Circular 36/2020 — Electronic Issuance of Securities Representing Securities Deposited in Securities Depository Institutions

Wednesday, September 30, 2020 OFFICIAL GAZETTE

CIRCULAR 36/2020 addressed to securities issuers and securities depository institutions, regarding the electronic issuance of securities representing securities deposited in securities depository institutions.

At the margin, a logo stating: Bank of Mexico.- "2020, Year of Leona Vicario, Meritorious Mother of the Fatherland".

CIRCULAR 36/2020

TO SECURITIES ISSUERS AND SECURITIES DEPOSITORY INSTITUTIONS:

SUBJECT: ELECTRONIC ISSUANCE OF SECURITIES REPRESENTING SECURITIES DEPOSITED IN SECURITIES DEPOSITORY INSTITUTIONS.

The Bank of Mexico, in order to continue promoting the sound development of the financial system and to foster the proper functioning of payment systems, as well as to protect the interests of the public, has resolved to establish a procedure with adequate security conditions for the electronic issuance of securities deposited in securities depository institutions, through the use of data messages, electronic signatures, and digital time stamps that guarantee their integrity and reliability.

For the foregoing, based on articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States; 24, 26, and 36, of the Bank of Mexico Law; 46, fraction IX, 53, and 81, of the Credit Institutions Law; 282 of the Securities Market Law; 106 of the Commercial Code; Fourth Transitory of the Decree by which various provisions of the Commercial Code are reformed and added regarding Electronic Signature, published in the Official Gazette of the Federation on August 29, 2003; 22 of the Law for Transparency and Order of Financial Services; 87-D of the General Law of Organizations and Auxiliary Credit Activities; 15 of the Investment Funds Law; 9 of the Organic Law of Nacional Financiera; 6 of the Organic Law of the Federal Mortgage Society; 9 of the Organic Law of the Welfare Bank; 9 of the Organic Law of the National Bank of Foreign Trade; 10 of the Organic Law of the National Bank of Public Works and Services; 8 of the Organic Law of the National Bank of the Army, Air Force and Navy; 7, fraction X, and 19, of the Organic Law of the National Financial Entity for Agricultural, Rural, Forestry and Fisheries Development; 4, first paragraph, 8, paragraphs fourth and eighth, 10, first paragraph, 12 Bis, first paragraph, in relation to 20 Quáter, fraction IV, 14 Bis, first paragraph, in relation to 17, fraction I, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Directorate of Payment Systems and Market Infrastructures and the General Legal Directorate, respectively; as well as Second, fractions X and XVII, of the Agreement on the Affiliation of the Administrative Units of the Bank of Mexico, has resolved to issue the following:

GENERAL PROVISIONS APPLICABLE TO THE ELECTRONIC ISSUANCE OF SECURITIES REPRESENTING SECURITIES DEPOSITED IN SECURITIES DEPOSITORY INSTITUTIONS

Article 1. These Provisions aim to determine which securities, whether multiple or unique, representing Securities deposited in Securities Depository Institutions, which, in accordance with article 282 of the Law, may be issued electronically, as well as the specific characteristics and security requirements they must meet for such purposes.

Article 2. For the purposes of these Provisions, the terms with initial capital letters used herein, in singular or plural, shall have the same meanings as those established for such terms in the Law and the Commercial Code, as well as the following:

Electronic Vault: the Information System of the Securities Depository Institution used for the archiving of Electronic Titles, constituted and operated in accordance with the technical requirements indicated in Annex 2 of these Provisions.

Qualified Digital Certificate: that Qualified Digital Certificate issued, in accordance with the IES Rules, by the Tax Administration Service, in its capacity as Certification Agency, also referred to in these provisions as “e.firma”, which is stored in a digital file with the extension “.cer”, when obtained from said authority in accordance with the provisions it establishes for such purpose, as well as any other Digital Certificate that, in accordance with the IES Rules, is issued by an authorized third party, if applicable, by the Bank of Mexico, subject to the determination of the latter that said Qualified Digital Certificate meets the same security and identity verification requirements observed by the Tax Administration Service for its issuance.

Encryption: the process of applying, through the Qualified Information System, the Qualified Electronic Signature Verification Data to a Data Message to generate a new one that is unintelligible to any person, except for the Holder of the Qualified Digital Certificate of which the Qualified Electronic Signature Verification Data are part, who, in turn, acts as the Recipient of said Data Message.

ISIN Code: the international identification number of Securities, known as such, by its English acronym, generated in accordance with the ISO 6166 standard, issued by the international organization known as the International Organization for Standardization, or the standard that, if applicable, replaces it.

Creation of an Electronic Signature: the process of applying, through the Qualified Information System, the Qualified Electronic Signature Creation Data to a Data Message and generating the Electronic Signature that is added to said Data Message.

Qualified Electronic Signature Creation Data: those Qualified Electronic Signature Creation Data provided for in the IES Rules that the Holder generates as part of the process of issuing their respective Qualified Digital Certificate, which are stored in a digital file with the extension “.key”.

Qualified Electronic Signature Verification Data: those Electronic Signature Verification Data referred to in the IES Rules that are part of the information included in the Qualified Digital Certificate.

Decryption: the process of applying, through the Qualified Information System, the Qualified Electronic Signature Creation Data to a Data Message that has been Encrypted, so that the Holder of the respective Qualified Digital Certificate can view the content of the original Data Message.

Banking Business Day: the days on which credit institutions are not obliged to close their doors or suspend operations, in terms of the general provisions issued for such purpose by the National Banking and Securities Commission.

Issuer: that referred to in article 2 of the Law, as well as any other person who issues Securities susceptible to being deposited in Securities Depository Institutions in accordance with applicable regulations.

Electronic Signature: the set of data that is added to a Data Message, which is logically associated with it and is attributable to the Holder once the Qualified Information System has been used, and which meets the requirements of Advanced or Reliable Electronic Signature referred to in articles 89 and 97 of the Commercial Code, as modified or replaced subsequently.

Extended Security Infrastructure (IES): that defined in terms of section I of the IES Rules.

Technological Infrastructure: the Information System comprising the computing, telecommunications, software, computer applications, and other tools used by Issuers and Financial Entities for the sending, receiving, recording, and other processing of Data Messages sent between them.

Securities Depository Institution: that anonymous company that enjoys the concession of the Federal Government to organize and operate with such character, in the terms set forth by the Law.

Law: the Securities Market Law.

Data Message: that defined in terms of section I of the IES Rules.

IES Rules: the Rules to Operate as a Registrar Agency and/or Certification Agency in the Extended Security Infrastructure, issued by the Bank of Mexico through Circular-Telefax 6/2005, as modified or replaced subsequently.

Qualified Information System: that Information System of the Bank of Mexico named WebSec, or any other from a third party that complies with what is provided in Annex 1 of these Provisions, which allows, on the one hand, the Creation of Electronic Signatures, as an Electronic Signature Creation Device in terms of the IES Rules, and, on the other hand, the Verification of Electronic Signatures, as an Electronic Signature Verification Device in terms of the said IES Rules, as well as to carry out the Encryption and Decryption of Data Messages.

Holder: that referred to in the IES Rules, who intervenes in its capacity as Signatory in terms of article 89 of the Commercial Code.

Electronic Titles: those securities, multiple or unique, that secure part or all of an issuance of Securities deposited in Securities Depository Institutions, which comply with what is provided in these Provisions to consider that they were issued electronically for the purposes of article 282 of the Law.

Verification of an Electronic Signature: the process of applying, through the Qualified Information System, the Qualified Electronic Signature Verification Data to the Electronic Signature of a Data Message and verifying, both the reliability of said Electronic Signature by verifying that it was created for that same Data Message using the Qualified Electronic Signature Creation Data corresponding to the Qualified Electronic Signature Verification Data, as well as the integrity of the Data Message by not suffering alteration after its Electronic Signature was generated.

Article 3. The securities issued electronically that Securities Depository Institutions may receive for deposit shall be all those securities deposited in accordance with the Law that are issued under the procedure established by said institutions in their internal regulations, in accordance with these Provisions.

Article 4. The Electronic Titles that Securities Depository Institutions may receive for deposit must comply with the technical requirements established in these Provisions, without prejudice to any other requirements applicable to the Security that the Electronic Title represents in accordance with the corresponding regulations. In any case, the Data Messages corresponding to the Electronic Titles in accordance with these Provisions must contain the text and other information that applicable regulations require for the nature of the respective Security and title.

Article 5. The Electronic Titles that Securities Depository Institutions maintain in deposit must be issued in accordance with the agreements entered into by the respective Issuers with the Securities Depository Institutions under which they have agreed on the procedure provided in these Provisions for their issuance, without prejudice to what is stated in these Provisions and other applicable norms regarding the issuance and deposit of the referred Electronic Titles. Issuers intending to issue Electronic Titles must, prior to doing so, deliver to the Securities Depository Institution the valid Qualified Digital Certificates of the Holders who, in accordance with applicable legislation and regulation, are authorized to represent such Issuers in the issuance of the titles. In this regard, the validity of said Qualified Digital Certificates must not be less than six months between the date of their delivery to the Securities Depository Institution and their expiration. Regarding Holders who represent other parties involved in the issuance of the Titles, such as common representatives, guarantors, or guarantors, Issuers must obtain from them the respective valid Qualified Digital Certificates, for delivery to the corresponding Securities Depository Institution, in accordance with this article, without prejudice to the verification that must be made regarding the powers of said Holders to sign the corresponding acts in the name and representation of the respective persons.

For the purposes provided in the preceding paragraph, the Electronic Titles must be issued in accordance with the procedure that the Securities Depository Institutions establish in their internal regulations for Issuers to deliver and keep updated the Qualified Digital Certificates of the Holders referred to in the preceding paragraph.

Article 6. For the purposes of the issuance of Electronic Titles, the respective Data Message that the Issuer generates for delivery to the Securities Depository Institution must contain, in addition to the information necessary to comply with the requirements established in applicable regulations, including the internal regulations of the respective Securities Depository Institution, depending on the type of Security involved, at least the following information:

I. Type of Security subject to the issuance; II. Quotation or issuance key of the type of Security; III. Corporate name of the Issuer; IV. Number of Securities that the issuance will secure; V. Issuance amount, nominal value, and denomination of the Security subject to the issuance; VI. Place and date of issuance; VII. Place and date of payment, if applicable; VIII. Series; IX. Maturity date, if applicable; X. Discount rate or interest, if applicable; and XI. Account of the Issuer in which the Electronic Titles will be deposited.

Article 7. The Holders of the Issuer, as well as, if applicable, the other parties involved in the issuance of the Electronic Title in question, must use the Qualified Information System to carry out the Creation of the Electronic Signatures corresponding to them, which must be added to the Data Message referred to in the previous article that constitutes the title to be issued electronically.

Once the foregoing provided in the preceding paragraph has been carried out, the Issuer must, through the Qualified Information System, carry out the Encryption of the referred Data Message and send it to the respective Securities Depository Institution, through the Technological Infrastructure established by said Securities Depository Institution for such purposes in accordance with its internal regulations or, in the absence of such Technological Infrastructure, by email generated by the Issuer and sent to the email address established by said Securities Depository Institution for such purposes, in accordance with its internal regulations.

Article 8. The Securities Depository Institution, once it receives the Data Message resulting from the processes provided in article 7 of these Provisions, within the timeframe it establishes for such purpose in its internal regulations, must, through the corresponding Qualified Information System, carry out the Decryption of the referred Data Message, as well as the Verification of the Electronic Signatures that have been added to it, in order to verify:

I. The authenticity of the Qualified Digital Certificates corresponding to the Electronic Signatures of the Holders of the Issuer and, if applicable, of the other parties involved in the respective issuance, that have been added to the referred Data Message, according to whether they correspond to the Qualified Digital Certificates, if applicable, duly updated, that the Issuer has delivered to the Securities Depository Institution, in terms of what is provided in article 5 of these Provisions; II. The integrity of the Data Message and the absence of alterations to it, subsequent to the moment when the Electronic Signature was added to the Data Message; and III. The sufficiency of the information that the Data Message must contain, in accordance with what is provided in article 6 of these Provisions.

In the event that, from the verification referred to in this article, the Securities Depository Institution determines that the Data Message complies with what is established in the Law, these Provisions, and the internal regulations of the referred Securities Depository Institution, said Securities Depository Institution, through the respective Qualified Information System, will carry out the Creation of an Electronic Signature of a Holder who is a representative of said Securities Depository Institution authorized by it for such purposes, who will add said Electronic Signature to that Data Message. Likewise, at the moment when the referred Electronic Signature is added to the Data Message, the Securities Depository Institution will assign, through its Technological Infrastructure, the corresponding ISIN Code and will safeguard it in its Electronic Vaults in accordance with what is indicated in these Provisions.

Once the foregoing provided in the preceding paragraph has been done, the Securities Depository Institution must archive the Electronic Titles under its deposit in at least four different Electronic Vaults. For such purposes, the Securities Depository Institution must place the four referred Electronic Vaults in at least three distinct geographic locations, which comply with what is established regarding their data processing centers in accordance with their business continuity plans adjusted to applicable regulations, subject to the risk analysis that said Securities Depository Institutions carry out to determine that each of said locations meets a distinct risk profile. Likewise, the Securities Depository Institution must maintain two of the referred Electronic Vaults in synchronous operation and the rest of the Electronic Vaults in asynchronous operation, with a latency not greater than two seconds.

In accordance with the foregoing, the Data Messages referred to in these Provisions will constitute Electronic Titles from the moment they are safeguarded in the two synchronous Electronic Vaults that the respective Securities Depository Institution maintains in operation in accordance with this Provision. Likewise, the referred Electronic Titles will be considered deposited in the respective Securities Depository Institution from that same moment.

Securities Depository Institutions must archive and carry out the corresponding operations on the Electronic Titles under their deposit in the four referred Electronic Vaults, until the maturity or cancellation of the Electronic Title, by fulfillment of the term, conditions provided, including substitution, for any other cause, or until its withdrawal, total or partial, by a person authorized for such purpose, as well as until the conclusion of the term established in applicable regulations for its conservation.

Securities Depository Institutions, in relation to the Electronic Vaults they establish and maintain, must comply with the requirements established in Annex 2 of these Provisions.

Article 9. The Electronic Titles will be registered by the Securities Depository Institution in the issuance account of Securities of the Issuer itself that has managed the deposit directly or, of the financial intermediary that has managed said deposit on behalf of the Issuer. Once the Securities Depository Institution has carried out the registration in the corresponding account, it must send to the Issuer and, if applicable, to the aforementioned financial intermediary a Data Message, with the Electronic Signature of the representative of said Securities Depository Institution, containing a copy of the registered Electronic Title, manifesting that it has been issued electronically and that it is deposited in the corresponding account. In this regard, the Securities Depository Institution must send the referred Data Message through its Technological Infrastructure or, if applicable, by email sent to the address indicated by the Issuer or the aforementioned financial intermediary for these purposes.

In the event that the terms of the Electronic Titles deposited in the Securities Depository Institution in accordance with these Provisions are modified, subsequent deposits of Electronic Titles generated in accordance with previously documented issuances are made, or the exchange of deposited Electronic Titles must be effected, the Electronic Titles that substitute the previously referred ones must be issued in accordance with these Provisions, without prejudice to the substitution procedure carried out by the Securities Depository Institution in terms of its internal regulations.

OFFICIAL GAZETTE Wednesday, September 30, 2020

Article 10. In addition to what is provided in the second paragraph of the previous Article 8, the Securities Depository Institution that receives the respective Electronic Titles in deposit, in accordance with these Provisions, must keep them with a Qualified Digital Certificate, which, in turn, must remain valid during the same period that such deposit subsists and must correspond to an Authorized Holder for such purposes as a representative of that Securities Depository Institution. To this end, six months prior to the expiration date of the Qualified Digital Certificate of said Holder, the Securities Depository Institution, through the Qualified Information System, must carry out the Creation of an Electronic Signature of the same or any other Holder who is a representative of that Securities Depository Institution authorized by this for such purposes, and must add said Electronic Signature to the corresponding Electronic Title.

Securities Depository Institutions must preserve the Data Messages that constitute the Electronic Titles they receive in deposit, in accordance with the Mexican Official Standard NOM-151-SCFI-2016 issued by the Ministry of Economy or any other that replaces it. For these purposes, the Securities Depository Institution that receives an Electronic Title in deposit in accordance with what is established in these Provisions must request from a Certification Service Provider, no later than the next Banking Business Day after that on which the respective Data Message constitutes an Electronic Title in accordance with what is provided in the fourth paragraph of the previous Article 8, the certificate of preservation of Data Messages corresponding to said Electronic Title, in accordance with what is established in the cited Mexican Official Standard or any other that replaces it.

Securities Depository Institutions must maintain the Electronic Titles in deposit with the corresponding valid data message preservation certificates during the respective periods in which such deposits remain in force. To this end, prior to the expiration date of the data message preservation certificate, the Securities Depository Institution in question must obtain an extension of the validity of the aforementioned certificate, in accordance with the Mexican Official Standard mentioned in this article. In addition, Securities Depository Institutions must archive the data message preservation certificates in the Electronic Vaults that they maintain in accordance with what is provided in the third paragraph of Article 8 of these Provisions.

In the event that a Securities Depository Institution obtains accreditation to be a Certification Service Provider in accordance with what is provided in the Commercial Code, it may issue the aforementioned data message preservation certificates for the Electronic Titles that remain under deposit in the same Securities Depository Institution or in any other.

The acts provided for in this article will not imply the modification of the information contained in the Electronic Title, to which Article 6 of these Provisions refers.

Article 11. The Electronic Titles deposited in Securities Depository Institutions that comply with the requirements established in the Law and these Provisions will produce the same effects that the laws grant to those issued in printed media and signed with autograph signature, and consequently, will have the same probative value.

ANNEX 1

For an Information System to be considered as a Qualified Information System in accordance with these Provisions, it must consist of computer software that meets the following requirements:

• Have as its main function the application of cryptographic algorithms that comply with the Electronic Signature specifications provided in the IES Rules.
• Maintain communication with a Registrar Agency of the Extended Security Infrastructure (IES) to be able to request and verify the validity of Qualified Digital Certificates of the Holders involved in the processes of Creation and Verification of Electronic Signatures and to encrypt and decrypt Data Messages. For this purpose, the computer software must comply with the Communication Protocol with the Extended Security Infrastructure that the General Directorate of Payment Systems and Market Infrastructures keeps available to interested parties on the page that the Bank of Mexico has on its website, identified with the domain www.banxico.org.mx.
• Implement the RFC 3852 standard “Cryptographic Message Syntax (CMS)” for the Creation of an Electronic Signature and encryption of Data Messages. Within the referred standard, the specification of the resulting file from the Creation of an Electronic Signature that is generated by the so-called Signed-data Content Type on the information that is composed of the type of data files whose specification in ASN.1 notation is described below. Likewise, within the indicated standard, the specification of the resulting file when encrypting a Data Message is generated by the so-called Enveloped-data Content Type on the information that is composed of the type of data files whose specification in ASN.1 notation is described below.

The information used within the RFC 3852 standard is that which is available according to the following description in ASN.1 notation:

Files ::= SEQUENCE of File File ::= SEQUENCE { name OCTET STRING, content OCTET STRING }

where name is the denomination of the file containing the information of interest of those titles, multiple or unique, that cover part or all of an issuance of Securities subject to deposit in Securities Depository Institutions, for the purposes of what is provided in Article 282 of the Law. On the other hand, content is the information included in said file interpreted as a sequence of bytes.

ANNEX 2

The Electronic Vaults used for the archiving of Electronic Titles under these Provisions must meet security requirements with the objective of reducing or eliminating information losses in accordance with the general characteristics of computer security contained in the international standard issued by the international organization called International Standard Organization under reference ISO 27002:2013, listed below:

• Information Integrity: Characteristic that refers to the content within the Electronic Vault so that it remains unchanged, unless modified by authorized personnel, and this modification is registered for subsequent controls or audits.
• Information Availability or Operability: Capacity to perform operations continuously, so that the Electronic Vault must be available at all times for queries, and preserving the integrity of the information, as well as the formats with which it was originally archived.
• Information Confidentiality: Characteristic that refers to the need for the information to be known only by users authorized by the Securities Depository Institution.
• Control over Information: Characteristic that certifies the users authorized by the Securities Depository Institution to decide on the modifications made in the Electronic Vault.
• Non-repudiation: Characteristic that allows defining protocols to evaluate if the information is valid and serviceable. Likewise, it allows identifying the origin of the information, validating the issuer of this, to prevent identity substitution.

The software and hardware characteristics that Securities Depository Institutions must observe regarding their Electronic Vaults are listed below:

I. The Electronic Vault will be constituted as a set of database servers or a storage network. II. At the software level, the Electronic Vault functions as a server for the organization and storage of information through the use of tables, indexes, and records, especially designed with high-performance architecture. III. The Electronic Vault can only be consulted, deleted, or modified by personnel authorized by the Securities Depository Institution and complying with the aforementioned security characteristics from secure network protocol connections.

OFFICIAL GAZETTE Wednesday, September 30, 2020

IV. At the hardware level, the Electronic Vault will be a set of database servers or a storage network with sole use for the Electronic Vault, dedicated to executing software only for electronic custody. The Securities Depository Institution must not allow the server to contain development environment software, compilers, or tools to hack, among others. V. In the case of the creation of the database or the storage network, the Electronic Vault will contemplate the three phases for the integration of information: conceptual, logical, and physical. In the conceptual phase, it is limited to the use of electronic custody to proceed with a data model for a management system. Finally, the physical design must be carried out, which must maintain coherence with the first two phases. VI. All stored data will be encrypted applying the confidentiality characteristic. VII. A WAF (Web Application Firewall) must be implemented, in order to protect the server against attacks related to the entry of command sequences, or specific attacks on the Internet. VIII. Security patch updates must be carried out. This refers to the need to update internal security software, both the operating system and the installed applications. IX. For Electronic Vaults, the security protocols implemented for sending backup copies must be updated and improved. X. Database security controls must be enabled. Likewise, security filters or controls must be reviewed and ensured that they are active at the time of the query. XI. User groups, services, and information systems must be segregated in the networks, to differentiate and allow access to the database or storage network only to those that have roles implicit to their use. XII. Sessions must be disconnected after a certain period of inactivity. XIII. The data used for tests must be carefully selected, protected, and controlled. XIV. Access to the source code of the software must be restricted, especially that which has access to the database or the storage network. XV. The implementation of changes must be controlled through the application of formal change control procedures. XVI. Critical business applications will be reviewed and tested when changes are made to the operating system, in order to guarantee that there are no adverse impacts on the organization's activities or security. XVII. The development of software subcontracted by the organization must be supervised and monitored, if applicable. XVIII. Maintenance or business operation recovery plans must be developed and implemented to ensure the availability of information to the degree and in the time scales required, after the interruption or failure of critical business processes. XIX. There must be no access with peripheral devices of the computer equipment on which the Electronic Vaults will be supported. XX. To prevent web attacks, data entries must be sanitized (input sanitization). XXI. The Database server must have hardening with the purpose of having only the software to operate with the Electronic Vault. XXII. A scan must be performed to detect vulnerabilities and mitigate at least those considered high and critical. XXIII. It will have a tool that allows detecting file alteration and malicious code.

Wednesday, September 30, 2020 OFFICIAL GAZETTE

XXIV. Passwords must be robust, individual, and the reuse of the last six must not be allowed. XXV. Wireless connections (Bluetooth, wifi, among others) are prohibited. XXVI. Internet exit from the server is prohibited or restricted. XXVII. It must have, at the operating system and application level, logs where the creation, modification, and deletion of accounts, the assignment of privileges, among others, are recorded. XXVIII. When the server is decommissioned or if any disk is changed, a secure deletion of the information must be performed. XXIX. It must have restrictions for remote access connection (specific permissions to only a limited number of equipment and no mappings to equipment to share folders).

TRANSITORY PROVISIONS

FIRST. This Circular will enter into force the day after its publication in the Official Gazette of the Federation.

SECOND. Securities Depository Institutions must submit to the authorization of the Bank of Mexico, in addition to the National Banking and Securities Commission, which is provided for in Article 294 of the Law, the project of modifications to their internal regulations to implement what is stated in these Provisions within a period of six months from the entry into force indicated in the previous transitory article.

Mexico City, September 22, 2020.- BANK OF MEXICO: The General Director of Payment Systems and Market Infrastructures, Manuel Miguel Ángel Díaz Díaz.- Rubric.- The General Legal Director, Luis Urrutia Corral.- Rubric.

For any queries regarding the content of this Circular, the Bank of Mexico is at your disposal through the Central Bank Authorizations and Sanctions Directorate at telephone (55) 5237-2000 extension 3200.