Circular 26/2008 — Electronic Attention Module

Wednesday, June 25, 2008 OFFICIAL GAZETTE (First Section) 1 CIRCULAR 26/2008 regarding the Rules to which Multiple Banking Institutions and Brokerage Houses must adhere concerning authorization requests and consultations submitted to the Bank of Mexico through the Electronic Attention Module.

A logo appears at the margin, stating: Bank of Mexico.

CIRCULAR 26/2008 TO MULTIPLE BANKING INSTITUTIONS AND TO BROKERAGE HOUSES:

SUBJECT: RULES FOR SUBMITTING AUTHORIZATION AND CONSULTATION REQUESTS TO THE BANK OF MEXICO THROUGH THE ELECTRONIC ATTENTION MODULE.

The Bank of Mexico, based on articles 28 of the Political Constitution of the United Mexican States, sixth and seventh paragraphs; 24 and 36 of the Bank of Mexico Law; 22 of the Law for Transparency and Ordering of Financial Services; as well as articles 8th, third and sixth paragraphs, 10, 14, in relation to article 25 fraction II and 17 fraction I, which provide for the powers of the General Directorate of Financial System Analysis, through the Directorate of Financial System Analysis, and the Directorate of Central Banking Regulations, to participate in the issuance of provisions, respectively, all of them from the Internal Regulations of the Bank of Mexico, published in the Official Gazette of the Federation on September 30, 1994, whose last modification was published in the aforementioned Official Gazette on May 9, 2008; considering that:

a) It is in the interest of the Central Bank to make the procedure for attending and resolving authorization requests and consultations submitted to it more efficient and secure, in order to contribute to the healthy development of the financial system;

b) Due to the development of new telecommunications and data transmission technologies, the financial system has increasingly increased the exchange of information electronically, with the intention of improving productivity and reducing costs;

c) The system known as "Extended Security Infrastructure" (IES) allows, among other functions, to verify that data messages signed with electronic signatures generated through said Infrastructure can be attributed to the holder of the corresponding digital certificate, and

d) If the aforementioned authorization and consultation requests made before this Central Institute are electronically signed using the IES, they will enjoy the necessary security and reliability, making it possible to ensure that their content has not been modified.

Therefore, it has resolved to issue the following:

RULES TO WHICH MULTIPLE BANKING INSTITUTIONS AND BROKERAGE HOUSES MUST ADHERE CONCERNING AUTHORIZATION REQUESTS AND CONSULTATIONS SUBMITTED TO THE BANK OF MEXICO THROUGH THE ELECTRONIC ATTENTION MODULE.

1. DEFINITIONS

For brevity, singular or plural, the following shall be understood as:

Certifying Agency: the institution, decentralized body, or company authorized by the Bank of Mexico to provide certification services in the IES, through the issuance of Digital Certificates.

Acknowledgment of Receipt: the Data Message that the Bank of Mexico generates and makes available to an Entity through the MAE, through its Representatives or its Operators, to inform it that it has received or made available to it: i) a Request,

Wednesday, June 25, 2008 OFFICIAL GAZETTE (First Section) 2

ii) additional documentation for the attention of a Request, iii) request for additional information, or iv) a Response; as applicable. In all cases, the Data Message will indicate the folio number, the confirmation number, the date, and the time at which the information was received or made available to the Entity.

Brokerage House: the legal entity authorized to operate as such under the Securities Market Law.

Digital Certificate: the Data Message electronically signed by the Certifying Agency that issued it, which confirms the link between the holder's identity and the respective Electronic Signature Verification Data.

Electronic Signature Creation Data: a unique information composed of an asymmetric cryptography private key that the holder generates under their total control and uses personally to create an Electronic Signature.

Electronic Signature Verification Data: a unique information composed of an asymmetric cryptography public key that the holder generates under their total control, which is mathematically related to the Electronic Signature Creation Data and is used to verify Data Messages signed electronically.

Business Day: the days of the week, except Saturdays, Sundays, and those on which financial entities are obliged to close their offices and branches, under the general provisions issued for such effect by the National Banking and Securities Commission.

Entity: Brokerage Houses and Multiple Banking Institutions, jointly or interchangeably.

Electronic Signature: the set of data added or attached to a Data Message, which is logically associated with it and is attributable to the holder of a Digital Certificate, once the respective Electronic Signature Verification Device has been used.

IES: the Extended Security Infrastructure, administered and regulated by the Bank of Mexico as referred to in Circular 6/2005 and its modifications.

Multiple Banking Institution: the legal entity authorized to operate as such under the Credit Institutions Law.

MAE: the system known as "Electronic Attention Module" developed by the Bank of Mexico, through which Entities can: i) submit Requests and additional documentation; ii) electronically consult requests for additional information; iii) follow up on the Response procedure, and iv) know the Response.

Data Message: information generated, sent, received, archived, or communicated through electronic means or other technologies.

Operator: the natural person designated and authorized by the Entity to have access to the MAE and thus be able to on its behalf: i) submit Requests and additional information; ii) follow up on the Response procedure, and iii) electronically consult requests for additional information, the Response, and other acts issued by the Bank of Mexico.

Representative: the natural person authorized by the Entity to electronically sign Requests on behalf of and in representation of the Entity, as well as to perform the actions that pertain to an Operator.

Wednesday, June 25, 2008 OFFICIAL GAZETTE (First Section) 3

Response: the Data Message with the Electronic Signature of the authorized officials of the Bank of Mexico to issue it, through which it attends to the Request through the MAE.

Request: the Data Message with the Electronic Signature of a Representative, through which an Entity through the MAE: i) requests an authorization; ii) formulates a consultation, or iii) presents additional information to the Bank of Mexico.

2. REQUIREMENTS

2.1 The Entities, through their General Manager, the head of the legal area, or the head of any other area related to the submission of Requests, must inform the Bank of Mexico of the name and email address of their Representatives and Operators.

For this purpose, the aforementioned General Manager or the heads of the areas in question must prepare a communication according to the format attached as an Annex to these Rules, addressed to the Directorate of Authorizations, Consultations, and Legal Control, accompanied by a certified copy of the deed in which their respective power(s) are recorded, or a certification of their appointment(s), issued by the secretary or assistant secretary of the board of directors.

It is the responsibility of the Entities to ensure that the persons designated as Representatives have sufficient powers to promote any type of act before the Bank of Mexico.

In order to accredit in the MAE the persons designated as Representatives and Operators, the Entities must also attach to said communication a device with a copy of the Digital Certificate of both the Representatives and the Operators they intend to designate.

The Entities must deliver the communication and information referred to in this section at least ten Business Days in advance of the date on which they intend to begin submitting Requests under these Rules.

2.2 In the event that the Entities determine to accredit Representatives or Operators different from those indicated in the communication referred to in the previous section, or if they decide that previously accredited persons cease to act as such, they must inform the Bank of Mexico through the Directorate of Authorizations, Consultations, and Legal Control, in the form and terms referred to in section 2.1.

The communication revoking or modifying the list of Representatives and Operators will take effect from the next Business Day following its receipt by the Bank of Mexico. This is always provided that it is received before 18:00:00 hours; otherwise, it will take effect on the second Business Day following.

The time mentioned in this section refers to the time in Mexico City, Federal District.

2.3 For the purposes of section 2.1, the Entities will need to perform the necessary acts before the Tax Administration Service (SAT); Cecoban, S.A. de C.V., or any other Certifying Agency authorized by the Bank of Mexico, so that their Representatives and Operators obtain the corresponding Digital Certificates.

3. PROCEDURE

3.1 Requests will be submitted to the MAE by the Representatives or by the Operators, for which they must incorporate the data and information required for this purpose. Only when the Requests meet the above requirements will the MAE generate the corresponding Acknowledgment of Receipt. The same procedure will apply to any additional documentation submitted.

Wednesday, June 25, 2008 OFFICIAL GAZETTE (First Section) 4

Requests or additional documentation submitted by the Entities to the MAE during business hours from 9:00:00 to 18:00:00 on Business Days will have legal effect on the same day. Information submitted to the MAE after 18:00:00 hours will have legal effect from 9:00:00 hours of the next Business Day.

The above must be done subject to the form and terms indicated in the MAE Operation Manual, which is available to Entities on the website that the Bank of Mexico has on the worldwide web (Internet). This Manual may be subject to periodic updates, so it is the responsibility of the Entities to consult it frequently.

The times mentioned in this section refer to the time in Mexico City, Federal District.

3.2 The Bank of Mexico may request additional information from the Entities through the MAE, in order to attend to their Requests, and will send a Data Message by email to notify this circumstance to the address indicated by the Entity for this purpose.

Entities that submit their Requests must regularly check the status of these, in order to timely attend to any requests for additional information that may be made to them.

In the event that Entities do not submit the additional information requested within the time limit indicated for each case in the respective request, their Request will be considered withdrawn, such Request having no legal effect and no responsibility for the Bank of Mexico.

3.3 The Bank of Mexico, through the MAE, will make the Response available to the corresponding Entity and will send a Data Message by email to notify this circumstance to the address indicated by the Entity for this purpose.

4. GENERAL PROVISIONS

4.1 The use of the Electronic Signature by both the Entities and the Bank of Mexico in accordance with these Rules will substitute for all legal effects for the handwritten signature, having the same probative value in accordance with applicable provisions.

4.2 Notifications made through the MAE will take effect on the Business Day following that in which the corresponding Acknowledgments of Receipt are generated. Responses will take effect on the date, if any, established as the start of validity, regardless of the date on which the Entities electronically consult them. Acknowledgments of Receipt will have probative value for all legal effects applicable.

In the event of technical failures not attributable to the Entities that prevent the operation of the MAE, notifications generated will take effect on the Business Day following that in which the operation of the MAE is restored.

4.3 The Entities will be responsible for the Requests submitted to the MAE by their Representatives or Operators, as well as for the acts they perform and the information they provide. This applies while the respective designation remains valid under these Rules.

4.4 The Bank of Mexico may authorize exceptions to what is provided in these Rules through the Directorate of Authorizations, Consultations, and Legal Control.

ANNEX

MODEL OF COMMUNICATION

"(ENTITY LETTERHEAD)"

Mexico, D.F., ___ of _________ of 200_.

Wednesday, June 25, 2008 OFFICIAL GAZETTE (First Section) 5

BANK OF MEXICO Directorate of Authorizations, Consultations, and Legal Control, Av. 5 de Mayo, number 2, 6th Floor, Col. Centro, C.P. 06059, Mexico, D.F.

By this means, I inform you that my represented entity expressly accepts the content of Circular 26/2008 of June 20, 2008, which contains the "RULES TO WHICH MULTIPLE BANKING INSTITUTIONS AND BROKERAGE HOUSES MUST ADHERE CONCERNING AUTHORIZATION REQUESTS AND CONSULTATIONS SUBMITTED TO THE BANK OF MEXICO THROUGH THE ELECTRONIC ATTENTION MODULE". Consequently, it expresses its conformity to process the requests referred to in such Rules, under the terms indicated therein. Likewise, in compliance with the provisions of said Rules, (FULL NAME OF THE ENTITY, INCLUDING, IF APPLICABLE, THE FINANCIAL GROUP TO WHICH IT BELONGS) requests that this Central Institute accredit the persons who will act as its Representatives and, if applicable, Operators, to submit Requests and receive notifications, or to cease considering them as such, as indicated below.

REPRESENTATIVES Register 1 Remove 1 Name Email Address Digital Certificate Serial Number (twenty digits) 1.- 2.- 3.- ...

OPERATORS Register 1 Remove 1 Name Email Address Digital Certificate Serial Number (twenty digits) 1.- 2.- 3.- ...

1 Mark with a cross (X) the applicable case.

Wednesday, June 25, 2008 OFFICIAL GAZETTE (First Section) 6

For this purpose, I declare that I have the powers provided for in section 2.1 of the aforementioned Rules, which is accredited with a copy of the public deed(s) in which the respective powers are recorded, or with the certification of the appointment issued by the secretary or assistant secretary of the board of directors, which is attached to this communication. Likewise, I declare that the persons designated and authorized in this act as Representatives by means of this communication also have the necessary powers in accordance with the aforementioned section 2.1.

(FULL NAME OF THE ENTITY INCLUDING, IF APPLICABLE, THE FINANCIAL GROUP TO WHICH IT BELONGS) hereby recognizes and accepts that by submitting authorization requests, consultations, or any other additional documentation in the manner provided for in the aforementioned Circular 26/2008, all notices, reports, and acts issued by the Bank of Mexico through the MAE will be carried out electronically, will have full legal validity, and will produce all legal effects applicable.

Likewise, (FULL NAME OF THE ENTITY INCLUDING, IF APPLICABLE, THE FINANCIAL GROUP TO WHICH IT BELONGS) recognizes and accepts that notifications made through the MAE will have legal effect on the Business Day following that in which the corresponding Acknowledgment of Receipt is generated, which will have full probative value for all legal effects applicable. This is without prejudice to the fact that Responses will take effect on the date indicated therein, regardless of the date on which this Entity electronically consults them.

Finally, (FULL NAME OF THE ENTITY INCLUDING, IF APPLICABLE, THE FINANCIAL GROUP TO WHICH IT BELONGS) hereby releases the Bank of Mexico from all responsibility for the attention given to authorization requests, consultations, or any other additional documentation submitted by the persons this Entity has designated to act as its Representatives and, if applicable, Operators, until the request to cease considering them as such takes effect in accordance with section 2.2 of the aforementioned Circular 26/2008.

Sincerely

(NAME AND SIGNATURE OF THE GENERAL MANAGER OR HEADS REFERRED TO IN THE FIRST PARAGRAPH OF SECTION 2.1 OF THE RULES, SPECIFYING THEIR POSITION OR POST)

TRANSITORY PROVISIONS

FIRST.- These Rules will enter into force on June 30, 2008.

SECOND.- From January 2, 2009, authorization or consultation requests and delivery of additional information that Entities submit to the Bank of Mexico will be processed and attended to exclusively through the MAE.

THIRD.- Those Entities that on January 2, 2009, are not able to comply with the provisions of these Rules, by December 31, 2008 at the latest, must notify and justify such circumstance to the Directorate of Authorizations, Consultations, and Legal Control of the Bank of Mexico.

Entities in such a situation, until they resolve such situation, may continue using the procedure that was in effect until June 27, 2008, with respect to submitting authorization or consultation requests and delivery of additional information to the Bank of Mexico.

Sincerely

Wednesday, June 25, 2008 OFFICIAL GAZETTE (First Section) 7

Mexico, D.F., June 20, 2008.- BANK OF MEXICO: The General Director of Financial System Analysis, José Gerardo Quijano León.- Initials.- The Director of Central Banking Regulations, Fernando Luis Corvera Caraza.- Initials.

For any inquiries regarding the content of this Circular, please contact the Directorate of Authorizations, Consultations, and Legal Control, at phones 5237.2308, 5237.3200, or 5237.2317, and in the case of any operational problems with the MAE, contact the Projects Directorate at phones 5237-2526 or 5237-2510.