Circular 4/2016 — Rules of the Interbank Payments System in Dollars (SPID)

(Fourth Section) OFFICIAL GAZETTE Friday, March 11, 2016 BANCO DE MEXICO CIRCULAR 4/2016, addressed to participants in the SPID, regarding the Rules of the Interbank Payments System in Dollars (SPID). At the margin a logo that says: Banco de México. CIRCULAR 4/2016 TO THE PARTICIPANTS IN THE SPID: SUBJECT: RULES OF THE INTERBANK PAYMENTS SYSTEM IN DOLLARS (SPID) The greater integration of the country into the global economy implies that an important fraction of transactions in production chains is denominated in United States dollars, many of them between dollar accounts at banks within national territory. In this sense, it is essential that companies with obligations in dollars have access to secure and efficient transfer mechanisms in this currency. In view of the above, Banco de Mexico has decided to develop and operate a system so that legal entities can make transfers between checking deposit accounts in dollars in Mexico held at credit institutions. This system will allow these persons to carry out their transfers more safely, quickly and at lower cost, compared to the mechanisms currently available. On the other hand, the operating rules of the system establish requirements for credit institutions that strengthen the information technology and operational security of the SPID and prevent risks related to the use of the SPID in the commission of illegal activities. For the foregoing, based on articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 2, sections I, IV and VIII, and 6, of the Payment Systems Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, paragraphs fourth and seventh, 10, first paragraph, 14 Bis, first paragraph, in relation to 17, section I, 14 Bis 1, first paragraph, in relation to 25 Bis 1, section IV, and 20, section XI, of the Internal Regulations of Banco de Mexico, which grant it the authority to issue provisions through the General Legal Directorate, the General Directorate of Affairs of the Financial System and the Directorate of Payment Systems, respectively, as well as Second, sections I, VIII and X, of the Agreement on the Attachment of Administrative Units of Banco de Mexico, has resolved to issue the following rules: RULES OF THE INTERBANK PAYMENTS SYSTEM IN DOLLARS CHAPTER I Preliminary Provisions 1a. Internal Norms.- For the purposes of what is provided in article 6th of the Payment Systems Law, these Rules and the Manual constitute the internal norms of the SPID. 2a. Definitions.- For the purposes of these Rules, the following shall be understood: I. Administrator: Banco de Mexico, in its capacity as Administrator of the SPID under article 2, section I, of the Payment Systems Law. II. Independent External Auditor: the professional who performs audit work on the Credit Institution, who is external to it and who meets, where applicable, the characteristics and requirements set forth in Rule 55th of these Rules. III. Settlement Notice: the message that the Administrator sends through the communication channels established in the Manual to the Sending Participant and the Receiving Participant of a Transfer Order, to notify them that said Transfer Order has been settled and that the respective charges and credits have been made in the SPID Accounts corresponding to those Participants. IV. Digital Certificate: with respect to the advanced electronic signature of an Operator, Sending Client or Beneficiary Client, the set of data or record contained in an electronic document issued by any certifying authority recognized in accordance with what is stated in the Manual, which on the one hand, confirms the link between the holder of said electronic signature and the data, known as private key, which he generates secretly and uses to create his electronic signature, in order to achieve the link between said electronic signature and the signatory, and on the other hand, includes those data, known as public key, which allow the verification of the authenticity of the signatory's electronic signature. V. Tracking Key: the alphanumeric data that the Sending Participant assigns to the Transfer Order in question, in accordance with the Manual, to uniquely identify that Transfer Order. VI. Beneficiary Client: the legal entity that is the holder of a money deposit account denominated in Dollars opened at the Receiving Participant of a Transfer Order and that is designated herein as the final recipient of the resources subject to said transfer. VII. Sending Client: the legal entity that is the holder of a money deposit account denominated in Dollars opened at that Participant with whom it has agreed to present Sending Requests. VIII. CNBV: the National Banking and Securities Commission. IX. Electronic Payment Receipt: the digital document that records the crediting of the Transfer Order in question in the Beneficiary Client's account, which is generated through the SPID with the information sent by the Receiving Participant and which the Administrator, on the internet site established for that purpose, makes available to the Sending Client and the Beneficiary Client involved in said Transfer Order, as well as to the Sending Participant and the Receiving Participant, so that said Participants, in turn, also make it available to the Sending Client and the Beneficiary Client, in accordance with what is established in these Rules. X. Payment Concept: the alphanumeric data with the description of the reason why the Sending Client requests the Sending Participant to process the Transfer Order in favor of the Beneficiary Client, which must be included in the Sending Request in terms of Rule 12th of these Rules. XI. Credit Confirmation: the message that the Receiving Participant of a Transfer Order Accepted by SPID sends to the Administrator, to inform that the resources of said Transfer Order were credited to the account of the respective Beneficiary Client. XII. Contract: the legal instrument that documents the consent to act as a Participant in the SPID that are celebrated by the Administrator on the one part and by the Credit Institution that intends to act as a Participant on the other part. XIII. Correspondent: a financial institution of the United States of America that provides dollar account management services, as well as receipt and sending of funds in said currency. XIV. SPID Account: that corresponding to the dollar money deposit that the Administrator keeps for each Participant to operate in the SPID on each business day. XV. Dollar Account for SPID Funding: a dollar deposit account that Participants must open and maintain in SIAC-BANXICO to provide liquidity to the SPID Account. XVI. Firm: the legal entity whose activity is the provision of certification services referred to in these Rules, in which Independent External Auditors work. XVII. Banking Business Day: the days of the calendar year other than those indicated by the CNBV in general character provisions as those in which Credit Institutions must close their doors and suspend operations. XVIII. Provisions: the "Provisions applicable to the operations of credit institutions and the National Development Bank for Agriculture, Rural, Forestry and Fisheries", contained in Circular 3/2012 of Banco de Mexico. XIX. Dollars: the legal tender in the United States of America. XX. Technological Infrastructure: the computing, telecommunications, software and applications infrastructure used by Participants to interconnect and operate with the SPID. XXI. Credit Institutions: multi-bank institutions and development bank institutions that offer checking deposit accounts in Dollars with or without checkbooks payable in the Mexican Republic to legal entities domiciled in national territory in terms of the Provisions. XXII. Manual: the document named "SPID Operating Manual", prepared by the Administrator, which describes the operational, technical, information security, operational risk management and Additional Risks management requirements to operate in the SPID, which is available to Participants. XXIII. Operator: the person designated by a Participant and registered with the Administrator to instruct operations of that Participant through the SPID in terms of Rule 37th of these Rules. XXIV. Transfer Order: the unconditional instruction that a Participant, on its own behalf or on behalf of its Sending Client, if applicable, specifies, sends to another Participant through the SPID in terms of these Rules, for the latter, if applicable, to credit a specified amount in Dollars to the account of the Beneficiary Client designated in said instruction. XXV. Transfer Order Accepted by SPID: that Transfer Order that has been settled in accordance with Rule 17th of these Rules. XXVI. Participant: the Credit Institution that is authorized by Banco de Mexico in accordance with what is provided in Circular 3/2016, which, in turn, has been admitted to participate in the SPID, in terms of Rule 48th of these Rules, and which has celebrated the Contract in terms of what is stated in Rule 49th of these Rules. XXVII. Sending Participant: the Participant that sends a Transfer Order in the SPID. XXVIII. Receiving Participant: the Participant that receives a Transfer Order Accepted by SPID. XXIX. Numerical Reference: the numerical data that, if applicable, the Sending Client of the Sending Participant indicates in the Sending Request presented to him, with the purpose of identifying the respective Transfer Order. XXX. Additional Risks: risks related to the use of the SPID in the commission of illegal activities. XXXI. Reserved Balance: the part of the total balance of the SPID Account that each Participant specifies with that character through the SPID, in order for the resources corresponding to that part of the balance to be destined for the settlement in the SPID of those Transfer Orders marked with high priority, in accordance with what is established in the Manual. XXXII. SIAC-BANXICO: the System for Attention to Account Holders of Banco de Mexico that the Bank itself makes available to Credit Institutions, in accordance with applicable provisions and stipulations, for the management of money accounts that these maintain in said Bank. XXXIII. Sending Request: the instruction presented by the Sending Client to the Sending Participant in question, by which he requires the latter to send a Transfer Order, which must include the information contained in Rule 12th of these Rules. XXXIV. SPID: the payment system named "Interbank Payments System in Dollars" that allows the sending, processing and settlement of interbank Transfer Orders denominated in Dollars through electronic means between checking deposit accounts in Dollars with or without checkbooks payable in the Mexican Republic corresponding to legal entities domiciled in national territory. The terms mentioned above may be used in singular or plural, without thereby understanding that their meaning changes. CHAPTER II Description of the Operational Scheme 3a. Object of the SPID.- The SPID aims to provide Participants with a means to securely and efficiently process electronic interbank transfers in Dollars between the accounts of legal entities that are clients of the Participants. 4a. Requirements to be a Participant.- Credit Institutions that submit their application for admission to act as Participants must comply with the requirements referred to in Chapters VI and VII of these Rules. 5a. Types of Transfer Orders.- Participants may, in terms of these Rules and the Manual, send the following types of Transfer Orders through the SPID: I. Third party to third party; II. Participant to third party; III. Third party to Participant; IV. Participant to Participant; V. Return, and VI. Late return. 6a. Liquidity Management.- Each Participant must maintain a sufficient balance in their SPID Account, so that Transfer Orders processed by said Participant before the SPID can be settled through the SPID. Participants may not incur overdrafts in their respective SPID Accounts. A Participant may increase the balance of their SPID Account through transfers made from their Dollar Account for SPID Funding in SIAC-BANXICO, or by means of Transfer Orders received from other Participants in the SPID. On the other hand, a Participant may increase the balance of their Dollar Account for SPID Funding in SIAC-BANXICO through transfers made to the Correspondent of Banco de Mexico. The aforementioned operations must be carried out in accordance with what is established in Chapter IV of these Rules and the Provisions. At the end of the SPID operating hours, the balance of the SPID Account of each Participant will be credited to their Dollar Account for SPID Funding through SIAC-BANXICO, in terms of these Rules. The Participant may dispose of the balance in their Dollar Account for SPID Funding, through transfers to the account at their respective Correspondent, in accordance with the schedules and terms established in the Provisions. 7a. Operational Flow.- The operational process of transfers of amounts denominated in Dollars between accounts of legal entities that are clients of the Participants, will be carried out based on Transfer Orders of the third party to third party type, in terms of Chapter III of these Rules and the Manual, in accordance with the following steps:

(Fourth Section) OFFICIAL GAZETTE Friday, March 11, 2016 I. The Sending Participant receives from its Sending Client a Sending Request to credit the dollar account of a legal entity at another Participant, designated as the Beneficiary Client; II. The Sending Participant carries out the corresponding verifications, including those related to Additional Risk management, and determines whether to proceed to process said Sending Request. In this case, the Sending Participant sends the respective Transfer Order to the Administrator through the SPID. Otherwise, it rejects the Sending Request and notifies the Sending Client of the fact and cause; III. The Administrator, once it receives, automatically in the SPID, the Transfer Order from the Sending Participant, carries out, in the same way, the corresponding validations and the verification of sufficient balance in the SPID Account of said Participant. If such validations and verification are appropriate, the Administrator will settle the Transfer Order through the automated processes of the SPID. On the contrary, if such validations are not appropriate, the Administrator, automatically in the SPID, will reject the Transfer Order or if the referred balance is insufficient to settle the Transfer Order, it will continue verifying sufficient balance in each clearing cycle until the operation can be settled and, if at the closing of the SPID business day it cannot carry out said settlement, it will cancel the Transfer Order; IV. Once the Administrator settles the Transfer Order, it proceeds to generate the Settlement Notice and send it to the Sending Participant and Receiving Participant; V. The Receiving Participant receives from the Administrator the Settlement Notice generated and sent through the SPID itself and, having done so, carries out the corresponding verifications, including those related to Additional Risk management, and determines whether to accept the Transfer Order Accepted by SPID according to the respective Settlement Notice, or reject it and send the Transfer Order of the corresponding type for the return provided for in these Rules, and VI. The Receiving Participant that accepts the Transfer Order Accepted by SPID credits the account of the Beneficiary Client and sends the corresponding Credit Confirmation to the Administrator. CHAPTER III Operation Section I Mandatory Payment Types 8a. Types of Mandatory Reception Transfer Orders.- As a general rule, the Participant to whom the Transfer Orders corresponding to any of the types indicated in Rule 5th of these Rules are directed will be obliged to process them. Section II Sending Requests 9a. Sending Request.- The Participant who has agreed with its Sending Clients to process, as Sending Participant and charged to their respective accounts, the Sending Requests that they transmit to it, must allow said transmission to be carried out through any of the following channels: I. Branches that the Sending Participant in question makes known to its Sending Clients for those effects, and II. Computer applications, including internet banking. 10a. Requirement of Digital Certificate of clients.- Participants must require their clients to have a valid and current Digital Certificate so that they can send or receive Transfer Orders in the SPID, and must verify, in addition to the validity of each Digital Certificate, that it corresponds to the client in question, in accordance with what is specified in the Manual. 11a. Verification of Digital Certificate of clients.- Participants must verify, at least once a month, the validity of the Digital Certificates of their clients in accordance with what is specified in the Manual.

Friday, March 11, 2016 OFFICIAL GAZETTE (Fourth Section) 12a. Information contained in Sending Requests.- Regarding Sending Requests, each Participant receiving them must observe the following: I. The Participant must require its Sending Clients to provide the following data in the respective fields of the Sending Requests, as a necessary condition to be able to process said Sending Requests: a) The denomination of the corresponding Receiving Participant, among those included in the list that the Administrator informs daily at the beginning of SPID operations, which must be made available to Sending Clients by the Sending Participant; b) The information of the Payment Concept; c) The denomination or corporate name of the Beneficiary Client; d) Any of the following data to identify the Beneficiary Client's account: the twenty digits that make up the Standardized Banking Key in Foreign Currency (CLABED), in accordance with what is specified in the Manual, or the sixteen digits of the debit card that, if applicable, corresponds; e) The denomination or corporate name and the Federal Taxpayer Registry key (with homoclave) corresponding to the Beneficiary Client, and f) The amount of the transfer subject to the respective Sending Request, and II. The Participant must allow its Sending Clients to incorporate in each Sending Request the Numerical Reference that they decide to indicate in the respective field of said Sending Request. 13a. Verification of Sending Requests.- The Participant will only consider valid that Sending Request transmitted by its Sending Client, once the latter has followed the identification and authentication procedures of said Sending Client, in accordance with the applicable provisions issued by the CNBV. If the authentication referred to in the previous paragraph is appropriate, the Participant must carry out the necessary verifications, including the availability of resources of the Sending Client's account to be charged, as well as those of Additional Risks specified in these Rules, in terms of Chapter 11 of the Manual. In particular, the Sending Participant must carry out the verification of the data of its Sending Client referred to in section IV of Rule 50th of these Rules. The Participant must carry out the verification referred to in the previous paragraph at the moment it receives the Sending Request from its Sending Client. If the Participant finds that the Sending Client, its direct shareholders, partners, associates or members of the equivalent governing body are listed in the lists and resolutions referred to in section IV of Rule 50th of these Rules, it must reject the Sending Request, in order to carry out the actions that should be taken in accordance with its internal policies, as well as the applicable legal provisions. When the verifications referred to in this Rule are appropriate, the corresponding Sending Request will be considered as a Sending Request accepted by the Sending Participant. The Participant receiving a Sending Request must inform the respective Sending Client, within sixty seconds following the moment in which said reception occurs, that said Sending Request is in the process of verification, or that it has been accepted. The Participant must inform the above to its Sending Client through the means they have agreed upon for that effect or through the same means by which the latter transmitted the respective Sending Request. 14a. Information on the status of the Sending Request.- The Participant receiving a Sending Request from its Sending Client must inform the latter, through the means agreed upon for that purpose, the status it holds, as well as the following information: I. Regarding Sending Requests accepted by said Participant: the Tracking Key that has been assigned in accordance with what is established for that purpose in the Manual and the time of day in which it was approved, including minutes and seconds, or

(Fourth Section) OFFICIAL GAZETTE Friday, March 11, 2016 II. In the case of Transfer Requests whose validation referred to in the previous Rule has resulted in a rejection, the Issuing Participant must inform the Issuing Client of this fact in accordance with what is established for this purpose in the Manual, no later than 14:14:59 hours on the same day it received the aforementioned Transfer Request. Section III Transfer Orders 15a. Transfer Orders.- The Issuing Participant must include, in the Transfer Order sent to the Administrator through the SPID, the information corresponding to the Tracking Key field, as well as that corresponding to the Numerical Reference and Payment Concept fields, if applicable, as specified by the Issuing Client in the Transfer Request accepted by said Issuing Participant. To this effect, the Issuing Participant must indicate for each Transfer Order whether its priority is normal or high. The Issuing Participant will only send Transfer Orders provided that it acts in its own name and on its own behalf, or when they originate from Transfer Requests transmitted by its Issuing Clients, provided that these act in their own name and on their own behalf. 16a. Sending of Transfer Orders.- The Issuing Participant must send to the Administrator, through the automated processes of the SPID, the Transfer Order corresponding to the Transfer Request accepted by said Participant, within thirty seconds counted from the moment the Participant itself has informed its Issuing Client that the Transfer Request was validated and accepted in accordance with what is stated in Rule 13a of these Rules. The Issuing Participant must comply with the foregoing, except in the case that it has agreed with its Issuing Client to send the Transfer Order at a later hour or date than the receipt of the Transfer Request, and in this case, the thirty-second period mentioned in this paragraph will begin to count from the hour they have agreed upon for this purpose or from 08:00:00 hours on the day they have agreed upon, if applicable. The Issuing Participant may send instructions to the Administrator, through the SPID, to cancel Transfer Orders that it has previously sent. Transfer Orders can only be cancelled when they have not been settled through the SPID in terms of Rule 17a of these Rules. Additionally, the Administrator will automatically cancel, through the SPID, those Transfer Orders that have not been settled by the close of the SPID operating hours each day. 17a. Settlement of Transfer Orders.- The settlement of Transfer Orders, once the Administrator has carried out, automatically through the SPID, the validations of said Transfer Orders received through the SPID, will be carried out through a clearing process in terms of the Payment Systems Law, which will consider the balances that Issuing Participants and Receiving Participants maintain in their respective SPID Accounts, as well as the Transfer Orders pending settlement and their priority. Once the settlement of the Transfer Orders has been effected and the Administrator has sent, through the SPID communication means, to the Issuing Participants and Receiving Participants the respective Settlement Notices, the corresponding Transfer Orders will be considered Transfer Orders Accepted by SPID. Regardless of what is stated in the previous paragraph, the Transfer Orders that have complied with the validations and verification referred to in the first paragraph of this Rule, and for which the Settlement Notices mentioned in the previous paragraph have been sent, will correspond to the accepted transfer orders referred to in the Payment Systems Law. In virtue of this, the Transfer Orders referred to in this paragraph, as well as their clearing and settlement contemplated by these Rules and the Manual, will be firm, irrevocable, enforceable, and opposable against third parties. 18a. Verification of Transfer Orders Accepted by SPID.- The Receiving Participant to whom the Settlement Notice of a Transfer Order Accepted by SPID is delivered, through the SPID, must carry out the verification of the Beneficiary Client data referred to in fraction IV of Rule 50a of these Rules in accordance with the Additional Risk Controls indicated in Chapter 11 of the Manual and in accordance with the technical specifications indicated in section 11.2 of the Manual.

Friday, March 11, 2016 OFFICIAL GAZETTE (Fourth Section) In the event that, as a result of the verification carried out by the Receiving Participant in terms of this Rule, it is found that its Beneficiary Client, its direct shareholders, partners, associates, or members of the equivalent governing body, are listed in the lists and resolutions referred to in fraction IV of Rule 50a of these Rules, it must return the Transfer Order Accepted by SPID, in order to carry out the actions that must be taken in accordance with its internal policies and the legal provisions applicable to them. When the verification referred to in this Rule results in successful validation, the Receiving Participant must credit the respective funds to the corresponding account of the Beneficiary Client, in terms of the following Rule. 19a. Crediting of Transfer Orders Accepted by SPID.- The Receiving Participant is obligated to credit, to the respective account of the Beneficiary Client, the amount of the Transfer Order Accepted by SPID within thirty seconds following the moment in which the verification of said Transfer Order concluded, in terms of the previous Rule. 20a. Confirmation of Credit.- The Receiving Participant of a Transfer Order Accepted by SPID corresponding to the third-party to third-party, third-party to Participant, or Participant to third-party type, which carries out the crediting of funds in the Beneficiary Client's account, for the amount of the Transfer Order Accepted by SPID, must generate a Confirmation of Credit in accordance with the specifications established in Appendix K of the Manual. The Receiving Participant must send to the Administrator, through the SPID, the Confirmation of Credit referred to in the previous paragraph, within thirty minutes counted from the moment it carried out the credit in the Beneficiary Client's account of the amount of the respective Transfer Order Accepted by SPID. 21a. Liability of the Administrator.- The Administrator will be released from all liability towards the Participants and their clients for the performance of those actions automated through the SPID that are indicated in these Rules and that are carried out in terms of what is indicated in the Manual. Section IV Return of Transfer Orders Accepted by SPID 22a. Return of Transfer Orders Accepted by SPID.- The Receiving Participant must execute the return of a Transfer Order Accepted by SPID in any of the following cases: I. If the result of the verification referred to in Rule 18a of these Rules is not favorable; II. In the event that it is not possible to credit the amount of the Transfer Order Accepted by SPID to the Beneficiary Client's account, for any of the causes established in the Manual, or III. When, by judicial mandate or that of a competent financial authority, it is prevented that the Beneficiary Client's account receives deposits. In the cases referred to in this Rule, the Receiving Participant must execute the Transfer Order corresponding to the respective return type, in accordance with the Manual and must ensure that the amount included corresponds to that of the original Transfer Order Accepted by SPID that is the subject of said return. 23a. Deadlines for the return of Transfer Orders Accepted by SPID.- The Receiving Participant referred to in the previous Rule must send the Transfer Order corresponding to the return type referred to in the previous Rule, no later than: I. The minute following the moment it received the Settlement Notice of the Transfer Order Accepted by SPID subject to the return, in the case of fractions II or III of the previous Rule, or II. When the circumstance of fraction I of the previous Rule occurs, which must occur no later than 14:14:59 hours on the same Banking Business Day it received the Settlement Notice of the Transfer Order Accepted by SPID subject to the return. 24a. Late returns.- In the event that, for any circumstance, the Receiving Participant has not carried out the return of the Transfer Order Accepted by SPID in question within the applicable period in the cases established in Rule 23a of these Rules, it must execute the Transfer Order corresponding to the late return type referred to in fraction VI of Rule 5a of these Rules, in accordance with the Manual, and must ensure that the amount included corresponds to that of the original Transfer Order Accepted by SPID that is the subject of said return, plus the amount corresponding to the compensation specified in Rule 62a of these Rules. This always provided that said return is made on any SPID operating day subsequent to the day on which said Participant received the respective Transfer Order. 25a. Crediting of the Return Transfer Order or Late Return Transfer Order.- The Issuing Participant of the Transfer Order subject to a return or late return must, within thirty seconds following the moment it receives the Settlement Notice of the Transfer Order corresponding to the return or late return type in question, credit the amount of said Transfer Order to the account of the Issuing Client that transmitted the respective Transfer Request. In the event that the Issuing Participant cannot carry out the crediting of the resources referred to in the previous paragraph, said Participant must: I. Refrain from generating another Transfer Order corresponding to the return or late return type regarding a Transfer Order of the return type that, in turn, it has received from the Receiving Participant, and II. Make the corresponding resources available to the aforementioned Issuing Client for withdrawal at the counter or so that they can be transferred to the account that, if applicable, said Issuing Client indicates. Section V Hours 26a. Hours.- The hours mentioned in these Rules are referenced to the time zone that governs in Mexico City. 27a. SPID Operating Hours.- The SPID operating hours will begin at 08:00:00 hours and end at 14:14:59 hours of each Banking Business Day. Participants must allow their Issuing Clients to present Transfer Requests in the hour period between 8:00:00 and 13:59:59 hours. On the other hand, the hour period from 14:00:00 to 14:14:59 hours will be exclusive for Participants to receive, and if applicable, credit, Transfer Orders Accepted by SPID and send Transfer Orders corresponding to the return type. 28a. Extension of Hours.- The Administrator may extend the SPID operating hours or suspend its service due to fortuitous event or force majeure. The Administrator must inform Participants of the hour extension it decides in terms of this Rule, through the electronic or telecommunications medium that the Administrator itself establishes and notifies to Participants for this purpose. Section VI Contingencies 29a. Contingencies.- In the event that any event occurs that affects SPID operations or puts the integrity and security of the system at risk, the Administrator may: I. Suspend the connection to a Participant; II. Instruct any Participant to suspend the sending of Transfer Orders through the SPID; III. Instruct Participants to continue with SPID operations through the use of contingency procedures provided for in Chapter 5 of the Manual, or IV. Put into operation the contingency procedure called “SPID Alternate Operation Procedure” (POA-SPID), in accordance with what is provided for in Chapter 5 of the Manual, for which Participants will be obligated to continue with SPID operations through the use of said procedure. In those cases where the computer applications or programs of a Participant present an event that affects its operation or connection with the SPID, said Participants will be obligated to apply the

Friday, March 11, 2016 OFFICIAL GAZETTE (Fourth Section) contingency procedure called “SPID Alternate Operation Client” (COA-SPID), in accordance with what is provided for in Chapter 5 of the Manual. Section VII Technical Elements 30a. Communication with the SPID.- The messages, notices, and other information exchanged by the Participant through the SPID must be subject to the hours, protocols, formats, sending methods, and procedures indicated in the Manual. 31a. Connection with the SPID.- The Participant must maintain its connection with the SPID, to comply with the operating hours established in Rule 27a of these Rules. In the event that, for any circumstance, the Participant loses this connection, it will be obligated to re-establish it in terms of what is provided for in Chapter 5 of the Manual, as well as to inform the Administrator immediately when the lack of connection occurs. In any case, the Participant must maintain its connection with the SPID, annually, at least at the availability level defined in Chapter 5 of the Manual. CHAPTER IV Fund Management in the SPID Account 32a. Dollar Account for SPID Funding.- Each Participant must maintain in the Bank of Mexico a Dollar Account for SPID Funding in terms of the Provisions. 33a. Correspondent Account for SPID Operations.- Each Participant must maintain at all times an account in a Correspondent Bank destined exclusively for its operation in the SPID. Additionally, each Participant may have another account, in a different Correspondent Bank, destined exclusively for its operation in the SPID. The Participant must inform the Bank of Mexico of the data of said accounts in terms of the Provisions. Each Participant must instruct the transfer of resources from its account, referred to in the previous paragraph, in favor of the Bank of Mexico's account in Correspondents that the Bank of Mexico itself will inform for such purposes and for credit to the Dollar Account for SPID Funding that each Participant maintains in the Bank of Mexico in terms of the Provisions. 34a. Funding of the SPID Account.- The SPID Account of each Participant may be credited through: I. Credits instructed by the Participant itself through the SIAC-BANXICO, in terms of the Provisions, or II. Transfer Orders instructed by other Participants through the SPID in favor of the Participant in question. 35a. Transfers from the SPID Account to the Dollar Account for SPID Funding.- For the debit of the SPID Account of a Participant and the respective credit to its Dollar Account for SPID Funding, said Participant must request from the Administrator a fund transfer through the SPID at any time within the SPID operating hours. 36a. Transfer of SPID Account Balances at the Close of SPID Operations.- At the close of operations, the SPID Administrator will transfer the total balances of the SPID Accounts to the Dollar Accounts for SPID Funding that the respective Participants maintain in the Bank of Mexico in terms of the Provisions. CHAPTER V Operators 37a. Functions of Operators.- For the operation of each Participant in the SPID, only the Operator or Operators that the Participant designates for this purpose may perform the following functions: I. Execute the connection of the computer application that the Participant requires to operate in the SPID; II. Sign and send Transfer Orders, as well as instruct fund transfers between the Participant's SPID Account and the Dollar Account for SPID Funding that it maintains in the Bank of Mexico, and III. Modify the Reserved Balance and send any other type of information to the SPID in accordance with what is specified in the Manual.

(Fourth Section) OFFICIAL GAZETTE Friday, March 11, 2016 38a. Operator Registration Request.- Each Participant must maintain, at all times, at least one Operator. Only those persons that the respective Participant registers with the Administrator may act as Operators. For this, each Participant must present to the Administrator, through the Business Continuity and Operations Management of the Payment Systems Department, a communication in the same terms as those included in the format attached as an Annex to these Rules, signed by the legal representative of the Participant in question who has the authority both to exercise acts of dominion and those necessary to designate those who may act as Operators in the payment systems administered by the Bank of Mexico. Each Participant must verify and keep a record that the persons designated as Operators comply with the following: I. Have experience in the operation of systems to carry out operations in the financial markets, and II. Have a valid Digital Certificate in the name of the person designated as Operator and registered in the extended security infrastructure, administered and regulated by the Bank of Mexico, in accordance with what is provided by Circular-Telefax 6/2005 issued by the latter. In addition to what is provided for in the aforementioned subsections, the person that the Participant intends to register as an Operator must present a letter of no criminal record and a communication signed by the SPID compliance officers, in which it indicates that the person intended to be designated as an SPID Operator is not disqualified from holding employment, position, or commission in the Mexican financial system based on the available public information provided by the CNBV. The registration of the person that the Participant in question has communicated to the Administrator will take effect no later than the third Banking Business Day after the Administrator has verified that the requests comply with the requirements established in this Rule. 39a. Operator De-registration Request.- The Participant that has registered an Operator with the Administrator may request, at any time, the de-registration of said person by presenting a communication in the same terms as those included in the format attached as an Annex to these Rules, addressed to the Administrator, through the Business Continuity and Operations Management of the Payment Systems Department, and signed by those persons whose signature has previously been registered with the Sub-department of Payment Systems Operations for the management of operations and various requests to operate with the Bank of Mexico. Without prejudice to the foregoing, the Participant must request the de-registration of its Operator, in terms of what is provided for in the previous paragraph, within a period not exceeding one Banking Business Day counted from the respective date on which: I. The Operator ceases to work for the Participant or cease to exercise the functions of Operator; II. The Participant detects that the Operator was involved in some incident by which sensitive information related to the operation of the SPID could be compromised, or III. The Participant has knowledge that the person designated as Operator ceases to comply with the requirements provided for in Rule 38a of these Rules. The request for de-registration of an Operator provided for in this Rule will take effect no later than the Banking Business Day following the day on which the Administrator has verified that the request complies with the requirements established in this Rule. CHAPTER VI Admission Process to Act as a Participant Section I Admission Requirements 40a. Criteria to be a Participant.- The Credit Institution that complies with the requirements, terms, and conditions established in these Rules, is authorized by the Bank of Mexico in accordance with what is provided by Circular 3/2016, and, in turn, is admitted by the Administrator in accordance with Rule 48a of these Rules and has celebrated the Contract mentioned in Rule 49a of these Rules, may be admitted as a Participant.

Friday, March 11, 2016 OFFICIAL GAZETTE (Fourth Section)

41a. Submission of admission application.- The Credit Institution seeking admission as a Participant must submit its admission application to the Administrator, in addition to the application it must submit to the Bank of Mexico to obtain its authorization in accordance with the provisions of Circular 3/2016. The two applications referred to in this Rule may be submitted jointly through the Business Operation and Continuity Management of the Payment Systems Department. In any case, the admission application must be signed by the General Director of the Credit Institution, or by an official holding a position at least two hierarchical levels below that of the aforementioned General Director, and must be accompanied by the opinions and certification referred to in Rule 46a of these Rules, which may also be used as supporting documentation for the authorization application referred to in Circular 3/2016.

42a. Requirements for admission as a Participant.- The Credit Institution submitting an admission application in accordance with the previous Rule must demonstrate, to the satisfaction of the Administrator, that it meets the requirements indicated below, in accordance with the specifications included in the Manual.

I. IT Security Requirements The Credit Institution must develop and document a policy that it must follow regarding IT security, which must at least include the following:

a) Have a designated area responsible for IT security that verifies that the administration of the Technological Infrastructure is carried out in accordance with the established IT security policies and procedures;

b) Have a written policy that it must follow regarding the strengthening of the Technological Infrastructure, which must include the following aspects:

1. Procedures to discontinue the use of insecure protocols in the Technological Infrastructure;
2. Procedures that contemplate the use of tools that allow for the detection of computer viruses and malicious code, as well as procedures that allow for their periodic update;
3. Procedures that allow for the management of IT security vulnerabilities arising from, among other factors, changes, updates, or errors in the Technological Infrastructure;
4. Procedures to inhibit the installation of any service, application, and/or software that is not essential for operation with the SPID in the Technological Infrastructure;
5. Procedures that contemplate measures to guarantee the IT security of the SPID application;
6. Procedures to detect and manage IT security incidents in the Technological Infrastructure, ensuring their identification, containment, and the adequate collection and preservation of IT security evidence for notification to senior management, and
7. Procedures to evaluate and/or audit, at least every two years, the IT security of the Technological Infrastructure, which must include internal or external penetration tests. Furthermore, said evaluation or audit must provide for the generation of a report establishing an IT risk level for the infrastructure and contemplate the formation of a documented work plan to address high and medium criticality risks;

c) Have policies that it must follow for the secure handling of electronic information, which must contain the following procedures:

1. Procedures that ensure that when discarding or decommissioning physical components or devices (hardware) of the Technological Infrastructure, the information contained therein is securely erased;

(Fourth Section) OFFICIAL GAZETTE Friday, March 11, 2016

2. Procedures to restrict access to connection ports and peripheral devices of the Technological Infrastructure, and
3. Procedures for the backup of information from the Technological Infrastructure and operations;

d) Have policies that it must follow to implement robust and secure access control mechanisms for the Technological Infrastructure, which must include the following procedures:

1. Procedures to implement robust logical access mechanisms and controls for the Technological Infrastructure;
2. Procedures for secure and robust password management;
3. Procedures to allow for manual and automatic locking of the Technological Infrastructure to ensure that equipment can only be used by authorized personnel, and
4. Procedures for the management of access privileges to the Technological Infrastructure, and

e) Have policies that it must follow for the management of a telecommunications network that allows secure and efficient communication with the Bank of Mexico, which must include the following procedures:

1. Procedures to restrict internet access from the Technological Infrastructure, and
2. Procedures for the management of a telecommunications network that allows communication with the Bank of Mexico in an efficient and secure manner;

II. Operational Risk Management Requirements

a) The Credit Institution must have documented policies and procedures that it must follow for the management of operational risks, which must include the following:

1. An operational risk management methodology related to operation with the SPID that considers the identification and evaluation of risks, as well as the implementation of controls that allow for the mitigation of identified risks;
2. A methodology for business impact analysis, which must consider at least: i. Identifying critical processes related to its operation with the SPID; ii. Identifying and classifying time-based impacts on system availability when identified operational risks materialize, in accordance with the defined operational risk management methodology; iii. Defining a target recovery time for each critical process related to its operation with the SPID, which must be less than or equal to two hours; iv. Defining a target recovery point in the event of interruption of its operation with the SPID, which must consider reconciliation procedures to recover operations to a consistent information state prior to the interruption; v. Identifying critical internal and external counterparties related to its operation with the SPID, and vi. Identifying critical material and human resources to perform operations with the SPID;
3. A procedure to ensure that personnel related to the operation of the application used to communicate with the SPID possess the required skills, competencies, and knowledge for the position they hold, and
4. Description of the activities required to perform its operation with the SPID, as well as allowing for the precise definition of responsibilities;

Friday, March 11, 2016 OFFICIAL GAZETTE (Fourth Section)

b) The Credit Institution must carry out the following risk mitigation actions referred to in this subsection:

1. Have a list of identified operational risks and associated controls for operation with the SPID, including those associated with external providers, indicating the risk classification and the result of its evaluation;
2. Have a scalability analysis of the resources available for operation with the SPID to ensure it has the capacity to handle high volumes of operations and meet its service level objectives, and
3. Have policies and guidelines for the management of physical access privileges to operational sites and data centers, and

c) The Credit Institution must have procedures that it must follow for the recovery and restoration of operations upon the materialization of a risk, which must include:

1. A continuity policy, as well as strategies and procedures that it must follow so that, upon the materialization of contingency scenarios identified in the risk analysis, it can continue operations with the SPID at an acceptable minimum level;
2. Document the actions it must follow for the handling of incidents that cause an impact on normal operations with the SPID, which must contemplate the phases of identification, diagnosis, handling, recovery, restoration, and documentation, and indicate the corresponding roles and responsibilities;
3. Document the activities it must perform to respond to emergencies in the event of any event affecting normal operations with the SPID, in which the activation of implemented continuity strategies and procedures is considered, and the roles and responsibilities, escalation levels and times, protocol, and internal and external communication means are indicated;
4. Document the actions it must follow for the return to normal operations once any continuity strategy is activated or any continuity procedure is executed due to the occurrence of an incident related to operation with the SPID, and
5. A test plan to which it must give follow-up to evaluate the implemented continuity strategies and procedures related to operation with the SPID, indicating the guidelines, type of tests to be performed, and their periodicity;

III. Certification Requirements for the Application Used to Connect to the SPID The Credit Institution must carry out, in accordance with Appendix F of the Manual, the following:

a) Demonstrate that the application complies with the SPID communication protocol; b) Demonstrate that the application properly processes Transfer Orders, even when a high volume of them is presented in a short period of time, and c) Validate that it can operate with the secondary infrastructure that the Administrator has implemented for the SPID in contingency cases, and

IV. Additional Risk Management Requirements The Credit Institution must satisfy the following:

a) Have adequate processes, systems, and personnel to collect, verify, and preserve the identification information of its Issuing Clients and Beneficiary Clients, as applicable, referred to in subsection I of Rule 50a of these Rules, as well as information regarding the characteristics of said clients that allows for the evaluation of the risk they may represent in the matter referred to in said Rule; b) Have processes that it must follow, as well as adequate systems and personnel, to carry out the verification referred to in subsection IV of Rule 50a of these Rules;

(Fourth Section) OFFICIAL GAZETTE Friday, March 11, 2016

c) Have processes that it must follow, as well as adequate personnel, to monitor transfers made through the SPID via the automated systems it has, in order to detect unusualities in said transfers or inconsistencies of these with information known to the Credit Institution in question, and take the appropriate actions to clarify such observations; d) Develop and document the policies and procedures that it must follow to evaluate and mitigate the risks that the Credit Institution may assume in relation to transfers made through the SPID related to allegedly illicit acts or resources of undetermined origin, which may form part of the policies and procedures that the Credit Institution has in similar risk matters, and e) Develop a risk assessment model in accordance with what is stated in item 11.4 of the Manual, which it must apply to clients who may perform transfers subject to the SPID.

Section II SPID Compliance Officers

43a. Designation of two SPID compliance officers.- Each Credit Institution requesting admission as a Participant must designate two SPID compliance officers, one of whom is responsible for ensuring compliance with the applicable SPID regulations regarding Additional Risks, and the other, responsible for ensuring compliance with the rest of the applicable SPID regulations on matters not involving Additional Risks.

The Credit Institution must verify that the persons it designates as responsible meet the following requirements:

I. SPID Compliance Officer in the matter of Additional Risks:

a) Have a valid certification issued by the CNBV in the matter of money laundering and terrorist financing prevention; b) Not be disqualified from holding employment, position, or commission in the Mexican financial system by the CNBV, and c) Report directly to the Compliance Officer of the Credit Institution or that this position falls on the Compliance Officer themselves, and

II. SPID Compliance Officer on matters not involving Additional Risks:

a) Have a certificate of no criminal record, and b) Report directly to the Compliance Officer of the Credit Institution or that this position falls on the same officer.

The Credit Institution, when it deems it convenient, may opt to have a single responsible person provided that this person meets the requirements established in the previous subsection I.

44a. Registration with the Administrator.- Each Credit Institution must inform, in writing addressed to the Administrator, through the Business Operation and Continuity Management of the Payment Systems Department, the name of the persons designated as SPID compliance officers.

Section III Third-Party Contracting

45a. Provision of services by third parties.- The Credit Institution intending to contract with third parties who provide it with an interface that allows it to connect to the SPID or any other service that is essential for the operation of the SPID, must obtain authorization from the Bank of Mexico in accordance with the provisions of Circular 3/2016.

Section IV Accreditation of Compliance with Requirements for Admission as a Participant and Signing of the Contract

46a. Compliance Evaluation.- The Credit Institution submitting the admission application to act as a Participant, in accordance with what is provided in Rule 4a of these Rules, must demonstrate in said application compliance with the IT security, operational risk management, and Additional Risk management requirements to operate with the SPID established in Section I of this Chapter, in accordance with the Manual and, in particular, Appendices E and G. For these purposes, the Credit Institution must attach the following documentation to the aforementioned admission application:

I. An opinion signed by the Compliance Officer and the Compliance Officer of the Credit Institution indicating that said Credit Institution complies with the Additional Risk management requirements, as well as the other requirements mentioned in these Rules, respectively; II. An opinion signed by the head of the internal audit area of the Credit Institution indicating how compliance is given to each requirement referred to in this Rule, the findings, and, if applicable, the irregularities or non-compliances detected, and III. A certification signed by an Independent External Auditor indicating the level of compliance by that Credit Institution of each of the requirements referred to in this Rule.

Friday, March 11, 2016 OFFICIAL GAZETTE (Fourth Section)

47a. Review by the Administrator.- To verify compliance with the IT security, operational risk management, and Additional Risk management requirements to operate with the SPID established in Section I of this Chapter, the Administrator may require the documentation, information, execution of tests, and additional opinions that it deems necessary. Likewise, the Administrator may carry out visits to the facilities and systems of the Credit Institution in question, for the purpose of verifying compliance with the aforementioned requirements.

48a. Administrator's Resolution.- The Administrator, based on the received documentation and once it has carried out the tests referred to in this Chapter and, if applicable, the visit mentioned in the previous Rule, will determine whether it is appropriate to admit the applying Credit Institution as a Participant in the SPID. The Administrator will inform its decision to the applicant so that they may celebrate the Contract referred to in the following Rule.

49a. Contract.- The interested Credit Institution that receives a favorable resolution from the Administrator regarding its admission as a Participant referred to in the previous Rule, must celebrate the Contract, for which it must provide the Administrator, through the Operations Instrumentation Management, the name of the persons intending to sign it, as well as a simple copy of their official identification and a certified simple copy of the public deed in which the powers to exercise acts of dominion are stated, as well as expressly the power to designate the persons who may act as operators in the payment systems administered by the Bank of Mexico.

CHAPTER VII Permanence Requirements

50a. Permanent compliance with requirements for admission as a Participant.- Participants must comply at all times with the policies and procedures referred to in Rule 42a of these Rules.

In addition to what is provided in the previous paragraph, Participants must comply with the following obligations regarding Additional Risk management:

I. Collect and preserve, without prejudice to the other identification information they must collect in accordance with applicable provisions, regarding each of those clients who may act as Issuing Clients or Beneficiary Clients, the following data:

a) Digital Certificate of the e.firma (formerly FIEL), of the respective client; b) Purpose, declared by the client, of the use they intend to give to the Dollar account; c) Transactional profile:

1. For clients with more than 6 months of seniority in their Dollar deposit operations, which must include, among others: the amount, number, and frequency of the transfers that such clients commonly make, and
2. For clients who have initiated the relationship with the Participants in question in a period of less than or equal to 6 months, the one declared by the client regarding their Dollar deposit operations, which must include, among others: the amount, number, and frequency of the transfers that such clients commonly estimate making;

(Fourth Section) OFFICIAL GAZETTE Friday, March 11, 2016 d) Information on Beneficiary Clients:

1. In the case of existing clients, the name or corporate name of the Beneficiary Client(s) to whom the client of the Participant commonly transfers funds through the SPID, as well as their Taxpayer Registry Key (with homoclave), account number, and the type of relationship they have with the client (for example, supplier, customer, creditor, debtor, subsidiary, parent company, among others), and
2. In the case of new clients, the name or corporate name of the Beneficiary Client(s) to whom the client intends to commonly transfer funds through the SPID, as well as their Taxpayer Registry Key (with homoclave), account number, and the type of relationship they have with the client (for example, supplier, customer, creditor, debtor, subsidiary, parent company, among others); e) Name, denomination or corporate name of the shareholders and Taxpayer Registry Key (with homoclave), or date of birth or incorporation of the direct shareholders, partners, associates, or members of the equivalent governing body, and f) With respect to those clients who, in accordance with the client risk assessment model in use by the SPID referred to in point 11.4 of the Manual, are classified in a high-risk category, the respective Participants must include the following information:
3. The corporate structure of the client, understood as the set of those legal entities linked to each other by their direct or indirect participation in their respective capital or social equity, and
4. Identification of those shareholders, partners, associates, or members of the client's governing body who exercise control over the client in question. Control is understood as the capacity of a person or group of persons, through the ownership of securities, by the execution of a contract, or by any other legal act, to: i. impose, directly or indirectly, decisions in the general assembly of shareholders, partners, or associates, or in the equivalent governing body of the client; ii. appoint or remove the majority of the directors, administrators, or equivalents of the client; iii. maintain the ownership of rights that allows, directly or indirectly, to exercise voting rights regarding more than fifty percent of the capital or social equity of the client, and iv. direct, directly or indirectly, the administration, strategy, or main policies of the client. The information and documentation collected by the Participants must be complete and up-to-date in such a way that it allows them, on the one hand, to form an understanding of the normal transactional activity of their respective clients, based on their economic activity or business operations, as well as to determine the degree of transactional risk at the opening of the account, and on the other hand, to have the necessary information that justifies the need for the use of both Dollar accounts and the SPID by their clients. Likewise, each Participant must document and conserve the reasons for the change in the transactional profile or account activity, if applicable, which must be reflected in the automated monitoring system referred to in subsection c), of fraction IV, of Rule 42 of these Rules. With respect to clients whose share certificates representing their social capital or securities representing such shares trade on the stock exchange, Participants may refrain from collecting the aforementioned identification data, with the exception of the Digital Certificate of the e.signature (formerly FIEL), considering that they are subject to stock market regulations on information disclosure; II. Update client information at least once every two years, under the criteria established by the Participants themselves and in accordance with the client's risk category of the risk assessment model referred to in subsection c), of fraction IV, of Rule 42 of these Rules. Notwithstanding the provisions of the previous paragraph, for those clients who, in accordance with the client risk assessment model used for operation in the SPID, are classified in a high-risk category, the file review must be annual. For clients who have presented significant changes in the risk category in which they have been classified, in accordance with the client risk assessment model referred to in subsection e) of fraction IV of Rule 42 of these Rules, or in their transactionality, in terms of the Participant's Policies and Procedures Manual, a shorter periodicity may be established; III. Include in the Submission Requests transmitted to their Originator Clients, in a complete and precise manner, at least the following data of the Originator Client in the corresponding information fields: a) Name or corporate name, and b) Taxpayer Registry Key (with homoclave). The data referred to in the aforementioned subsections must be included in the respective fields of each Transfer Order in a manner consistent with the Digital Certificate of the e.signature (formerly FIEL) of said Originator Client, and IV. Verify if their Originator Clients or Beneficiary Clients, as the case may be, and their respective direct shareholders, partners, associates, or members of the equivalent governing body, are part of: a) General lists or particular resolutions issued by competent authorities regarding persons with respect to which Credit Institutions are obliged by law to suspend their operations, and b) Official lists issued by the competent authorities that must be observed by the Correspondent with which the Participant in question holds a Dollar deposit account to operate in the SPID.

51a. Functions of the SPID compliance officers.- Each Participant, while maintaining such status, must maintain at all times the SPID compliance officer(s) referred to in Rule 43 of these Rules, to whom they must entrust, at least, the following functions: I. Submit a semi-annual written report to the Participant's audit committee containing the findings and, if applicable, irregularities and non-compliances with the internal SPID rules, as well as with the other applicable regulations for the SPID, the actions adopted to correct them, and the degree of progress and efficiency of such actions. Additionally, they must send a copy of the report referred to in this fraction and the receipt confirmation by the Participant's audit committee to the Administrator, through the Business Operation and Continuity Management of Payment Systems, no later than the fifteenth Banking Business Day following that on which they submitted the aforementioned report to said committee; II. Prepare a written report when, in the exercise of their functions, they detect any irregularity or non-compliance with the internal rules related to the management of Additional Risks. In the event that the SPID compliance officer reports directly to the Participant's compliance officer, they must present said report to the latter. On their part, said compliance officer must present the report in the session of the communication and control committee immediately following the detection of the non-compliance or irregularity, and III. Prepare a written report when they detect any irregularity or non-compliance with the internal SPID rules that do not involve Additional Risks, no later than the next Banking Business Day following that on which said irregularity or non-compliance was detected. In the event that the SPID compliance officer reports directly to the Participant's compliance officer, they must present said report to the latter. In case that, in accordance with the provisions of Rule 43 of these Rules, the SPID compliance officer on matters not involving Additional Risks is the same as the compliance officer of the Credit Institution, said report must be presented to the audit committee.

(Fourth Section) OFFICIAL GAZETTE Friday, March 11, 2016 In case any Participant replaces any of the persons they have designated as SPID compliance officers, said Participant must inform the Administrator of this situation, through a written submission presented to the Business Operation and Continuity Management of Payment Systems, no later than the tenth Banking Business Day counted from that on which the new responsible person was designated.

52a. Periodic report and certification.- Each Participant must verify annually the compliance with the information security requirements, operational risk management, and Additional Risk management requirements to operate in the SPID established in Rule 50 of these Rules, through reviews carried out by the head of the internal audit area of the Participant themselves in a given year, as well as by the Independent External Auditors in the following year. The reviews by the head of the internal audit area and the Independent External Auditor must observe the provisions of fractions II and III of Rule 46 of these Rules, respectively. The opinions and certifications corresponding to the verifications referred to in the previous paragraph must be delivered to the Participant's audit committee and to the Administrator, through the Business Operation and Continuity Management of Payment Systems, within sixty natural days following the closing of the fiscal year. With respect to the audit opinion related to the compliance with the Additional Risk management requirements, the provisions of this Rule may be considered fulfilled when the Participant delivers to the Administrator a copy of the audit opinion established in Rule 60 of the "General Provisions referred to in Article 115 of the Credit Institutions Law" that, if applicable, includes the review of Additional Risks. The Participant may not contract the services of an Independent External Auditor to obtain the certification referred to in this Rule for more than three consecutive certification periods. Without prejudice to the foregoing, the Participant may designate the same Independent External Auditor again after a minimum interruption of five years counted from the last certification that had been granted with respect to said Participant. Additionally, each time a new version of the application used to connect to the SPID is generated, the Participant must inform the Administrator, who will determine if accreditation tests must be carried out in accordance with what is established in fraction III of Rule 42 of these Rules.

53a. Compulsory compliance plan.- In case that, as a result of the review carried out by the Administrator on a Participant or of the results of the Independent External Auditor, the Administrator detects irregularities or non-compliances with the internal SPID rules, they may require the Participant to present a compulsory compliance plan in which the actions that the Participant obligates itself to adopt to correct the detected irregularities or non-compliances are provided, as well as the deadline in which they will be carried out and the responsible persons for the attention of each of them. To this effect, the Participant must submit the compulsory compliance plan for approval by the Administrator, through the Authorizations and Regulatory Follow-up Management. In the plan referred to in this Rule, the Participant must designate the Independent External Auditor to whom they will entrust following up on the actions aimed at remedying the irregularities or non-compliances referred to in the previous paragraph, as well as to inform the Administrator, in the terms established in the compulsory compliance plan itself, of the degree of progress and efficiency of the actions adopted. The Administrator may request modifications to the compulsory compliance plan project presented by the Participant and will grant a deadline no greater than ten Banking Business Days to attend to them. When the Administrator determines that the modifications were not attended to, the compulsory compliance plan will be considered not presented and the corresponding sanctions will be imposed. Once the compulsory compliance plan is approved, the Administrator may request the Participant, at any time, additional information regarding the compliance with said plan and, if applicable, request adjustments to said plan when they detect that any of the measures contained in it present deviations, that they are not achieving an effective correction of the irregularity or non-compliance, or that the Participant could incur in another irregularity or non-compliance or in a possible impact on the payment systems, the financial system, or the users of the SPID services.

Friday, March 11, 2016 OFFICIAL GAZETTE (Fourth Section) In case that the compulsory compliance plan is not carried out in the terms approved by the Administrator, the Participant must, until such time as they comply, to the satisfaction of the Administrator, with what is provided in said plan, comply with the resolution that, if applicable, is issued by the Bank of Mexico for: I. Restricting the making of withdrawals and deposits of the Dollar deposit accounts that the Participant holds for its clients, through electronic interbank fund transfer Orders through the SPID, or II. Restricting the opening of Dollar demand deposit accounts with or without checkbooks, payable in the Mexican Republic that the Participant offers to legal entities that have their domicile in national territory in terms of the Provisions. The provisions of this Rule will be applicable without prejudice to the sanctions that correspond in terms of the applicable provisions.

CHAPTER VIII Independent External Auditors

54a. Hiring of Independent External Auditors.- Credit Institutions must hire the services of an Independent External Auditor, for the certification of the level of compliance that they give to the requirements referred to in Rule 42 of these Rules.

55a. Independence requirements.- The Independent External Auditors that certify the level of compliance that Credit Institutions and Participants give to the requirements referred to in these Rules, as well as the respective Firms to which they belong, must be independent on the date of celebration of the service provision contract and during the development of the audit. It will be considered that there is no independence when the person or the Firm in question is located in any of the circumstances referred to in Article 189, fractions I to VI, IX and X, of the "General Provisions applicable to credit institutions", issued by the CNBV, as well as in the following: I. The Independent External Auditor, the Firm in which they work or some partner or employee thereof, provides to the Credit Institution or Participant, in addition to the certification, any of the following services: a) Consulting on the elaboration of processes, procedures, policies, and criteria, as well as the systems that the Credit Institution or Participant must have to comply with the requirements referred to in these Rules; b) Operation, directly or indirectly, of the financial information systems of the respective Credit Institution or Participant or well, administration of their local network; c) Supervision, design, or implementation of the computer systems (hardware and software) of the Institution, which carry out activities for the operations that the Credit Institution or Participant carry out through the SPID; d) Administration, temporary or permanent, participating in the decisions of the Credit Institution or Participant; e) Internal audit related to the certification of the level of compliance of the requirements referred to in these Rules; f) Recruitment and selection of personnel of the Credit Institution or Participant to occupy positions of general director or of the two immediate lower levels to the latter, and g) Any other that implies or could imply conflicts of interest with respect to the external audit work, and II. The income that the Independent External Auditor receives or will receive for carrying out the certification of the Credit Institution or Participant depends on the result of the certification itself or on the success of any operation carried out by the Credit Institution or Participant itself that has as its basis the certification of the Independent External Auditor.

CHAPTER IX Disincorporation

(Fourth Section) OFFICIAL GAZETTE Friday, March 11, 2016

56a. Voluntary disincorporation.- The Participant may request authorization from the Administrator, through the Business Operation and Continuity Management of Payment Systems, to cease acting as a Participant. Said request must be presented at least one Banking Business Day in advance of the date on which the Participant intends for their disincorporation as a Participant to take effect. Said request will only proceed when the Participant does not hold Dollar demand deposit accounts with or without checkbooks payable in the Mexican Republic to legal entities that have their domicile in national territory in terms of the Provisions.

57a. Expulsion.- The Administrator may expel a Participant from the SPID when they incur in any of the non-compliances indicated below and that, as a result of said non-compliance, the correct functioning of the payment systems, the stability of the financial system could be put at risk, or relevant impacts could occur to the users of the SPID services: I. The Participant fails to comply with any of the requirements to act as a Participant in the SPID, including the policies and procedures that they have become obligated to follow, and II. The Participant fails to comply with the compulsory compliance plan referred to in Rule 53 of these Rules.

CHAPTER X Obligations on service levels, information, and compensation for clients

58a. Service availability.- Each Participant must provide to their clients who are legal entities domiciled in national territory and holders of Dollar-denominated deposit accounts opened in the Participant themselves the service of fund transfers through the SPID, at least at the availability level defined in Chapter 5 of the Manual.

59a. Information on Accepted Transfer Orders.- The Originator Participant and the Receiving Participant of the same Transfer Order Accepted by SPID must provide to the Originator Client and to the Beneficiary Client, respectively, in accordance with what is established in Rule 60 of these Rules, the following information with respect to said Transfer Order Accepted by SPID: I. With respect to the Originator Participant, they must provide the following information to the Originator Client who transmitted the Submission Request of the Transfer Order in question: a) The name of the Receiving Participant that corresponds in accordance with the SPID catalog in force at the moment the Transfer Order was settled; b) The calendar date and time when the Transfer Order was settled; c) The amount of the Transfer Order; d) The number of the beneficiary account indicated in the Transfer Order to identify the respective account of the Beneficiary Client; e) Name or corporate name of the respective Beneficiary Client, as it was indicated by the Originator Client of the Originator Participant in the respective Submission Request, followed by the following phrase: "(Data not verified by this institution)"; f) The information of the Tracking Key field that corresponded to the Transfer Order; g) The information of the Numeric Reference field indicated for the Transfer Order, and h) The information of the Payment Concept field indicated for the Transfer Order, and II. With respect to the Receiving Participant, they must provide to the Beneficiary Client the information indicated in subsections b, c, f, g, and h of the previous fraction I, in addition to the following: a) The name of the Originator Participant that corresponds in accordance with the SPID catalog in force at the moment the Transfer Order Accepted by SPID is received; b) The ordering account corresponding to the Originator Client who requested the Originator Participant to send the Transfer Order, and

Friday, March 11, 2016 OFFICIAL GAZETTE (Fourth Section)

c) The name or corporate name of the person that the Issuing Participant indicated in the Transfer Order Accepted by SPID as the holder of the account referred to in the preceding subsection b).

60a. Method for Disclosing Information Regarding Transfer Orders Accepted by SPID.- The Issuing Participants and Receiving Participants referred to in the preceding Rule shall disclose to the Issuing Clients or Beneficiary Clients, respectively, the information indicated in said Rule, in accordance with the following:

I. The Issuing Participants must include the information referred to in the preceding Rule in the same channels they have made available to their respective clients to submit Sending Requests, and said channels, in turn, allow them to consult the details of the movements in the respective accounts associated with them. Regarding this, each Issuing Participant must include said information in the referred channels within a period of sixty seconds following the time in which it has received from SPID the respective Settlement Notice of the Transfer Order in question, as well as maintain it for consultation in said channels for a period of no less than two months following the time in which the indicated settlement was carried out;

II. In addition to what is provided in the preceding subsection, during the first fifteen calendar days following the end of each calendar month, the Participants referred to in this Rule must send to the Issuing Clients or Beneficiary Clients, respectively, free of charge, to the respective addresses provided by them, the information referred to in the Rule above for each of the Transfer Orders Accepted by SPID that have been carried out during said month;

III. As an exception to what is provided in the preceding subsection, the Participants will not be obligated to send the information in the manner indicated in said subsection if they include that same information in the account statements they periodically issue to their account holders in accordance with the applicable provisions, and

IV. In the event that the Transfer Order Accepted by SPID has not been credited, the Receiving Participant must make available to the Beneficiary Client the information referred to in subsection II of Rule 59a of these Rules through a means accessible to the Beneficiary Client.

61a. Access to Electronic Payment Receipts.- The Participants referred to in the preceding Rule who have agreed with those clients referred to in Rule 59a above to carry out operations through internet banking services, must include in the site of the internet portals they make available to them for the consultation of movements in the corresponding accounts, for each Transfer Order Accepted by SPID, the electronic link constructed in accordance with the Manual, so that their clients can consult, either the status of their respective Transfer Orders or, in the event that these have been credited to the corresponding Beneficiary Clients, generate the Electronic Payment Receipts of said Transfer Orders.

With respect to each Transfer Order Accepted by SPID that the Participant shows to their respective clients in accordance with what is provided in this Rule, said Participant must include directly in the portal of the Bank of Mexico, in the event that the client in question accesses said portal through the link provided by the Participant themselves in accordance with the preceding paragraph, the following information of that which must be included in said portal for the generation of the corresponding Electronic Payment Receipt:

I. The calendar date on which the respective Transfer Order was settled; II. The information of the field Tracking Key or Numerical Reference that corresponded to the Transfer Order Accepted by SPID in question; III. The name of the Issuing Participant and the Receiving Participant that corresponds in accordance with the SPID catalog in effect at the time the Transfer Order was settled; IV. The beneficiary account indicated in the Transfer Order Accepted by SPID, and V. The amount of the Transfer Order Accepted by SPID.

62a. Payment of Compensation for Delay.- Each Participant must pay the client the amounts referred to in the following subsections, without prejudice to the other payments it must make in accordance with these Rules, when it falls under the following circumstances:

(Cuarta Sección) OFFICIAL GAZETTE Friday, March 11, 2016

I. In the event that the Issuing Participant fails to comply with any of the deadlines indicated in Rule 16a or 25a of these Rules, and said non-compliance persists, at least, to the SPID operation day that is subsequent to the one in which the applicable deadline expired, said Participant must pay the amount that results in accordance with what is provided in Rule 63a of these Rules. The Participant must pay, no later than the close of the SPID operation day immediately following the one in which the non-compliance in question has concluded, said amount in the same account corresponding to the Issuing Client who submitted the Sending Request of the Transfer Order in question;

II. In the event that the Receiving Participant has failed to comply with the deadline provided in Rule 19a of these Rules, and said non-compliance persists, at least, to the SPID operation day that is subsequent to the one in which the applicable deadline expired, said Participant must pay the amount that results in accordance with what is provided in Rule 63a of these Rules. In this case, the Participant must pay, no later than the close of the SPID operation day immediately following the one in which the non-compliance in question has concluded, said amount in the same account corresponding to the Beneficiary Client of the Transfer Order in question, and

III. In the event that the Receiving Participant has failed to comply with the deadline provided in Rule 23a of these Rules, and said non-compliance persists, at least, to the SPID operation day that is subsequent to the one in which the applicable deadline expired, said Participant must pay to the Issuing Participant of the Transfer Order subject to the return, the amount that results in accordance with what is provided in Rule 63a of these Rules. In this case, the Receiving Participant must send a Transfer Order corresponding to the type of late return to the Issuing Participant, for an amount equal to the sum of the original amount plus the amount resulting in accordance with what is provided in Rule 63a. The Issuing Participant is obligated to credit the amount of said late return type Transfer Order to the Issuing Client who instructed the Transfer Order subject to the return.

63a. Calculation of Amounts.- To calculate the amount referred to in the preceding Rule, the Participant must first calculate a reference amount in the following way: I. Multiply the effective daily interest rate of federal funds, closed to two decimals, made known by the Federal Reserve of the United States of America on the Banking Business Day previous in the United States of America to the one in which the non-compliance occurs, by the amount of the Transfer Order in question, including cents; II. Multiply the result by the number of natural days of delay, and III. Divide the obtained result by 360. The reference amount will be the result of closing to two decimals the quantity obtained from this division.

The Participants obligated to make any of the payments referred to in Rule 62a of these Rules must pay the amount that results greater between:

I. Twenty Dollars, or II. The result obtained by multiplying by two the amount that results from the calculation of the reference amount referred to in the first paragraph of this Rule.

64a. Charging of Commissions to Clients.- The Receiving Participant is prohibited from charging any commission to the Issuing Participants or to the Beneficiary Clients for the receipt of Transfer Orders Accepted by SPID.

In the event that the Issuing Participant charges commissions to its Issuing Clients for the sending of Transfer Orders referred to in these Rules, it must disclose through the channels it has made available to its respective Issuing Clients to submit Sending Requests the cost that the operation will have before it is carried out. This is unless they have agreed on another scheme for charging transactions with the referred Issuing Client.

CHAPTER XI SPID Fees

65a. Fee for Use of SPID.- The Participant must pay the Administrator for the use of SPID an amount equivalent to the fixed fee and the variable monthly fee in accordance with this Rule.

The variable monthly fee that each Participant must pay the Administrator, in accordance with what is provided in the preceding paragraph, will be that which the Administrator calculates based on the number of operations carried out in the SPID by the Participant in question, in the month immediately preceding the one in which the payment must be made, as well as the other fees per operation that the Administrator determines.

Friday, March 11, 2016 OFFICIAL GAZETTE (Fourth Section)

The Administrator will inform the Participants of the fixed fee and the fee per operation for the calculation of the variable monthly fee, no later than the last Banking Business Day of the month of November of the year immediately preceding the one in which the payment of the fixed fee in question must be made or at least thirty natural days in advance of the date on which the new rates take effect.

The Administrator will inform the Participants, the amount corresponding to the variable monthly fee, no later than the fifth Banking Business Day of the month following the one to which the referred monthly fee corresponds.

To this effect, the Administrator will inform the fees referred to in the third and fourth paragraphs of this Rule, through electronic communication addressed to the email addresses that the Participant has made known to the Administrator in accordance with the model contained in Appendix I of the Manual. With respect to the fixed fee, this must be paid on the tenth Banking Business Day of the month of January of each calendar year, while the variable monthly fee must be paid on the tenth Banking Business Day of the month immediately following the one to which it corresponds. This is with the exception of the year of start of operations of the Participant in question, in which the fixed fee must be paid on the tenth Banking Business Day of the month immediately following the start of operations in the SPID.

The fees that the Administrator charges each Participant for the return of Transfer Orders, will be borne by the respective Issuing Participants of the original Transfer Orders, with the exception of those in which the circumstance for return is indicated in subsection I of Rule 22a of these Rules, in which case they will be borne by the Receiving Participant of the original Transfer Order Accepted by SPID.

ANNEX MODEL THAT PARTICIPANTS IN THE SPID MUST USE TO EFFECT THE REGISTRATION AND/OR DELETION OF THEIR OPERATORS

[Letterhead of the Credit Institution]

“_____ of _________________ of _____.

BANK OF MEXICO

5 de Mayo Avenue number 6, Ground Floor, Centro Neighborhood, Cuauhtémoc Delegation C.P. 06059, Mexico City

Attention: Management of Operation and Business Continuity of Payment Systems.

For the purposes of the connection, participation and operation of (Full Name of the Credit Institution including, if applicable, the financial group to which it belongs) in the Interbank Payment System in Dollars (SPID), we would greatly appreciate it if that Central Bank, with respect to the Operators of this Credit Institution, proceeds as indicated in this document.

To this effect, the undersigned hereby declares under oath that he (we) has (have) verified that the person(s) designated as Operator(s) meets (meet) all and every one of the requirements established for such effect in Circular 4/2016 “Rules of the Interbank Payment System in Dollars”, so that this Credit Institution assumes full responsibility regarding said designation(s), as well as regarding all acts that such Operator(s) carry out in its/their name and representation.

OPERATORS OF THE INTERBANK PAYMENT SYSTEM IN DOLLARS ADMINISTERED BY THE BANK OF MEXICO DESIGNATED BY:

Number Full Name of the Institution-Participant Operator Name Digital Certificate Number Registration / Deletion

(Cuarta Sección) OFFICIAL GAZETTE Friday, March 11, 2016

(20 positions)

Annex valid from _____________ 1

---

BANK OF MEXICO [NAME OF THE INSTITUTION]

Authorized Representative 2

TRANSITORY PROVISIONS

FIRST. This Circular will enter into force the day after its publication in the Official Gazette of the Federation, with the exceptions established in the following transitory articles.

SECOND. Regarding the provision contained in Rule 8a of these Rules, the obligation to process the types of Transfer Orders “Participant to Participant” referred to in subsection IV of Rule 5a of these Rules, will enter into force on May 27, 2016. With respect to the obligation to process the types of Transfer Orders “Participant to third party” and “Third party to Participant” referred to in subsections II and III of Rule 5a of these Rules, they will enter into force starting from June 29, 2016, and with respect to the obligation to process the type of Transfer Orders “Late Return” referred to in subsection VI of Rule 5a of these Rules, it will enter into force starting from October 28, 2016.

During the periods indicated in the preceding paragraph, Receiving Participants may return Transfer Orders Accepted by SPID when they correspond to any of the types that the referred Receiving Participant is not obligated to process, in terms of what is provided in the preceding paragraph, adhering to what is established in Section IV of Chapter III of these Rules. In these cases, the Administrator will charge the corresponding amount for said returns to the respective Issuing Participants of the original Transfer Orders, in accordance with the last paragraph of Rule 65a of these Rules.

THIRD. The provision contained in subsection I of Rule 9a of these Rules will enter into force 182 days after the entry into force of this Circular.

FOURTH. The provision contained in subsection II of Rule 46a of these Rules will enter into force on October 3, 2016.

FIFTH. The obligation on Participants to have the model provided for in subsection e), of subsection IV, of Rule 42a will enter into force on November 4, 2016.

SIXTH. The obligation on Participants to collect the information provided for in subsections b) and e), of subsection I, of Rule 50a of these Rules and incorporate it into the monitoring system referred to in subsection c), of subsection IV, of Rule 42a of these Rules, will enter into force on November 4, 2016.

SEVENTH. The provision contained in the third paragraph of Rule 65a of these Rules will enter into force on November 30, 2016. Until then, the Bank of Mexico will inform no later than April 8, 2016 the fees referred to in the third paragraph of the referred Rule, applicable to the 2016 exercise, through electronic communication addressed to the email addresses that the Participant has made known to the Administrator in accordance with the model contained in Appendix I of the Manual.

EIGHTH. The provision contained in Rule 20a of these Rules will enter into force on January 13, 2017.

1 For exclusive use of the Bank of Mexico. 2 In those cases where the registration of Operators is requested, this document must contain the name, signature and position of the person(s) with authority to exercise acts of dominion, as well as those necessary to designate those who may act as Operators in the payment systems administered by the Bank of Mexico. In those cases where only the deletion of Operators is requested, the document may be signed by persons with signatures previously registered before the Sub-management of Operation of Payment Systems of the Bank of Mexico.”

Friday, March 11, 2016 OFFICIAL GAZETTE (Fourth Section)

NINTH. The provision contained in Rule 59a of these Rules will enter into force on January 13, 2017. Until then, Participants must make available to their clients the information referred to in Rule 59a of these Rules through at least one of the means referred to in subsections I and II of Rule 60a of these Rules.

TENTH. The provision contained in Rule 61a of these Rules will enter into force on January 13, 2017.

ELEVENTH. The provision contained in subsection IV and second paragraph of Rule 29a of these Rules will enter into force on April 3, 2017.

TWELFTH. Regarding the provision contained in Rule 12a of these Rules, the part concerning the twenty digits that make up the Standardized Banking Key (CLABED) referred to in subsection d), of subsection I, will enter into force on April 3, 2017. Until then, Participants may use an identification of up to twenty digits to identify the account of the Beneficiary Client.

THIRTEENTH. Credit Institutions, to comply with what is provided in subsection III of Rule 46a of these Rules, may present to the Administrator the audit report provided for in Provision 60 of the “General Provisions referred to in article 115 of the Law of Credit Institutions” that includes the review of these risks in the SPID within the 60 natural days following the close of the 2016 fiscal year.

Mexico City, March 9, 2016.- The General Legal Director, Luis Urrutia Corral.- Rubric.- The General Director of Affairs of the Financial System, Jesús Alan Elizondo Flores.- Rubric.- The Director of Payment Systems, Manuel Miguel Ángel Díaz Díaz.- Rubric.

For any consultation regarding the content of this Circular, please contact the Management of Authorizations, Consultations and Legal Control, at the phones (55) 5237-2308, (55) 5237-2317 or (55) 5237-2000 Ext. 3200.