Circular 2/2020 — Standardized Application Programming Interfaces under Article 76 of the Law for Regulating Financial Technology Institutions

Tuesday, March 10, 2020 OFFICIAL GAZETTE 1 BANCO DE MEXICO CIRCULAR 2/2020 addressed to Credit Information Societies and Clearing Houses, regarding the general provisions referred to in Article 76 of the Law for Regulating Financial Technology Institutions, applicable to credit information societies and clearing houses in matters of standardized application programming interfaces. At the margin, a logo that says: Bank of Mexico.- "2020, Year of Leona Vicario, Meritorious Mother of the Fatherland". CIRCULAR 2/2020 TO THE CREDIT INFORMATION SOCIETIES AND CLEARING HOUSES: SUBJECT: GENERAL PROVISIONS REFERRED TO IN ARTICLE 76 OF THE LAW FOR REGULATING FINANCIAL TECHNOLOGY INSTITUTIONS, APPLICABLE TO CREDIT INFORMATION SOCIETIES AND CLEARING HOUSES IN MATTER OF STANDARDIZED APPLICATION PROGRAMMING INTERFACES. The Law for Regulating Financial Technology Institutions establishes, in its Article 76, that the credit information societies and clearing houses referred to in the Law for Transparency and Ordering of Financial Services shall be subject to the general provisions issued by the Bank of Mexico regarding the exchange of data and information through standardized application programming interfaces. In line with the above, the Bank of Mexico seeks to establish such regulation observing the principles of financial inclusion and innovation, promotion of competition, consumer protection, preservation of financial stability, and technological neutrality, with the purpose of continuing to promote the healthy development of the financial system and facilitating the proper functioning of payment systems, protecting the interests of the public, as well as preserving the effectiveness of the public order rules established in the Law for Regulating Financial Technology Institutions. Therefore, the Bank of Mexico, based on Articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 76 of the Law for Regulating Financial Technology Institutions, 24 and 26 of the Bank of Mexico Law, 22 of the Law for Transparency and Ordering of Financial Services, 1, 4, first paragraph, 8, paragraphs fourth and eighth, 10, first paragraph, 12 Bis, first paragraph, in relation to 20 Quater, fraction IV, 14 Bis, first paragraph, in relation to 17, fraction I, 25 Bis 1, fraction IV, and 29 Bis, fraction VIII, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Directorate of Payment Systems and Market Infrastructures, the General Legal Directorate, the Regulation and Supervision Directorate, and the Cybersecurity Directorate, respectively, as well as Second, fractions I, IX, X and XVII, of the Agreement on the Affiliation of the Administrative Units of the Bank of Mexico, has resolved to issue the following provisions: GENERAL PROVISIONS REFERRED TO IN ARTICLE 76 OF THE LAW FOR REGULATING FINANCIAL TECHNOLOGY INSTITUTIONS, APPLICABLE TO CREDIT INFORMATION SOCIETIES AND CLEARING HOUSES IN MATTER OF STANDARDIZED APPLICATION PROGRAMMING INTERFACES CHAPTER I PRELIMINARY PROVISIONS Article 1. Definitions. In addition to the terms used in the Law under the definitions included in said legislation, whether in singular or plural, in these Provisions the following shall be understood: API: standardized application programming interfaces referred to in Article 76 of the Law. Bank of Mexico Digital Certificate: a data message in digital format generated in terms of the "Rules to Operate as a Registrar Agency and/or Certification Agency in the Extended Security Infrastructure" contained in Circular-Telefax 6/2005 issued by the Bank of Mexico or those that, in their case, replace them. Interconnection Contracts: contracts for the connectivity and access of applications developed or administered by Recognized Entities to the APIs established by clearing houses and CIS, with the aim of sharing data and information. Aggregated Data: those referred to in Article 76, fraction II, of the Law. Open Financial Data: those referred to in Article 76, fraction I, of the Law. Transactional Data: those referred to in Article 76, fraction III, of the Law. Banking Business Day: the days on which credit institutions are not obliged to close their doors or suspend operations, in terms of the general provisions issued for such effect by the CNBV. Recognized Entities: Financial Entities, money transmitters, FTIs, societies authorized to operate with Novel Models and Specialized Third Parties, as well as clearing houses and CIS, which, pursuant to Article 76 of the Law, may establish, through the APIs they develop, connectivity to those other APIs established by clearing houses and CIS pursuant to that same article and these Provisions, in order to access the data and information provided for in said legal provision. Technological Infrastructure: the computing, telecommunications, software, computer applications, and other tools used by clearing houses and CIS to establish and operate the APIs. Law: the Law for Regulating Financial Technology Institutions. Work Plan: the set of documents and information that clearing houses and CIS must present to the Bank of Mexico in terms of what is established in Annex 2 of these Provisions. CIS: legal entities authorized to act as credit information societies in terms of what is provided in the Law for Regulating Credit Information Societies. Specialized Third Parties: third parties specialized in information technology referred to in Article 76 of the Law. Article 2. Establishment of APIs. The clearing houses referred to in the Law for Transparency and Ordering of Financial Services and CIS shall be subject to these Provisions regarding the exchange of data and information indicated in Article 76 of the Law, which they may share through the APIs they are obliged to establish and maintain in accordance with said article. On the other hand, Recognized Entities that wish to have access, through the APIs they develop for this purpose, to the data and information that clearing houses and CIS must share with them pursuant to the aforementioned Article 76, shall be subject to what is established for this purpose in these Provisions. Article 3. Standards for API interoperability. In the APIs established by clearing houses and CIS, these must comply with the interoperability standards established in Annex 1 of these Provisions. Likewise, clearing houses and CIS must make available to Recognized Entities the technical information for API interoperability. CHAPTER II AUTHORIZATIONS Article 4. Authorization for the establishment of APIs for Aggregated Data and, where applicable, Open Financial Data. Clearing houses and CIS must obtain prior authorization from the Bank of Mexico to establish the APIs referred to in Article 76 of the Law. For such purposes, each clearing house and CIS must present an authorization request to the Directorate of Authorizations and Sanctions of Central Banking of the Bank of Mexico in terms of Article 20 of these Provisions. The aforementioned request must contain evidence accrediting compliance with what is established in Annex 1 of these Provisions, as well as a Work Plan that includes, at least, the elements indicated in Annex 2 of these Provisions, and a model of the clauses of the Interconnection Contracts that the respective clearing house or CIS intends to celebrate with the corresponding Recognized Entities.

OFFICIAL GAZETTE Tuesday, March 10, 2020 3 In the aforementioned request, the respective clearing house or CIS must specify the data and information provided for in fractions I and II of Article 76 of the Law that it may share through the corresponding APIs, as follows: I. Regarding Open Financial Data, while clearing houses are not authorized to offer products and services directly to the general public and these or the CIS do not have branches or other access points to offer such products, they will not be obliged to make the respective Open Financial Data available through their APIs. Without prejudice to the foregoing, only to the extent that the clearing house in question obtains authorization to offer products and services to the general public, in addition to those it is authorized to offer to the entities determined in the applicable legal provisions or has branches or other access points to offer such products and services or it is a CIS that obtains authorization to provide additional services to those it can provide pursuant to Article 5 of the Law for Regulating Credit Information Societies or has branches, the clearing house or CIS will specify such information so that it is shared through the corresponding API. II. Regarding Aggregated Data, each clearing house and CIS must specify the statistical information related to those operations carried out by or through the entity itself, susceptible to being subject to exchange through the API it establishes in accordance with these Provisions. The Bank of Mexico will specify in the respective authorization the categories of data and information that the respective clearing house or CIS may share through the API it establishes. Article 5. Authorization to share Transactional Data. With respect to the Transactional Data provided for in fraction III of Article 76 of the Law, once the respective clearing house or CIS has obtained authorization from the Bank of Mexico to exchange Aggregated Data and, where applicable, Open Financial Data pursuant to the previous article, it must present an additional authorization request to exchange Transactional Data that are appropriate in accordance with the requirements that the Bank of Mexico establishes through general resolutions issued for this purpose, in which it may establish additional requirements for such exchange. Article 6. Modifications to the Work Plan. Clearing houses and CIS must request authorization from the Bank of Mexico to make modifications to the Work Plan authorized by it. For such purposes, clearing houses and CIS must present a request to the Directorate of Authorizations and Sanctions of Central Banking of the Bank of Mexico in terms of Article 20 of these Provisions, specifying the modifications they wish to make to the Work Plan, stating arguments and presenting sufficient evidence to accredit that the proposed modifications would constitute improvements for data exchange or information security. The Bank of Mexico will resolve on the request in terms of Article 8 of these Provisions. Likewise, in protection of the public interest, the Bank of Mexico may formulate, at any time, modifications to the Work Plan to ensure the proper functioning of the APIs, access to data and information on equitable and transparent conditions, the correct administration of data, information security, or for any other risk or impact on such interests. Article 7. Authorization to Recognized Entities for access to APIs. Recognized Entities that wish to obtain access to the data and information of clearing houses and CIS, as provided in Article 76 of the Law, through the APIs they establish for this purpose, must obtain prior authorization from the Bank of Mexico. For such purposes, from the date on which the Bank of Mexico, pursuant to Article 8 of these Provisions, publishes on its website the types of data and information that clearing houses and CIS will be authorized to exchange through the APIs they establish, each Recognized Entity must present its authorization request to the Directorate of Authorizations and Sanctions of Central Banking of the Bank of Mexico in terms of Article 20 of these Provisions. The aforementioned request must contain the measures it will implement to comply with the standards established in the API of the clearing houses and CIS to ensure information and other processes related to its connection with the API. In the aforementioned request, the respective Recognized Entity must specify the types of data and information provided for in fractions I to III of Article 76 of the Law, which the Bank of Mexico has published on its website pursuant to the following Article 8, to which it intends to access through the corresponding APIs.

4 OFFICIAL GAZETTE Tuesday, March 10, 2020 Article 8. Admissibility of authorization requests. The Bank of Mexico will evaluate the authorization request presented by each clearing house or CIS pursuant to Articles 4, 5, and 6 above or Recognized Entities pursuant to Article 7 above and, in each case, will determine if it meets the requirements provided for in these Provisions. In cases where the authorization request does not contain the necessary information and documentation, or does not comply with the requirements provided for in the Law or in these Provisions, the Bank of Mexico will notify the applicant, in writing and only once, to remedy the omissions or make modifications to the request or documentation presented within the term of ten Banking Business Days counted from the Banking Business Day on which the Bank of Mexico notifies the prevention to the interested party. The Bank of Mexico may grant an extension to the aforementioned term for up to five additional Banking Business Days, upon request made for such purposes by the interested party within the term to address the corresponding prevention. If the term established in the prevention or, where applicable, in the corresponding extension has elapsed and the applicant has not remedied the indicated omissions or made the modifications required by the Bank of Mexico, it will dismiss the request. The Bank of Mexico will resolve on the authorization request within a term of one hundred and eighty days counted from the Banking Business Day immediately following that on which it receives the request. This term will be suspended once the prevention indicated in the preceding paragraph is notified, and will resume from the Banking Business Day immediately following that on which the interested clearing house or CIS addresses the prevention. If the term mentioned in the previous paragraph elapses without the Bank of Mexico having pronounced itself regarding the admissibility of the authorization request, the corresponding resolution will be understood to be negative. With respect to the authorizations that the Bank of Mexico grants to clearing houses and CIS pursuant to Articles 4 and 5 above, it will publish on its website, located at www.banxico.org.mx, the types of data and information that it has authorized each clearing house and CIS to share through its respective API in accordance with these Provisions. Without prejudice to the foregoing, by virtue of the authorization that the Bank of Mexico grants to the respective clearing house or CIS pursuant to Articles 4 and 5 above, it will have the authority to require this entity, at any time, the exchange of data or information additional to those authorized. Likewise, the Bank of Mexico may establish, through a general resolution, the specifications of the query operations and their response, as well as the data dictionary. Article 9. Revocation of authorizations. The Bank of Mexico may revoke the authorizations referred to in these Provisions in cases where what is established in the Law, in these Provisions, or in the Work Plan authorized by the Bank of Mexico is not complied with. In any case, the authorizations referred to in these Provisions will be considered revoked in cases where the competent authority revokes the authorization of the obligated subjects to operate as the type of entity or financial intermediary in question or, where applicable, lose the status of Recognized Entity. The revocation referred to in this article will be without prejudice to the imposition of sanctions as appropriate. CHAPTER III ACCESS TO INFORMATION Article 10. Interconnection Contracts. Clearing houses and CIS must allow access and connectivity to the APIs they establish only to Recognized Entities that have the authorization from the Bank of Mexico referred to in Article 7 of these Provisions, as well as to those subjects referred to in the eleventh paragraph of Article 76 of the Law for Regulating Financial Technology Institutions for the effects provided for in said paragraph, and who have celebrated Interconnection Contracts with the respective clearing houses and CIS. For these purposes, the Interconnection Contracts celebrated by clearing houses and CIS must include, at least, the following elements: I. The express acceptance by the Recognized Entity to submit to what is established in Article 76 of the Law and in these Provisions. II. Copy of the authorization to access the API of the Recognized Entity, as well as the express declaration of the Recognized Entity that such authorization is in effect and, where applicable, the date on which it will cease to be effective.

Tuesday, March 10, 2020 OFFICIAL GAZETTE 5 III. The obligation of the Recognized Entity to notify the respective clearing house or CIS about the revocation of the authorization for access to the API. IV. The obligations of confidentiality, security, and integrity of information, in congruence with what is established in the Law, these Provisions, and the Work Plan authorized by the Bank of Mexico. V. The acceptance of the contracting parties to permit each other the referral to the Bank of Mexico of the information and documentation they exchange with each other due to the operation of the Interconnection Contract. VI. The mechanisms and support schemes to solve problems and incidents of a technical nature. VII. The causes for the suspension or termination of access to information due to actions or omissions committed by the Recognized Entity, in congruence with what is established in the Law, these Provisions, and the Work Plan authorized by the Bank of Mexico. VIII. The prohibition of subcontracting or assigning the duties, rights, and obligations contained in the Interconnection Contract. IX. The stipulation that the validity of the Interconnection Contract will be subject to the resolutive condition of the termination of the validity and of the revocation of the authorizations to establish the API and to access the information shared through the APIs. X. The stipulation that the Interconnection Contract may be rescinded in case the Recognized Entity fails to comply with what is established in the Law, these Provisions, or the Work Plan authorized by the Bank of Mexico. XI. The procedure that will be carried out for the rescission or ordered termination of the Interconnection Contract. XII. The express submission to Mexican federal law and courts, waiving the jurisdiction that may correspond to them by reason of other causes. The terms and conditions that clearing houses and CIS establish in the Interconnection Contracts they formalize with Recognized Entities must be in congruence with those provided for in the Law, these Provisions, and the Work Plan authorized by the Bank of Mexico. CHAPTER IV CONSIDERATIONS Article 11. Requirements of considerations. The considerations charged by clearing houses and CIS due to the exchange of data and information in terms of these Provisions must be equitable and transparent to all individuals involved, and must not constitute formal, regulatory, economic, or practical barriers. Clearing houses and CIS may not charge differentiated considerations for access to information. Article 12. Request for registration of considerations. Clearing houses and CIS must request the Bank of Mexico to register a new consideration and any modification to previously registered considerations. The request must contain the following elements: I. The name of the consideration. II. Specify whether the consideration is new, consists of an increase or a reduction. III. The act or fact generating the consideration. IV. The periodicity in which the consideration would be due. V. The amount corresponding to the consideration or, where applicable, the calculation method. Regarding modifications, both the current amount or calculation method and the one intended to be registered must be indicated. VI. The currency in which the consideration would be denominated. VII. The date from which the new consideration or the modification of a previously registered consideration is intended to be applied. Article 13. Admissibility of the registration of considerations. The Bank of Mexico will evaluate in each case whether the request for registration of considerations contains the elements provided for in the previous article. For such purposes, the Bank of Mexico may require the interested party any information or documentation it deems necessary.

6 OFFICIAL GAZETTE Tuesday, March 10, 2020

In cases where the registration request for considerations does not contain the elements provided for in Article 12 of these Provisions, the Bank of Mexico will issue a written notice to the applicant, only once, within a period of seven Banking Business Days counted from the Banking Business Day immediately following the one on which the registration request for a new consideration or the increase of a previously registered one is presented, or within a period of two Banking Business Days counted from the Banking Business Day immediately following the one on which the registration request for the reduction of a previously registered consideration is presented, for the applicant to remedy the omissions or make the modifications to the documentation presented that the Bank of Mexico requires within a period of ten Banking Business Days counted from the Banking Business Day immediately following the one on which the Bank of Mexico notifies the notice. If the period established in the notice expires and the applicant has not remedied the indicated omissions or made the modifications required by the Bank of Mexico, it will dismiss the request.

If the applicable period to issue the notice as stated in the previous paragraph expires without the Bank of Mexico having issued a notice to the applicant, the consideration will be deemed registered with effects starting from the Banking Business Day immediately following the one on which the interested party presented its registration request.

In the event that the Bank of Mexico has issued a notice to the applicant and this has satisfactorily remedied the indicated omissions or made the modifications required by the Bank of Mexico, the consideration will be deemed registered with effects starting from the Banking Business Day immediately following the one on which the interested clearing house or credit information society satisfactorily resolves the notice.

The Bank of Mexico, where applicable, may communicate to the requesting clearing house or credit information society that the registration request for the consideration has been dismissed, or that the consideration or modification has been registered, indicating the effective date of the registration.

Article 14. Observations on considerations. The Bank of Mexico may formulate observations on the application of considerations when they are new or imply an increase, within fifteen Banking Business Days following the one on which the clearing houses or credit information societies make them known to it. For this purpose, the following shall apply:

I. It will be understood that the clearing houses and credit information societies make the considerations known to the Bank of Mexico on the effective date of their registration.

For the case of registration requests for considerations presented as part of the Work Plan in accordance with what is provided in Article 4 and Annex 2 of these Provisions, the effective date of registration will be the Banking Business Day immediately following the one on which the Bank of Mexico notifies the applicant of the authorization for the establishment of the API.

II. In the event that the Bank of Mexico intends to formulate observations and, where applicable, veto the considerations, it will notify the relevant clearing house or credit information society within seven Banking Business Days following the effective date of registration of the consideration.

III. The clearing house or credit information society will have a period of three Banking Business Days counted from the Banking Business Day immediately following the one on which it receives the notification referred to in the preceding fraction II to manifest what it considers appropriate for its rights and, where applicable, offer evidence, through a written document addressed to the Directorate of Authorizations and Sanctions of Central Banking of the Bank of Mexico, signed by persons with sufficient powers for such effects.

IV. In the event that within the period provided for in the preceding fraction II the clearing house or credit information society does not provide the information or elements that, in the judgment of the Bank of Mexico, justify avoiding the formulation of observations on the considerations, or does not communicate the decision to withdraw the registration request, the Bank of Mexico will proceed to formulate the observations no later than the expiration date of the period indicated in the first paragraph of this article.

Article 15. Veto of considerations. If the clearing houses or credit information societies decide to apply the considerations on which the Bank of Mexico has made and published observations, the Bank of Mexico may veto those considerations and these entities may not charge them. Without prejudice to the foregoing, the clearing houses and credit information societies must refrain from interrupting access to information for this cause.

Article 16. Publication of considerations, observations, and vetoes. The Bank of Mexico will publish the registered considerations, as well as the observations it formulates on them and the vetoes it applies, through its website located at www.banxico.org.mx.

CHAPTER V SUPERVISION AND REGULARIZATION PROGRAMS

Tuesday, March 10, 2020 OFFICIAL GAZETTE 7

Article 17. Supervision. The Bank of Mexico may require, at any time, from the clearing houses, credit information societies, Recognized Entities, and subjects referred to in the eleventh paragraph of Article 76 of the Law, the documentation, data, records, reports, and, in general, the information that the Bank of Mexico deems necessary to verify compliance that the referred subjects give to what is established in the Law, in these Provisions, or in the Work Plan authorized by the Bank of Mexico.

The supervision carried out by the Bank of Mexico will be conducted in accordance with what is established in the Supervision Rules, Self-Correction Programs, and Sanctioning Procedure of the Bank of Mexico.

Article 18. Suspension of information exchange. To protect the interests of the public, the Bank of Mexico may, prior to granting a hearing right to the corresponding clearing house, credit information society, or Recognized Entity, order the partial or total, temporary or definitive, suspension of the exchange of information through the APIs, in cases where what is established in the Law or in these Provisions is not complied with. The foregoing, unless the Bank of Mexico approves a regularization program that the relevant clearing house or credit information society sends to it, with the object of remedying the non-compliances.

Article 19. Regularization program. The regularization program that the clearing houses and credit information societies present to the Bank of Mexico in terms of the previous article must include, at least, the following:

I. The identification of the Bank of Mexico's notification regarding irregularities or non-compliances, as well as the indication of the provisions contravened.

II. The actions that the relevant clearing house or credit information society will take to remedy the irregularities or non-compliances, as well as the persons and areas responsible for carrying out each of them, as well as the manner and deadlines in which it intends to report on their progress to the governing bodies of the clearing house or credit information society, as well as to the Bank of Mexico.

III. The period in which the clearing house or credit information society will carry out the actions aimed at correcting the irregularities or non-compliances, as well as, where applicable, a detailed schedule of activities to be carried out for this effect.

IV. The mention of the damage or harm that the irregularity or non-compliance has produced to the clearing house or credit information society itself or to third parties, in case this is known to the clearing house or credit information society, as well as the compensation that, where applicable, has been made for such damages or harms. In all cases, the information and documentation necessary to support what is provided for in this fraction must be attached.

V. If applicable, information on the suspension of the action or omission that motivated the contravention of the norm.

VI. The indication of the specific information that, where applicable, must be treated as confidential, in terms of the General Law and Federal Law on Transparency and Access to Public Information, understanding that the omission to specify the nature thereof will imply consent for its disclosure when there is a request from a third party, attentive to the principle of maximum transparency and the bases contained in Article 6 of the Political Constitution of the United Mexican States.

VII. The signature of the general director or equivalent, as well as of the president of the audit committee or its equivalent of the relevant clearing house or credit information society.

The Bank of Mexico will issue a notice to the relevant clearing house or credit information society when its request for authorization of the regularization program project does not contain any of the applicable requirements, if the Bank of Mexico presumes some irregularity or if there is any doubt regarding the corresponding request.

The relevant clearing house or credit information society will have a period of ten Banking Business Days to resolve such notice, counted from the Banking Business Day immediately following the one on which the Bank of Mexico notifies it. In exceptional cases where circumstances justify it, the supervised clearing house or credit information society may request the Bank of Mexico for an extension to said period, which may be granted when the Bank of Mexico considers it appropriate. If the deficiencies are not remedied within the mentioned period or its extension, as applicable, the request will be deemed dismissed and may not be presented again.

In what is not provided for in these Provisions regarding the regularization program, the applicable rules to the self-correction programs referred to in the Supervision Rules, Self-Correction Programs, and Sanctioning Procedure of the Bank of Mexico will apply.

8 OFFICIAL GAZETTE Tuesday, March 10, 2020

CHAPTER VI GENERAL PROVISIONS

Article 20. Submission of requests to the Bank of Mexico. The authorization and registration requests for considerations referred to in Articles 4, 5, 6, 7, and 12 of these Provisions must be sent via email by the relevant clearing house or credit information society to the Directorate of Authorizations and Sanctions of Central Banking of the Bank of Mexico, at the email address autorizaciones_api@banxico.org.mx.

The persons who sign the requests must:

I. Have a valid Bank of Mexico Digital Certificate issued in their name.

II. Sign the requests digitally using the tool that the Bank of Mexico determines for these purposes and that it makes known, as well as the Bank of Mexico Digital Certificate referred to in fraction I of this article.

In cases where the clearing houses or credit information societies do not have access to the necessary elements to send digitally signed requests, they may deliver them in physical format to the Directorate of Authorizations and Sanctions of Central Banking of the Bank of Mexico, located at Avenida 5 de Mayo number 2, Centro neighborhood, postal code 06000, Cuauhtémoc Territorial Demarcation, Mexico City, in original duplicate, signed by persons who have sufficient powers to exercise acts of administration or dominion on behalf of the applicant. For such purposes, the clearing houses and credit information societies must attach a certified and simple copy of the deeds in which the referred powers are recorded to their request letter, as well as a document signed by the referred representative in which they specify the justifications for which they see themselves in the need to send requests by this alternative means.

Article 21. Sanctions. The clearing houses and credit information societies that fail to comply with what is established in these Provisions will be sanctioned by the Bank of Mexico in accordance with the Law to Regulate Financial Technology Institutions, the Bank of Mexico Law, and the other applicable provisions. The foregoing, without prejudice to the powers that laws grant to other authorities.

TRANSITORY PROVISIONS

FIRST. Except for what is established in Article 5 of these Provisions, this Circular will enter into force three hundred and sixty days following the day of its publication in the Official Gazette of the Federation.

SECOND. The clearing houses and credit information societies will have a period of three hundred and sixty days from the entry into force of these Provisions to obtain the Bank of Mexico's authorization for the establishment of the APIs.

Entities that obtain authorization to operate as credit information societies and clearing houses after the entry into force of these Provisions will have a period of three hundred and sixty days from the date on which that takes effect, to obtain the Bank of Mexico's authorization for the establishment of the APIs.

THIRD. The authorization requests for access to the data and information of the APIs, as well as for the testing of new products and services, may be granted by the Bank of Mexico once the clearing houses and credit information societies have established and initiated the operation of the APIs in question.

FOURTH. The clearing houses and credit information societies, prior to requesting authorization from the Bank of Mexico to carry out the exchange of Transactional Data through the APIs that they must establish in accordance with Article 5 of these Provisions, must present, within a period of three hundred and sixty days from the publication of these Provisions, before the Directorate of Authorizations and Sanctions of Central Banking of the Bank of Mexico, their proposals on the type of data and information that must be included in this category, as well as on the mechanisms through which such entities could authenticate, identify, and collect, where applicable, the express consent of the respective clients for such effects. The Bank of Mexico will take into account the referred information presented by the clearing houses and credit information societies and will establish, through the general resolution it issues regarding this matter, the Transactional Data that the clearing houses or credit information societies must share through their respective APIs, as well as the requirements that the mechanisms through which, where applicable, the express consent of the client referred to in fraction III of Article 76 of the Law must be collected, must meet.

Based on the foregoing, Article 5 of these Provisions will enter into force on the date that the Bank of Mexico establishes in the general resolution referred to in the preceding paragraph.

Tuesday, March 10, 2020 OFFICIAL GAZETTE 9

Mexico City, March 5, 2020.- BANK OF MEXICO: The General Director of Payment Systems and Market Infrastructures, Manuel Miguel Ángel Díaz Díaz.- Rubric.- The General Legal Director, Luis Urrutia Corral.- Rubric.- The Director of Regulation and Supervision, Viviana Garza Salazar.- Rubric.- The Cybersecurity Director, Alejandro de los Santos Santos.- Rubric.

For any consultation regarding the content of this Circular, the Bank of Mexico places itself at your disposal through the Directorate of Authorizations and Consultations on Payment Systems and Market Infrastructures at telephone (55) 5237-2000 extension 3200.

ANNEX 1 MINIMUM INTEROPERABILITY REQUIREMENTS AND AUTHENTICATION MECHANISM FOR THE APIS THAT MUST BE ESTABLISHED BY CLEARING HOUSES AND CREDIT INFORMATION SOCIETIES

The APIs that clearing houses and credit information societies, as well as Recognized Entities, establish in accordance with these Provisions must comply with the technical requirements described below.

I. COMMUNICATION

The APIs must be capable of receiving service requests through the following communication protocols defined by the "Internet Engineering Task Force" organization, hereinafter IETF, sponsored by the company incorporated in the United States of America named IETF Administration LLC.:

1. IP (Internet Protocol), version 4 and, optionally, version 6, as addressing protocol, under specifications RFC 791 and RFC 8200, respectively.

2. TCP (Transmission Control Protocol), as data transmission control protocol, implemented under specification RFC 675.

3. TLS (Transport Layer Security), version 1.2 and, optionally, version 1.3, as cryptographic protocol and point-of-access identity validation, implemented under specifications RFC 5246 and RFC 8446, respectively.

4. HTTP (HyperText Transport Protocol), version 1.1, as data communication protocol under specifications RFC 7230, RFC 7231, RFC 7232, RFC 7233, RFC 7234, and RFC 7235.

Clearing houses and credit information societies may make the APIs available through other protocols, in addition to those described above, provided that these maintain the principle of data encryption in transit and allow validation, by the computer system or application requesting service, of the identity of the API access point.

The APIs must be available for execution on a public internet protocol (IP) address.

II. SECURITY

a. Privacy and integrity of information

The data shared through the APIs must be protected by privacy and integrity mechanisms during transfer via network.

b. Authenticity of information

In order for computer systems and applications to validate the identity of the API access points established by clearing houses and credit information societies, these access points must present, during the process that establishes secure communication via the TLS protocol, a valid digital certificate issued for these purposes by a certifying authority that meets the following criteria:

1. Free distribution of its root certificate, as well as its corresponding intermediate certificates for its subordinate certifying authorities.

2. Free and public validation of the non-revocation of certificates issued by it and by its subordinate certifying authorities through certificate revocation lists (CRL in English), under specification RFC 5280, or through the OCSP (Online Certificate Status Protocol) protocol, under specification RFC 6960, both defined by the IETF.

The digital certificate must be issued in accordance with the X.509 v3 format, under specifications RFC 5280, RFC 6818, RFC 8398, and RFC 8399 defined by the IETF. Clearing houses and credit information societies must send the Bank of Mexico the digital certificate they will use for purposes of demonstrating their identity as described in this section, at least seven days in advance of the date on which the referred certificate will be used.

c. Authentication and access control

As an authentication and access control mechanism for Aggregated Data in the APIs they establish, clearing houses and credit information societies must implement access control lists by Internet Protocol (IP) address. These lists will allow authenticating and granting access to Authorized Recognized Entities in accordance with what is provided in these Provisions.

III. OPERATION

10 OFFICIAL GAZETTE Tuesday, March 10, 2020

The APIs must provide service through web services designed and developed based on the software architectural style known as REST (Representational State Transfer).

The transmitted data must be represented in the JSON (JavaScript Object Notation) format, defined by the IETF under specification RFC 8259.

Clearing houses and credit information societies must notify the Bank of Mexico of the electronic address through which the APIs will be available, as well as any changes, at least seven days in advance of the date on which service will begin through this.

The execution of the interfaces must be synchronous.

ANNEX 2 WORK PLAN

The Work Plan that clearing houses and credit information societies present with the authorization request for the establishment of the APIs must contain, at least, the following elements:

1. On data transmission: 1.1. The categories of data regarding which they request authorization to transmit through the API, detailing the specific information they would share in each of said categories, observing the principles of confidentiality, usability, and timeliness. 1.2. The measures to prevent the transmission of Aggregated Data from allowing the identification of personal data or transactions of persons. 1.3. The authentication mechanisms to verify that third parties intending to access the API are Recognized Entities with which they have formalized Interconnection Contracts. 1.4. The measures to verify the authentication mechanisms for access to Aggregated Data.

2. Legal aspects: 2.1. Draft model of Interconnection Contract, with the terms and conditions that are consistent with those provided for in the Law, these Provisions, and the Work Plan. 2.2. Registration request for considerations they intend to charge.

3. Corporate governance aspects: 3.1. Draft manual on the transmission of information in terms of these Provisions. 3.2. The corporate or general administration structure, including internal regulations and those manuals or bylaws that the relevant clearing house or credit information society considers applicable and, where applicable, the modifications they would make to them.

4. Operational risk: 4.1. The measures and policies that will be taken to guarantee the security of information transmission and ensure the operational continuity of the API. 4.2. The measures and policies in the matter of operational risk control and cybersecurity. 4.3. The documentation and other elements that accredit that the Technological Infrastructure that clearing houses and credit information societies dedicate to the API is separate from the infrastructure they use to carry out other activities.

5. Business:

5.1. The documentation and other elements that verify that the transmission of data and information through the API will not affect the adequate provision of services related to the corporate purpose of the applicant.

6. Efficacy and efficiency: 6.1. Service level agreements for the transmission of information.

The Bank of Mexico may require the interested party to provide any information or documentation it deems necessary to evaluate the authorization request and the Work Plan.

---