Circular 3/2022 — Modifications to Circular 13/2017 (Indirect Participation and Miscellaneous Topics)

Wednesday, March 23, 2022 OFFICIAL GAZETTE 1 BANCO DE MEXICO CIRCULAR 3/2022, addressed to Credit Institutions and other companies that professionally provide the service of fund transfers, regarding the Modifications to Circular 13/2017 (Indirect Participation and Miscellaneous Topics).

A logo is placed at the margin, which says: Bank of Mexico.

CIRCULAR 3/2022 TO CREDIT INSTITUTIONS AND OTHER COMPANIES THAT PROFESSIONALLY PROVIDE THE SERVICE OF FUND TRANSFERS:

SUBJECT: MODIFICATIONS TO CIRCULAR 13/2017 (INDIRECT PARTICIPATION AND MISCELLANEOUS TOPICS)

The Bank of Mexico, with the purpose of continuing to promote the proper functioning of payment systems, as well as to promote the healthy development of the financial system and the protection of the public's interests, has resolved to modify the "General Provisions applicable to credit institutions and other companies that professionally provide the service of fund transfers, as well as to participants in payment systems administered by the Bank of Mexico and to other interested parties in acting as participants in said systems", issued through Circular 13/2017, with the objective, on the one hand, to establish the regulatory framework applicable to indirect participation in payment systems administered by this Central Institute, in particular, the Interbank Electronic Payment System (SPEI). On the other hand, the necessary requirements are established to expand the infrastructure of said system, which will allow maintaining the service and operation standards of the SPEI due to the sustained growth in the number of transfers processed in that infrastructure, to implement new transfer operation schemes in the SPEI, as well as to ensure compliance with the standards, processing times, and conditions required in the operation of the new payment schemes, in favor of greater competition in payment services and for the benefit of end-user clients. Additionally, the necessary conditions that SPEI participants who offer their clients, holders of such accounts, to receive transfers from other accounts opened in the same institutions through the generation of debit messages must meet are established, in order that the computer programs they use for this purpose do not cause fragmentation between those used for fund transfers between accounts of different institutions and those opened in the same institution, so that clients can benefit from the use of the same type of system.

On the other hand, requirements are established that the referred participants must meet in order to carry out schemes that allow the sending of fund transfers in whose instructions the beneficiary accounts are identified only with the ten digits of the respective mobile phone line numbers that have been associated with said accounts, without the need to generate duplicities in centralized records of sensitive data corresponding to SPEI accounts associated with mobile phone line numbers of the participants' clients in said system.

For the above, based on articles 28, sixth and seventh paragraphs, of the Political Constitution of the United Mexican States, 2, 3, fraction I, 24 and 35 Bis of the Bank of Mexico Law, 10 and 19 of the Payment Systems Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, fourth and eighth paragraphs, 10, first paragraph, 14 Bis, first paragraph, in relation to 17, fraction I, and 20 Quater, fraction IV, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Legal Directorate and the Directorate of Policy and Studies of Payment Systems and Market Infrastructures, respectively, as well as Second, fractions X and XVII, of the Agreement on the Assignment of Administrative Units of the Bank of Mexico, it has resolved to modify the definition of "Debit Message" provided in fraction II. Ter of 2a., rules 2a. Bis., first paragraph, 4a., second paragraph, 8a., first paragraph and fraction VII, 9a., second paragraph, 10a., second paragraph, 12a., second paragraph, and 15a., fractions V, first paragraph, XII, XVI, XII and XVIII, as well as add the definition of "Banking Business Days" in fraction I Bis. of 2a., the second paragraph to fraction V of 15a., and fractions XIX, XX, XXI, XXII, XXIII, XXIV, XXV and XXVI to 15a., of the

2 OFFICIAL GAZETTE Wednesday, March 23, 2022 "General Provisions applicable to credit institutions and other companies that professionally provide the service of fund transfers, as well as to participants in payment systems administered by the Bank of Mexico and to other interested parties in acting as participants in said systems", contained in Circular 13/2017, to remain in the following terms:

GENERAL PROVISIONS APPLICABLE TO CREDIT INSTITUTIONS AND OTHER COMPANIES THAT PROFESSIONALLY PROVIDE THE SERVICE OF FUND TRANSFERS, AS WELL AS TO PARTICIPANTS IN PAYMENT SYSTEMS ADMINISTERED BY THE BANK OF MEXICO AND TO OTHER INTERESTED PARTIES IN ACTING AS PARTICIPANTS IN SAID SYSTEMS

"2a. Definitions.- ... I. Bis. Banking Business Days: the days on which credit institutions are not obliged to close their doors nor suspend operations, in terms of the provisions of general character, for such effect, issued by the National Banking and Securities Commission. II. and II. Bis. ... II. Ter. Debit Message: to that message processed by means of computer programs for the transfer of funds between accounts opened in different Participants or in the same Participant, which is generated by the holder of the account designated as the recipient of the resources of the fund transfer object of said message, so that, in turn, it is delivered to the holder of the account in the Participant in which said transfer must originate, with the purpose that, once the latter accepts what is indicated in said message, the funds indicated in the said message are transferred to the referred recipient account. III. to XIII. ... ..."

"2a. Bis Disposition of Resources.- Receiving Entities, with respect to those transfers or transfers of funds executed, in favor of their clients, for amounts equal to or greater than fifty thousand pesos, as well as, if applicable, several transfers or transfers received on the same day that, derived from the sum that is recommended to said Receiving Entities to carry out, are equivalent to or are greater than said amount, must allow those clients, as beneficiaries of such transfers or transfers, that, only from the next Banking Business Day after that on which the transfer or transfer of funds in question has been executed, they can dispose of the corresponding resources, for those same amounts, through the delivery of cash, in national currency or, if applicable, in the foreign currency resulting from a currency exchange operation carried out with said resources, or gold or silver pieces or coins in fine metals derived from the sale carried out with said resources, or cashier's checks issued, if applicable, by said Receiving Entities, including the delivery of cash for the payment of checks drawn, if applicable, against the corresponding accounts of said clients. Additionally, Receiving Entities that offer deposit accounts for demand with checkbooks in which, in turn, they make deposits of resources corresponding to transfers or transfers for the amounts referred to, must refrain from certifying, on the same day that the deposits mentioned have been made, checks drawn against said accounts for those same amounts, as well as, if applicable, carrying out those other operations or actions that the Administrator notifies through the communication systems agreed upon for the payment system in question. As an exception to what is provided in this paragraph, Receiving Entities may deliver, in cash, cashier's checks or gold and silver pieces and coins mentioned above, the amounts corresponding to the transfers or transfers of funds provided for in this Rule, as well as certify checks or carry out the other actions indicated by the Administrator, on the same day of their crediting, provided that said Receiving Entities expressly authorize their clients individually, subject to compliance with the procedures they establish regarding this, which include the verification of the requirements they establish for these effects, based on the characteristics of the clients in question and their observed operability. ..."

Wednesday, March 23, 2022 OFFICIAL GAZETTE 3 "4a. Presentation of the application for authorization to act as a Participant.- ... The authorization application referred to in this Provision, as well as the admission application referred to in 3a., second paragraph, of these Provisions, may be presented jointly to the Bank of Mexico through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, and must be signed by the general director of the interested party or by the person who holds the position in the interested party that has under their responsibility the functions of administration, or by any official who holds a position of at least two immediate lower hierarchies below that of the aforementioned general director or equivalent. ..."

"8a. Provision of services by third parties.- The Participant or the interested party in acting as such may agree with third parties that provide them with an interface that allows them to connect with the Payment System in which they have the character of Participant or in which they intend to participate in accordance with what is provided in these Provisions, or any other service that is essential for the processing of Transfer Orders, provided that they comply with the requirements and conditions established in this Chapter, as well as in the Internal Standards, for which the Participant or the referred interested party must present an application for authorization to the Bank of Mexico, through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, which must be signed by the general director of the interested party, by the person who has the administration functions of the interested party under their charge or by any official of the interested party with sufficient powers for this who holds a position within the two immediate lower hierarchies below that of the aforementioned general director or equivalent. ... I. to VI. ... VII. The document that describes the actions that will be carried out for the orderly termination of the same, in the event that the provision of the service through the third party is suspended and it is not possible to replace the third party in said provision on the termination date, and VIII. ..."

"9a. Third parties residing abroad.- ... I. to III. ... Additionally, in the event that any authority of the third party's country of origin requires information related to the services it provides to the Participant or to the interested party in acting as such, said Participant or the interested party must inform the Bank of Mexico regarding such situation no later than the next Banking Business Day after having knowledge and must provide a copy of the information that the third party has delivered to the authority of its country of origin."

"10a. Documentation that accredits compliance with the Provisions regarding the hiring of third parties.- ... The Participant or the interested party must obtain prior and written authorization from the Bank of Mexico, which must be requested through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, to effect any modification to the contract or legal instrument that they have celebrated with the third party. Likewise, it must inform the Bank of Mexico, through the mentioned Directorate, regarding any reform to the social object of the third party or modifications to the internal organization, that may affect the provision of the service, with at least five Banking Business Days in advance for these to take place. ..."

4 OFFICIAL GAZETTE Wednesday, March 23, 2022 "12a. Suspension of the provision of the service.- ... The Participant must inform in writing to the Bank of Mexico through the Directorate of Operation and Continuity of Payment Systems and Market Infrastructures, about the suspension or termination of the provision of the service by the third party, the causes that motivated it, as well as the actions that are being carried out for continuity, with at least thirty natural days prior to the date of suspension or termination of the provision of the service."

"15a. Obligations of SPEI Participants.- ... I. to IV. ... V. Have systems, procedures and control measures that allow certifying and validating the identity of the issuing client, the availability of resources in the issuing account, as well as safeguarding the elements of identity verification and identifiers of the issuing client. With regard to Participants that provide indirect participation services in the SPEI, ensure that the clients to whom they provide the referred services have such control measures that allow certifying and validating the identity of their respective clients in terms of what is provided in the Internal Standards; VI. to XI. ... XII. Have at all times an information security officer designated in accordance with what is provided in the Internal Standards and inform the Administrator of the appointment; XIII. to XV. ... XVI. Refrain from making available to the clients referred to in the previous fraction VI, the same Banking Business Day on which they receive the Transfer Order accepted by SPEI directed to the account of the mentioned client, the resources corresponding to the deposit that has resulted procedural to make, when the Administrator issues a notice on situations where the SPEI Participants must elevate their monitoring and alert mechanisms with respect to the fund transfers that they process through the SPEI; XVII. Refrain from issuing Transfer Orders in the name of the SPEI Participant in question and on behalf of third parties, for the deposit of the corresponding resources in any of the accounts of the clients referred to in fraction VI above opened in the same SPEI Participant or in any other; XVIII. Generate, process and receive, in terms of the Internal Standards, Debit Messages by means of Computer Programs developed in accordance with the referred Internal Standards; XIX. Send, process and receive, in terms of the Internal Standards, the Transfer Orders in the instances of the SPEI referred to in the "Rules of the Interbank Electronic Payment System", contained in Circular 14/2017 issued by the Bank of Mexico; XX. Be, at all times, in the possibility of connecting to any of the instances of the SPEI to which the "Rules of the Interbank Electronic Payment System" refer, contained in the Circular 14/2017 issued by the Bank of Mexico; XXI. Comply and supervise the strict compliance, by the clients who act as indirect participants, of the terms and conditions established for the provision of indirect participation services provided for in the Internal Standards of the SPEI, as well as the agreement they celebrate with their clients for the provision of such services. Likewise, they must verify that the clients to whom they provide the services referred to in this fraction comply, at all times, with the technical requirements, protocols, procedures, forms, terms, conditions, deadlines, schedules and other restrictions and operational obligations to which the Participant itself is subject in accordance with the Internal Standards. Verify that any scheme of Debit Messages that indirect participants implement is carried out through CoDi transfer orders, in accordance with what is provided in the "Rules of the Interbank Electronic Payment System", contained in Circular 14/2017 of the Bank of Mexico;

Wednesday, March 23, 2022 OFFICIAL GAZETTE 5 XXII. With regard to Participants that provide indirect participation services in the SPEI, assign sets of "Standardized Basic Key" to their clients who have the character of Indirect Participants as well as assign the digits that will identify each of said CLABE to each one of the Indirect Participants, with the purpose that these, in turn, assign each of those CLABE to the Accounts of the Indirect Clients that said Indirect Participants take to their Indirect Clients and inform the Administrator about such sets that they have assigned in accordance with what is provided in the Internal Standards of the SPEI; XXIII. Receive from their clients to whom they provide indirect participation services in the SPEI the deposit confirmations to inform that the resources object of a Transfer Order Accepted were deposited into the accounts of the clients of the latter, in terms of what is provided in the Internal Standards of the SPEI; XXIV. With regard to those Participants that carry out international fund transfers at the request of their clients or users, without doing so by means of operations through the SPEI or doing so in an aggregated manner through the SPEI, they must conserve the information that makes up said transfers and their characteristics for at least five years from their realization, and keep it available to the authorities empowered to regulate and supervise said Participants; XXV. With regard to those Participants who intend to offer their clients the receipt of resources in the accounts of said clients derived from electronic fund transfers executed, charged to other accounts opened in the same Participant, in accordance with instructions issued by means of equipment, media, systems or mobile devices, as a result of the acceptance of Debit Messages, these must be generated through Computer Programs that comply with the requirements and specifications established for this effect in the "Rules of the Interbank Electronic Payment System", contained in Circular 14/2017 of the Bank of Mexico. As an exception to what is provided in the previous paragraph, the Participant who determines to offer to its clients the sending of fund transfers executed between accounts opened in the same Participant, by the acceptance of Debit Messages, this can be carried out through programs different from the Computer Programs, provided that, in the calendar month in question, the total accumulated amount of said transfers does not exceed eight million pesos and the Participant has agreed to send or receive such transfers with the clients respectively that, in total, do not exceed one thousand distinct accounts. The Participant who determines to carry out electronic fund transfers originated by the acceptance of Debit Messages through programs different from the Computer Programs indicated in the first paragraph of this fraction, subject to being located within the limits mentioned in the previous paragraph, must inform of this determination to the Bank of Mexico, through a letter addressed to the Directorate of Policy and Studies of Payment Systems and Market Infrastructures, with at least ten Banking Business Days in advance to the date on which it begins to carry out the indicated transfers. With regard to the Participant that, in turn, allows the holders of the respective accounts that it holds said Participant to send instructions for electronic fund transfers that are originated, charged to those accounts, by the acceptance of Debit Messages generated through a Computer Program, as well as receive this type of transfer and credit the respective resources in the corresponding accounts opened in the same Participant, this latter must send the notifications of the crediting or, if applicable, rejection, whether attributable to the ordering account or the beneficiary account, or the return that results from the resources corresponding to the transfer in question, to the Administrator of the SPEI, in accordance with the internal standards applicable to said system, in order for this to notify, through the Computer Programs, to the respective ordering and beneficiary account holders of the events indicated in the cited notifications as a result of such electronic fund transfers.

---

6 OFFICIAL GAZETTE Wednesday, March 23, 2022

The Participant referred to in the preceding paragraph shall send the corresponding notification in accordance with the provisions of that same paragraph to the SPEI Administrator, in compliance with the Internal Rules applicable to said payment system, no later than within the deadline established for this purpose in said rules, and

XXVI. Regarding those Participants who intend to offer their clients the sending of electronic fund transfers via SPEI to accounts identified solely by the ten digits of cellular telephone line numbers, without including any other identification data, through a registration and consultation mechanism for such line numbers associated with accounts eligible to receive such transfers, they must obtain data on the accounts associated with such numbers from the database that the SPEI Administrator makes available to Participants, in accordance with what is provided in the "Rules of the Interbank Electronic Payment System," contained in Circular 14/2017 of the Bank of Mexico.

TRANSITIONAL RULES

FIRST.- This Circular shall enter into force the day following its publication in the Official Gazette of the Federation, with the exception of what is stated in the following Transitional Rules.

SECOND.- The addition of fraction XIX to Article 15 shall enter into force on May 4, 2022.

THIRD.- The addition of fraction XX to Article 15 shall enter into force on September 20, 2022. Without prejudice to the foregoing, Participants other than those who send or receive electronic fund transfers that are originated by the acceptance of Collection Messages generated through a Computer Program, shall have until December 15, 2022, to comply with the aforementioned addition.

FOURTH.- The additions of the second paragraph of fraction V, and fractions XXI, XXII, XXIII, and XXIV of Article 15 shall enter into force on December 15, 2022.

FIFTH.- Regardless of what is established in this Circular, without prejudice to the mechanisms that may be established for the exchange and discussion of opinions, ideas, and projects between the Bank of Mexico and the sector corresponding to the subject matter of these Rules, any person may submit to the Bank of Mexico, within the period of twenty Banking Business Days following the publication of this Circular in the Official Gazette of the Federation, their comments or suggestions regarding what is established in fractions XXIV and XXVI of Article 15 of this Circular.

The comments and suggestions submitted by the persons indicated in this Transitional Rule to the Bank of Mexico shall be public. For these purposes, such persons must submit their comments and suggestions through the public consultation portal established by the Bank of Mexico on its website, located at the following address: https://www.banxico.org.mx/ConsultaRegulacionWeb/

The Bank of Mexico will consider the comments and suggestions submitted in accordance with the above, and within sixty Banking Business Days following the conclusion of the period indicated in the first paragraph of this Rule, it will publish on its website a report on the recommendations and suggestions received, without prejudice to the powers that it may exercise as a result of the foregoing.

Mexico City, March 15, 2022.- BANK OF MEXICO: General Legal Director, Luis Urrutia Corral.- Signature.- Director of Payment Systems and Market Infrastructures Policy and Studies, Othón Martino Moreno González.- Signature.

For any inquiries regarding the content of this Circular, the Bank of Mexico is available through the Central Bank Authorizations and Sanctions Directorate at telephone number (55) 5237-2000 extension 3200.