Circular 2/2025 — Modifies Circular 14/2017

Friday, February 21, 2025 OFFICIAL GAZETTE 1 BANCO DE MEXICO CIRCULAR 2/2025 addressed to the participants of the Interbank Electronic Payment System and other interested parties acting with such status, regarding the Modifications to Circular 14/2017 (Clearing Houses for Indirect Participation Fund Transfers and Miscellaneous Topics).

A logo appears at the margin, stating: Bank of Mexico.

CIRCULAR 2/2025 TO THE PARTICIPANTS OF THE INTERBANK ELECTRONIC PAYMENT SYSTEM AND OTHER INTERESTED PARTIES ACTING WITH SUCH STATUS:

SUBJECT: MODIFICATIONS TO CIRCULAR 14/2017 (CLEARING HOUSES FOR INDIRECT PARTICIPATION FUND TRANSFERS AND MISCELLANEOUS TOPICS).

The Bank of Mexico, with the purpose of continuing to promote the sound development of the financial system, protect the interests of the public, and foster the proper functioning of payment systems, has resolved to update the regulatory framework for the provision of indirect participation services in the SPEI with the objective of delimiting the risk management criteria that must be implemented for these services, as well as including additional elements that provide greater clarity to the regulatory framework for SPEI participants.

For the above reason, based on articles 28, paragraphs seventh and eighth, of the Political Constitution of the United Mexican States, 2, fractions I, IV and VIII, and 6 of the Payment Systems Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, paragraphs fourth and eighth, 10, first paragraph, 12 Bis, first paragraph, in relation to 20 Quater, fraction IV, and 17, fraction I, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Directorate of Payment Systems and Market Infrastructures and the Directorate of Central Banking Provisions, respectively, as well as Second, fractions X and XVII, of the Agreement on the Assignment of Administrative Units of the Bank of Mexico, it has resolved to modify the 9a. Bis., fraction IV, subsection b), and fraction V, subsections a) to Bis), numeral 1, c), numeral 2, and d), numeral 3, 9a. Bis 1., first paragraph, 9a. Bis 4., fraction I, 9a. Bis 10., first paragraph and fraction I, 12a., fraction II, second paragraph, 19a., fractions I, and IV, subsection b), 25a., fraction VI, 46a., fraction III, subsection e), 53a., fractions I and II, and second paragraph, 59a., fraction I, 74a., first paragraph, 83a., fraction I, subsection i), 85a., second paragraph, 98a., second paragraph, as well as add the second and third paragraphs to fraction IV and fractions XI Bis and XXVII Bis to 9a. Bis 4., subsection c) to fraction I of 9a. Bis 10., a second paragraph to 20a., shifting the current second paragraph and subsequent ones of the aforementioned 20a., a fifth paragraph to 43a., shifting the current fifth paragraph to become the sixth paragraph of the aforementioned 43a., fraction III to 53a., section C and its subsections a), b), c), d), e), f), g) and h) to fraction I of 58a., the second and sixth paragraphs to 74a., shifting the current third and sixth paragraphs, as well as their subsequent ones, of the aforementioned 74a., fraction IV and its subsections a) and b) to 83a. and 89a. Bis., of the "Rules of the Interbank Electronic Payment System", issued through Circular 14/2017, to remain as follows:

RULES OF THE INTERBANK ELECTRONIC PAYMENT SYSTEM

“9a. Bis. Obligations related to CoDi Transfer Orders.- … I. to III. … IV. … a) … b) Allow the holders of the aforementioned Customer Accounts to generate Payment Messages for amounts up to the equivalent of six thousand UDIS, calculated as indicated in the last paragraph of this Rule, per message, or for those higher amounts that, if applicable, said Participant decides to establish.

2 OFFICIAL GAZETTE Friday, February 21, 2025 … c) to e) … V. … a) Allow the respective Issuing Clients to receive, twenty-four hours a day, all days of the year, Payment Messages through software programs on mobile devices enabled in accordance with these Rules and Appendix AD of the Manual, either without amount or up to the equivalent of six thousand UDIS, calculated as indicated in the last paragraph of this Rule, per Payment Message, or for those higher amounts that, if applicable, said Participant decides to establish. a Bis) …

1. Allow its Indirect Clients to receive Payment Messages through software programs on mobile devices enabled in accordance with these Rules, either without amount or up to the equivalent of six thousand UDIS, calculated as indicated in the last paragraph of this Rule, per Payment Message, or for those higher amounts that, if applicable, said Participant decides to establish, and
2. … b) … c) …
3. …
4. “CoDi Folio”, as defined in Appendix AD of the Manual, corresponding to the Payment Message in question.
5. to 7. … d) …
6. and 2. …
7. Postpone, so that the referred software program stores the Payment Message and allows the Issuing Client to accept or reject it at a later time, provided that the characteristics of the referred message allow the action to be carried out in terms of what is established in Appendix AD of the Manual. … e) to j) … …”

“9a. Bis 1. Circumstances for the Provision of Indirect Participation Services.- Except as provided in 9a. Bis 2. of these Rules, the Participant interested in providing Indirect Participation Services may only provide them to its Clients that are regulated and supervised financial entities by a national financial authority and that are duly empowered and authorized to provide the services of sending or receiving fund transfers on a habitual and professional basis to their respective clients or users. …”

“9a. Bis 4. Minimum Content of Indirect Participation Service Contracts.- … I. The services that, if applicable, the Indirect Participation Service Provider will provide to the Indirect Participant, as well as the guidelines and characteristics that the Indirect Participant must fulfill for connection to the systems through which the Indirect Participation Service is provided. In all cases, in the Indirect Participation Service Contracts entered into by the Participant, it must stipulate that it will provide the respective Indirect Participants with the service of receiving Transfer Orders directed to the Indirect Beneficiary Clients of said Indirect Participants. On the other hand, the Participant must stipulate in said instrument that it will provide the Indirect Participants with the service of receiving and crediting fund transfers that the Participant must process between the Indirect Participants to whom it provides Indirect Participation Services, including those that may arise from the acceptance of Payment Messages received from other Indirect Participants of the same Participant and, if applicable, the sending of the referred fund transfers. Additionally, at the request of the Participant's Client, the latter may agree to provide it with services for sending and clearing Transfer Orders, receiving and sending CoDi Transfer Orders, clearing, clearing and reconciliation of Transfer Orders sent and received by other Indirect Participants of the same Participant, as well as other related services. The foregoing shall be observed without prejudice to what is stated in 9a. Bis., fractions II and II Bis, of these Rules; II. and III. … IV. … In the case of Participants providing Indirect Participation Services to a Client that has the status of a Credit Institution or an electronic payment fund institution and that, in accordance with what is provided in 15a. of these Rules, maintains, at least, three thousand deposit accounts for demand deposits or electronic payment funds, as applicable, it must provide Indirect Participation Services twenty-four hours a day, all days of the year. Likewise, in the event that, as part of the Indirect Participation Services, the processing of Payment Messages and the reception of CoDi Transfer Orders is included, or those fund transfers that the Participant must process between its respective Indirect Participants arising from the acceptance of said Payment Messages, as well as the processing of Transfer Orders arising from Sending Requests in which the respective Indirect Issuing Clients have indicated only the ten digits of cellular phone numbers, including those arising from fund transfers processed by the Participant between its respective Indirect Participants, the days and hours agreed upon in the Indirect Participation Service Contract for the provision of Indirect Participation Services must provide that the hours and processing times of the referred fund transfers in this paragraph are carried out entirely within timeframes no greater than those provided in these Rules for the aforementioned Participants. V. to XI. … XI Bis. The obligation of the Indirect Participant to use usernames and passwords for the sending of Transfer Orders, as well as for the fund transfers that the Participant must process between the Indirect Participants to whom it provides Indirect Participation Services. XII. to XXVII. … XXVII Bis. The characteristics and service levels that will apply to the clearing and settlement of fund transfers that the Participant must process between its respective Indirect Participants to whom it provides Indirect Participation Services, and XXVIII. … …”

“9a. Bis 10. Transfer Instructions.- The Participant that, under the Indirect Participation Service Contract celebrated with its Indirect Participant, processes fund transfers between the Indirect Participants to whom it provides Indirect Participation Services, including those that may arise from the acceptance of Payment Messages, as well as that which has allowed its Indirect Participant to present the Sending Requests derived from the instructions for electronic fund transfers that its Indirect Clients present to said Indirect Participant, must ensure that said Sending Requests include the corresponding information indicated for these purposes in section 8 of the Manual, as well as include in the Sending Requests and in the fund transfers between the Indirect Participants to whom it provides Indirect Participation Services the Federal Taxpayer Registry (RFC) keys or the Unique Registry of Population Keys (CURP) of the respective Indirect Issuing Clients, and that they meet the following requirements: I. … a) Any of the customer account identification data of the Customer Account corresponding to the Beneficiary Client or of the Customer Account corresponding to the Indirect Beneficiary Client indicated in 12a., fraction I, subsection a), sub-subsections i., ii., and iii., of these Rules, and that the Indirect Participant must allow the Indirect Issuing Client to choose, in accordance with what is established in the account type catalog in section 9 of the Manual; b) The amount of the transfer subject to the respective instruction, and c) The name of the Beneficiary Client or Indirect Beneficiary Client designated in said instruction. II. to V. … …”

“12a. Information contained in the Sending Request.- … I. … II. … a) to c) … The data referred to in the aforementioned subsections a) and b) must be created under the structure provided for this purpose in section 8 of the Manual, for which the Participant must establish the applicable parameters that allow adding this data to the Sending Request in accordance with said structure and up to the maximum length established for each of these data in said section of the Manual. …”

“19a. Crediting of Transfer Orders Accepted by SPEI.- … … I. … The thirty-second period specified in the previous paragraph will not apply to that Participant that has the status of a Credit Institution regarding the Transfer Order Accepted by SPEI that it receives for an amount up to the equivalent of one thousand five hundred UDIS, in which case the period will be five seconds following that in which the Administrator has made the cited Liquidation Notice available to it through the SPEI. As an exception to what is provided in the previous paragraph, regarding those individual transfers for amounts equal to or greater than six thousand UDIS, or those referred to the same Customer Account corresponding to the Beneficiary Client in question, that are received during the same SPEI operation day and that, by the sum of their respective amounts, reach or exceed said amount, in case that any Receiving Participant determines to carry out, in accordance with its internal processes, additional validations to those provided in these Rules to carry out the crediting referred to in this fraction, it may request authorization from the Administrator, through the Directorate of Payment Systems and Market Infrastructures Operation and Continuity, for a period not greater than six months, to carry out said crediting in a period greater than those referred to in the first and second paragraphs of this fraction, as applicable, which it determines for these purposes. The Participants requesting the indicated authorization must state in their request that they are in the process of automating the validations, for the purposes referred to in this rule in the timeframes indicated in this fraction, once the period of the requested authorization concludes. For the purposes of what is provided in the present paragraph, Participants must consider the official value of the UDI corresponding to the first day of January of each calendar year. Additionally, regarding those fund transfers directed to Beneficiary Client Accounts indicated in Rule 58a., fraction V, last paragraph, the respective Receiving Participants must carry out additional validations to those provided in these Rules before carrying out the crediting referred to in this fraction, to determine if they accept the respective Transfer Orders Accepted by SPEI, and, regarding said validations, they must take into account, among other aspects they determine, the opening date of the corresponding Customer Accounts, as well as the transactional patterns of these in comparison with those considered unusual. In this case, the referred Participants will not be obligated to comply with the timeframes indicated in the first and second paragraphs of this fraction, as applicable, and may carry out the corresponding crediting in the timeframe that, for this purpose, the Administrator authorizes each Participant in response to the request presented through the Directorate of Payment Systems and Market Infrastructures Operation and Continuity. Until the Participants have the authorization from the Bank of Mexico referred to in this paragraph, they must carry out each of the aforementioned crediting starting from the twenty-four hours following the receipt of the Liquidation Notice of the Transfer Order Accepted by SPEI. In this case, the crediting timeframes will be those indicated in 19a. of these Rules. II. and III. … IV. … a) … b) It concerns Transfer Orders Accepted by SPEI for amounts greater than one thousand five hundred UDIS, that those Participants that have the status of a Credit Institution or a Clearing House for Transfers Through Mobile Devices between the opening hours of the SPEI specified in 35a. of these Rules and 05:59:59 hours of the referred Banking Business Day corresponding to the SPEI operation date; V. and VI. … …”

“20a. Confirmation of Crediting.- … Regarding the Scheduled Payments referred to in fraction V of 19a. of these Rules, the Receiving Participant must generate and send, through the SPEI, a Confirmation of Crediting to the Administrator in terms and with the characteristics specified in Appendix D of the Manual, no later than 06:05:00 hours of the Banking Business Day corresponding to the SPEI operation date. …”

“25a. Timeframes for the Return of Transfer Orders Accepted by SPEI Not Credited in Customer Accounts.- … … I. to V. … VI. Those corresponding to Transfer Orders Accepted by SPEI received by Participants that have the status of a Credit Institution or a Clearing House for Transfers Through Mobile Devices for amounts greater than one thousand five hundred UDIS, between the opening hours of the SPEI specified in 35a. of these Rules and 05:59:59 hours of the referred Banking Business Day corresponding to the SPEI operation date. In this case, the Transfer Order of the type of return of transfer not credited in the Customer Account must be sent no later than 06:00:10 hours of the following Banking Business Day mentioned, or VII. …”

“43a. Collaboration Mechanism for the Protection of Issuing Clients and Indirect Issuing Clients.- …

6 OFFICIAL GAZETTE Friday, February 21, 2025 … I. to VIII. … … The referred Participants must send to the Administrator, no later than the last Banking Business Day of September of each year, a communication in terms of what is established in 98a. of these Rules, through which they ratify the contact data of the persons designated to process support requests on behalf of and in representation of the respective Participants. Additionally, in case of making changes or updates to said contact data, these must be notified to the Administrator in accordance with what is established in Appendix AQ of the Manual. …”

“46a. Participant Contingencies.- … I. to II. … III. … a) to d) … e) Those received by the Participant that has the status of a Credit Institution or a Clearing House for Transfers Through Mobile Devices for amounts greater than one thousand five hundred UDIS, and said reception occurs from 16:00:00 hours of any Banking Business Day and 05:59:59 hours of the next Banking Business Day corresponding to the SPEI operation day. In this case, the Participant must send the respective return of the Transfer Order Accepted by SPEI not credited in the Customer Account in question no later than 08:00:00 hours of the same SPEI operation day mentioned above. …”

“53a. Request for Operator Registration.- … I. Have experience in operating systems to carry out operations in financial markets; II. Have a valid Digital Certificate in the name of the person designated as Operator, and III. Not be disqualified from exercising commerce or holding a job, position, or commission in public service, or in the Mexican financial system. The registration of the person that the Participant in question intends to designate as Operator and that has communicated to the Administrator in accordance with what is indicated in the previous paragraph, will take effect for all SPEI Instances once the Administrator has verified that the submitted request meets the requirements established in this Rule. The sending of the communication referred to in this Rule, by the Participant to the Administrator, must be subject to what is established in 98a. of these Rules. …”

“58a. Requirements for Admission as a Participant.- … I. … A. and B. … C. In software programs installed on telecommunications mobile devices. Those interested who, through software programs installed on telecommunications mobile devices, offer their Clients the service of processing Payment Messages and CoDi Transfer Orders, or the service of sending or receiving Transfer Orders derived from Sending Requests in which the respective Issuing Clients have indicated only the ten digits of cellular phone numbers must have processes or systems duly documented that include at least: a) Implementation of procedures to promote the correct installation and updates of new versions available in software programs installed on mobile devices

---”

mobile telecommunications devices and that allow protecting sensitive information processed in said channels. b) Encryption and secure storage of sensitive information in software programs installed on mobile telecommunications devices. c) Implementation of procedures and controls that allow encrypting communication between software programs installed on mobile telecommunications devices and other applications necessary to provide functionalities. d) Incorporation of procedures and controls to have authentication factors and session management in software programs installed on mobile telecommunications devices. e) Procedures that ensure that a formal and documented development process is followed for the implementation of functionalities. f) Implementation of procedures and controls to prevent the execution of software programs installed on mobile telecommunications devices with administration permissions and on modified operating systems. g) Implementation of procedures that ensure that the security of software programs installed on mobile telecommunications devices is reviewed statically and dynamically and threats are managed. h) Procedures that allow verifying the integrity of software programs installed on mobile telecommunications devices. …” “59a. Compliance Officers of the SPEI.- … … I. Not be disqualified from engaging in commerce or holding an employment, position, or commission in public service, or in the Mexican financial system, and II. … …” “74a. Periodic Report and Evaluation.- Each Participant must verify the compliance it must give to the requirements of computer security, operational risk management, and protection of Issuing Clients of the Participant, Additional Risks, interoperability to operate in the SPEI established in Rule 58a of these Rules, as well as the business model or scheme provided for in Rule 58a Bis., respectively. Likewise, each Participant must inform the Administrator about any other identified risk, through reviews that must be carried out every two years by the head of the internal audit area of the Participant itself, or if the Participant so determines, the Independent External Auditor(s). These reviews must observe what is provided in fractions II and III of Rule 62a of these present Rules. In case the Participant does not have an internal audit area, the respective Independent External Auditors must carry out the aforementioned reviews in all cases, in the referred two-year periods. Participants must refrain from carrying out consecutively the reviews in charge of the head of the internal audit area of the Participant in question, referred to in the preceding paragraph. … With respect to those Participants who have been admitted as Participants of the SPEI in the last quarter of the year immediately preceding that of the presentation of the report referred to in the first paragraph of this Rule, they will not be obliged to deliver the aforementioned report and certificate. In such a case, the referred Participants must comply with the mentioned obligation during the immediate biennial period following that corresponding to the date on which they were admitted as Participants, according to Rule 64a of these present Rules. …” “83a. Information of Transfer Orders Accepted by SPEI.- … I. …

8 OFFICIAL GAZETTE Friday, February 21, 2025 a) to h) … i) Regarding CoDi Transfers, the information of the field “Folio del Esquema Cobro Digital” (Digital Collection Scheme Folio) in accordance with what is established in section 8 of the Manual. II. a III. … IV. Participants that process fund transfers between Indirect Participants to whom they offer Indirect Participation Services, must provide said Indirect Participants with the information indicated in fraction I of this Rule, as well as the information indicated below, with the objective that the referred Indirect Participants make it available to Indirect Clients: a) The corporate name of the Indirect Participants involved in the fund transfer in question, as well as the corresponding one to the SPEI Participant that processes the information. b) A unique identifier of the fund transfer in question that may be consistent with the structure of the Tracking Key.” “85a. Access to Electronic Payment Receipts.- … Participants must make the electronic link referred to in the preceding paragraph available to the corresponding Clients no later than five minutes after the Administrator has made it available to them, through the SPEI, the Settlement Notice regarding the Transfer Order Accepted by SPEI in question, as well as to maintain said electronic link for consultation by the respective Clients in the means referred to in the preceding paragraph for a period of no less than three months subsequent to the date on which the corresponding settlement was carried out. …” “89a. Bis. Information relative to the operation.- The Administrator will publish periodically on its website, aggregated statistical information on the Transfer Orders and CoDi Transfer Orders that each of the Participants process, under the terms established by the Administrator. The referred information must not allow relating Participants with their Clients.” “98a. Sending of digital communications to the Administrator.- … Such communications must be digitally signed by the persons corresponding to what is stated in each Rule, which must be previously registered in the catalog of personnel that the Participant authorizes to carry out the management of operations and various requests to operate with the Bank of Mexico, according to the procedure established in Appendix T of the Manual. …” TRANSITORY PROVISIONS FIRST.- What is provided in this Circular will enter into force on March 24, 2025. SECOND.- The modifications to Rule 58a of the Rules will enter into force on May 23, 2025. THIRD.- The modifications to Rule 9a Bis, fraction IV, subsection b), fraction V, subsection a), and numeral 1 of subsection a Bis) of the referred fraction, as well as Rule 19a, fraction I, third paragraph, of the Rules, relative to the amounts equivalent to six thousand UDIS that Participants must implement, will enter into force on February 23, 2026. FOURTH.- The modifications to Rule 9a Bis 4, fractions I and IV, Rule 9a Bis 10, first paragraph, as well as the additions of fractions XI Bis and XXVII Bis to Rule 9a Bis 4, subsection c) to fraction I of Rule 9a Bis 10, and fraction IV to Rule 83a of the Rules, will enter into force on November 25, 2025. FIFTH.- The modifications to the second paragraph of Rule 85a of the Rules will enter into force on August 25, 2025.

Friday, February 21, 2025 OFFICIAL GAZETTE 9 Mexico City, February 13, 2025.- BANK OF MEXICO: General Director of Payment Systems and Market Infrastructures, Othón Martino Moreno González.- Rubric.- Director of Central Banking Regulations, María Teresa Muñoz Arámburu.- Rubric. For any inquiry regarding the content of this Circular, the Bank of Mexico places itself at your disposal through the Directorate of Central Banking Authorizations and Sanctions at telephone (55) 5237-2000 extension 3200.