Circular 18/2014 — Modifications to Circular 4/2014 Regarding Third-Party Contracting by Card Payment Clearing Houses

Tuesday, October 7, 2014 OFFICIAL GAZETTE (First Section) BANK OF MEXICO CIRCULAR 18/2014, addressed to the Clearing Houses for Card Payments, regarding the Modifications to Circular 4/2014, with respect to the contracting of third parties by the Clearing Houses for Card Payments.

At the margin, a logo that says: Bank of Mexico.

CIRCULAR 18/2014
TO THE CLEARING HOUSES FOR CARD PAYMENTS:
SUBJECT: MODIFICATIONS TO CIRCULAR 4/2014, WITH RESPECT TO THE CONTRACTING OF THIRD PARTIES BY THE CLEARING HOUSES FOR CARD PAYMENTS.

The Bank of Mexico, in order to allow the Clearing Houses for Card Payments to carry out the contracting of third parties who provide them with services related to their object, deems it convenient to establish the requirements and conditions that said Clearing Houses must comply with for this purpose. Additionally, it specifies other aspects related to the constitution and operation of Clearing Houses for Card Payments.

For the above, based on articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States; 24 of the Bank of Mexico Law; 3, fractions II and XII, 19, 19 Bis, 21, 22, 47, 49, fraction VII, and 49 Bis of the Law for the Transparency and Ordering of Financial Services; 4, first paragraph, 8, paragraphs fourth and seventh, 10, first paragraph, 14 Bis in relation to 17, fraction I, and 15 in relation to 20, fraction XI, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Legal Directorate and the General Directorate of Payment Systems and Corporate Services, respectively, as well as Second of the Agreement on the Assignment of Administrative Units of the Bank of Mexico, fractions VIII and X, has resolved to modify the Rules for the Organization, Functioning and Operation of Clearing Houses for Card Payments to group them by Chapters in order to improve the organization of their content. Likewise, it has resolved to reform Rules 2nd., fraction VI, subsection g) and last paragraph of said fraction, fraction IX, subsections d) and e) of fraction X and the last paragraph of the Rule; 5th. first paragraph; 6th.; 7th.; 10th., first paragraph and fraction V; 12th., first paragraph; 15th.; 17th., fractions III and IV and the second paragraph; 18th.; 19th.; 20th., fractions IV, V, VI, VII, and VIII and 21st.; add Rules 2nd., fraction III, with a second paragraph, fraction VI with subsection g Bis); 5th., with a second paragraph, moving the current second paragraph in its order; a Third Chapter to be called “Contracting of Third Parties”, which will comprise Rules 16th Bis 1 to 16 Bis 6.; 17th., with a fraction V and the third and fourth paragraphs; 20th., with fractions IX and X; and Annexes 1 and 2 and repeal Rules 2nd., fraction V; 5th., last paragraph and the 11th., of the “Rules applicable to clearing houses for card payments”, issued on March 11, 2014, through Circular 4/2014, to remain as follows:

RULES FOR THE ORGANIZATION, FUNCTIONING AND OPERATION OF CLEARING HOUSES FOR CARD PAYMENTS

“Chapter First
General Provisions”
1st. …

“Chapter Second
Organization and functioning of the Clearing Houses for Card Payments”

“2nd. Application for authorization of Clearing Houses for Card Payments.- … … …

...

(First Section) OFFICIAL GAZETTE Tuesday, October 7, 2014
I. to II.
III. …
a) to c) …
In the case of companies whose shares are traded on any stock exchange, they must indicate, instead of the information indicated in subsections a) to c) above, the shareholdings that, under applicable legislation, they are obligated to disclose to the securities market.
IV. …
V. (Repealed)
VI. …
a) to f) … g) The legal acts that they have celebrated with the telecommunications company or companies, as well as the tariffs and technical specifications of the service that said companies provide them; g Bis) The actions that, in their case, the Clearing House for Card Payments will carry out for the orderly closure of Routing, Clearing or Settlement operations, in the event that it suspends such operations, as well as a detailed schedule that indicates the execution deadlines, and h) … This operating plan must be presented to the Bank of Mexico at least every two years and will be subject to the supervision procedures established in Rule 17th of these Rules;
VII. to VIII. …
IX. Description of the technological and operational capacity that allows them to provide the services, meeting the response times and availability established in the Conditions for Interchange between Clearing Houses, and
X. …
a) to c) … d) Security measures to preserve the integrity of the information and avoid its unauthorized disclosure, with a description of the technical elements as well as the processes, which must comply with what is established in Annex 1 of these Rules; e) Business continuity plans, which identify the means for controlling risks derived from Routing, Clearing and Settlement, which must comply with what is provided in Annex 2 of these Rules, and f) … The Bank of Mexico may require additional documentation, information and certifications that it deems necessary to verify the previous requirements, as well as carry out visits for the purpose of verifying technical and operational aspects of the processing sites and the information and communication technology systems that the company in question would use to provide the Routing, Clearing or Settlement services or to obtain authorization to operate as a Clearing House for Card Payments. The foregoing in order to evaluate the convenience of granting the requested authorization.”

3rd. to 4th. …

“5th. Modification to internal norms, bylaws or contracts.- In the event that the Clearing Houses for Card Payments intend to make any modification to their bylaws, to the content of their internal norms, with respect to subsections a) and c) regarding dispute resolution with other Clearing Houses for Card Payments, of fraction X of Rule 2nd of these Rules, or to the contracts provided for in subsection b) of said fraction X of said Rule 2nd that they have celebrated with the respective Participants, with the Trademark Holders or with other Clearing Houses for Card Payments, they must obtain prior and written authorization from the Bank of Mexico, through a request submitted to the Directorate of Authorizations, Queries and Legal Control. In the event that the Clearing Houses for Card Payments or the third party they have hired in terms of what is provided in Chapter Third of these Rules intend to make any modification to aspects of their internal norms, other than those indicated in the previous paragraph, they must notify the Bank of Mexico with an advance of at least 10 business banking days prior to its implementation, through a letter addressed to the Directorate of Authorizations, Queries and Legal Control. The Bank of Mexico may request the adjustments it considers pertinent regarding said modifications for the national market. … (Repealed)”

“6th. Tests.- Prior to the start of operations, the Clearing Houses for Card Payments must demonstrate to the full satisfaction of the Bank of Mexico the connection and message exchange tests in accordance with what is indicated in the Conditions for Interchange between Clearing Houses.”

“7th. Authorized operations.- The Clearing Houses for Card Payments may agree with third parties on the provision of services related to their object, provided that they comply with the requirements and conditions established in Chapter Third of these Rules. In the case of those services related to the Routing, Clearing and Settlement of a Clearing House for Card Payments that the third party in question carries out against a counterparty or user of said Clearing House for Card Payments, said third party must act in the name and on behalf of the latter.”

8th. to 9th. …

“10. Restricted activities.- The Clearing Houses for Card Payments will not discriminate in any way between their subsidiaries, partners or shareholders, on the one hand, and users and other counterparties, on the other.
…
I. to IV. …
V. Inform the Bank of Mexico about any discriminatory measure or exclusivity obligation of which they have knowledge, in the use or acceptance of certain Cards that are being carried out by the Trademark Holders, Acquirers, Issuers or other Clearing Houses for Card Payments, to which they provide services, and
VI. …”

“11th. Business continuity.- (Repealed)”

“12th. Link obstruction.- Any Clearing House for Card Payments must notify the Bank of Mexico when, in its opinion, it estimates that another one is infringing what is provided in Rule 9th or 10th of these Rules. The Bank of Mexico may require the Clearing Houses for Card Payments that allegedly fail to comply with what is stated in said Rules, the information it considers necessary to determine if they have infringed what is established in the mentioned Rules.
I. to II. …”

13th. to 14th. …

“15th. Authorization of charges.- The Clearing Houses for Card Payments may charge their Participants and other Clearing Houses for Card Payments to which they provide the Routing, Clearing and Settlement services, only those charges that have the prior authorization of the Bank of Mexico.

(First Section) OFFICIAL GAZETTE Tuesday, October 7, 2014 In any case, the Clearing Houses for Card Payments must refrain from granting discounts of any type and by any means, on the charges they make for the services provided when said discounts are granted to their clients for being partners or shareholders or when they are conditioned to the contracting of other services provided by said Clearing House for Card Payments or any company with which it maintains business or patrimonial links. For the purposes of what is provided in this Rule, by business or patrimonial link it will be understood what is provided in the Credit Institutions Law. Charges may be a fixed fee per transaction or a percentage of the transaction amount. In the latter case, a maximum charge amount per transaction must be established. Likewise, differentiated fees may be established based on the number of operations carried out, provided that the price differential between the highest and lowest fee does not exceed 5%, regardless of the fee calculation method chosen.”

16th. …

“Chapter Third
Contracting of third parties”

“16th Bis 1. Third-Party Authorization Request.- The Clearing Houses for Card Payments that intend to carry out the contracting of third parties for the provision of services related to their object must obtain prior authorization from the Bank of Mexico, through the Directorate of Authorizations, Queries and Legal Control, which must be requested for each of the services they intend to contract. For this purpose, the Clearing Houses for Card Payments must provide regarding the third party, the information or documentation provided for in fractions III, IV, VI subsections a) and d), VII, VIII, IX and X, subsections d) and e), of Rule 2nd of these Rules, as well as that indicated below:
I. Draft contract or legal instrument that they intend to celebrate with the third party, which must expressly provide that any modification to the terms established therein must have, for its validity, the prior authorization of the Bank of Mexico in accordance with what is provided in Rule 16th Bis 4 of these Rules.
Likewise, the contract must establish the prohibition for the third party to subcontract the provision of Routing, Clearing or Settlement services, or any other necessary to provide such services, except in those cases where the Bank of Mexico authorizes it. Without prejudice to the foregoing, in the event that the third party requires contracting a company that provides it with the necessary services to carry out those for which said third party was hired, the contracting of said company will correspond to the Clearing House for Card Payments. Likewise, said contract or instrument must provide for the actions that the Clearing House for Card Payments will carry out for the orderly termination of the contract or legal instrument, in the event that the provision of the service through the third party is suspended and it is not possible to replace the third party in said provision. Additionally, the mentioned contract or legal instrument must establish that the third party accepts to be subject unconditionally, with respect to the services subject to contracting, to the following obligations:
a) Carry out the provision of services in compliance with the Conditions for Interchange between Clearing Houses authorized by the Bank of Mexico; b) Allow the Bank of Mexico to carry out home visits to its offices and facilities, under the terms and conditions requested from the Clearing House for Card Payments, for the purpose of verifying technical and operational aspects of the processing sites and the information and communication technology systems, as well as the visits referred to in the last paragraph of Rule 2nd of these Rules. The Bank of Mexico, in order to verify that the services contracted by the Clearing House for Card Payments allow it to comply with what is provided in these Rules, may carry out the consultation of books, systems,

Tuesday, October 7, 2014 OFFICIAL GAZETTE (First Section) registries, manuals and documents in general, related to the provision of the service in question; c) Provide the Bank of Mexico, under the terms and deadlines that it indicates, the information that, in its case, it requests through the corresponding Clearing House for Card Payments; d) Allow the carrying out of audits by the external auditor of the Clearing House for Card Payments, on the topics referred to in fractions VI subsections a) and d), VII, VIII, IX, and X subsections d) and e) of Rule 2nd, as well as with respect to any others that the Bank of Mexico determines; e) Deliver to the external auditor of the Clearing House for Card Payments itself the books, systems, registries, manuals and documents in general, related to the provision of the service. Likewise, it will allow the external auditor or the Clearing House for Card Payments itself to have access to its offices and facilities in general; f) Make known to the Clearing House for Card Payments, for this to inform the Bank of Mexico in turn, any reform to its corporate object, as well as any modification to its internal organization that may affect the provision of the service, with at least fifteen natural days of advance notice before they take place; g) Keep confidentiality regarding information related to operations that, under applicable legislation, is defined as personal data and that it collects as part of the activities it carries out under the contract or legal instrument it celebrates with the Clearing House for Card Payments, in terms of Rule 16th of these Rules, and h) Have security guidelines and business continuity plans that comply with what is established in Annexes 1 and 2 of these Rules, respectively;
II. Bylaws of the third party or any other equivalent document, in which it is provided that it can carry out as part of its object the services subject to contracting;
III. Approval of the board of directors of the Clearing House for Card Payments, in which it must be stated that:
a) The contracting does not put at risk the compliance with the applicable provisions to the Clearing House for Card Payments, and b) The business practices of the third party are consistent with the operation of the Clearing House for Card Payments.
The documentation supporting the aspects provided for in this fraction must be kept at all times available to the Bank of Mexico.
IV. Documents that accredit the experience, technical capacity and human resources of the third party with respect to the services subject to contracting, as well as the requirements that the governing body of the third party must meet for taking administrative, financial, operational or legal decisions, which may affect the provision of the service;
V. Procedure that the third party offers to the Clearing House for Card Payments to identify, measure, monitor, limit, control, inform and disclose risks that may arise from the provision of its services;
VI. Mechanisms for the resolution of disputes between the Clearing House for Card Payments and the third party, relative to the contract or legal instrument they have celebrated;
VII. Procedure to evaluate the performance of the third party in the provision of services and the compliance with its contractual obligations;
VIII. Tariffs that the third party will charge for its services to the Clearing House for Card Payments;

(First Section) OFFICIAL GAZETTE Tuesday, October 7, 2014
IX. General operating plan of the service that the third party will provide, which contemplates the information referred to in subsections a), b), c), d), g), g) Bis and, in its case, h), of fraction VI of Rule 2nd of these Rules, and
X. That additional documentation, information and certifications that the Bank of Mexico requests.
The documentation referred to in this Rule must be at all times available to the Bank of Mexico, at the address of the central administration of the Clearing House for Card Payments in the national territory.
In the event that the documentation referred to in this Rule is written in a language other than Spanish, when the Bank of Mexico so requires, it must be presented together with its corresponding official translation duly legalized.

16th Bis 2. Third parties residing abroad.- In the event that the Clearing Houses for Card Payments celebrate a contract or legal instrument with third parties, whose provision of the service is carried out totally or partially outside the national territory, in addition to the requirements established in the previous Rule, the Clearing Houses for Card Payments must:
I. Accredit that the third parties reside in countries whose internal law provides protection to the data of persons, safeguarding their confidentiality, or that they maintain subscribed international agreements with Mexico in matters of personal data protection or that allow the exchange of information between competent authorities abroad;
II. Additionally provide in the instrument in which the approval of the board of directors referred to in fraction III of Rule 16th Bis 1 above is recorded, that there will be no impact on the financial stability or operational continuity of the Clearing House for Card Payments, due to the geographical distance and, in its case, the language that will be used in the provision of the service, and
III. Have technical support schemes that allow solving problems and incidents independently of the differences that, in their case, exist in time zones and business days.
The documentation referred to in this Rule must be at all times available to the Bank of Mexico, at the address of the central administration of the Clearing House for Card Payments in the national territory.
In the event that the documentation referred to in this Rule is written in a language other than Spanish, when the Bank of Mexico so requires, it must be presented together with its corresponding official translation duly legalized.
Additionally, in the event that any authority of the third party's country of origin requests information related to the services it provides to the Clearing House for Card Payments, said Clearing House for Card Payments must inform the Bank of Mexico regarding such situation immediately after it has knowledge and must provide it with a copy of the information that the third party has delivered to the authority of its country of origin.

16th Bis 3. Resolution.- Once the third-party authorization request contains the corresponding documentation and information, the Bank of Mexico will analyze if, based on it, it is appropriate to grant the authorization in question and must inform its decision within a period not exceeding ninety natural days. In the event that, after the period indicated in the previous paragraph, the Bank of Mexico does not communicate its decision to the petitioner, it will be understood that its request has been denied.

16th Bis 4. Modifications to documentation.- The Clearing Houses for Card Payments must obtain prior and written authorization from the Bank of Mexico, through a request submitted to the Directorate of Authorizations, Queries and Legal Control, to make any modification to the contract or legal instrument they have celebrated with the third party, to the criteria and procedures for selecting it, to the procedures for monitoring and evaluating its performance, as well as to the general operating plan of the service that the third party will provide.

Tuesday, October 7, 2014 OFFICIAL GAZETTE (First Section)

Likewise, they must inform the Bank of Mexico, through the aforementioned Management, regarding any reform to the corporate purpose of the third party or internal organization, that could affect the provision of the service, with at least five banking business days in advance of their implementation.

16th Bis 5. Liability.- Card Payment Clearing Houses will be liable at all times for the services provided by third parties, even when these are carried out under terms different from those agreed. Likewise, Card Payment Clearing Houses will be liable for the actions of third parties that result in non-compliance with applicable provisions. The foregoing shall proceed without prejudice to the civil, administrative, or criminal liabilities that said third parties may incur for violations of applicable legal provisions.

The provisions of this Rule must be expressly provided for in the contract or legal instrument entered into between the Card Payment Clearing House and the third party.

16th Bis 6. Suspension of service provision.- Card Payment Clearing Houses must refrain from continuing the provision of the service by the third party when they observe changes in its operation that could affect compliance with the Conditions for Interchange between Clearing Houses, or when they identify non-compliance by the third party with applicable regulations.

Card Payment Clearing Houses that provide their services through a third party must provide in the business continuity plan referred to in subsection e), fraction X, of the 2nd of these Rules, the actions they will carry out to continue providing the service on their own in the event of the suspension or termination of the service provision through the third party.

Card Payment Clearing Houses must inform the Bank of Mexico about the suspension or termination of the service provision through the third party, the causes that motivated it, as well as the actions they are undertaking for the continuity of service provision, within five banking business days following its occurrence.”

“Chapter Fourth
Supervision and sanctions”

“17th. Supervision.- …
I. to II. …
III. Carry out inspections or request information to verify the operating plan of the respective Card Payment Clearing House;
IV. Issue recommendations regarding the operation of Card Payment Clearing Houses, and
V. Require the Card Payment Clearing House to provide opinions and other reports prepared by an external auditor approved for this purpose by the Bank of Mexico, regarding audits carried out with respect to said Clearing House or any of the third parties, which the Bank of Mexico itself approves for this purpose.

The Bank of Mexico, in the exercise of its supervisory powers, may at any time require Card Payment Clearing Houses to update or modernize the technologies that they, on their own or through third parties hired in accordance with what is provided in Chapter Third of these Rules, use for the development of their corporate purpose or the provision of the service, respectively.

With respect to third parties hired by a Card Payment Clearing House for the provision of their services in accordance with the provisions of these Rules, the requirements, observations, or corrective measures resulting from the supervision carried out by the Bank of Mexico in terms of these Rules, will be made directly to the Card Payment Clearing House.

Likewise, in terms of what is provided in Rule 16th Bis 1, fraction I, subsection d), the Bank of Mexico may at any time require the third party to be audited by the external auditor of the Card Payment Clearing House, for which it will specify the aspects that must be covered. The Card Payment Clearing House in question will be obligated to present to the Bank of Mexico the report prepared by said external auditor as a result of the audit.”

(First Section) OFFICIAL GAZETTE Tuesday, October 7, 2014 “18th. Sanctions.- The Bank of Mexico will sanction the Card Payment Clearing House, with a fine imposed in terms of what is provided in the Law for Transparency and Order of Financial Services, when the Card Payment Clearing House itself or the third party with which the latter has entered into a contract or any other legal instrument for the provision of services related to its corporate purpose, infringe any of the provisions provided in these Rules and in the Conditions for Interchange between Clearing Houses.

Taking into account the circumstances of the specific case, the Bank of Mexico, in addition to imposing the corresponding fine, if applicable, may limit or partially suspend the carrying out of operations of the Card Payment Clearing Houses, or the provision of the service through the third party that the Card Payment Clearing House in question has hired, for infringing the provisions established in these Rules or in the Conditions for Interchange between Clearing Houses in a repeated or serious manner.”

“19th. Limitation or suspension of operations.- The Bank of Mexico will notify the Card Payment Clearing House to which a limitation or partial suspension to the carrying out of Routing, Clearing, or Settlement operations, or, in its case, to the provision of services by a third party that the Card Payment Clearing House in question has hired, in accordance with the 18th of these Rules, at least 40 banking business days in advance of the date from which it will cease to provide the services that the Bank of Mexico has partially limited or suspended.

Such Card Payment Clearing House must inform its Participant clients and the rest of the Card Payment Clearing Houses, no later than the next banking business day after receiving said notification or any other related to the non-compliance with these Rules. Likewise, the Bank of Mexico will make public the limitations or suspensions of operations it imposes.”

“20th. Revocation.- …
I. to III. …
IV. Have presented to the Bank of Mexico, as part of the authorization requests referred to in these Rules or in response to information requests made by it in accordance with these Rules, false documents or declarations;
V. Make modifications to the contract or legal instrument it has entered into with any of the third parties provided for in Chapter Third of these Rules, without the authorization of the Bank of Mexico;
VI. The Card Payment Clearing House, or in its case, the third party it has hired in accordance with what is provided in Chapter Third of these Rules, cease to meet the necessary requirements for the granting of authorization;
VII. The third party hired by the Card Payment Clearing House ceases to reside in countries whose internal law provides protection for personal data, safeguarding its confidentiality, or that maintain international agreements with Mexico in matters of personal data protection or that allow the exchange of information between authorities, when the provision of the service is carried out totally or partially outside national territory or by residents abroad;
VIII. The Card Payment Clearing House or, in its case, the third party it has hired enters into a process of dissolution and liquidation;
IX. The Card Payment Clearing House, or in its case, the third party it has hired is declared in commercial bankruptcy by a judicial authority, or
X. The Card Payment Clearing House, or in its case, the third party it has hired commits serious infractions or is a repeat offender.”

Tuesday, October 7, 2014 OFFICIAL GAZETTE (First Section) “21st. Recidivism or serious infractions.- For the purposes of the limitation, suspension, or revocation provided for in these Rules, the Card Payment Clearing House will be considered a repeat offender if, having incurred in an infraction that has been sanctioned, for actions of the Card Payment Clearing House itself or for actions of the third party it has hired, it commits another infraction of the same type or nature within the two immediate years following the date on which the corresponding resolution became final.

For the purposes of these Rules, serious infractions to these Rules will be considered those when Card Payment Clearing Houses:
I. Do not have a board of directors in terms of Rule 2nd, fraction II, subsections c) and d);
II. Carry out a transmission of shares representing their share capital in violation of what is provided by Rule 2nd, fraction II, subsection e);
III. Modify their internal rules or contracts, without the authorization of the Bank of Mexico, in contravention of Rule 5th, first paragraph;
IV. Conduct tied sales, violating in consequence what is provided in Rule 10th, fraction I;
V. Obstruct the link with other Card Payment Clearing Houses, in accordance with Rules 9th and 12th;
VI. Make charges for the basic services of Routing, Clearing, and Settlement without the authorization of the Bank of Mexico in terms of Rule 15th;
VII. Do not inform the Bank of Mexico in a timely manner regarding modifications to the corporate purpose of the third party that, in its case, they hire, their internal organization, or the procedures or internal rules of said third party that could affect the provision of the service subject to the contract, in contravention of what is established in Rule 16th Bis 4, second paragraph, and
VIII. Make changes to the criteria and procedures for selecting the third party referred to in Chapter Third, to the policies and procedures for monitoring and evaluating its performance, as well as to the general operating plan of the service it will provide, without the prior authorization of the Bank of Mexico, in violation of what is established in Rule 16th Bis 4, first paragraph;

Likewise, serious infractions attributable to Clearing Houses will be considered those related to the provision of services by third parties they have hired in terms of these Rules, the violation of what is provided in the following Rules:
I. The third party prevents the carrying out of home visits by Bank of Mexico personnel or the carrying out of audits, or obstructs their development, in contravention of what is provided in Rule 16th Bis 1, fraction I, subsections b) and d);
II. The third party does not carry out the provision of the service in compliance with the Conditions for Interchange between Clearing Houses, authorized by the Bank of Mexico, in violation of what is established in Rule 16th Bis 1, fraction I, subsection a);
III. The third party fails to comply with the obligation to keep confidential information related to the operations it carries out under the contract or legal instrument it has entered into with the Card Payment Clearing House, in violation of what is provided in Rule 16th Bis 1, fraction I, subsection g);
IV. The third party subcontracts the provision of the service, contrary to what is provided in Rule 16th Bis 1, fraction I;
V. The security guidelines or the continuity plan that the third party has do not comply with what is established in Annexes 1 and 2 of these Rules, respectively, contrary to what is established in Rule 16th Bis 1, fraction I, subsection h), or
VI. The third party does not carry out the update or modernization of the technologies it uses for the provision of the contracted services, in violation of what is provided in Rule 17th, second paragraph.”

(First Section) OFFICIAL GAZETTE Tuesday, October 7, 2014 “ANNEX 1 SECURITY MEASURES A. SECURITY MEASURES FOR THE TRANSMISSION, STORAGE, AND PROCESSING OF INFORMATION Card Payment Clearing Houses must implement security measures or mechanisms in the transmission, storage, and processing of information, so that it is not known by persons unrelated to it. For these purposes, they must comply with the following:

1. Encrypt messages or use encrypted communication means, in the transmission of sensitive information (cardholder personal information containing names, addresses, phone numbers, together with card numbers, account numbers, credit limits, balances, or authentication information) of the Cards and their operations, from the device where the transaction originates until its receipt for authorization by the Issuers.

For the purposes of the foregoing, they must use technologies that handle encryption schemes and require the use of cryptographic keys to mitigate the risk of third parties accessing the information in question.

2. Ensure that cryptographic keys and the encryption and decryption process are installed in high-security devices, such as those known as HSM (Hardware Security Module), which must have administration practices that prevent unauthorized access and disclosure of the information they contain.

3. Have controls for access to the databases and files corresponding to the operations and services carried out through the Card Payment Clearing Houses, even when said databases and files reside in backup storage media. For the purposes of the foregoing, they must comply with the following:

a. Access to databases and files will be permitted exclusively to expressly authorized persons, based on the authorizations granted for this purpose by the respective Card Payment Clearing House. When such accesses are granted, a record of such circumstance must be made, indicating the purposes and the period to which the accesses are limited.

b. With respect to accesses made remotely, encryption mechanisms must be used in communications.

c. They must have secure procedures for the destruction of storage media for databases and files containing sensitive cardholder information, which prevent their restoration through any mechanism or device.

d. They must develop policies related to the use and storage of information that is transmitted and received, resulting from the corresponding services, being obligated to verify the compliance of their policies by their providers and affiliates.

4. Generate records, logs, and audit trails of the operations and services performed, in which at least the date and time and other information allowing the identification of the largest number of elements involved in the access and operation of Card Payments are recorded. Said records, logs, and audit trails may be reviewed by Bank of Mexico personnel, regarding which corrections may be requested at any time.

5. Store the information involved in Card Payment processing services, including the records, logs, and audit trails mentioned in the previous item 4, securely for a minimum period of one hundred eighty natural days counted from their generation and contemplate mechanisms to prevent their alteration, as well as maintain internal control procedures for their access and availability. The foregoing, without prejudice to what is established in the provisions applicable to them.

6. Carry out security reviews, focused on verifying the sufficiency of controls applicable to the processing and telecommunications infrastructure for Card Payments. The reviews must be carried out at least annually, or when significant changes occur to said infrastructure, and must include the following:

Tuesday, October 7, 2014 OFFICIAL GAZETTE (First Section)

a. Configuration and access controls to the processing and telecommunications infrastructure. b. Updates required for operating systems, certificates, keys, and software in general.
c. Vulnerability analysis of the processing and telecommunications infrastructure, and systems.
d. Identification of possible unauthorized modifications to the original software. e. Identification of possible tools or procedures that allow knowing the information of the Cards or of the cardholders, as well as any information that could be obtained directly or indirectly to carry out Card Payments without the knowledge or consent of the cardholder. f. Methodical analysis of the infrastructure, certificates, keys, and software in general, with the purpose of detecting errors, unauthorized functionality, or any code that puts or could put at risk the information of the cardholders.

7. Have preventive, detection, deterrent measures, and incident response procedures, information security controls, and security measures to mitigate threats and vulnerabilities related to the services provided by the Card Payment Clearing House that could affect Participants. Said measures and procedures must be evaluated by internal or external audits to determine their effectiveness and, if applicable, carry out the corresponding updates. In case that the existence of vulnerabilities and associated risks to the mentioned services is detected, measures must be taken in a timely manner to prevent Participants from being affected.

8. In case that sensitive information is extracted, lost, or if they suppose or suspect any incident involving unauthorized access to said information, they must:

a. Send in writing to the Payment Systems Directorate of the Bank of Mexico within five natural days following the event in question, the information contained in Section B of this Annex.

b. Carry out an immediate investigation to determine if the information has been or may be misused, and in this case, they must notify this situation, within the following three business days, to the board of directors of the Card Payment Clearing House or to the Participants to whom they provide services, in order to warn them of the risks derived from the misuse of the information that has been extracted, lost, or compromised, informing said Participants of the measures they must take. Likewise, they must send to the Payment Systems Directorate of the Bank of Mexico the result of said investigation within a period not greater than five natural days after its conclusion.

B. REPORT OF INFORMATION LOSS EVENTS MANAGED, TRANSMITTED, OR PROCESSED BY CARD PAYMENT CLEARING HOUSES AND THIRD PARTIES.

I. Information of the Card Payment Clearing House or the Participant

1. Name of the Participant
2. Address of the office(s) or establishment(s) where the information security incident occurred
   2.1. City
   2.2. State
   2.3. Postal Code
   II. Information of the information security incident
3. Brief description of the information security incident
4. Compromised information

(First Section) OFFICIAL GAZETTE Tuesday, October 7, 2014

Debit account numbers
Expiration date, service code, validation code (CVC2 or CVV2) Credit account numbers Expiration date, service code, validation code (CVC2 or CVV2)
3. Number of Affected Cards.
Number of Affected Cards
Number of Blocked or Suspended Affected Cards
Comments
Attach to the report the disaggregated affected Cards digitally as indicated in the following table:
Affected Card Number Status of the Affected Card (blocked, suspended, active) Comments
4. Date or period in which the information security incident occurred
5. Total amount in pesos known or estimated involved in the information security incident, if applicable
6. Classification of the information security incident:

a. Intrusion into computer equipment [ ] b. Credit cards [ ]
c. Debit cards [ ]
d. Theft of databases [ ] e. Others [ ]

7. Amount of damage in pesos, if applicable
8. Amount recovered in pesos, if applicable
9. Has the information security incident been disclosed to any local or federal authority?
   [ Yes ] [ No ]
   If affirmative:
   To which authority?
   On what date?
   III. Contact at the Card Payment Clearing House or at the Participant
10. Name of the person authorized to provide information to the Authority
11. Position held
12. Phone
13. Email
    ______________________________”

Tuesday, October 7, 2014 OFFICIAL GAZETTE (First Section)

“ANNEX 2
BUSINESS CONTINUITY PLAN
FIRST SECTION
GENERAL PROVISIONS

Card Payment Clearing Houses must have a business continuity plan in accordance with the provisions of this Annex, the purpose of which shall be the restoration of processes in the event of an operational contingency. For the purposes of this Annex, an operational contingency shall be understood as any event that hinders or disables the Card Payment Clearing House from providing services or carrying out its Routing, Clearing, or Settlement processes, and which results in damage or loss to the Card Payment Clearing Houses themselves or to the Participants.

The General Management of the Card Payment Clearing House shall be responsible for the proper implementation and continuous updating of the business continuity plan, and therefore shall be in charge of drafting, reviewing, and updating said plan. To this end, it must propose to the Board of Directors the approval of said business continuity plan, as well as its update at least once a year.

Likewise, the General Management shall be responsible for:

I. Subjecting the business continuity plan to effectiveness tests regularly in order to ensure its timely update.

II. Disseminating the plan within the Card Payment Clearing House. To this effect, it must establish a training program for personnel participating in both the processes identified as critical and in the development of the plan itself.

III. Designing and carrying out a communication policy regarding the occurrence of operational contingencies, which must be part of the business continuity plan. This policy must provide for the timely reporting to the Board of Directors of the Card Payment Clearing House regarding the occurrence of operational contingencies.

IV. Providing for the necessary measures to inform the Bank of Mexico, by any available means, of the operational contingencies that occur in any of its systems, provided that such contingencies last at least 30 minutes.

In any case, the aforementioned notification must be made within 60 minutes following the emergence of the corresponding operational contingency.

In the notification referred to in this section, the date and time of the start of the operational contingency, an indication of whether it is ongoing or has concluded and its duration, the affected processes, systems, and channels, as well as a description of the event that occurred, must be stated.

Likewise, the Card Payment Clearing House must send to the Payment Systems Directorate of the Bank of Mexico, within a period not exceeding fifteen calendar days following the conclusion of the operational contingency, an analysis of the causes that motivated it, the impact caused in qualitative and quantitative terms, including the monetary impact, as well as an indication of the actions that will be implemented to prevent its recurrence.

V. Develop methodologies to estimate the quantitative and qualitative impacts of operational contingencies, for use in the impact analysis provided for in the Second Section of this Annex, as well as in the evaluation referred to in the following subsection VI.

(The effectiveness of the methodologies must be verified annually by comparing their estimates against the operational contingencies actually observed, and, where applicable, the necessary corrections shall be carried out; in any case, the result of such comparison must be presented to the Board of Directors.)

VI. Review the application of the business continuity plan through audits, evaluating its efficiency and effectiveness.

VII. Inform the Board of Directors, at least once a year, about the status of the business continuity plan. The report must contain an evaluation of the sufficiency and continuous relevance of the business continuity plan, its adequate dissemination among the relevant areas, and the identification, where applicable, of the necessary adjustments for its update and strengthening, as well as the consequences that the realization of identified risks would generate for the business.

SECOND SECTION
MINIMUM REQUIREMENTS OF THE BUSINESS CONTINUITY PLAN

I. Card Payment Clearing Houses, prior to the development of the business continuity plan, must carry out a business impact analysis that:

a) Identifies the critical processes considered indispensable for the continuity of operations.

b) Determines the minimum human, logistical, material, technological infrastructure, and any other nature resources necessary to maintain and restore the services and processes of the Card Payment Clearing Houses in the event of an operational contingency, as well as at its conclusion.

c) Develops relevant scenarios regarding the verification of possible operational contingencies, such as:

i. Natural and environmental disasters.

ii. Infectious diseases.

iii. Cyberattacks or attacks on computer activity.

iv. Sabotage.

v. Terrorism.

vi. Interruptions in energy supply.

vii. Failures or unavailability in technological infrastructure (telecommunications, information processing, and networks).

viii. Unavailability of human, material, or technical resources.

ix. Interruptions in services provided by third parties.

d) Estimates the quantitative and qualitative impacts of operational contingencies, based on the scenarios defined for each process and through the methodologies referred to in the First Section, subsection V of this Annex, approved for this purpose by the Board of Directors of the Card Payment Clearing House.

e) Defines the recovery priority for each of the processes identified as critical.

f) Determines the Recovery Time Objective (known as RTO, from its English acronym), for each of the processes identified as critical.

g) Establishes, where applicable, the Recovery Point Objective (known as RPO, from its English acronym) understood as the maximum tolerable data loss for each of the processes identified as critical.

h) Identifies and evaluates risks related to data processing and transmission processes, as well as those related to the custody and safeguarding of information of the Card Payment Clearing House.

i) Determines risks derived from the geographic location of the main data processing centers and operation of the processes identified as critical pursuant to subsection a) of this section, to ensure that alternate data processing and operation centers are not exposed to the same risks as the main ones.

II. In the development of the business continuity plan, Card Payment Clearing Houses must incorporate the following strategies:

a) Prevention, which will include at least the determination, based on the analysis referred to in the previous subsection I, of actions and procedures related to:

i. Reducing the vulnerability of processes and services to operational contingencies.

ii. The availability of the human, financial, material, technical, and technological infrastructure resources necessary to act promptly in the event of an operational contingency.

iii. The establishment of a testing program that evaluates all stages and components of the business continuity plan, which must be updated at least annually, or earlier if there is a significant change in the technological infrastructure, processes, products and services, or internal organization of the Card Payment Clearing House.

iv. The training program referred to in this Annex.

v. The communication policy referred to in this Annex, which must address all stages of operational contingencies, from their occurrence and containment to their resolution and evaluation.

vi. Procedures for recording, attending to, following up, and disseminating to relevant personnel the findings, incidents, or observations resulting from tests conducted on the business continuity plan or from the execution of the plan itself in the event of an operational contingency.

b) Contingency, which will include the definition of authorized response actions and procedures for:

i. Promptly identifying the nature of operational contingencies affecting the processes identified as critical by the Card Payment Clearing House.

ii. Containing the effects of operational contingencies on the processes identified as critical and favoring the restoration of operations to the required levels of functioning based on what is established in subsections f) and g) of subsection I above.

c) Restoration, which will include the definition of actions and procedures for the services and processes of the Card Payment Clearing House to return to minimum service levels and eventually to normality, including mechanisms for updating and reconciling information, observing the standards established in subsections f) and g) of subsection I above.

d) Evaluation, which will include the collection and analysis of relevant information regarding the development of the operational contingency and the actions and procedures followed for its prevention, containment, and restoration in order to, where applicable, make the necessary adjustments to the business continuity plan.

When defining the different actions and procedures referred to in this subsection, the Card Payment Clearing House must at all times clearly determine the responsible personnel, as well as provide for their replacement or substitution in case the incumbents are unable to carry out what the business continuity plan establishes.

THIRD SECTION
CHARACTERISTICS OF PROCESSING SITES

Each Card Payment Clearing House must have two processing sites, one primary and one backup, which must have the capacity to respond to requests and connect with new Card Payment Clearing Houses. Both processing sites must be linked to the corresponding systems of the other Card Payment Clearing Houses with which it must, in turn, be linked, under the conditions established in the 9th of these Rules. These links (primary and backup) must have the following characteristics:

I. Be dedicated;

II. Be contracted with at least two different telecommunications providers;

III. Comply with the requirements set forth in the Conditions for Exchange between Clearing Houses that the Bank of Mexico authorizes or, where applicable, establishes, regarding the capacity to transport the information flow estimated to be exchanged between the Card Payment Clearing Houses it connects, taking into account the growth in information flow, and

IV. Maintain their proper functioning.”

TRANSITORY PROVISION

SINGLE. This Circular shall enter into force on the third banking business day following its publication in the Official Gazette of the Federation.

Mexico, D.F., October 3, 2014.- The General Director of Payment Systems and Corporate Services, Lorenza Martínez Trigueros.- Signature.- The General Legal Director, Luis Urrutia Corral.- Signature.

For any inquiries regarding the content of this Circular, please contact the Authorization, Consultations, and Legal Control Management, at phones (55) 5237-2308, (55) 5237-2317, or (55) 5237-2000 Ext. 3200.