendar months subsequent to the one in which said nine-month period concludes:

I. The Indirect Participant, at any time, has more than five hundred thousand Indirect Client Accounts corresponding to checking deposits, electronic payment fund accounts or any other of the financial products specified in Appendix D of the Manual, which have registered positive balances, at any time during a period of twelve consecutive calendar months prior to the month in question, or that, charged to such accounts, at least one fund transfer has been sent in said period;

II. During a period of twelve consecutive calendar months prior to the month in question, it sends or receives three million or more fund transfers, through the SPEI or any other system, including those between accounts opened at the same Indirect Participant, or

III. During a period of twelve consecutive calendar months prior to the month in question, it sends or receives fund transfers, through the SPEI or any other system, including those between accounts opened at the same Indirect Participant, for an aggregate amount superior to the equivalent of four thousand five hundred million UDIS, calculated in accordance with the value of said accounting unit on the last natural day of the calendar month prior to the first month of the twelve-month period for which the calculation of said amount is made.

…”

“12a. Bis. Send Requests processed with mobile phone numbers.- Subject to what is provided in this Rule, in the event that the Participant in question decides to offer the modality indicated below, it may allow its respective Clients to present Send Requests in which they specify, as the identifier of the Client Accounts corresponding to the Beneficiary Clients, or of the Indirect Client Accounts corresponding to Indirect Beneficiary Clients, only the ten digits of the numbers of the mobile phone lines corresponding, without including the identification of the Participants to which said Client Accounts or Indirect Client Accounts correspond. Additionally, the Participant that provides Indirect Participation Services may offer to the respective Indirect Participant that it, if it so accepts, offer to its Indirect Clients the modality of sending instructions for the issuance of Send Requests in the same manner as previously referred.

…

I. …

In this situation, the Participant must preserve evidence of the consultation it has carried out in accordance with the above for having updated the situation provided for in this section, for the processing of the Send Requests contemplated in this Rule. The referred evidence must be preserved for at least five years following the date on which the consultation was carried out.

II. and III. …”

6 OFFICIAL GAZETTE Tuesday, December 13, 2022

“15a. Calculation of the number of financial product accounts.- For the purposes of those cases that refer to the number of demand deposit accounts or electronic payment fund accounts, provided for in 5a. Bis., fraction I, 9a. Bis., fraction II, 11a., fraction IV, second paragraph, 19a., fraction II, second paragraph, and fraction IV, 25a., fraction III, second paragraph, 46a. fraction III, item b), and 58a., fraction II, item c), numeral 1, fraction i, sub-item i.a), of these Rules, said number of demand deposit accounts or electronic payment fund accounts, which Participants or Indirect Participants that have the status of Credit Institution or electronic payment fund institution, as the case may be, maintain open in favor of their Clients or Indirect Clients, will correspond to those that said Participants or Indirect Participants register at the close of the calendar quarter in question. Regarding the number of demand deposit accounts of credit institutions, this will be determined based on the information that these institutions report to the Bank of Mexico in response to information requests made by the latter through the Financial System Information Directorate or, in their case, in those accounts that the Bank of Mexico corroborates resulting from the verification it carries out in the exercise of its supervisory powers. …”

“16a. Bis. Transfer Orders related to Remittances.- Participants who receive Sending Requests from their Sender Clients, including those issued by instructions from Indirect Sender Clients, that have been generated as part of the Remittances service that said Clients or Indirect Clients offer, in turn, to their own clientele, must process the resulting Transfer Orders under the corresponding payment types for Remittances indicated in section 9 of the Manual, as well as use the respective formats specified in section 8 of the Manual, only when said Sending Requests have been generated to carry out the respective Remittances or to credit the resources of these to the Client Accounts or Indirect Client Accounts corresponding to the Beneficiary Clients or Indirect Beneficiary Clients, respectively, who are the final recipients of said Remittances, or well, that they must deliver the respective resources to the final beneficiaries in a manner other than crediting said resources to any account held by said Clients or Indirect Clients. For these purposes, the aforementioned Participants must collect and include in said Transfer Orders the information required in said payment types.

The Participant who, in accordance with what is established in 9a. Bis 5. of these Rules, has knowledge that any of the Indirect Participants to whom it provides Indirect Participation Services allows its Indirect Clients to send Transfer Orders for the processing of Remittances must process them under the payment types corresponding to Remittances associated with the Indirect Participation Services indicated in section 9 of the Manual, as well as use the respective formats specified in section 8 of said Manual. Additionally, said Participant must establish, in the Indirect Participation Services Contract that it enters into with its Indirect Participants, the obligations of the latter to include the information required according to the referred payment types. In the same way, the Participant must establish, in the Indirect Participation Services Contract, the obligation of the Indirect Participant to identify its Indirect Clients that could offer the Remittances service, in which case the respective payment types and formats indicated in sections 8 and 9 of the Manual must also be used.

Participants are not required to process Transfer Orders under the payment types corresponding to Remittances that, for this purpose, the Manual establishes, in those cases where the respective Sending Requests are generated for the credit of resources to Client Accounts or Indirect Client Accounts that are used by the holders to disperse them to each of the Client Accounts or Indirect Client Accounts corresponding to the Beneficiary Clients or Indirect Beneficiary Clients indicated as the final recipients of the respective Remittances, or well, that said Sending Requests are generated for the credit of resources to Client Accounts or Indirect Client Accounts used for the settlement of the purchase and sale of foreign currencies derived from sets of Remittances that the respective Clients or Indirect Clients process.”

“58a. Bis. Requirements of the business models of Participants.- In addition to what is provided in the previous Rule 58a., the interested party must present to the Administrator, as part of the information and documentation that accompanies to prove what is indicated in said Rule, a description of the business model. For these purposes, the documentation that the interested party presents must specify the following:

I. The operations and services that will be carried out, in which, for their realization, it contemplates sending or receiving transfers through the SPEI;

Tuesday, December 13, 2022 OFFICIAL GAZETTE 7

II. The tariff scheme that it will implement, as well as any other charge that it will require for the services or products that it will offer to its clientele, in which, for their realization, it involves transfers executed through the SPEI; and

III. The channels through which the Participant's Clients can instruct operations that are intended to be processed through the SPEI.

IV. Repealed.

V. Repealed.

The interested party that is admitted as a Participant must notify the Administrator of any change to the business model and other documentation that it has presented to the Administrator in accordance with what is established in this Rule. In this case, the Participant must evaluate whether the referred modifications would generate operational, technical, or legal risks for the Participant itself and whether the respective changes meet the requirements indicated above. The referred Participant must notify the foregoing in accordance with 98a. of these Rules with, at least, thirty natural days prior to the one in which it implements the referred modifications.

The Administrator may make observations to the proposal for change of business model that the Participant notifies it within thirty Banking Business Days following the one in which said notification is made.”

“59a. Bis 1. Exclusivity of functions of the compliance officers and information security officers of the SPEI.- The persons who are designated as compliance officers of the SPEI or as information security officers of the SPEI, and their respective substitutes, must dedicate themselves exclusively to the activities indicated in 59a. and 59a. Bis. previous, as well as those complementary activities to their functions within the internal operations of each Participant, provided that said activities are of an analogous nature to those described in 59a. and 59a. Bis. of these Rules.

I. Repealed.

II. Repealed.”

“71a. SPEI transfer services.- …

I. to III. …

IV. Each time the Sender Client intends to make the instruction of a Sending Request, a second identity verification element corresponding to those provided for in the previous fraction I must be requested to them, in addition to those used for logging into the Electronic Channels, with the exception of instructions for Sending Requests for an amount up to the equivalent of one thousand five hundred UDIS, calculated according to the value of said accounting unit that corresponds to January 1 of the year in which said order is issued, in which the Participant may not require its Sender Clients to use a second verification element. …”

“72a. Permanence requirements in matters of Additional Risks.- …

I. …

I Bis. Identify, among its Clients, those subjects referred to in Rule 58a., fraction V, last paragraph.

Regarding the Clients referred to in this fraction, the Client Accounts that Participants hold for them may only correspond to demand deposit accounts opened in credit institutions, popular financial societies, community financial societies, or savings and loan cooperatives, as well as electronic payment fund accounts opened in an electronic payment fund institution, regarding which Participants collect the same documentation and identification data that the general provisions referred to in article 115 of the Credit Institutions Law establish for level 4 accounts offered by said institutions.

a) to c) …

II. to IV. … …”

8 OFFICIAL GAZETTE Tuesday, December 13, 2022

TRANSITORY

UNIQUE.- This Circular will enter into force on the Banking Business Day following its publication in the Official Gazette of the Federation.

Mexico City, December 1, 2022.- BANK OF MEXICO: General Legal Director, Luis Urrutia Corral.- Rubric.- Director of Policy and Studies of Payment Systems and Market Infrastructures, Othón Martino Moreno González.- Rubric.

For any queries regarding the content of this Circular, the Bank of Mexico is at your disposal through the Directorate of Authorizations and Sanctions of Central Banking at telephone (55) 5237-2000 extension 3200.