Circular 2/2022 — Modifies Circular 4/2016 (Miscellaneous Matters)

Wednesday, March 23, 2022 OFFICIAL GAZETTE 1 BANK OF MEXICO CIRCULAR 2/2022, addressed to participants in the SPID, regarding modifications to Circular 4/2016 (Miscellaneous Matters).

A logo appears at the margin, stating: Bank of Mexico.

CIRCULAR 2/2022 TO THE PARTICIPANTS IN THE SPID: SUBJECT: MODIFICATIONS TO CIRCULAR 4/2016 (MISCELLANEOUS MATTERS)

The Bank of Mexico, with the purpose of continuing to promote the proper functioning of payment systems, as well as to promote the healthy development of the financial system and the protection of the public's interests, has resolved to modify the Rules of the Interbank Payment System in Dollars (SPID), in order to provide certainty to system participants regarding the independence requirements that the independent external auditors hired by participants must meet to comply with various obligations established in the aforementioned Rules.

For the above, based on articles 28, sixth and seventh paragraphs, of the Political Constitution of the United Mexican States, 2, sections I, IV and VIII, and 6 of the Payment Systems Law, 22 of the Law for the Transparency and Regulation of Financial Services, 4, first paragraph, 8, fourth and eighth paragraphs, 10, first paragraph, 14 Bis, first paragraph, in relation to 17, section I, and 20 Quáter, section VIII, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Legal Directorate and the Directorate of Policy and Studies of Payment Systems and Market Infrastructures, respectively, as well as Second, sections X and XVII, of the Agreement on the Affiliation of the Administrative Units of the Bank of Mexico, it has resolved to modify rules 38a., first paragraph, 39a., first paragraph, 41a., 42a., subsection e) of section IV, 44a., 50a., second paragraph of section VI, 51a., second paragraph of section I and last paragraph, 52a., second paragraph, 53a., first paragraph, 55a., first paragraph and subsection g) of section I, and sections II, 56a., first paragraph, and Annex 1, as well as adding sections III, IV, V, VI, VII, VIII, IX and X to 55a., to the “Rules of the Interbank Payment System in Dollars”, contained in Circular 4/2016, to read as follows:

RULES OF THE INTERBANK PAYMENT SYSTEM IN DOLLARS

“38a. Application for Operator Registration.- Each Participant must maintain, at all times, at least one Operator. Only those persons registered by the respective Participant with the Administrator may act as Operators. For this, each Participant must present to the Administrator, through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, a communication in the same terms as those included in the format attached as Annex 1 of these Rules, signed by the legal representative of the respective Participant who has authority both to exercise acts of dominion and those necessary to designate those who may act as Operators in the payment systems administered by the Bank of Mexico. Each Participant must verify and keep a record that the persons designated as Operators comply with the following: ...”

“39a. Application for Operator De-registration.- The Participant who has registered an Operator with the Administrator may request, at any time, the de-registration of said person by presenting a communication in the same terms as those included in the format attached as Annex 1 of these Rules, addressed to the Administrator, through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, and signed by those persons whose signature has been previously registered with the Sub-directorate of Payment Systems Operation and Market Infrastructures for the management of operations and various requests to operate with the Bank of Mexico.

2 OFFICIAL GAZETTE Wednesday, March 23, 2022 ...”

“41a. Submission of Admission Application.- The Credit Institution intending to be admitted as a Participant must submit its admission application to the Administrator, in addition to the application it must submit to the Bank of Mexico to obtain its authorization in accordance with the provisions of Circular 3/2016. The two applications referred to in this Rule may be submitted jointly through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures. In any case, the admission application must be signed by the General Director of the Credit Institution, or by an official holding a position at least two hierarchical levels below that of the aforementioned General Director, and must be accompanied by the opinions and certification referred to in Rule 46a. of these Rules, which may also be used as supporting documentation for the authorization application referred to in Circular 3/2016.”

“42a. Requirements for Admission as a Participant.- ... I. to III. ... IV. ... a) to d) ... e) Have an Additional Risk Assessment Model, which is obliged to apply to all its clients who are holders of Dollar deposit accounts and who, therefore, may become Beneficiary Clients of Transfer Orders that the Credit Institution in question receives from its admission to the SPID, as well as its Issuing Clients with whom it agrees to process Sending Requests. Said Additional Risk Model must meet the characteristics established in Annex 2 of these Rules and must be approved by the Risk Committee based on the proposal made for this purpose by the Communication and Control Committee that the Participant must establish in accordance with applicable provisions, which must be reported by said Risk Committee to the Board of Directors or Executive Board of the Credit Institution, as applicable. Likewise, the Credit Institution must send to the Bank of Mexico, through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, no later than 30 Banking Business Days after the date on which the aforementioned Additional Risk Model was reported to the Board of Directors or Executive Board, a document describing it and including at least the aspects indicated in Annex 2.”

“44a. Registration with the Administrator.- Each Credit Institution must inform, in writing addressed to the Administrator, through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, the name of the persons designated as responsible for SPID regulatory compliance.”

“50a. Ongoing Compliance with Admission Requirements as a Participant.- ... I. to V. ... VI. ... If applicable, the Communication and Control Committee must submit to the approval of its Risk Committee the modifications made to the Additional Risk Assessment Model of its clients referred to in section IV, subsection e), of Rule 42a. of these Rules and inform this fact to the Board of Directors or Executive Board of the Participant as applicable, as well as to the Bank of Mexico, through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, within fifteen Banking Business Days following the date of that approval by the Risk Committee, the result of the application of said modified model to the respective clients.

Wednesday, March 23, 2022 OFFICIAL GAZETTE 3 ...”

“51a. Functions of the SPID Regulatory Compliance Officers.- ... I. ... Additionally, it must send to the Administrator a copy of the report referred to in this section and of the receipt confirmation by the Participant's audit committee, through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, no later than the fifteenth Banking Business Day following the date on which the aforementioned report was presented to said committee. The obligation to deliver the reports referred to in this section shall begin after 180 calendar days have elapsed from the date of admission in accordance with Rule 48a. of these Rules; II. to IV. ... In the event that a Participant replaces any of the persons it has designated as responsible for SPID regulatory compliance, said Participant must notify the Administrator of this situation, in writing submitted to the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, no later than the tenth Banking Business Day counted from the date on which the new responsible person was designated.”

“52a. Periodic Report and Certification.- ... The compliance reports corresponding to the verifications referred to in the previous paragraph must be delivered to the Participant's audit committee and to the Administrator, through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, within sixty calendar days following the end of the fiscal year. ...”

“53a. Compulsory Compliance Plan.- In the event that, as a result of the review conducted by the Administrator on a Participant or of the results of the Independent External Auditor, the Administrator detects irregularities or non-compliance with the internal SPID rules, it may require the Participant to present a compulsory compliance plan in which the actions the Participant obliges itself to adopt to correct the detected irregularities or non-compliance are provided for, as well as the deadline by which they will be carried out and the persons responsible for attending to each of them. To this effect, the Participant must submit the compulsory compliance plan for approval by the Administrator, through the Directorate of Authorizations and Inquiries on Payment Systems and Market Infrastructures. ...”

“55a. Independence Requirements.- The Independent External Auditors who certify the level of compliance that Credit Institutions and Participants give to the requirements referred to in these Rules, as well as the respective Firms to which they belong, must be independent on the date of celebration of the service provision contract and during the development of the audit. Independence will be considered non-existent when the person or Firm in question falls under any of the following circumstances: I. ... a) to f) ... g) Any other that implies or could imply conflicts of interest regarding the external audit work; II. The income that the Independent External Auditor receives or will receive for carrying out the certification of the Credit Institution or Participant depends on the result of the certification itself or on the success of any operation carried out by the Credit Institution or Participant itself that is supported by the certification of the Independent External Auditor; III. The income received by the Firm from the interested party or Participant, its holding company, subsidiaries, associates, affiliates or legal entities belonging to the same business group, as defined in article 5, section VI, of the Law to Regulate Financial Groups, derived from the provision of their services, represent in total ten percent or more of the total income of the Firm during the year immediately preceding that in which the service is to be provided; IV. The Firm, Independent External Auditor or any partner or employee of the Firm has been an important client or supplier of the interested party or Participant, its holding company, subsidiaries, associates or affiliates, during the year immediately preceding that in which the service is to be provided. A client or supplier is considered important when its sales or, as applicable, purchases to the interested party or Participant, its holding company, subsidiaries, associates or affiliates, represent in total ten percent or more of their total sales or, as applicable, total purchases; V. The Independent External Auditor or any partner of the Firm where they work are or have been during the year immediately preceding their designation as auditor, a councilor, general director or employee holding a position within the two levels immediately below the latter of the interested party or Participant, its holding company, subsidiaries, associates or affiliates; VI. The Independent External Auditor, the Firm where they work, any partner or employee thereof, the spouse, concubine, concubinary or economic dependent of the aforementioned natural persons, have investments in shares or debt securities issued by the interested party or Participant, its holding company, subsidiaries, associates or affiliates, credit instruments representing such values or derivatives that have them as underlying, except for fixed-term deposits, including withdrawable certificates of deposit on predetermined days, bank acceptances or promissory notes with yield payable at maturity, provided that these are contracted under market conditions. The foregoing is not applicable to the holding of shares representing the share capital of investment companies; VII. The Independent External Auditor, the Firm where they work, any partner or employee thereof, the spouse, concubine, concubinary or economic dependent of the aforementioned natural persons maintain with the interested party or Participant, its holding company, subsidiaries, associates or affiliates, debts from loans or credits of any nature, except for credit card debts, for financing destined for the purchase of durable consumer goods and for mortgage credits for the acquisition of real estate, provided that these are granted under market conditions; VIII. The interested party or Participant, its holding company, subsidiaries, affiliates or associates have investments in the Firm carrying out the audit; IX. The Independent External Auditor, the Firm, any partner or employee thereof falls under any of the circumstances provided for in the Professional Ethics Code of the professional college recognized by the Ministry of Public Education to which it belongs or, in its absence, the one issued by the Mexican Institute of Public Accountants, A.C., as causes of partiality in the judgment to express its opinion and which are not provided for in these provisions, or X. The Firm of which the Independent External Auditor is a partner has pending accounts receivable with the interested party or Participant for fees from the audit service or for any other service.”

“56a. Voluntary Disincorporation.- The Participant may request authorization from the Administrator, through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, to cease acting as a Participant. The aforementioned application must be submitted at least three Banking Business Days in advance of the date on which the Participant intends for its disincorporation as a Participant to take effect.

Wednesday, March 23, 2022 OFFICIAL GAZETTE 5 ...”

“Annex 1 MODEL THAT SPID PARTICIPANTS MUST USE TO REGISTER AND/OR DE-REGISTER THEIR OPERATORS [Letterhead of the Credit Institution] _____ of _________________ of _____. BANK OF MEXICO 5 de Mayo Avenue number 6, Ground Floor, Centro Neighborhood, Cuauhtémoc territorial demarcation, C.P. 06000, Mexico City. Attention: Directorate of Operation and Continuity of Payment Systems and Market Infrastructures. For the purposes of connection, participation and operation of (Full Name of the Credit Institution including, if applicable, the financial group to which it belongs) in the Interbank Payment System in Dollars (SPID), we would greatly appreciate if that Central Bank would proceed as indicated in this document regarding the Operators of this Credit Institution. To this effect, the undersigned hereby declare(s) under oath that I/we have verified that the person(s) designated as Operator(s) comply(s) with all and each of the requirements established for such effect in Circular 4/2016 “Rules of the Interbank Payment System in Dollars”, therefore this Credit Institution assumes full responsibility regarding such designation(s), as well as regarding all acts performed by such Operator(s) on its behalf and representation. OPERATORS OF THE INTERBANK PAYMENT SYSTEM IN DOLLARS ADMINISTERED BY THE BANK OF MEXICO DESIGNATED BY: Number Full Name of the Participant Institution Operator Name Digital Certificate Number (20 positions) Registration / De-registration Annex valid from _____________ 1

---

BANK OF MEXICO [INSTITUTION NAME] Authorized Representative 2 1 For exclusive use of the Bank of Mexico. 2 In those cases where the registration of Operators is requested, this document must contain the name, signature and position of the person(s) with authority both to exercise acts of dominion and those necessary to designate those who may act as Operators in the payment systems administered by the Bank of Mexico. In those cases where only the de-registration of Operators is requested, the document may be signed by persons with signatures previously registered with the Sub-directorate of Payment Systems Operation and Market Infrastructures of the Bank of Mexico.”

TRANSIT RIA SINGLE.- This Circular shall enter into force the day following its publication in the Official Gazette of the Federation. Mexico City, March 15, 2022.- BANK OF MEXICO: General Legal Director, Luis Urrutia Corral.- Initials.- Director of Policy and Studies of Payment Systems and Market Infrastructures, Othón Martino Moreno González.- Initials.

6 OFFICIAL GAZETTE Wednesday, March 23, 2022 For any inquiries regarding the content of this Circular, the Bank of Mexico is at your disposal through the Directorate of Central Bank Authorizations and Sanctions at phone (55) 5237-2000 extension 3200.