Circular 5/2019 — Novel Models

90 (First Section) OFFICIAL GAZETTE Friday, March 8, 2019 BANCO DE MEXICO CIRCULAR 5/2019 addressed to Corporations constituted in accordance with Mexican Commercial Legislation, other than Financial Technology Institutions, Financial Entities, and other supervised entities by any Supervisory Commission or by the Bank of Mexico, interested in obtaining authorization from the Bank of Mexico to carry out routing, clearing, or settlement services, or any combination of such services, through novel models, in relation to the general provisions on novel models.

At the margin, a logo stating: Bank of Mexico.- “2019, Year of the Southern Leader, Emiliano Zapata”.

CIRCULAR 5/2019 TO CORPORATIONS CONSTITUTED IN ACCORDANCE WITH MEXICAN COMMERCIAL LEGISLATION, OTHER THAN FINANCIAL TECHNOLOGY INSTITUTIONS, FINANCIAL ENTITIES, AND OTHER SUPERVISED ENTITIES BY ANY SUPERVISORY COMMISSION OR BY THE BANK OF MEXICO, INTERESTED IN OBTAINING AUTHORIZATION FROM THE BANK OF MEXICO TO CARRY OUT ROUTING, CLEARING, OR SETTLEMENT SERVICES, OR ANY COMBINATION OF SUCH SERVICES: SUBJECT: GENERAL PROVISIONS ON NOVEL MODELS.

The Bank of Mexico, considering that both financial technology institutions, financial entities, and supervised entities by financial authorities, as well as companies other than these, could design new business models and develop innovative implementations that have the potential to generate more efficient processes in clearing, routing, and settlement services, and that these in turn could represent lower costs for end users, provided they have adequate risk control measures.

For this purpose, the Law to Regulate Financial Technology Institutions established a regulatory framework that allows these entities to request temporary authorization to test in a controlled risk environment, under the novel model scheme, new models and innovative implementations that could have a positive impact on end users.

Regarding this, the Bank of Mexico identified the need to establish rules for those applicants intending to carry out activities related to a clearinghouse, in order for such applicants to disclose all necessary information to their participants and to the clients of their participants. Furthermore, it is necessary to establish guidelines in such rules so that applicants implement risk mitigation mechanisms derived from failures in the operation with a novel model that could affect totally or partially (including possibly the operation unrelated to the model being tested), in terms of cybersecurity and operational continuity.

Therefore, based on Articles 28, sixth and seventh paragraphs, of the Political Constitution of the United Mexican States, 24 and 26, of the Bank of Mexico Law, 82 and 87, of the Law to Regulate Financial Technology Institutions, 4, first paragraph, 8, fourth and seventh paragraphs, 10, first paragraph, 12, first paragraph in relation to 20, fraction XI, and 14 Bis, first paragraph in relation to 17, fraction I, of the Internal Regulations of the Bank of Mexico, which grant the authority to issue provisions through the General Directorate of Operations and Payment Systems and the General Legal Directorate, respectively,

Friday, March 8, 2019 OFFICIAL GAZETTE (First Section) 91 as well as Second, fractions VI and X, of the Agreement on the Assignment of Administrative Units of the Bank of Mexico, has resolved to issue the following provisions:

GENERAL PROVISIONS ON NOVEL MODELS

CHAPTER I GENERAL PROVISIONS

1. Object.- These Provisions aim to establish the criteria and conditions that corporations constituted in accordance with Mexican Commercial Legislation, other than Financial Technology Institutions, Financial Entities, and other supervised entities by any Supervisory Commission or by the Bank of Mexico, must meet to obtain authorization from the Bank of Mexico to carry out Routing, Clearing, or Settlement services, or any combination of such services, through Novel Models.

2. Definitions.- For the purposes of these Provisions, in addition to the terms used in the Law to Regulate Financial Technology Institutions under the definitions included in said legislation, the following shall be understood:

Clearinghouse: the person acting as the central entity or operator of a centralized processing mechanism, through which the corresponding actions are carried out to exchange between acquirers and issuers, authorization requests, authorizations, rejections, returns, adjustments, or other financial obligations, including Clearing. For the purposes of the foregoing, the terms acquirer, issuer, authorization request, authorization, rejection, return, and adjustment, shall be understood in accordance with their definition established in Circular 4/2014 of the Bank of Mexico.

Digital Certificate: a data message in digital format generated in terms of the “Rules to Operate as a Registrar Agency and/or Certification Agency in the Extended Security Infrastructure”, contained in Circular-Telefax 6/2005 of the Bank of Mexico, or those that, in their case, replace them.

Clearing: the process to determine at the close of a set period the debtor or creditor balance corresponding to each of the participants of the Clearinghouse or to other Clearinghouses to which it transmits and from which it receives authorizations of operations, returns, adjustments, and other financial obligations, and that said balances result from the exchange of obligations between those participants and the Clearinghouses and that have the effect that they assume the character of reciprocal creditors and debtors.

Banking Business Day: the days on which credit institutions are not obliged to close their doors or suspend operations, in terms of the general provisions issued for such effect by the CNBV.

Law: the Law to Regulate Financial Technology Institutions.

Settlement: the act by virtue of which participants consider the corresponding obligation resulting from Clearing to be fulfilled.

Routing: the transmission of operation authorization requests, operation authorizations, operation rejections, returns, or operation adjustments that Clearinghouses of participants carry out, through which the exchange between them is realized.

Applicant: the corporation constituted in accordance with Mexican Commercial Legislation, other than Financial Technology Institutions, Financial Entities, and other supervised entities by any Supervisory Commission or by the Bank of Mexico, as well as the corporation constituted as a Financial Technology Institution, Financial Entity, or other supervised entity by any Supervisory Commission or by the Bank of Mexico or a consortium of any of the foregoing, interested in obtaining authorization from the Bank of Mexico to carry out Routing, Clearing, or Settlement services, or any combination of such services, through Novel Models.

CHAPTER II AUTHORIZATIONS

3. Authorization Request.- Applicants intending to operate any Novel Model related to Routing, Clearing, and Settlement services, or any combination of such services, must present their authorization request to the Central Banking Authorizations and Consultations Management of the Bank of Mexico in terms of Provision 7. of these Provisions. Such request must be accompanied by the following information:

I. Instrument duly notarized before an authorized public notary by which sufficient powers are granted to the representatives of the Applicant, who present the corresponding request to the Bank of Mexico.

II. Bylaws of the Applicant, which must expressly include, at least, the following:

a) Address of its central administration, which must be located within national territory.

b) Express agreement that any modification to the bylaws of the company must have the prior authorization of the Bank of Mexico for its validity.

c) In its case, the habitual or professional performance of Routing, Clearing, and Settlement services, or any combination of such services.

III. List of persons occupying executive positions or, in their case, those proposed to occupy executive positions of the Applicant company or institution.

IV. List and information of persons who directly or indirectly intend to maintain any participation in the capital of the Applicant, equal to or greater than 10% of the capital.

V. Compliance matrix reflecting the requirements established by applicable regulation and the evidence supporting compliance with these based on the information and documentation accompanying the request in question.

VI. List of all applicable provisions that hinder the development of the products or services that would be offered through the Novel Model, as well as an explanation of the reasons why they are considered to represent an obstacle.

VII. Mechanism by which the Applicant intends to inform and obtain consent from its Clients regarding that they will carry out operations with societies authorized to operate with Novel Models, as well as the risks to which they are subject by virtue thereof.

VIII. Description of the Novel Model, which must specify, in addition to what is established in the Law, the following:

a) Target audience, as well as a detailed description of the potential benefits for the Clients of the Applicant and their clients, with respect to what exists in the market.

b) Timeframe with which they intend to operate with the Novel Model.

c) Detailed description of the processes of the service or services that the Applicant intends to provide, which must include at least the personnel involved in said processes and a description of the processes that require internal control.

d) Obligations that the Applicant will have with its Clients, as well as a description of the measures so that in no moment do said Clients or their clients incur in any type of loss derived from the operation with the Novel Model.

e) Limits with which it intends to operate, which must be consistent with the amounts and number of transactions with respect to the Novel Model they intend to implement, regardless of whether the activity in which they intend to implement the Novel Model is Routing, Settlement, or Clearing, or any combination of such services.

f) Limit of Clients with which it intends to operate.

g) Characteristics, existing or planned, of its Technological and telecommunications Infrastructure.

h) Financial viability study of the Applicant.

i) Method by which they will link their processing systems with those of their Clients and with other Clearinghouses with which they interact or intend to interact or with other infrastructures that allow interoperability.

j) Technical and security characteristics of said links.

k) Information security scheme containing the fundamental criteria for the protection of Client resources and information. In particular, standards covering:

1. Confidentiality: the information that is transmitted and stored must have controls that guarantee the confidentiality and privacy of Client information and their operations. Procedures should be in place that at least consider the following:

A. Authentication mechanisms.

B. Access, password, and others, such as fingerprints, facial recognition elements, among others.

C. Privilege management in applications.

D. Information encryption mechanisms.

E. Encryption of sensitive data, use of encrypted connections.

2. Integrity and non-repudiation: the information that is transmitted and stored must contain mechanisms that allow validating that the processed information comes from a reliable source and has not been modified in the transfer process. Mechanisms should be in place that at least consider the following:

A. Implementation of signatures in message transmission.

B. Authorization mechanisms.

l) Authorization plan as a Clearinghouse during the testing period.

m) Actions that, in their case, the Applicant will carry out for the orderly closure of Routing, Clearing, or Settlement services, or any combination of such services, in the event that it suspends such operations, as well as a detailed calendar indicating execution deadlines.

IX. Comprehensive risk framework that identifies at least the risks associated with the operation with Novel Models, taking into account at minimum financial, operational, information security, illicit proceeds operations, and reputational risks, which must include at least the following information:

a) Identification of risk sources:

1. Define the risk sources to which the Applicant is exposed.

2. Have policies that mandate following regarding the risk tolerance that the Applicant is willing to assume by establishing levels and limits of risk.

b) Risk disclosure. Establish in the contract with the participants involved in the project that they must notify their Clients about the implication of the participant in a project related to Novel Models.

c) Measurement of risk exposure:

1. Have methodologies that mandate following to measure exposure to identified risk sources, determining for this purpose the risk factors associated with said risk sources.

2. Establish rules and procedures that mandate following for obtaining information in a timely manner for the methodologies indicated in the previous numeral.

d) Allocation of own resources for risk management:

1. Provide the necessary financial, human, and material resources for efficient and effective risk management, as well as establish limits to such resources in order not to compromise its operation.

2. Establish functions and lines so that personnel assigned to risk management report to the personnel responsible for decision-making by the Applicant.

e) Allocation of own resources to compensate possible losses to participants and their clients.

1. Designate sufficient financial resources to fully cover possible losses of participants and their clients who participate in the project in case of failure.

2. Establish a liability scheme to fully cover possible losses.

f) Risk control and containment policies and procedures:

1. Establish operational and communication procedures with the Bank of Mexico that mandate following upon the materialization of any risk event.

2. Define the rules and procedures for the use of resources for risk control and containment.

g) Recovery and orderly liquidation plan:

1. Establish policies, procedures, and times that mandate following to recover affected activity and services in cases of contingency, as well as the resources that would have been used for risk containment.

2. Establish procedures for orderly liquidation in case it cannot continue with its operations and there is some commitment with its Clients.

h) Exit procedure strategy:

1. Establish procedures for orderly liquidation when there is some obligation with its Clients in case of deciding not to continue with the temporary authorization, in case that at the end of the testing period the Novel Model is still not recognized in regulation, or if the Bank of Mexico determines that it will not modify the regulation for the operation of the Novel Model in question.

2. Establish the work plan for authorization in case that, according to current regulation, it is possible to continue with the project. Otherwise, the Applicant must establish the procedure it will carry out in case the Bank of Mexico initiates a regulatory modification process so that the Novel Model can be authorized.

i) Policies and procedures for review and adjustment of risk management that mandate following to:

1. Evaluate how changes related to the conditions of the provision of its services can affect the established levels and limits of risk and measurement and mitigation procedures.

2. Evaluate, at least every calendar year, the quantity and characteristics of the resources indicated in the allocation of own resources for risk management.

3. Document and justify the need for changes in the risk management manual based on the results of the evaluations referred to in this numeral.

j) Disclosure of risk management:

1. Inform the results of tests performed to the personnel responsible for decision-making by the Applicant and personnel responsible for decision-making by the Applicant at the end of the validity of the temporary authorization.

2. Inform the personnel responsible for decision-making by the Applicant of the adjustments resulting from the review and adjustment procedures of risk management when applicable according to the policies defined in fraction IX, subsection i), numeral 3, of this provision.

3. Inform, at the beginning of the validity period of the authorization, the Bank of Mexico, about the impact or vulnerability that each risk contained in the risk management manual could generate, consequently, on other market participants. Without prejudice to the foregoing, the Bank of Mexico may require that the report referred to in this numeral be presented at any time during the validity period of the authorization.

4. Admissibility of Authorization.- The Bank of Mexico, regarding the authorization request received for carrying out operations with Novel Models in terms of these Provisions, will evaluate whether such request meets the requirements provided in Provision 3. above. Likewise, the Bank of Mexico may require the Applicant any information it deems necessary in order to analyze the referred request and, if applicable, determine if the Novel Model subject of said request that is intended to be operated complies with what is established in these Provisions.

The Bank of Mexico may require modifications to the documentation presented by the Applicant, for which it will grant a period of up to 60 Banking Business Days for the Applicant to make said modifications. Without prejudice to the foregoing, the Bank of Mexico may grant an extension for up to an equivalent period of 60 Banking Business Days additional, prior to the request of the Applicant. If, after the modification period or its extension, the Applicant has not made the referred modifications, the submitted request will be rejected.

5. Response Time.- Once the Bank of Mexico has determined that the request meets the requirements provided in the Provisions, it will have a period of 20 Banking Business Days to respond to the request.

If the period mentioned in the previous paragraph of this Provision elapses without the Bank of Mexico having responded to the authorization request, the corresponding resolutions will be understood to be negative for the Applicant.

6. Extension of Authorization.- The Applicant who has obtained authorization from the Bank of Mexico to operate any Novel Model related to Routing, Clearing, or Settlement services, or any combination of such services, may request the extension of the temporary authorization granted by said Bank of Mexico for up to the times established in the Law as appropriate, for which it must present its extension request to the Central Banking Authorizations and Consultations Management of the Bank of Mexico.

Friday, March 8, 2019 OFFICIAL GAZETTE (First Section) 95 of Mexico in terms of the 7th of these Provisions, with an advance of 20 Banking Business Days prior to the date on which the temporary request ceases to have effect. The aforementioned extension request must set forth the reasons why the Applicant requires such extension to be granted and be accompanied, if applicable, by the documentation that was presented along with the initial authorization request and that has undergone modifications. The Bank of Mexico will have a period of 20 Banking Business Days to respond to the request. Once the aforementioned period has elapsed, without the Bank of Mexico having given a response to the authorization request, the corresponding resolutions will be understood to be negative for the Applicant. 7th Sending of authorization requests to the Bank of Mexico.- The authorization requests referred to in the 3rd of these Provisions must be sent by the Applicants via email to the Central Banking Authorizations and Consultations Department of the Bank of Mexico at the address autorizaciones@banxico.org.mx. The persons who sign the requests must: I. Have a valid Digital Certificate issued in their name, and II. Sign the requests digitally using the tool that the Bank of Mexico determines for these purposes and that it will make known, as well as the Digital Certificate referred to in fraction I of this Provision. In cases where the Applicants do not have access to the necessary elements to send digitally signed requests, they may deliver them to the Central Banking Authorizations and Consultations Department, at 5 de Mayo Avenue number 2, Centro Neighborhood, Postal Code 06000, Mexico City, in original and duplicate, and signed by persons who have the authority to perform acts of administration or ownership, for which they must accompany their request letter with a certified and simple copy of the deeds in which the aforementioned authorities are recorded, adding a communication specifying the reason why they are compelled to send requests by this alternative means. 8th Obligations of the Applicants with the Bank of Mexico.- The Applicants who obtain authorization from the Bank of Mexico to carry out operations with Novel Models will be obligated to supply the Bank of Mexico with the information that it requests, in the terms and timeframes that it indicates. Likewise, the Applicant who has obtained the corresponding authorization must prepare and deliver to the Bank of Mexico the report referred to in the first paragraph of article 89 of the Law, at least every six months during the validity period of the authorization. The Bank of Mexico may conduct inspection visits to the facilities of the Applicant who has obtained the corresponding authorization, as well as require the said Applicant to undergo evaluations by an independent third party, to supervise compliance with what is established in their Novel Model description and integral risk framework. For this purpose, the Applicant in question must allow the Bank of Mexico, or the independent third party designated by it, to conduct inspections of their facilities, in the terms and timeframes that the Bank of Mexico indicates to them. 9th Non-compliance.- In the event that the Bank of Mexico detects non-compliance by the Applicants with respect to what is provided in these Provisions and in the authorizations granted to them for this purpose, it may revoke the authorization in question, as well as impose the corresponding sanctions in accordance with the Bank of Mexico Law, the Law, and other applicable provisions. The foregoing, without prejudice to the powers that the laws grant to other authorities. TRANSITIONAL PROVISIONS FIRST.- This Circular will enter into force the day following its publication in the Official Gazette of the Federation. SECOND.- Regardless of what is established in these Provisions, without prejudice to the mechanisms that are established for the exchange and discussion of opinions, ideas, and projects between the Bank of Mexico, the other Financial Authorities, and the sector corresponding to the subject matter of these Provisions, any person may present to the Bank of Mexico, during the period of sixty Banking Business Days following the publication of these Provisions in the Official Gazette of the Federation, their comments or suggestions regarding what is established in this Circular. The comments and suggestions presented by the persons indicated in this provision to the Bank of Mexico will be public. For these purposes, such persons must present their comments and suggestions through the public consultation portal established by the Bank of Mexico on its website, located at the following address: https://www.banxico.org.mx/ConsultaRegulacionWeb/ The Bank of Mexico will consider the comments and suggestions presented in accordance with the above, and within the sixty Banking Business Days following the conclusion of the period indicated in the first paragraph of this Provision, it will publish on its website a report on the recommendations and suggestions received, without prejudice to the powers that it may exercise as a result of the foregoing.

96 (First Section) OFFICIAL GAZETTE Friday, March 8, 2019 Mexico City, March 6, 2019.- The General Director of Operations and Payment Systems, Jaime José Cortina Morfín.- Rubric.- The General Legal Director, Luis Urrutia Corral.- Rubric. For any inquiries regarding the content of this Circular, please contact the Central Banking Authorizations and Consultations Department at telephone numbers (55) 5237-2308, (55) 5237-2317, or (55) 5237-2000, extension 3200.