Circular 4/2024 — Modifies Circular 9/2023 on Cash Operations Regarding Cybersecurity

"2024, Year of Felipe Carrillo Puerto, Meritorious of the Proletariat, Revolutionary and Defender of the Mayab" Page 1 of 7

CIRCULAR 4/2024 Mexico City, March 4, 2024. SUBJECT: Modifications to Circular 9/2023 regarding Cash Operations on cybersecurity topics.

TO CREDIT INSTITUTIONS:

The Bank of Mexico, based on the provisions of Articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States; Articles 2nd, 3rd, fraction I, 4th, 24, paragraphs first and second, and 25, of the Bank of Mexico Law; Article 48 of the Credit Institutions Law; Articles 1st, 4th, paragraphs first and fourth, 8th, paragraphs fourth and eighth, 10, paragraph first, 16 Bis, fraction II, and 17, fraction I, of the Internal Regulations of the Bank of Mexico; and Second, fractions III and X, of the Agreement on the Assignment of Administrative Units of the Bank of Mexico, has resolved to modify the Index, sections I.1.32, I.1.33, II.II.3, II.XII.1, II.XII.5, and Annex 30, as well as to add section I.1.35 and Annexes 31 and 32 to its Circular 9/2023, regarding Cash Operations (Circular).

The aforementioned modifications aim to strengthen the cybersecurity of credit institutions that perform cash operations, as well as correspondents. In this regard, cybersecurity security requirements related to risk management and operational continuity applicable to credit institutions, correspondents, and value transport companies that interact with the User Administration System of Different Credit Institutions (AUDI) and the Currency Authentication System (SAM) are incorporated into the regulation.

It should be noted that, based on section 13, fraction III, of the "Policies for Public Consultation of General Provisions Issued by the Bank of Mexico," the modifications referred to in this communication were exempted from the public consultation process, taking into account that these are provisions whose prior disclosure prior to their issuance could affect the security of the storage, supply, exchange, delivery, or withdrawal of banknotes or metallic coins.

Page 2 of 7

ANNEXES 1 5 9 13 17 21 25 29 2 6 10 14 18 22 26 30 3 7 11 15 19 23 27 31 4 8 12 16 20 24 28 32

I.1.31 …

I.1.32 Incident: Any event caused by human, organizational, and equipment factors, which generates or could generate an impact on the User or Correspondent in the execution of processes, in the information, or other resources of their infrastructure.

I.1.33 Cybersecurity Requirements: The document referred to in Chapter XII of this Circular, which the Bank of Mexico shall prepare and make known to Users, VTCs (Value Transport Companies), and Correspondents, in which the technical and cybersecurity requirements of the computing equipment and telecommunications of Users, VTCs, and Correspondents are established, allowing them to Interconnect with the services of SIBUC, AUDI, and SAM administered by the Bank of Mexico, who shall make said document known to Users, VTCs, and Correspondents.

I.1.34 …

I.1.35 Cyberresilience: The capacity of the Bank of Mexico or Credit Institutions to prevent, adapt, respond, or recover their operation in SIBUC, AUDI, or SAM against cyberattacks or incidents that may affect the confidentiality, integrity, availability, or operational continuity of the technological infrastructure, as well as the information it uses. This is achieved through the implementation of technological tools, controls, structures, strategies, policies, processes, and practices.

II.II.2.2 …

II.II.3 Registration in the Bank of Mexico systems The Bank of Mexico shall register in the AUDI the persons authorized as referred to in section II.II.2.1, who shall have the status of SIBUC administrators. Likewise, the aforementioned authorized persons shall, in turn, register or deregister in the AUDI the persons authorized to sign the documents derived from Cash Operations, as well as to attend to matters related to said Operations, in accordance with what is indicated in Annex 7 2/2.

Credit Institutions must send the list of IP addresses or network segments authorized to have access to AUDI, SIBUC, and SAM in accordance with what is stated in section II.XII.1 of Chapter XII of the present Title.

Page 3 of 7

II.II.3.1 …

CHAPTER XII REQUIREMENTS FOR THE STRENGTHENING OF CYBERSECURITY IN THE EXCHANGE OF INFORMATION THROUGH THE SYSTEMS USED FOR CASH OPERATIONS.

II.XII.1 Characteristics of the interconnection scheme for SIBUC, AUDI, and SAM. a. The User may interconnect to SIBUC through the Internet using only the computing equipment that the User assigns for this purpose. To this effect, the User must send to the Cash Operations Monitoring Office, at the email osoc@banxico.org.mx of the Bank of Mexico, using the format provided in Annex 30, in Excel, which must contain the electronic signature of an authorized person of the User in question, from those registered in accordance with section II.II.2.1 of this Circular, a list of the network segments or public IP addresses of the equipment with which access to SIBUC is obtained, including those used by VTCs that access SIBUC. The network segments must be written in subnet masks that have a minimum length of /16, or in another length that groups the public IP addresses (from /17 to /29, preferably /24) of the equipment that access SIBUC.

b. The User may interconnect to AUDI through the Internet using only the computing equipment that the User assigns for this purpose. To this effect, the User must send to the Cash Operations Monitoring Office, at the email osoc@banxico.org.mx of the Bank of Mexico, using the format provided in Annex 31, in Excel, which must contain the electronic signature of an authorized person of the User in question, from those registered in accordance with section II.II.2.1 of this Circular, for SIBUC administrator users, or the electronic signature of the User registered with the Bank of Mexico at the Payment Systems and Market Infrastructures Operation and Continuity Directorate for SAM administrator users, a list of the network segments or public IP addresses of the equipment with which access to AUDI is obtained, including those used by VTCs that access AUDI. The network segments must be written in subnet masks that have a minimum length of /16, or in another length that groups the public IP addresses (from /17 to /29, preferably /24) of the equipment that access AUDI.

c. The User may interconnect to SAM through the Internet using only the computing equipment that the User assigns for this purpose. To this effect, the User must send to the Subdirectorate of Coin Counterfeiting Attention, at the email OEPPF@banxico.org.mx of the Bank of Mexico, using the format provided in Annex 32, in Excel, which must contain the electronic signature of the User registered with the Bank of Mexico at the Payment Systems and Market Infrastructures Operation and Continuity Directorate for SAM administrator users, a list of the public network segments of the equipment with which access to SAM is obtained, including those used by VTCs that access SAM. The network segments must be written in subnet masks that have a minimum length of /16, or

Page 4 of 7 in another length that groups the public IP addresses (from /17 to /29, preferably /24) of the equipment that access SAM.

d. Likewise, Credit Institutions must send to the Bank of Mexico, at the email osoc@banxico.org.mx, using the format provided in Annexes 30 or 31, or at the email OEPPF@banxico.org.mx using the format provided in Annex 32, within the first 10 banking business days of each month, the details of the additions or deletions to the relationship mentioned in the previous subsections. The request for the additions or deletions of the network segments or public IP addresses of the equipment with which access to SIBUC, AUDI, and SAM is obtained will be attended to no later than 10 banking business days after its receipt.

e. The interconnection infrastructure components assigned to the Bank of Mexico in accordance with what is stated in this section must, at all times, comply with the specifications indicated by the Bank of Mexico in the Cybersecurity Requirements.

f. In the event that Cybersecurity Incidents occur in any of the computing and telecommunications infrastructure components or in the applications used by Credit Institutions (Users or Correspondents) to interact with SIBUC, AUDI, or SAM, they must report them within 30 minutes following the moment they identified the Cybersecurity Incident through the email: ciberseguridad-banxico@banxico.org.mx.

g. Credit Institutions that use the services of SIBUC, AUDI, and SAM must participate in the Cyberresilience exercises that the Bank of Mexico convenes to maintain the proper functioning of SIBUC, AUDI, and SAM; this shall be carried out under the terms and conditions established by the Central Institute.

II.XII.2 to II.XII.4 …

II.XII.5 On the computers that operate with SIBUC, AUDI, and SAM. The computers must be protected with at least the Technical Security Elements to comply with what is established in the Cybersecurity Requirements.

II.XII.6 …

Page 5 of 7

ANNEX 30 Format to inform the network segments or public IP addresses of the equipment authorized to have access to SIBUC.

Institution [Name of Institution]

IP Address	Format [A.B.C.D]	Network Segment	Format [A.B.C.D / Subnet Mask]	Addition	Deletion
1.1.1.10		10.10.10.0	/24
1.1.2.5		10.10.0.0	/16
1.1.3.6		10.10.10.128	/25

Note: Mark with an "X" if it is an Addition or Deletion.

Electronic signature of a representative of the User in question, from those registered in accordance with section II.II.2.1 of this Circular for SIBUC users.

Page 6 of 7

ANNEX 31 Format to inform the network segments or public IP addresses of the equipment authorized to have access to AUDI.

Institution [Name of Institution]

IP Address	Format [A.B.C.D]	Network Segment	Format [A.B.C.D / Subnet Mask]	Addition	Deletion
1.1.1.10		10.10.10.0	/24
1.1.2.5		10.10.0.0	/16
1.1.3.6		10.10.10.128	/25

Note: Mark with an "X" if it is an Addition or Deletion.

Electronic signature of a representative of the User in question, from those registered in accordance with section II.II.2.1 of this Circular for SIBUC administrator users, or electronic signature of the user registered with the Bank of Mexico at the Payment Systems and Market Infrastructures Operation and Continuity Directorate for SAM administrator users.

Page 7 of 7

ANNEX 32 Format to inform the public network segments of the equipment authorized to have access to SAM.

Institution [Name of Institution]

Network Segment	Format [A.B.C.D / Subnet Mask*]	Addition	Deletion
10.10.0.0	/16
172.17.2.0	/24
172.19.10.128	/25

*: from /16 to /30

Note: Mark with an "X" if it is an Addition or Deletion.

Electronic signature of the user registered with the Bank of Mexico at the Payment Systems and Market Infrastructures Operation and Continuity Directorate for SAM users.

TRANSITORY SINGLE.- These modifications shall enter into force on July 1, 2024.

Without prejudice to the foregoing, credit institutions must provide the Bank of Mexico with the IP addresses or network segments authorized to have access to AUDI and SAM, in accordance with what is stated in section II.XII.1 subsections b and c of Circular 9/2023, regarding Cash Operations, no later than April 30, 2024.

Sincerely,

BANK OF MEXICO

---

ISABEL MORALES PASANTES MARÍA TERESA MUÑOZ ARÁMBURU Director of Cash Programming and Distribution Director of Central Banking Provisions