Circular 18/2018 — Amendments to Circular 14/2017 Regarding SPEI Rules on Risk Mitigation

Monday, December 24, 2018 OFFICIAL GAZETTE (First Section) BANK OF MEXICO CIRCULAR 18/2018 addressed to participants of the Interbank Electronic Payment System and other interested parties in acting with such character, regarding reforms to the Rules of the Interbank Electronic Payment System (SPEI), in matters of Risk Mitigation. At the margin a logo, which says: Bank of Mexico. CIRCULAR 18/2018 TO THE PARTICIPANTS OF THE INTERBANK ELECTRONIC PAYMENT SYSTEM AND OTHER INTERESTED PARTIES IN ACTING WITH SUCH CHARACTER: SUBJECT: REFORMS TO THE RULES OF THE INTERBANK ELECTRONIC PAYMENT SYSTEM (SPEI), IN MATTERS OF RISK MITIGATION. The Bank of Mexico, in its capacity as administrator of the Interbank Electronic Payment System (SPEI), with the purpose of continuing to promote the good functioning of payment systems and the sound development of the financial system, as well as the protection of public interests, has considered it necessary to establish measures to clarify the treatment that participants of said system must give to client accounts that offer services for the professional buying and selling of virtual assets, for the prevention of risks related to the handling of resources derived from unauthorized transfers of funds legitimately and additionally. In particular, the aforementioned measures allow for the full identification of clients associated with remote acquisitions of this type of asset under schemes used in other platforms that allow the buying and selling of other types of assets remotely. In this way, the referred measures seek to strengthen the objectives pointed out by the cited rules, consisting of robustifying the security of participants in the SPEI, comprehensively, as well as promoting greater benefits to the general population, by establishing homogeneous practices on the treatment that must be given to client accounts that may imply higher risk, with the purpose of fostering appropriate conditions for an adequate risk control environment that provides certainty and confidence both to participants and to users. For the above reason, the Bank of Mexico, based on articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 2, fractions I, IV and VIII, and 6 of the Payment Systems Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, fourth and seventh paragraphs, 10, first paragraph, 12, first paragraph in relation to 20, fraction XI, and 14 Bis, first paragraph in relation to 17, fraction I, of the Internal Regulations of the Bank of Mexico, which grant it the attribution to issue provisions through the General Directorate of Operations and Payment Systems and the General Legal Directorate, respectively, as well as Second, fractions VI and X, of the Agreement on the Attachment of Administrative Units of the Bank of Mexico, has resolved to modify fraction I, last paragraph, of Article 58th, and fraction I Bis, of Article 72nd, add a new fraction V and a last paragraph to Article 59th Bis, as well as repeal fraction VI, of Article 59th Bis of the Rules of the Interbank Electronic Payment System, contained in Circular 14/2017, to remain in the following terms: RULES OF THE INTERBANK ELECTRONIC PAYMENT SYSTEM “Article 58th. Requirements for Admission as Participant.- … I. … A. …

(First Section) OFFICIAL GAZETTE Monday, December 24, 2018 … B. … … In addition to what is previously established in this fraction, the interested party wishing to act as a Participant must have a documented policy and procedures that they commit to follow in matters of trust and integrity tests that they must apply to those members of their personnel, as well as to third parties who provide information and communication technology services, who have access to relevant information and systems in the operation with the SPEI. What is provided in this Rule will not be applicable in the case where the Participant is the Bank of Mexico, in its capacity as trustee of any trust without organizational structure or an operator of an international system for the settlement of foreign exchange operations that include the peso as one of the participating currencies. …” Article 59th Bis. SPEI Information Security Officer.- … I. to IV. … V. Inform the participant’s audit committee and risk committee or the bodies exercising such functions, in the session immediately following the verification of the irregular event, circumstance or threat referred to in the previous Rule 46th, regarding the actions taken and the follow-up to measures to prevent or avoid the recurrence of the mentioned incidents. … What is provided in this Rule will not be applicable in the case where the Participant is the Bank of Mexico, in its capacity as trustee of any trust without organizational structure or an operator of an international system for the settlement of foreign exchange operations that include the peso as one of the participating currencies.” “Article 72nd. Permanence Requirements in Matters of Additional Risks.- … I. … I Bis. … With respect to the Clients referred to in this fraction, the Client Accounts that Participants maintain for them may only correspond to demand deposit accounts opened at credit institutions, popular financial societies, community financial societies, or savings and loan cooperatives, regarding which Participants collect the same documentation and identification data that the general provisions referred to in Article 115 of the Credit Institutions Law establish for level 4 accounts offered by said institutions. Without prejudice to what is provided in the previous paragraph, each Participant must refrain from opening to any of the Clients indicated in this fraction Series of Client Accounts, linked to a particular Client Account opened in the name of said Client, which this client can, in turn, offer to its users for sending or receiving fund transfers through the SPEI in favor of said Clients. As an exception to what is provided in this paragraph, Participants may open the referred Client Accounts only in the following cases where said Clients demonstrate to the satisfaction of the Participants:

Monday, December 24, 2018 OFFICIAL GAZETTE (First Section) a) Client Accounts in which the sum of credits made to each of them, as a result of the respective fund transfers, does not exceed, during a calendar month, the equivalent in national currency to three thousand UDIS and that, additionally, meet the following characteristics:

1. Participants collect, directly or through their respective Clients, the same documents and identification data of those users in whose favor they open said Client Accounts, corresponding to those that the general provisions referred to in Article 115 of the Credit Institutions Law require for level 2 demand deposit bank accounts, and
2. Clients enter into contracts with the respective users for the use of the referred Client Accounts, either in person or, if applicable, remotely, provided that, in the latter case, Clients comply with the same requirements and obligations established for Credit Institutions for the opening of level 2 demand deposit accounts set forth in Title Two, Chapter II, Second Section, Subsection B, of the “General Provisions applicable to credit institutions” issued by the National Banking and Securities Commission. b) Client Accounts in which the sum of credits made to each of them, as a result of the respective fund transfers, exceeds, during a calendar month, the equivalent in national currency to three thousand UDIS and that, with respect to said accounts, Participants comply with the same characteristics indicated in numerals 1. and 2. of subsection a) above. Additionally, in those cases where the referred Clients celebrate, remotely, the contracts indicated in numeral 2. of subsection a) above, said Clients must obtain the advanced electronic signature of each of the respective users backed by a valid certificate issued in terms of what is provided in Article 17-D of the Federal Tax Code. In the cases referred to in subsections a) and b) of this fraction I Bis, Participants may only allow the opening of no more than one of the referred Client Accounts per individual user. Additionally, Participants may only receive or send, through the SPEI, fund transfers from or to the referred Client Accounts, provided that said transfers come from or are directed to those other Client Accounts that correspond to demand deposit accounts opened at a Credit Institution, popular financial society, community financial society, or savings and loan cooperative, whose holder is the same user to whom the Client assigned said Client Account. The Participant referred to in this fraction I Bis will be responsible for compliance with the requirements established in this same fraction. …” TRANSITORY PROVISIONS FIRST. What is provided in this Circular will enter into force on the twentieth Banking Business Day immediately following the date of its publication in the Official Gazette of the Federation. SECOND. Those Participants who have obtained authorization from the Bank of Mexico to comply with what is provided in Rule 72nd, fraction I Bis, within a period subsequent to that indicated in Transitory Rule First of Circular 11/2018, issued by the same Bank of Mexico and published in the Official Gazette of the Federation on July 27, 2018, must observe what is provided in said Rule no later than from the day indicated in Transitory Rule First of this Circular.

(First Section) OFFICIAL GAZETTE Monday, December 24, 2018 Mexico City, December 19, 2018.- The General Director of Operations and Payment Systems, Jaime José Cortina Morfín.- Rubric.- The General Legal Director, Luis Urrutia Corral.- Rubric. For any consultation regarding the content of this Circular, please contact the Central Banking Authorizations and Consultations Department, at phones (55) 5237-2308, (55) 5237-2317 or (55) 5237-2000 Ext. 3200.