Circular 4/2019 — Operations with Virtual Assets by Credit Institutions and Financial Technology Institutions

90 (First Section) OFFICIAL GAZETTE Friday, March 8, 2019 BANCO DE MEXICO CIRCULAR 4/2019 addressed to Credit Institutions and Financial Technology Institutions regarding the general provisions applicable to Credit Institutions and Financial Technology Institutions in the Operations they carry out with virtual assets.

A logo appears at the margin, stating: Bank of Mexico.- "2019, Year of the Southern Leader, Emiliano Zapata".

CIRCULAR 4/2019 TO CREDIT INSTITUTIONS AND FINANCIAL TECHNOLOGY INSTITUTIONS:

SUBJECT: GENERAL PROVISIONS APPLICABLE TO CREDIT INSTITUTIONS AND FINANCIAL TECHNOLOGY INSTITUTIONS IN THE OPERATIONS THEY CARRY OUT WITH VIRTUAL ASSETS.

The Bank of Mexico, considering that interest in virtual assets has increased in the international environment among the media and certain sectors of the public. These assets have been characterized by being volatile, costly to conduct transactions, and difficult to scale. On the other hand, there are risks for holders of these assets, given that, due to the complexity of the technology supporting them, they may not fully understand the possible problems that could arise and lead to the loss of their resources.

In particular, in cases where virtual assets are used in services offered to the general public, there may be an information asymmetry problem generated by two causes. The first arises as a result of the complexity of the mathematical and cryptographic processes supporting virtual assets and the difficulty for users to understand said processes. The second cause stems from the complexity of the factors determining the price of virtual assets, the lack of knowledge of the elements determining the supply and demand for said assets, as well as the lack of any reference with which to estimate their price. In addition to the above, if a financial institution were to offer services to the general public involving virtual assets, due to the reputation of said institutions, a perception could be generated that the risks associated with the assets are lower than they actually represent.

Likewise, virtual assets carry significant risk in terms of preventing operations with funds of illicit origin (money laundering) and financing of terrorism, due to the ease of transferring virtual assets to different countries, as well as the absence of homogeneous controls and prevention measures at the global level.

In this context, it is considered convenient to maintain a healthy distance between virtual assets and the financial system. However, despite the above, the Central Bank seeks to promote and take advantage of the use of technologies that could have a benefit from the perspective of efficiency or functionality, provided that these technologies are used in the context of the internal operations of financial technology institutions and credit institutions and this, in turn, does not imply a significant increase in their operational or financial risks. That is, the use of technology such as distributed ledgers, blockchain, or even the virtual assets themselves in their internal processes could become feasible, provided that the risks of virtual assets do not impact the end consumer.

Therefore, based on Articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 24 and 26, of the Bank of Mexico Law, 16, 30, 32 and 88, of the Law to Regulate Financial Technology Institutions, 4, first paragraph, 8, paragraphs fourth and seventh, 10, first paragraph, 12, first paragraph in relation to 20, fraction XI, and 14 Bis, first paragraph in relation to 17, fraction I, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Directorate of Operations and Payment Systems and the General Legal Directorate, respectively, as well as Second, fractions VI and X, of the Agreement on the Affiliation of the Administrative Units of the Bank of Mexico, has resolved to issue the following provisions:

GENERAL PROVISIONS APPLICABLE TO CREDIT INSTITUTIONS AND FINANCIAL TECHNOLOGY INSTITUTIONS IN THE OPERATIONS THEY CARRY OUT WITH VIRTUAL ASSETS

CHAPTER I PRELIMINARY PROVISIONS

1.a Object.- These Provisions have the following objectives:

Friday, March 8, 2019 OFFICIAL GAZETTE (First Section) 91

a) Determine the virtual assets, as well as define their characteristics, with which Institutions may operate in accordance with what is provided in the Law; b) Establish the terms, conditions, and restrictions of the Operations that Institutions may carry out with virtual assets; c) Establish deadlines, terms, and conditions that Institutions must observe for cases in which the virtual assets with which they operate are transformed into other types of virtual assets or modify their characteristics; d) Determine the information related to Operations with Virtual Assets that Institutions must present to the Bank of Mexico to obtain authorization to operate with virtual assets, and e) Establish the characteristics of the authorizations to carry out Operations with Virtual Assets.

2.a Definitions.- For the purposes of these Provisions, in addition to the terms used in the Law to Regulate Financial Technology Institutions under the definitions included in said legislation, the following shall be understood:

Digital Certificate: a message of data in digital format generated in terms of the "Rules to Operate as a Registrar Agency and/or Certification Agency in the Extended Security Infrastructure", contained in Circular-Telefax 6/2005 of the Bank of Mexico, or those that, in their case, replace them.

Banking Business Day: the days on which credit institutions are not obliged to close their doors or suspend operations, in terms of the general provisions issued for such effect by the CNBV.

Technological Infrastructure: the data processing networks and operating systems that support the operation of virtual assets.

Institution: credit institutions and financial technology institutions authorized in accordance with what is provided in the Credit Institutions Law and the Law, respectively.

Law: the Law to Regulate Financial Technology Institutions.

Internal Operations: the activities that Institutions carry out internally to carry out the passive, active, and service operations that they celebrate with their Clients or that they carry out on their own account, including the activities that Institutions carry out to support international fund transfers that they carry out.

Operation with Virtual Assets: the Internal Operations that Institutions intend to carry out directly or indirectly with virtual assets in terms of these Provisions.

Administrative Body: the sole administrator or the board of directors of an Institution.

Protocol: the rules by which the Technological Infrastructure of a virtual asset is governed.

Independent Third Party: the competent professional to carry out evaluation work on the compliance with the requirements that Institutions must comply with in accordance with these Provisions, who is external to the Institution and who meets, insofar as applicable, with the characteristics provided in 18.a of these Provisions.

CHAPTER II OPERATIONS

3.a Characteristics of operations.- Institutions may only celebrate Operations with Virtual Assets that correspond to Internal Operations, subject to prior authorization granted by the Bank of Mexico, in terms of Chapter II of these Provisions, and are prohibited from celebrating operations with said assets in terms other than those established in the respective authorization.

92 (First Section) OFFICIAL GAZETTE Friday, March 8, 2019

Institutions, in carrying out Operations with Virtual Assets, must at all times prevent the risk of said Operations with Virtual Assets from being transmitted, directly or indirectly, to the Clients of said Institution.

Operations that Institutions request to celebrate with virtual assets through which they intend to directly provide their Clients with services of exchange, transmission, or custody of virtual assets will not be eligible for obtaining the authorization referred to in Chapter II of these Provisions.

4.a Characteristics of virtual assets.- The virtual assets with which Institutions may carry out operations in accordance with these Provisions must meet the following characteristics:

I. Be units of information, uniquely identifiable, even in fractional form, registered electronically, that do not represent the ownership or rights of an underlying asset or, if they do, represent such ownership or rights for a value lower than these; II. Have defined issuance controls determined by Protocols to which third parties can subscribe, and III. Have Protocols that prevent copies of the units of information or their fractions from being available to be transmitted more than once at the same time.

Without prejudice to the above in this Provision, Institutions may carry out Internal Operations using technologies corresponding to other virtual assets with characteristics different from those established in this same Provision, for which they must be subject to the provisions applicable to them in matters of use of technologies and automated data processing systems.

5.a Authorizations to carry out operations.- The authorization to carry out Operations with Virtual Assets will take effect only with respect to the requesting Institution to which said authorization is granted and will have effect for up to the period that the Bank of Mexico determines in the authorization itself. Such authorizations may be renewed in terms of these Provisions.

6.a Application for Authorization to carry out operations.- The Institution that intends to carry out Operations with Virtual Assets must present its application for authorization to the Bank of Mexico in terms of 19.a of these Provisions. Said application must be accompanied by the following information:

I. The description of the Model of Operation with Virtual Assets that the Institution intends to use to carry out said operation, in which the requesting Institution must establish the measures it intends to establish to prevent the risk, directly or indirectly, of said Operations with Virtual Assets from being transmitted to the Clients of the respective Institution, as well as the manner in which the Institution will supervise the compliance with said measures; II. A comparative table that allows identifying the requirements of the applicable regulation and the measures that the Institution will establish to comply with said regulation, as well as the reference to the document containing the evidence supporting its compliance. For this purpose, the Institution must demonstrate the viability of said measures and support its capacity to implement them, as well as indicate the time in which it expects to be able to carry out its implementation; III. The benefits that carrying out the Operations with Virtual Assets for which authorization is requested represents; IV. The operational manuals that the respective Institution has prepared in relation to the Operation with Virtual Assets for which said Institution requests authorization from the Bank of Mexico. The manual must include:

a. A description of the virtual asset with which it intends to carry out the Internal Operation and the reasons why it considers that said asset meets the characteristics referred to in 4.a of these Provisions. b. The characteristics of the Protocols of the virtual asset for which authorization is requested, including, among others, a description of the operating rules of its Technological Infrastructure, of the subjects involved in said infrastructure, and the Protocols that limit concentration in the decision-making process, when access to said information is available, as well as a description of the characteristics that allow the tracking of transactions and free access to transactional records.

Friday, March 8, 2019 OFFICIAL GAZETTE (First Section) 93

c. The characteristics of the market of the virtual asset intended to be used to carry out Operations with Virtual Assets, including the liquidity, depth, and transparency of said market. d. A description of the processes in which the Institution plans to use in its Internal Operation the virtual asset indicated in the corresponding application for authorization, which includes at least the personnel involved in said processes, their functions, and responsibilities. Likewise, the Institution must justify the reasons why it considers that this Operation with Virtual Assets does not constitute the offering of services or operations directly to the Clients of said Institution. e. The measures that the Institution intends to adopt to prevent at all times its Clients from incurring any risk derived from the Institution's Operation with Virtual Assets. f. Procedures to determine the circumstances that imply new risks derived from changes in the Protocols that require a modification to the operational manual, and V. A comprehensive risk framework that is mandatory to follow that identifies at least the risks associated with the Institution's Operation with Virtual Assets taking into account at least the risks of business, exchange, financial, operational, cybersecurity, operations with funds of illicit origin, and reputational risks, which includes at least the following information:

a. Identification of risk sources:

i) Define the risk sources to which the Institution is exposed. ii) Have policies to be followed regarding the risk tolerance that the Institution is willing to assume by establishing levels and limits of risk. b. Measurement of risk exposure:

i) Have methodologies to measure its exposure to the identified risk sources, determining for this purpose the risk factors associated with said risk sources. ii) Establish rules and procedures for obtaining information in a timely manner for the methodologies indicated in the previous subsection. c. Allocation of own resources for risk management:

i) Designate the financial, human, and material resources necessary for efficient and effective risk management and establish limits to such resources in order not to compromise its Internal Operation. ii) Establish functions and lines of accountability of the personnel assigned for risk management, as well as accountability to the Administrative Body for decision-making. d. Risk control and containment policies and procedures:

i) Establish operational and communication procedures with the Bank of Mexico upon the update of any risk event. ii) Define the rules and procedures for the use of resources for risk control and containment. iii) Establish the measures that will be adopted in relation to each of the risks to prevent the Institution's Clients from incurring any type of risk derived from the Operation with Virtual Assets. e. Recovery plan:

i) Establish policies, procedures, and times to recover the activity and services affected in cases of contingency, as well as the resources that have been used for risk containment. ii) Establish procedures for the orderly liquidation of commitments with Clients denominated in legal tender, in the event that it is no longer possible to continue with the authorized operations in accordance with these Provisions. f. Policies and procedures for review and adjustment of risk management:

94 (First Section) OFFICIAL GAZETTE Friday, March 8, 2019

i) Evaluate the manner in which changes related to the conditions of the provision of its services can affect the established levels and limits of risk and procedures for measuring and mitigating risks. ii) Evaluate, at least each calendar year, the quantity and characteristics of the resources indicated in the allocation of own resources for risk management. iii) Document and justify the need for changes in the risk management manual based on the results of the evaluations referred to in the previous subsection. g. Disclosure of risk management:

i) Inform the results of the tests performed to the Administrative Body and personnel responsible for decision-making of the Institution. ii) Inform the adjustments resulting from the review and adjustment procedures of risk management to the personnel responsible for decision-making of the Institution when applicable according to the policies they have defined in accordance with fraction V, letter f, subsection iii, of this provision. iii) Inform the Bank of Mexico about the impact or vulnerability that each risk contained in the risk management manual could generate, consequently, to other market participants as a result of the Operations with Virtual Assets that the Institution might carry out in the application for authorization, at least once a year after the authorization, as well as at any time that the Bank of Mexico considers necessary.

Institutions must carry out a review each calendar year of the comprehensive risk framework referred to in this fraction V with the aim of keeping it updated. In the event that such update is required, they must make the necessary modifications and, in the event that new risks are generated, they must report to the Bank of Mexico what the new risks generated are and their potential impact.

7.a Proceeding of the authorization.- The Bank of Mexico, regarding the application for authorization it receives for the carrying out of Operations with Virtual Assets in terms of these Provisions, will evaluate whether said application meets the requirements provided in the previous Provision 6.a. Likewise, the Bank of Mexico may require the Institution any information it deems necessary in order to analyze said application and, if applicable, determine if the virtual asset subject of said application and the Internal Operation intended to be carried out with said asset comply with what is established in these Provisions.

8.a Modifications to the Operational Manual.- In those cases where Institutions intend to make changes to the operational manual, in any of the elements mentioned in fraction IV of 6.a of these Provisions, said Institution must present the modification project to the Bank of Mexico for prior authorization along with the update of its comprehensive risk framework, or in its case, a detailed explanation of why a change in said framework is not necessary.

The Bank of Mexico will resolve regarding the modification project in question within 30 Banking Business Days following the day on which the respective Institution presents its project. Until the Bank of Mexico issues the corresponding response, the respective Institution must continue with its Internal Operation in accordance with the terms of the current operational manual.

In those cases where the requesting Institution manifests and proves to the satisfaction of the Bank of Mexico in its application writing that the project for reform of the operational manual is indispensable for the Institution to continue with its Internal Operations, the deadline for the Bank of Mexico to issue the corresponding response will be 60 Banking Business Days, and during said period the Institution may carry out its Internal Operations, in terms of the project for modifications to the operational manual.

After the deadlines applicable to the preceding paragraphs of this Provision have elapsed, without the Bank of Mexico having given a response to the application for authorization, the corresponding resolutions will be understood to be negative to the promoting Institution.

The Bank of Mexico may request changes or additional documents to the proposal of the operational manual within the deadlines provided in this Provision, insofar as applicable, and in the event that the Bank of Mexico does not expressly authorize the changes in the manual, institutions will not be able to continue carrying out the respective Operations with Virtual Assets.

9.a Revocation.- The Bank of Mexico may declare the revocation of the authorization it has granted when the Institution:

I. Does not update the operational manual and the comprehensive risk framework referred to in fractions IV and V of 6.a of these Provisions in the terms described therein.

Friday, March 8, 2019 OFFICIAL GAZETTE (First Section) 95

II. Not report to the Bank of Mexico when additional risks are generated for the Institution or for market participants as a result of the Virtual Asset Operations that the Institution may carry out.

III. Not implement measures to prevent its Clients from incurring any direct or indirect risk derived from the Virtual Asset Operation.

IV. Not observe the risk control and containment policies and procedures defined within the comprehensive risk framework that it had presented.

V. Not disclose risk management information in terms of said comprehensive risk framework.

VI. Carry out Virtual Asset Operations under terms different from those provided in the respective authorization.

The foregoing established in this Provision shall be without prejudice to the imposition of sanctions as applicable under the applicable provisions.

CHAPTER III THIRD-PARTY CONTRACTING

10th. Services that can be contracted with third parties.- Institutions may contract with third parties, including other national Institutions or foreign entities, the provision of services related to Virtual Asset Operations, subject to what is stated in this Chapter.

Institutions must ensure that the persons providing them with services maintain the due confidentiality of information related to the operations carried out with their Clients, as well as that of the Clients themselves, in case they have access to it, in terms of these Provisions.

11th. Request for authorization to contract third parties.- Institutions, to contract a third party for the provision of services related to Virtual Asset Operations, must obtain prior authorization from the Bank of Mexico, based on the request they submit for this purpose.

Along with the request referred to in this Provision, Institutions must provide, regarding the third party with which they intend to agree on the provision of services related to Virtual Asset Operations, the documentation and information indicated below:

I. Draft contract or legal instrument that they intend to celebrate with the third party. The referred contract or instrument must expressly state the third party's willingness, regarding the services subject to contracting, to unconditionally adhere to these Provisions, as well as to all obligations to which the Institution that hired it is subject regarding the service related to the Virtual Asset Operation, including, but not limited to, the following:

a) Allow the Bank of Mexico to carry out visits to verify compliance with the applicable requirements referred to in these Provisions.

b) Provide the information that the Bank of Mexico requests within the deadlines indicated by it.

c) Allow the Institution that hired it and an independent external auditor of the Institution to have access to its facilities, documents, equipment, and general information, and to carry out audits regarding the contracted services in relation to what is established in these Provisions.

d) Deliver to the independent external auditor of the Institution the books, system codes, records, manuals, and general documents, related to the provision of the service related to the Virtual Asset Operation.

e) Maintain confidentiality regarding information related to the technical aspects of the functioning of the service related to the Virtual Asset Operation, as well as information about the operations that, according to applicable legislation, is defined as personal data and that it collects as part of the activities it carries out under the contract or legal instrument it celebrates with the Institution.

f) Have, if applicable, security guidelines and business continuity plans that comply with what is established in the applicable Provisions.

g) Establish the prohibition for the third party to subcontract the provision of the services related to the Virtual Asset Operation that it provides to the Institution, and

96 (First Section) OFFICIAL GAZETTE Friday, March 8, 2019

h) Stipulate in the contract its rescission in case the third party does not provide the services subject to the contract under the terms and conditions stipulated or if it causes the Institution to fail to comply with the obligations that result applicable to it according to the Law, these Provisions, and other corresponding regulations.

II. Approval of the board of directors or equivalent body that has under its responsibility the administration functions of the third party, in which it must be stated that:

a) The contracting does not put at risk the compliance with the applicable provisions to the Institution regarding its Virtual Asset Operation, and

b) The third party's business practices are consistent with the Institution's operation;

III. Documents that evidence the third party's experience, technical capacity, and sufficiency of human resources regarding the services subject to contracting;

IV. The procedure that the third party offers to the Institution to identify, measure, monitor, limit, control, report, and disclose the risks that may arise from the provision of its services;

V. The mechanisms for the resolution of disputes agreed upon between the Institution and the third party, relative to the contract or legal instrument they have celebrated;

VI. The procedure to evaluate the third party's performance in the provision of services, the compliance with its contractual obligations, and the frequency of the evaluation;

VII. The document that describes the actions that will be carried out for the orderly termination of the same, in the event that the provision of the service through the third party is suspended and it is not possible to immediately substitute the third party in said provision, and

VIII. That documentation, information, and certifications that the Bank of Mexico additionally requests.

12th. Third parties residing abroad.- In the event that the Institution celebrates a contract or legal instrument with third parties, who provide the service wholly or partially outside the national territory related to the Internal Operation services with virtual assets, in addition to the requirements established in the previous Provision, the Institution must:

I. Accredit that the third parties reside in countries that, on the one hand, their internal law provides protection for the data of persons, safeguarding their confidentiality, or that they maintain international agreements subscribed with the Mexican State in matters of personal data protection and, on the other hand, allow the exchange of information between competent authorities abroad;

II. Additionally provide in the instrument in which the approval of the board of directors or equivalent body that has under its responsibility the administration functions referred to in fraction II of the previous Provision is stated, that there will be no impact on the operational continuity of the Institution, due to the geographical distance and, if applicable, the language that will be used in the provision of the service, and

III. Have technical support schemes that allow solving problems and incidents independently of the differences that, if any, exist in time zones and business days.

Additionally, in the event that any authority from the third party's country of origin requires information related to the services it provides to the Institution, the latter must inform the Bank of Mexico regarding such situation immediately after it becomes aware of it and must provide it with a copy of the information that the third party has delivered to the authority of its country of origin.

13th. Documentation that evidences compliance with the Provisions regarding third-party contracting.- The documentation referred to in the Provisions of this Chapter must be at the disposal of the Bank of Mexico at all times, at the Institution's domicile.

The Institution must obtain prior and written authorization from the Bank of Mexico, which must be requested through the Central Banking Authorizations and Inquiries Management, to make any modification to the contract or legal instrument they have celebrated with the third party. Likewise, it must inform the Bank of Mexico, through the aforementioned Management, regarding any reform to the third party's corporate purpose or modifications to its internal organization, that may affect the provision of the service, with at least five Banking Business Days in advance before these take place.

In the event that the documentation referred to in the Provisions of this chapter is written in a language other than Spanish, when the Bank of Mexico so requires, it must be presented along with its corresponding official translation duly legalized.

Friday, March 8, 2019 OFFICIAL GAZETTE (First Section) 97

14th. Responsibility.- The Institution will be responsible at all times for the services provided by third parties related to the Internal Operation services with virtual assets, even when these are carried out under terms different from those agreed. Likewise, the Institution will be responsible for the actions of the third parties that result in non-compliance with these Provisions or any other applicable provision. The foregoing will proceed without prejudice to the civil, administrative, or penal responsibilities in which said third parties may incur for violations of the applicable legal provisions.

What is stated in this Provision must be expressly provided for in the contract or legal instrument celebrated between the Institution and the third party.

15th. Suspension of the provision of the service.- The Institution must refrain from using the third party's service related to the Internal Operation services with virtual assets when it notices changes in its operation or in the contracted services in a manner different from what was stipulated for this purpose that may affect compliance with these Provisions, or when it identifies or has knowledge of the non-compliance by the third party with the applicable regulations to the Institution itself or to said third party.

The Institution must inform in writing to the Bank of Mexico through the Management of Operation and Business Continuity of the Payment Systems, about the suspension or termination of the provision of the service by the third party, the causes that motivated it, as well as the actions it is undertaking for continuity, with at least 20 Banking Business Days prior to the date of suspension or termination of the provision of the service.

Regardless of the foregoing, in case the Bank of Mexico, in the exercise of its supervisory powers, detects any infringement by the Institution to the Law or to these Provisions as a consequence of the actions or omissions of the third party contracted in terms of this Chapter, it may revoke the authorization it has granted according to the 11th of these Provisions.

CHAPTER IV EVALUATION THROUGH INDEPENDENT THIRD PARTIES

16th. Hiring of Independent Third Parties.- Institutions must contract the services of an Independent Third Party, for the evaluation of the level of compliance with the requirements provided in these Provisions.

17th. Evaluation by the Independent Third Party.- The level of compliance evaluation carried out by the Independent Third Party referred to in the previous Provision must be carried out every two years.

The compliance evaluation report must be delivered by the Independent Third Party to the Administration Body of the Institution and presented to the audit committee of said Institution, if it has one. Likewise, the Institution must send the Bank of Mexico, through the Management of Operation and Business Continuity of the Payment Systems, the referred report, within 5 Banking Business Days following the presentation of the report to the Administration Body.

Institutions may not contract the services of an Independent Third Party, nor of the legal entities through which they provide the respective services, to obtain the compliance evaluation referred to in this Provision for more than three consecutive evaluation periods. Without prejudice to the foregoing, the Institution may designate the same Independent Third Party or referred legal entity again, after a minimum interruption of five years counted from the last compliance evaluation it had granted regarding said Institution.

18th. Qualification and period of independence of the Independent Third Party.- The Independent Third Parties that evaluate the level of compliance that Institutions give to the requirements referred to in these Provisions, as well as the legal entities through which they provide the respective services, must be independent on the date of celebration of the service provision contract, during the development of the compliance evaluation and until the issuance of the compliance evaluation report in question.

It will be considered that there is no independence when the Independent Third Party or the legal entity through which it provides its services is in any of the situations referred to in article 6, fractions I to VI, IX and X, of the "General Provisions applicable to entities and issuers supervised by the National Banking and Securities Commission that contract external audit services for basic financial statements", issued by the CNBV, as well as in the following:

I. The Independent Third Party, the firm where it works, or any partner or employee thereof, provides to the Institution, in addition to the compliance evaluation, any of the following services:

98 (First Section) OFFICIAL GAZETTE Friday, March 8, 2019

a. Consultancy on the elaboration of processes, procedures, policies, and criteria, as well as the systems that the Institution must have to comply with the requirements referred to in these Provisions.

b. Direct or indirect operation of the Institution's financial information systems, or administration of its local network.

c. Supervision, design, or implementation of the Institution's computer systems (hardware and software), which carry out activities for the operations that the Institution carries out.

d. Administration, temporary or permanent, participating in the Institution's decisions.

e. Internal audit relative to the evaluation of the level of compliance with the requirements referred to in these Provisions.

f. Recruitment and selection of Institution personnel to occupy positions of general director or of the two immediate lower levels to the latter.

g. Any other that implies or could imply conflicts of interest regarding the external audit work, and

II. The income that the Independent Third Party receives or will receive for carrying out the evaluation of the Institution, depends on the result of the compliance evaluation itself or on the success of any operation carried out by the referred Institution that has the compliance evaluation as its basis.

CHAPTER V GENERAL PROVISIONS

19th. Sending of authorization requests to the Bank of Mexico.- The authorization requests referred to in the 6th and 11th of these Provisions must be sent by Institutions via email to the Central Banking Authorizations and Inquiries Management of the Bank of Mexico at the address autorizaciones@banxico.org.mx.

The persons who sign the requests must:

I. Have a valid Digital Certificate issued in their name, and

II. Sign the requests digitally using the tool that the Bank of Mexico determines for these purposes and that it makes known, as well as the Digital Certificate referred to in fraction I of this Provision.

In cases where Institutions do not have access to the necessary elements to send digitally signed requests, they may deliver them to the Central Banking Authorizations and Inquiries Management, at Avenida 5 de Mayo number 2, Colonia Centro, Postal Code 06000, Mexico City, in original, in duplicate, and signed by persons who have faculties to exercise acts of administration or ownership, for which they must accompany their request letter with a certified and simple copy of the deeds in which the referred faculties are stated, adding a communication in which they specify the reason why they are in the need to send requests by this alternative means.

TRANSITORY

FIRST.- This Circular will enter into force the day following its publication in the Official Gazette of the Federation.

SECOND.- Regardless of what is established in these Provisions, without prejudice to the mechanisms that are established for the exchange and discussion of opinions, ideas, and projects between the Bank of Mexico, the other Financial Authorities, and the sector corresponding to the subject matter of these Provisions, any person may present to the Bank of Mexico, during the term of sixty Banking Business Days following the publication of these Provisions in the Official Gazette of the Federation, their comments or suggestions regarding what is established in this Circular, as well as, in general, regarding Virtual Asset Operations and their modalities, including the characteristics of the latter, which could be subject to the general provisions that correspond to the Bank of Mexico to issue.

The comments and suggestions that the persons indicated in this provision present to the Bank of Mexico will be public. For these purposes, said persons must present their comments and suggestions through the public consultation portal established by the Bank of Mexico on its website, located at the following address:

https://www.banxico.org.mx/ConsultaRegulacionWeb/

The Bank of Mexico will consider the comments and suggestions presented in accordance with the foregoing and, within the sixty Banking Business Days following the conclusion of the term indicated in the first paragraph of this Provision, it will publish on its website a report on the recommendations and suggestions received, without prejudice to the powers that it may exercise as a result of the foregoing.

Mexico City, March 6, 2019.- The General Director of Operations and Payment Systems, Jaime José Cortina Morfín.- Rubric.- The General Legal Director, Luis Urrutia Corral.- Rubric.

For any consultation regarding the content of this Circular, please contact the Central Banking Authorizations and Inquiries Management at the phones (55) 5237-2308, (55) 5237-2317 or (55) 5237-2000, extension 3200.