Circular 19/2023 — Modifies Circular 4/2012

Thursday, December 21, 2023 OFFICIAL GAZETTE 121 BANK OF MEXICO CIRCULAR 19/2023, addressed to credit institutions, brokerage houses, investment funds, multiple-object financial societies that have equity links with a Multiple Banking Institution, General Deposit Warehouses, Insurance Institutions and the National Financial Development Institution for Agriculture, Rural, Forestry and Fisheries, regarding the Modifications to Circular 4/2012 (Requirements for entities intending to carry out Derivative Operations).

A logo appears at the margin, which says: Bank of Mexico.- “2023, Year of Francisco Villa, the revolutionary of the people”.

CIRCULAR 19/2023

TO CREDIT INSTITUTIONS, BROKERAGE HOUSES, INVESTMENT FUNDS, MULTIPLE-OBJECT FINANCIAL SOCIETIES THAT HAVE EQUITY LINKS WITH A MULTIPLE BANKING INSTITUTION, GENERAL DEPOSIT WAREHOUSES, INSURANCE INSTITUTIONS AND THE NATIONAL FINANCIAL DEVELOPMENT INSTITUTION FOR AGRICULTURE, RURAL, FORESTRY AND FISHERIES:

SUBJECT: MODIFICATIONS TO CIRCULAR 4/2012 (REQUIREMENTS FOR ENTITIES INTENDING TO CARRY OUT DERIVATIVE OPERATIONS)

The Bank of Mexico, with the purpose of continuing to promote the sound development of the financial system, considers it appropriate to adjust the requirements for the celebration of derivative operations, taking into account the recommendations and principles in matters of risk administration and control established by the Basel Committee on Banking Supervision and European regulation, as well as various aspects identified in the exercise of supervisory powers.

For the above, based on Articles 28, sixth and seventh paragraphs, of the Political Constitution of the United Mexican States, 24, 26, 27 and 36 of the Bank of Mexico Law, 46, fraction XXV, and 48 of the Credit Institutions Law, 176, first paragraph, of the Securities Market Law, 15, second paragraph, of the Investment Funds Law, 11 Bis 2, fraction XII, and 87-D, fourth paragraph, of the General Law of Organizations and Auxiliary Credit Activities, 133 of the Insurance and Surety Institutions Law, 9, second paragraph, of the Organic Law of National Financiera, 6, second paragraph, of the Organic Law of the Federal Mortgage Society, 9, second paragraph, of the Organic Law of the Bank of Well-being, 9, second paragraph, of the Organic Law of the National Foreign Trade Bank, 10, second paragraph, of the Organic Law of the National Bank of Public Works and Services, 8, second paragraph, of the Organic Law of the National Bank of the Army, Air Force and Navy, 22 of the Law for the Transparency and Ordering of Financial Services, 4th, first paragraph, 8th, fourth and eighth paragraphs, 10, first paragraph, 17, fraction I, and 25 Bis 1, fraction IV, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the Directorate of Central Banking Regulations and the Directorate of Regulation and Supervision, respectively, as well as Second, fractions I and X, of the Agreement on the Affiliation of the Administrative Units of the Bank of Mexico, has resolved to modify Annex 1 of the “Rules for the carrying out of derivative operations”, issued through Circular 4/2012, to read as follows:

RULES FOR THE CARRYING OUT OF DERIVATIVE OPERATIONS

…

“ANNEX 1 REQUIREMENTS FOR ENTITIES INTENDING TO CARRY OUT DERIVATIVE OPERATIONS

I. ADMINISTRATION REQUIREMENTS

1.- The General Management shall establish and the Board of Directors or the Board of Trustees, as applicable, shall specifically approve:

a) The objectives, goals, policies and general procedures for operation with clients and other intermediaries in the market; b) The global limits of exposure to market, credit, including potential exposure and liquidity, risk, considered acceptable with respect to the celebration of Derivative Operations, and other risks considered acceptable for the Entity. Such exposure limits to risk may be defined with respect to the portfolio to which the positions are associated, which may include operations with debt instruments, foreign exchange transactions, operations with equity instruments, or credits, in addition to derivative products; c) The mechanisms that the Entity will implement for compliance with the risk exposure limits referred to in subsection b), and d) The general process for operating new products, from registration in the trading system to accounting impact, in which at least the market, credit and liquidity risks, as well as their management, associated with the new Derivative Operation in question, must be identified and analyzed. Likewise, the aforementioned process must provide that the Board of Directors or the Board of Trustees be informed regarding each new product that is authorized.

2.- The Risk Committee shall designate and the Board of Directors or the Board of Trustees, as applicable, shall approve an Integrated Risk Management Unit (UAIR), different from the risk-taking areas, dependent directly on the risk committee.

The purpose of the UAIR, in matters of Derivative Operations, shall be:

a) Identify, measure, evaluate and follow up on market, credit (counterparty and credit valuation adjustment), liquidity, operational, such as technological and legal, information security, as well as climate and environmental, and other risks considered relevant for the Entity, arising from these instruments, which must be documented through policies, procedures and methodologies; b) Communicate, as soon as known, to the risk committee and the General Management, any deviation from the established risk exposure limits for operations that manage, transfer, eliminate or mitigate risks; c) Report daily to the General Management, as well as to the business units, and, with the frequency deemed appropriate, to the Board of Directors, on positions in Derivative Operations and consumption of market, credit and liquidity risk exposure limits, and on the risk tolerance levels established by the Entities, and d) Establish the approval mechanisms, by the Board of Directors or the Board of Trustees, as applicable, regarding the general process for the celebration of Derivative Operations of a type other than those already authorized, in a different Market, or with new Underlyings. Such mechanisms must contain, as a minimum, an analysis that allows the identification of risks associated with these new operations, taking into consideration the complexity of the Derivative Operation in question and, if applicable, the type of clientele to whom it is directed.

3.- The General Management and the Risk Committee must be involved, in a systematic and timely manner, in the follow-up of the administration of market, credit (counterparty and credit valuation adjustment), liquidity, operational, such as technological, legal, information security, climate and environmental, as well as other risks considered relevant for the Entity arising from these instruments. Likewise, they must carry out and document a review of the objectives, goals and operation and control procedures, as well as risk tolerance levels, at least with semi-annual periodicity.

Contingency Procedures.

4.- The General Management must have a contingency action procedure that allows it to act when it is detected that policies, procedures, internal controls, the managerial information system or risk tolerance levels are deficient or when violations of applicable laws, norms or circulars occur.

Additionally, a business continuity plan must be in place that guarantees that the operation is not interrupted in the face of unexpected events. The aforementioned business continuity plan must guarantee that the systems used in the alternate center used for the celebration, Confirmation, measurement and Settlement of Derivative Operations can be resumed within a maximum period of two hours once a contingency is identified.

Regarding this, the Entity must perform tests in its alternate operation center, at least, once a year.

5.- The General Management and a committee designated by the Board of Directors must establish the professional conduct standards that will guide the celebration of Derivative Operations by the Entity, as well as the mechanisms for disseminating said standards among the Entity's personnel involved in the celebration and those whose responsibility is the processing and control of Derivative Operations. The aforementioned dissemination mechanisms must be used, at least, annually.

6.- The General Management must implement, taking into account the needs identified due to the job profile and the results of personnel performance evaluations, a continuous training program directed at operators, personnel dedicated to the Confirmation and Settlement of Derivative Operations, risk administration, internal audit, accounting, audit and systems, the content of which must include aspects related to the regulations and internal policies related to Derivative Operations, business continuity plan, and in general, topics related to financial and operational risks associated with these instruments.

II. OPERATION REQUIREMENTS

7.- The different areas responsible for the operation and supervision of the market must have established the objectives, goals and particular operation and control procedures, as well as the maximum acceptable risk tolerances by area, which must be consistent with the general guidelines established by the General Management. Likewise, the acceptable risk exposure limits by area must be approved by the Risk Committee and leave evidence that there is consistency between the global risk limits and the particular limits by area established for these products.

8.- Derivative Operations trading desks will be composed of a manager, with recognized experience in the celebration of Derivative Operations and, at least, two operators, who must have a valid certification related to the celebration of Derivative Operations, issued by a stock exchange, or an association or recognized evaluating entity.

9.- The Entity must have a system that allows the UAIR and the managers of the celebration of Derivative Operations to measure, monitor and supervise, in a systematic and timely manner, the activity of the personnel who carry out the celebration and promotion of Derivative Operations, clearly identifying who carried out the operations in question.

10.- The Entity must have systems that allow operators and promoters to follow up on the positions assigned to them, be able to obtain the theoretical valuation of the Derivative Operations they have celebrated, as well as verify compliance with their market, credit and other risk exposure limits they consider important, prior to and after celebrating new Derivative Operations.

11.- The trading desks, the promotion area and the UAIR must have systems that allow the processing of operations, valuation and real-time risk control, both in the operation and in the support area. Real-time risk control must be of market, credit, liquidity, credit valuation adjustment, and others they consider important, in order to allow timely knowledge of the added risk impact in new operations.

12.- Derivative Operations trading desks, together with the UAIR, must participate in the determination of valuation models consistent with the technology developed to date. These models must be made known to the personnel of the area responsible for confirming and settling the operations, keeping a record of the communication of this particular.

The Entity's Risk Committee must approve the valuation and risk measurement models, as well as their modifications, both to the models and their parameters. Such models must be documented and indicate the corresponding justifications. The Entity must safeguard the aforementioned document with all modifications made.

III. INTERNAL CONTROL REQUIREMENTS

III.1 General.

124 OFFICIAL GAZETTE Thursday, December 21, 2023

13.- The activities and responsibilities of the personnel of the Derivative Operations trading desks, as well as of the areas in charge of confirming and settling said operations, must be adequately defined based on a job profile established by the Entity and assigned to the different administrative units.

Conflicts of interest must be avoided in the areas responsible for the negotiation of operations and support to the operation.

14.- Operation and control manuals must be established in writing, in such a way that they allow the correct execution of the functions and responsibilities of the personnel of the areas involved in the celebration of Derivative Operations, such as: credit, promotion, legal, operation, registration, Confirmation, valuation, Settlement, accounting and risk follow-up of all negotiated operations.

Likewise, the operation and control manuals must contain procedures in case of early termination events, which include default events or settlement agreements, or any other mechanism by which the parties to a certain Derivative Operation have agreed to extinguish their obligations totally or partially in advance.

The aforementioned manuals must be made known to operators, personnel dedicated to the Confirmation and Settlement of Derivative Operations, risk administration, accounting, audit, internal audit and systems.

15.- The Entity must establish internal criteria for a proper analysis, evaluation, selection and approval of limits to clients who wish to participate in the celebration of Derivative Operations considering, among other things, concentration risk.

Additionally, in Derivative Operations carried out with persons other than financial entities, Institutional Investors and Qualified Investors, Entities must: i) qualify Derivative Operations according to the risks they can offer their clients, and ii) define the policies and procedures that allow associating the Derivative Operations they are authorized to celebrate with the needs of their clients. Likewise, Entities must provide their clients with information regarding the characteristics of the Derivative Operation, its potential benefits, risks and costs, as well as any other warning that the client should know.

16.- Procedures must be established that ensure that all negotiated operations are covered by a signed master contract, and are properly documented, confirmed, registered, accounted for and included in all reports that, in accordance with applicable provisions, the Entity must present to its internal bodies and competent authorities.

In Derivative Operations carried out with persons other than financial entities, Institutional Investors and Qualified Investors, Entities must conserve evidence that:

a) They warned the client that the requested operations do not come from a recommendation, informed them of the market risks associated with them, and therefore, that the client would be responsible for having verified that the Derivative Operations in question were consistent with their investment objectives, and b) The client had reiterated the request to contract the service, even after being warned of the above.

17.- Procedures must be established to ensure that Derivative Operations approved by the General Management have adequate operational support for their functioning and control.

18.- Without prejudice to the guidelines established by the Entity itself, an internal audit function must be established which must review, at least once a year, compliance with operation and internal control policies and procedures, as well as adequate documentation of operations, incorporating all Derivative Operations and Underlyings authorized to that Entity, regardless of whether it has or does not have active positions. The internal audit area must review at least:

a) The integrity and veracity of the information stored in the systems used for the celebration, Confirmation, Settlement and risk measurement of Derivative Operations.

Thursday, December 21, 2023 OFFICIAL GAZETTE 125

b) Compliance with policies and procedures for associating Derivative Operations that are authorized to celebrate, with the profile of their clients. c) Compliance with policies and rules defined by the Entity's information security body, for Derivative Operations.

Additionally, the internal audit area must inform the audit committee, in its next regular session, any observation or deviation it identifies in relation to the celebration of Derivative Operations.

19.- Technological infrastructure, including automated data processing systems, risk administration and valuation models, must have adequate backup and control that includes information recovery, in case an operational contingency occurs, up to the moment prior to its occurrence.

III.2 Follow-up.

20.- The UAIR must have daily access to the operation and support systems so that it can measure and evaluate risks arising from operations. Likewise, it must provide daily to the General Management and business units duly verified reports on the maximum exposure limits to market, credit and liquidity risks established by the Entities. These reports must include relevant non-discretionary risk events that may occur, such as operational, technological and legal risk, as well as, if applicable, the status of the risk tolerance levels established in the Entity. Likewise, it must present to the Board of Directors and the Risk Committee, at least in the regular sessions they hold, duly verified reports that correctly and timely show the exposure limits and risk tolerance levels established by the Entities.

III.3 Operation, registration and verification.

21.- Operation manuals must establish policies, procedures and control mechanisms, such as those related to voice recordings and reciprocal Confirmations of all terms of operations agreed between the parties, in order to ensure the truthfulness and authenticity of the negotiated Derivative Operations. In addition, they must establish the necessary procedures to document the registration of incidents in daily operations, including those that have been resolved, and inform the UAIR, at least, weekly and whenever there are important incidents.

Finally, controls must be established to guarantee the sending of Confirmations by other Entities or clients, as well as implement escalation policies, for cases where the Confirmation is not received by the Entity or the client.

22.- All Confirmations must be executed by support personnel and they will be the only ones who can receive Confirmations from counterparties, which must be duly compared with the reports of the personnel of the trading desks or promotion of these Derivative Operations and, in case of doubt, with the voice recording of the day or the record in an electronic or digital medium by which the operation was agreed.

23.- The Entity must establish procedures to verify, at least semi-annually, that active operations are properly documented, registered, accounted for, confirmed and included in all reports that, in accordance with applicable provisions, the Entity must present to its internal bodies and competent authorities.

III.4 Valuation.

24.- Valuation and market, credit and liquidity risk measurement models must be validated by experts who are independent of those who developed said models and of the personnel of the Derivative Operations trading desks, at least once a year, leaving a record of said validation.

In the case of valuation models, the annual validation must be done by type of Derivative Operation and authorized Underlying, including structured notes or combinations of Derivative Operations.

Such validation must include exercises in which the valuation obtained by the expert is shown, contrasting with the Entity's data, for each derivative product and Underlying it has in its portfolio.

126 OFFICIAL GAZETTE Thursday, December 21, 2023 authorization, regardless of whether there are any outstanding operations at the time of validation. These exercises must also include a comparison of the values obtained for market risk, credit risk, liquidity, and others considered relevant.

25.- The Internal Audit Unit (UAIR) must have access to reliable external information sources, enabling it to know market movements at all times, as well as to value the Entity's outstanding Derivative Operations.

III.5 Accounting.

26.- The accounting area must reconcile, or approve on a daily basis, accounting records against operational records, including balances and valuation, leaving documentary evidence of daily reconciliations and, in case of discrepancies, of the follow-up performed. This validation must be applied to the balance sheet and income statement accounts corresponding to Derivative Operations.

27.- The accounting area must establish accounting guidelines related to Derivative Operations in accordance with applicable accounting criteria, and record them in accordance with said guidelines, which must be documented in the corresponding manuals.

28.- The Settlement of Derivative Operations must be carried out by staff in the support areas for operations under duly authorized instructions, verified amounts, and with the Confirmation from counterparties or clients with whom the operation was agreed. The aforementioned authorization cannot be performed by business units.

29.- The area responsible for the Settlement of Derivative Operations must have written procedures to investigate unsettled operations, both on the part of the Entity itself, indicating the contingent causes that motivated its non-compliance, and in the case where its counterparties or clients fail to comply with the Entity; if both situations occur, the results must be reported to the General Management for corrective actions, maintaining systematic records of the investigation.

III.6 Guarantees and Margins.

30.- The operation and control manuals must establish procedures that allow defining, controlling, and ensuring the sufficiency of guarantees or credit lines granted. Likewise, Entities must have adequate documentation of the credit risk management process in accordance with the desired risk profile.

The aforementioned guarantees must be consistent with those negotiated in the respective contracts, including the applicable procedures in case of discrepancies in their valuations.

III.7 Legal.

31.- The Entity must have procedures to verify master or framework agreements, schedules, and other formats that bind the Entity and the counterparty to the due fulfillment of their obligations before they are signed, as well as the updating of personnel authorized to negotiate and confirm Derivative Operations. The manuals must define the areas responsible for the custody, administration, and follow-up of the aforementioned documents.

The aforementioned contracts must establish procedures for the valuation of Derivative Operations, as well as the designation of the calculation agent and the dispute resolution process.”

…

TRANSITIONAL PROVISIONS

FIRST.- The modifications to requirements 1, 5, 6, 7, 8, 9, 10, 12, 13, 14, 17, 19, 20, 21, 22, 23, 25, 26, 27, 28, 29, and 30, of Annex 1 of the Rules for carrying out derivative operations, issued by Circular 4/2012 of the Bank of Mexico, published in the Official Gazette of the Federation on March 2, 2012, shall enter into force on December 27, 2024.

SECOND.- The modifications to requirements 2, 3, 4, 11, 15, 16, 18, 24, and 31, of Annex 1 of the aforementioned Rules, shall enter into force on June 27, 2025.

Mexico City, December 18, 2023.- BANK OF MEXICO: Director of Central Banking Provisions, María Teresa Muñoz Arámburu.- Rubric.- Director of Regulation and Supervision, Viviana Garza Salazar.- Rubric.

Thursday, December 21, 2023 OFFICIAL GAZETTE 127 For any inquiries regarding the content of this Circular, the Bank of Mexico is at your disposal through the Directorate of Authorizations and Sanctions of Central Banking at telephone (55) 5237-2000 extension 3200.