Circular 39/2010 — Modifies Circular 27/2008

Friday, December 10, 2010 OFFICIAL GAZETTE (First Section) 121

CIRCULAR 39/2010, addressed to credit information societies regarding modifications to Circular 27/2008.

A logo appears at the margin, stating: Bank of Mexico.

CIRCULAR 39/2010

TO CREDIT INFORMATION SOCIETIES:

SUBJECT: MODIFICATIONS TO CIRCULAR 27/2008

The Bank of Mexico, with the objective of promoting the sound development of the financial system and in protection of the public's interests, considers it convenient to foresee the possibility that credit information societies may deliver credit reports to users of their clients, when they use the digital fingerprint of these clients in substitution of their autograph signature as the means to obtain their authorization and give their consent. The foregoing, always provided that users can demonstrate in a conclusive manner that the digital fingerprint of their clients was captured exclusively for that purpose.

Likewise, it deems it opportune to make various clarifications to the rules applicable to credit information societies, in accordance with the current legal regime.

For the foregoing, based on articles 28 of the Political Constitution of the United Mexican States, sixth and seventh paragraphs; 24 of the Bank of Mexico Law; 28 of the Law to Regulate Credit Information Societies; 22 of the Law for Transparency and Ordering of Financial Services; as well as 8th, fourth and seventh paragraphs, 10, 14 Bis in relation with 17 fraction I, as well as 14 Bis 1 first paragraph in relation with 25 Bis 1 fraction IV, of the Internal Regulations of the Bank of Mexico, which grant it the attribution to issue provisions through the General Legal Directorate and the General Directorate of Financial System Affairs, respectively, as well as the Sole Agreement of the Adscription of the Administrative Units of the Bank of Mexico, fractions III and XII, has resolved to modify the Eighth and Ninth, as well as repeal the Thirteenth, of the "General Rules to which the operations and activities of Credit Information Societies and their Users must be subject", contained in Circular 27/2008 and its modifications, to remain in the following terms:

GENERAL RULES TO WHICH THE OPERATIONS AND ACTIVITIES OF CREDIT INFORMATION SOCIETIES AND THEIR USERS MUST BE SUBJECT

CHAPTER III

Of Credit Reports

"EIGHTH.- In the case of Users who intend to make credit offers to individual Clients with whom they do not maintain a legal relationship, the Societies, in terms of what is provided in article 28 of the Law, may deliver Credit Reports to said Users when these have the express authorization of the Clients granted verbally; by electronic means, or with their digital fingerprint, always provided that previously the Users inform said Societies in writing in a detailed manner the terms and conditions of the credit offer in question, as well as the other information that the Societies require of them.

Before requesting the authorization mentioned in the previous paragraph, the identity of the User must be communicated to the Clients and the characteristics of the credit offered must be explained to them, including among others, the Total Annual Cost and the associated commissions.

I. In the case that Clients grant their authorization verbally or by electronic means, Users must comply with the following:

1. Identify the Clients, collecting at least the information indicated below:

a) Full name and surnames; b) Address (street and number, neighborhood, city and federal entity);

Friday, December 10, 2010 OFFICIAL GAZETTE (First Section) 122

c) Unique Population Registration Key, Federal Taxpayer Registry or date of birth; d) If they have one or more credit cards and, if affirmative, indicate from one of them the last four digits of the number that identifies the account; e) If they have a mortgage credit, and f) If they have exercised an automotive credit in the last two years.

2. Record and conserve in magnetic or electronic media, the authorization along with the information indicated in numeral 1. above, for subsequent consultations and evidentiary effects.

II. In the case that Clients grant their authorization by means of digital fingerprint, Users must comply with the following:

1. Identify the Clients, collecting at least the information indicated below:

a) Full name and surnames; b) Address (street and number, neighborhood, city and federal entity), and c) Unique Population Registration Key, Federal Taxpayer Registry or date of birth.

2. Capture and conserve in biometric or electronic media, the digital fingerprint along with the information related to the Client's identification indicated in subsection 1. above, for subsequent consultations and evidentiary effects.

III. For its part, the Societies must:

1. Receive the Client identification data sent by the Users and check the information against their database. They may only deliver Credit Reports in cases where the aforementioned Client information coincides with the data in possession of the Society.
2. Send Credit Reports only to the official or employee of the User who requested them, always provided that they are registered in accordance with what is stated in Rule Fourteenth.

When verbally, by electronic means or with their digital fingerprint, in substitution of the autograph signature, the Client authorizes that their credit history be consulted, Users may only use such authorization always provided that they can demonstrate that it was granted exclusively for such purpose in terms of what is provided in article 28 first paragraph of the Law. Such authorization may only be used to consult the Credit Report of the Clients on a single occasion.

When the consent of the Clients to consult their credit history is obtained through their digital fingerprint in substitution of the autograph signature, Societies may only deliver the Credit Reports corresponding to Users who have conducted credit operations for at least two years prior to the date on which they began using the corresponding biometric or electronic systems for the capture of such digital fingerprints.

The authorizations referred to in this Rule shall be subject to what is provided in articles 29 and 30 of the Law.

To avoid incurring violation of the provisions regarding Financial Secrecy, Societies must reject the requests of Users who do not comply with what is provided in this Rule."

"NINTH.- Societies may provide Credit Reports to Users who maintain a legal relationship with Clients who have authorized in writing the use of electronic authentication means.

In such a case, in the authorizations referred to in article 28 of the Law, the requirement of the autograph signature may be substituted with any of the following mechanisms or procedures:

1. Personal Identification Number (PIN), if the User makes the offer through its Internet page; ATMs; telephone lines, or in its establishments or branches.
2. Digital fingerprint, if the User makes the offer through ATMs or in its establishments or branches.

Friday, December 10, 2010 OFFICIAL GAZETTE (First Section) 123

3. Electronic signature, if the User makes the offer through its Internet page.

In credit offers made available to Clients through Internet pages and ATMs, Users must have processes in their electronic systems so that Clients have to re-enter their electronic signature, PIN or digital fingerprint to grant the authorization referred to in said article 28.

Likewise, Users must be able to demonstrate in a conclusive manner that they have the corresponding authorization in accordance with what is provided in article 28 of the Law and conserve a record of it through optical, magnetic or any other technology means, for the term established in article 31 of the Law.

In the case that the authorization is made by means of digital fingerprint, it must be captured in biometric or electronic devices that allow proving its existence and the association of said fingerprint with the previous record that the User has of it. In this case, the User must: i) use elements that ensure that the records are different each time they are generated, in order that they be used on a single occasion, and ii) be able to demonstrate that the capture of the aforementioned digital fingerprint was carried out exclusively as a means to manifest their express consent regarding the aforementioned authorization.

Authorizations made by means of PIN or Electronic Signature shall have the validity referred to in the sixth paragraph of said article 28.

When the consent of the Clients to consult their credit history is obtained through their digital fingerprint in substitution of the autograph signature, Societies may only deliver the Credit Reports corresponding to Users who have conducted credit operations for at least two years prior to the date on which they began using the corresponding biometric or electronic systems for the capture of such digital fingerprints."

"THIRTEENTH.- Repealed."

TRANSITORY SINGLE. This Circular shall enter into force on December 13, 2010.

Mexico, D.F. on December 8, 2010.- BANK OF MEXICO: The General Legal Director, Héctor Reynaldo Tinoco Jaramillo.- Rubric.- The General Director of Financial System Affairs, José Gerardo Quijano León.- Rubric.

For any consultation regarding the content of this Circular, please go to the Manager of Authorizations, Queries and Legal Control, located at Avenida 5 de Mayo number 2, Colonia Centro, Mexico, Federal District, C.P. 06059, or to the phones 5237.2308, 5237.2000 ext. 3200 or 5237.2317.