Circular 8/2019 — Modifies Circular 14/2017

Monday, May 20, 2019 OFFICIAL GAZETTE (Second Section)

SECOND SECTION BANK OF MEXICO

CIRCULAR 8/2019 addressed to the participants of the Interbank Electronic Payment System and other interested parties in acting with such status, Credit Institutions, other companies that professionally provide the fund transfer service, and the National Financial Development Company for Agriculture, Rural, Forestry and Fisheries, regarding the modifications to Circular 14/2017 (Implementation of CoDi Transfers).

At the margin a logo, which says: Bank of Mexico.- “2019, Year of the Southern Leader, Emiliano Zapata”.

CIRCULAR 8/2019 TO THE PARTICIPANTS OF THE INTERBANK ELECTRONIC PAYMENT SYSTEM AND OTHER INTERESTED PARTIES IN ACTING WITH SUCH STATUS, CREDIT INSTITUTIONS, OTHER COMPANIES THAT PROFESSIONALLY PROVIDE THE FUND TRANSFER SERVICE AND THE NATIONAL FINANCIAL DEVELOPMENT COMPANY FOR AGRICULTURE, RURAL, FORESTRY AND FISHERIES:

SUBJECT: MODIFICATIONS TO CIRCULAR 14/2017 (IMPLEMENTATION OF CODI TRANSFERS)

The Bank of Mexico, with the aim of promoting the proper functioning of payment systems, as well as promoting the sound development of the financial system, has developed the Interbank Electronic Payment System (SPEI), which it maintains under its operation as a hub system that allows, both participants and their clients, to make payments for any amount (wholesale and retail), end-to-end, in real time (5 seconds on average), under mechanisms aimed at maintaining a high level of security and efficiency. In this way, SPEI offers a wider range of operations than that offered by other real-time payment systems operated by central banks in other countries, which only allow the participation of banks and solely for the purpose of making high-value payments, while leaving it to the private sector to establish platforms for retail payments that commonly offer payment services at 24 and 48 hours.

Given the above and with the commitment to provide the general population with new payment services that satisfy their needs and make their activities in the economy more efficient, which contributes to the proper functioning of payment systems, the Bank of Mexico has developed an electronic platform called “Digital Collection” (CoDi). Its objective is to carry out electronic payments through a scheme in which the payment is requested, by who would be the recipient of the funds, from a mobile device or from the internet and the issuer of the payment authorizes it from their own device. In this way, it is sought that the CoDi platform provide a secure and efficient payment method to small businesses, e-commerce businesses, service providers and the general public to make charges with the security and efficiency advantages of electronic transfers. To this end, the Bank of Mexico has decided to modify its regulation to (i) establish the obligations of SPEI Participants necessary to guarantee the correct functioning and adoption of the CoDi collection request scheme; (ii) implement the corresponding operational processes for the processing of CoDi Transfers; as well as (iii) include the applicable regime for the Administrator to maintain the resources contributed by Participants for the validation of Beneficiary Clients' accounts.

In particular, the modifications to the regulation are focused on establishing high security requirements, guaranteeing homogeneous service levels and ensuring the efficiency and speed necessary for the CoDi Transfer scheme to perform as a viable alternative to the electronic payment services currently present in the market, as well as the use of cash. The implementation of the CoDi platform will open the possibility of accessing electronic payment services through SPEI to all holders of mobile devices in the country, promoting financial inclusion, the greater use of electronic payment methods and the promotion of competition in the electronic payment market. The foregoing will be carried out for the benefit of businesses and users of electronic payment services, as well as for those segments of the population that, to date, are not part of the formal financial system.

With the aforementioned reforms, it is sought to continue promoting: i) the protection of users' interests; ii) the adoption of electronic payment methods; iii) competition in this market, and iv) the proper functioning of payment systems and the sound development of the financial system.

Therefore, the Bank of Mexico, based on articles 28, paragraphs sixth and seventh, of the Political Constitution of the United Mexican States, 2, fractions I, IV and VIII, and 6, of the Payment Systems Law, 22 of the Law for Transparency and Ordering of Financial Services, 4, first paragraph, 8, paragraphs fourth and seventh, 10, first paragraph, 14 Bis, first paragraph, in relation to 17, fraction I, and 20, fraction XI, of the Internal Regulations of the Bank of Mexico, which grant it the authority to issue provisions through the General Legal Directorate and the Payment Systems Directorate, respectively, as well as Second, fractions VI and X, of the Agreement on the Assignment of Administrative Units of the Bank of Mexico, has resolved to modify the definitions “Beneficiary Client”, “Issuer Client” and “Collaboration Agreement for the Protection of Issuer Clients” of the 2nd., 7th., fraction III, 9th., first paragraph, 10th., fractions I and II, 11th., first paragraph and fraction IV, 12th., literal a. of fraction I and numeral ii. of the cited literal a., 13th., first paragraph, 15th., first paragraph, 17th., paragraphs first, second and third, 19th., fraction I, paragraphs first and third, fraction II, second paragraph, fraction III and fraction V, 20th., 21st., first paragraph, 23rd., first paragraph, fractions VII to X, 24th., first paragraph and fraction II, 25th., first paragraph, fraction II, fraction III, second paragraph, fraction IV, literals a) and b) of fraction V and fraction VI, 26th., 27th., first paragraph and current second, fraction I and last paragraph, the name of section V, of chapter III, 29th., 30th., 31st., paragraphs first and current second, 43rd., paragraphs first and second, fractions VI and VII, 45th., fractions IV to VI, 46th., fourth paragraph, 52nd., fractions II and III, 53rd., second paragraph, 54th., 58th., literal e) of fraction III and literal C of fraction IV, 62nd., first paragraph and fraction III, 68th., third paragraph, 72nd., fraction I, 74th., paragraphs first and third, 83rd., literals d), e), g) and h) of fraction I and fraction II, first paragraph and literal b), 84th., fraction III, 86th., fractions II and III, 90th., first paragraph, 97th., 98th. paragraphs first and fifth, and the 100th., paragraphs first and second, as well as add the definitions “Collection Message” and “CoDi Transfer Order” to the 2nd, the 7th. Bis, a second paragraph to the 9th., Section I Bis to Chapter III, the 9th. Bis, a last paragraph to fraction II of the 12th., a last paragraph to the 13th., a second paragraph to the 14th., four final paragraphs to the 17th., a fraction VI to the 19th., a fraction VII to the 25th., the 25th. Bis, a second paragraph to the 27th., a second paragraph to the 28th., a second paragraph to the 31st., a last paragraph to the 43rd., a fraction VII to the 45th., a fifth, sixth, seventh, eighth and ninth, paragraphs to the 46th., the 46th. Bis, the 51st. Bis, a fraction IV to the 52nd., a literal i) to fraction I of the 83rd., a second paragraph to fraction III of the 83rd., a last paragraph to the 86th., a second paragraph to the 88th. and the 98th. Bis, to the “Rules of the Interbank Electronic Payment System”, contained in Circular 14/2017, to remain in the following terms:

Rules of the Interbank Electronic Payment System

2nd. Definitions.- For the purposes of these Rules, the following shall be understood:

I. to IX. …

“X. Beneficiary Client: the holder of the Client Account, opened in the Receiving Participant, which is indicated in the respective Transfer Order received by the latter as that in which the final credit of the resources subject to said Transfer Order must be made, including that holder of the Client Account referred to above who generates Collection Messages with the purpose that the Receiving Participant credit in said account the amounts of the CoDi Transfer Orders that the latter receives as a result of the processing of such Collection Messages.

XI. Issuer Client: the holder of the Client Account opened with the Participant with whom they have agreed to process their Sending Requests charged to said Account, including that holder of the Client Account referred to above who receives Collection Messages with the purpose that this holder issues the Sending Requests as a result of their acceptance of such Collection Messages.

XII. to XVIII. …

Monday, May 20, 2019 OFFICIAL GAZETTE (Second Section)

XIX. Collaboration Agreement for the Protection of Issuer Clients: the instrument by which Participants agree on collaboration measures to protect their Issuer Clients against Transfer Orders Accepted by SPEI not instructed by said Clients, prepared in the terms provided in the 43rd. of these Rules.

XX. to XXX. …

XXX. Bis Collection Message: to that message that the Beneficiary Client generates for delivery to the Issuer Client in question, with the purpose that, once the latter accepts what is indicated in said message through the procedure established for this purpose in accordance with these Rules, the respective CoDi Transfer Order is sent with the characteristics determined in accordance with the message itself.

XXXI. to XXXIII. …

XXXIII. Bis CoDi Transfer Order: to that Transfer Order that the Participant in question sends on behalf of the Issuer Client, as a result of the latter's acceptance of a Collection Message generated by the Beneficiary Client indicated in said Transfer Order, as provided in the Catalog of Payment Types corresponding to CoDi of the Manual that, for its realization, complies with the requirements established for this purpose in these Rules and the Manual.”

XXXIV. to XLVI. …

…

7th. …

I. to II. …

“III. The Administrator, once it receives, in an automated manner in SPEI, the Transfer Order from the Issuing Participant, carries out the corresponding validations and verifies the balance sufficiency in the SPEI Account of said Participant. In the event that, through said validations and verification, it is found that the conditions established for the processing of the Transfer Order are met, the Administrator will carry out its settlement through the automated processes of SPEI. On the contrary, if in accordance with said validations and verification, the conditions indicated are not met, the Administrator, in an automated manner in SPEI, will reject the Transfer Order. Additionally, in those cases where the aforementioned settlement cannot be carried out, for the causes provided in the 17th. of these Rules, the Administrator will eliminate, in an automated manner through SPEI, the respective Transfer Orders in accordance with the provisions of said Rule;”

IV. to VI. …

“7th. Bis. Operational process corresponding to CoDi Transfer Orders.- In addition to what is provided in the 7th. of these Rules, the operational process to carry out fund transfers derived from CoDi Transfer Orders will be carried out in accordance with Appendices AD and AE of the Manual, in the following steps:

I. The holder of a Client Account who wishes to generate Collection Messages to receive CoDi Transfer Orders in their favor in said account, as a Beneficiary Client, will enable with the Administrator the specific mobile device they wish to use for this purpose. This will be carried out through some computer program installed on said device, among those programs offered by the Administrator itself or, in its case, by the Receiving Participant or a third party, which have been previously enabled with the Administrator and comply with the requirements established for this purpose in Appendix AD of the Manual. The enabling of the referred device must be carried out only once, prior to the generation of the first of the Collection Messages. Additionally, the Participant that administers Client Accounts referred to in this fraction, may enable with the Administrator, on behalf and on account of their holders, with their prior consent, the mobile devices and the computer programs referred to, for the same purposes, in accordance with the procedure established for this purpose in Appendix AD of the Manual.

On the other hand, the holder of a Client Account who wishes to generate Collection Messages for sending through the internet will register with the Administrator, through the computer program offered by the latter or by a third party for such purposes, said Client Account and other data indicated in Appendix AD of the Manual, in accordance with the procedure established for this purpose in said Appendix.

II. Having done the above, the Administrator, in attention to the request of the holder of a Client Account presented directly or through the corresponding Participant through any of the computer programs previously referred to, will carry out the validation of the respective Client Account in accordance with the 51st. Bis of these Rules.

To carry out the validation of the aforementioned Client Account, the Participant in question must previously send to the Administrator the resources referred to in the 51st. Bis of these Rules.

III. Once what is provided in the previous fractions has been carried out, the holder of a Client Account who wishes to receive fund transfers in their favor, as a Beneficiary Client, will generate a Collection Message through the respective computer program installed on the mobile device indicated in the previous fraction I or, in the case of Collection Messages for sending by internet, through the computer program that complies with the requirements established in Appendix AD of the Manual.

The Collection Message generated by the holder of a Client Account in accordance with the above will be delivered to the Issuer Client, in accordance with the procedure established for this purpose in Appendix AD of the Manual, through any of the computer programs that, for this purpose, have the certification of the Administrator and that have been installed on the Issuer Client's mobile device with their consent.

IV. On the other hand, the holder of a Client Account who wishes to receive Collection Messages so that they can generate Sending Requests, as an Issuer Client, will enable with the Administrator the mobile device they specify for the reception of said Collection Messages, as well as any of the computer programs installed on said device provided, for such purposes, by the Participant itself, such as those corresponding to mobile banking, or by a third party authorized by the same Participant, which complies with the requirements established for this purpose in Appendix AD of the Manual. Additionally, the Participant that administers Client Accounts corresponding to Issuer Clients, with the consent of the latter, may enable with the Administrator, on behalf and on account of them, the mobile devices and the computer programs referred to, for the same purposes, in accordance with the procedure established for this purpose in Appendix AD of the Manual.

V. The Issuer Client who receives the Collection Message in accordance with what is indicated in the previous fraction may carry out any of the following actions, through the referred computer program installed on the mobile device indicated in the previous fraction:

a) Accept what is indicated in said Collection Message. b) Reject what is indicated in said Collection Message. c) Postpone the acceptance or rejection of said Collection Message for a later moment.

VI. In the event that the Issuer Client accepts the Collection Message in accordance with the previous fraction V, the corresponding Issuing Participant will allow them to issue the Sending Request to send the CoDi Transfer Order with the characteristics indicated in the referred Collection Message. For these purposes, the Issuing Participant will cause the computer program referred to in the aforementioned fraction V to show the necessary data so that the Issuer Client accepts the generation of the respective Sending Request in accordance with the procedure established for this purpose in Appendix AD of the Manual, as well as the applicable provisions to authenticate said operation by electronic means.

VII. The processing of the Sending Request generated in accordance with the immediate previous fraction will follow the operational process described in fractions I and II of the 7th. of these Rules.

Monday, May 20, 2019 OFFICIAL GAZETTE

VIII. The Administrator will carry out the settlement of the CoDi Transfer Order resulting from the aforementioned Sending Request in accordance with what is described in fraction III of the 7th. of these Rules.

As an exception to what is indicated in said fraction III, in the event that the balance in the SPEI Account of the respective Issuing Participant is insufficient to cover the referred CoDi Transfer Order, or if the Receiving Participant is not connected to SPEI, it will be eliminated immediately after finishing the first compensation cycle of the Transfer Orders of SPEI in which the settlement has not been carried out.

IX. Upon the settlement of the CoDi Transfer Order provided in the first paragraph of the immediate previous fraction, the Settlement Notice of the Transfer Order will be generated in accordance with the operational process indicated in fraction IV of the 7th. of these Rules.

X. The Receiving Participant who has access to the Settlement Notice generated in accordance with the above, will carry out what is described in fraction V of the 7th. of these Rules. In the event that the Receiving Participant has rejected the Transfer Order Accepted by SPEI, it will send to the Administrator a processing notice regarding said rejection, in accordance with what is specified in Appendix AD of the Manual.

XI. In the event that the Receiving Participant accepts the referred Transfer Order Accepted by SPEI, the procedure provided in fraction VI of the 7th. of these Rules will be followed and, additionally, it will send to the Administrator a processing notice regarding said acceptance, in accordance with what is specified in Appendix AD of the Manual.”

“9th. CLABE Assignment.- Participants must, in accordance with what is established for this purpose in section 6 of the Manual, assign a CLABE to each of the Client Accounts they maintain open and that correspond to the financial products indicated in the catalog of said products included in Appendix D of the Manual. Participants must ensure that each CLABE is distinct for each Client Account.

In addition to what is provided in the previous paragraph, Participants must assign the aforementioned CLABE to those Client Accounts corresponding to the financial products indicated in said paragraph that financial institutions have agreed with their clients, such as those referred to revolving credits associated with credit cards, insurance contracts, among others, with respect to which said Participants have agreed with such institutions to carry out their processing.”

“Section I Bis Obligations corresponding to CoDi Transfers

9th. Bis Obligations related to CoDi Transfer Orders.- Participants must observe the following obligations in relation to CoDi Transfer Orders:

I. The Participant that so decides may allow the holders of Client Accounts opened in said Participant to generate Collection Messages, in order to receive CoDi Transfer Orders in their favor, as Beneficiary Clients, in accordance with these Rules, through computer programs provided by this Participant or by a third party and installed, with the consent of said Clients, on the mobile devices they choose and that comply with the requirements established regarding this in Appendix AD of the Manual.

II. In the event that the Participant has the status of Credit Institution that, in accordance with what is provided in the 15th. of these Rules, maintains at least three thousand demand deposit accounts and allows its Issuer Clients to generate Sending Requests through computer programs installed on mobile devices, it must allow all referred holders to generate Sending Requests, which it must process in the terms of these Rules for the sending of CoDi Transfer Orders, as a result of the acceptance of said holders to the Collection Messages they receive through computer programs that the latter install on their respective mobile devices. For these purposes, the referred Participant must enable the computer programs that it makes available to the holders of Client Accounts opened in said Participant for the performance of those financial and payment operations, as well as the other acts related to these, which they agree upon, such as those corresponding to mobile banking, in order for said Clients to be able to generate the Sending Requests for the sending of the”

(Second Section) OFFICIAL GAZETTE Monday, May 20, 2019 Orders for CoDi Transfers corresponding to the Charge Messages received in accordance with the previously provided provisions. Any other Participant that does not fall under the scenario in the preceding paragraph may allow its Clients to generate Sending Requests, as a result of the acceptance of Charge Messages that they receive through the software programs offered by the Participant itself or by a third party authorized by said Participant and that said Clients install on their respective mobile devices. The Participant that falls under the scenario in this paragraph must submit to the Administrator its request to provide these services formulated in accordance with the Model established in Annex 1 of Appendix AE of the Manual and will be subject to the same obligations applicable to the Participant referred to in the preceding paragraph. III. The Participants referred to in fractions I and II of this Rule must comply with the following obligations: a) Carry out the processing of Charge Messages and CoDi Transfer Orders in accordance with what is established for this purpose in these Rules, as well as maintain, with the technical characteristics established for this purpose in Appendix AD of the Manual, the software programs that they make available to the holders of the respective Client Accounts opened at said Participants for the performance of those financial and payment operations, as well as other acts related to these, which they agree upon regarding this, through which said holders can execute the corresponding actions for the Charge Messages they receive. b) Certify before the Administrator the software programs that they make available to the holders of the respective Client Accounts opened at said Participants for the generation or receipt of Charge Messages, including those software programs through which said holders can perform financial and payment operations, as well as the other related acts they agree upon for this purpose, in which they can also generate the Sending Requests derived from the acceptance of the Charge Messages received by said holders, in accordance with what is stipulated in Appendix AD of the Manual. c) Allow the holders of the respective Client Accounts opened at said Participants to enable and disable with the Administrator the software programs referred to in subsection b) immediately above that have been installed on the mobile devices of said holders, as well as the mobile devices themselves for the same purposes, without prejudice to the power of the Participants to enable and disable before the Administrator the software programs and mobile devices in the name of said holders, with their consent, in accordance with the procedure established for this purpose in Appendix AD of the Manual. d) Allow said holders of Client Accounts to use the software programs developed by the Administrator, by the Participants themselves related to the holders in question, or by any other entity for the generation of Charge Messages. The software programs developed by the Participants or by any other entity must observe the technical and operational requirements provided for this purpose in Appendix AD of the Manual, as well as have prior certification by the Administrator regarding the functionality requirements of said programs and, if applicable, the information security certification of the same, or the certification regarding information security requirements granted by a third party that complies with the requirements established for this purpose in Appendix AE of the Manual. e) Receive from the Administrator the notifications that it directs to them in accordance with what is specified in Appendix AD of the Manual so that, through the software programs referred to in subsection a) above, they show their Clients the status of the Charge Messages generated or received by said software programs. IV. The Participant referred to in fraction I of this Rule must comply with the following obligations in addition to those other that apply to it: a) Allow the respective holders of Client Accounts opened at the same Participant to request the Administrator, through the software program in accordance with Appendix AD of the Manual, which is offered by the Participant itself or a third party to said holders, for the generation of Charge Messages, the validation of their Client Accounts to use them in the processing of CoDi Transfer Orders derived from the Charge Messages they generate, without prejudice to the power of the Participant to request directly from the Administrator the validation of the Client Accounts, in the name of the respective holders, subject to the consent they grant for this purpose.

Monday, May 20, 2019 OFFICIAL GAZETTE (Second Section) b) Allow said holders of Client Accounts to generate Charge Messages for amounts of up to eight thousand pesos per message or for those higher amounts that, if applicable, said Participant decides to establish. c) Allow said holders of Client Accounts to include the following information in the Charge Messages they generate, with the characteristics established for this purpose in Appendix AD of the Manual:

1. Amount.
2. Payment concept.
3. Numeric Reference.
4. Validity period. d) Refrain from modifying the information that has been included in the Charge Message by the holder of the Client Account that generated said Charge Message. e) Change the status of the Charge Message in question to "expired" when the holder of the Client Account that generated it has specified a date and time until which said Charge Message can be accepted by the Issuing Client who receives it and said date and time has passed without such acceptance having occurred. V. The Participant referred to in fraction II of this Rule must comply with the following obligations: a) Allow the respective Issuing Clients to receive Charge Messages through the software programs on mobile devices enabled in accordance with these Rules for up to an amount of eight thousand pesos per Charge Message, or for those higher amounts that, if applicable, said Participant decides to establish. b) Obtain from the Administrator the necessary data for the processing of the Charge Message in accordance with what is specified in Appendix AD of the Manual. c) Show, from the moment established for this purpose in the Manual once it obtains the data indicated in the previous subsection, the following information on the screen of the software program installed on the mobile device of the holder of the Client Account in question, with their consent, to generate Sending Requests:
5. The CoDi scheme logo, with the character , included in Appendix AE of the Manual.
6. Operation Folio, corresponding to the Charge Message in question.
7. Name of the holder of the Client Account that generated the Charge Message and that will remain as the Beneficiary Client in the respective CoDi Transfer Order.
8. Amount of the respective Sending Request equivalent to that of the corresponding Charge Message
9. Payment Concept that, if applicable, has been defined by the holder of the Client Account that has generated the Charge Message.
10. Numeric Reference that, if applicable, has been defined by the holder of the Client Account that has generated the Charge Message.
11. The following information that, if applicable, has been included in the Charge Message: i) Date and time of validity in accordance with what is established in Appendix AD of the Manual. ii) Content of the field “Beneficiary Name 2”, in addition to the field “Beneficiary Name” in accordance with what is established in Appendix AD of the Manual. d) Allow its Issuing Clients who receive Charge Messages to perform only one of the following actions, with respect to each of said Charge Messages, through the software program through which they received them, at any time prior to the date and time of termination of the validity of the respective Charge Message that, if applicable, has been established in said Charge Message:
12. Accept, with the aim that, in this case, the referred software program generates a Sending Request, which the Participant must process in accordance with what is established for this purpose in these Rules, as well as update the status of the Charge Message to “accepted”.

(Second Section) OFFICIAL GAZETTE Monday, May 20, 2019 2. Reject, with the aim that, in this case, the referred software program prevents said Charge Message from being processed and updates the status of the Charge Message to “rejected”. 3. Postpone, with the aim that the referred software program stores the Charge Message and allows the Issuing Client to accept or reject it at a later time, provided that the characteristics of the referred message allow performing the action in terms of what is established in Appendix AD. Participants may not allow those Charge Messages that have been rejected in accordance with the above to be subsequently accepted. Likewise, those Charge Messages that have been accepted in accordance with the above may not be subsequently rejected. Likewise, those Charge Messages that have been accepted or rejected in accordance with the above may not be postponed. e) Once the Issuing Client has performed any of the actions indicated in subsection d) immediately above, the Participant must, in accordance with the processes established for this purpose in Appendix AD of the Manual, on the one hand, send to the Administrator a processing notice regarding said action within the immediate second following that in which that action was executed and, on the other hand, store the Charge Message in its systems with the specification of the corresponding statuses. f) Allow the Issuing Client in question to perform, again, any of the actions indicated in numerals 1, 2 and 3 of subsection d) in case said Client has accepted a Charge Message, but its authentication in the software program to generate the Sending Request has not been carried out in accordance with the requirements established for this purpose. g) Send a new CoDi Transfer Order with a new Tracking Key and inform the Issuing Client of this, in case the latter has accepted, on more than one occasion, a Charge Message when the Participant has allowed it to perform again, any of the actions indicated in numerals 1, 2 and 3 of subsection d) in the event that the Administrator, through the system used for the operation of SPEI, has deleted the CoDi Transfer Order corresponding to the Sending Request generated due to the previous acceptance of the Charge Message, due to the disconnection of the SPEI of the Receiving Participant or to the insufficiency of funds in the SPEI Account of the Issuing Participant. In the cases referred to in this subsection, as well as in subsection f) above, the Participant must allow the Issuing Client to perform again, any of the actions indicated in numerals 1, 2 and 3 of subsection d) up to three times. h) Allow its Issuing Client, in case it receives, through the software program that it has installed on its respective mobile device, any Charge Message generated through the internet without knowledge of the cause that gave rise to said Charge Message, to report this situation to the Participant itself, through the same referred software program. In this case, the Participant must send a notification to the Administrator regarding said report, in accordance with what is specified in Appendix AJ of the Manual. i) Allow its Issuing Client to, in case it has received a Charge Message for an amount greater than previously agreed with the holder of the Client Account that generated said Charge Message, be able to report this situation through the software program that it has installed on its respective mobile device, without prejudice to the actions that said Issuing Client can carry out in accordance with what is indicated in subsection d) above. In this case, the Participant must send a notification to the Administrator regarding said report, in accordance with what is specified in Appendix AJ of the Manual. j) Allow its Issuing Client to enable the software program installed on its device as the default program for the reception of Charge Messages that have been sent by internet. For this purpose, they must adhere to what is established in Appendix AD and have evidence of the request that the Issuing Client would have presented to it.” 10a. … I. “For any amount, provided that it does not exceed the balance of available resources in the respective Client Account to be charged. Without prejudice to the above, Participants may establish maximum limits on the amounts of Sending Requests, provided that said

Monday, May 20, 2019 OFFICIAL GAZETTE (Second Section) Participant has previously established a procedure for the Issuing Client to formulate Sending Requests without being subject to such limits. II. For their sending to any of the Participants included in the list that the Administrator informs daily to all Participants at the start of SPEI operations, which they must make available to their Issuing Clients. The list that Participants make available to their Issuing Clients must exclude the identifiers corresponding to Alternative SPEI Accounts of the Participants, the identifiers of the Participants referred to in fraction IV of the 56th of these Rules, as well as those corresponding to the Administrator that uses for the receipt of deposits referred to in the 51st Bis of these Rules.” III. … “11a. Schedule for presenting Sending Requests.- Participants must allow their Issuing Clients to present Sending Requests, which said Participants must process in accordance with the these Rules, at any time within the following schedules: I. to III. … IV. Regarding Sending Requests generated as a result of the acceptance of Charge Messages to send CoDi Transfer Orders, during the 24 hours of all days of the year.” … 12a. … I. … a) “Any of the following identification data of the Client Account corresponding to the Beneficiary Client that the Participant must allow them to choose: i. … ii. The sixteen digits of the debit or credit card that, if applicable, corresponds, or iii. … b) … II. … … … Regarding Sending Requests for CoDi Transfer Orders, the Participant referred to in fraction II of the 9th Bis of these Rules must refrain from allowing its Issuing Client to modify, in the Sending Request that is generated due to the acceptance of the Charge Message that the latter has performed in accordance with what is provided in Rule 9th Bis, fraction V, subsection d), numeral 1, above the information displayed by the respective software program on the screen of its mobile device indicated in the 9th Bis, fraction V, subsection c), of these Rules, except for the amount, only in case this has not been specified in said Charge Message. In this case, the Issuing Participant must allow the Ordering Client to introduce the amount that this determines, in accordance with what is established in subsection b) of fraction I of this Rule.” “13a. Verification of the Sending Request.- The Issuing Participant will consider valid that Sending Request that it transmits its Issuing Client through the use of Electronic Channels, once said Participant has followed the identification and authentication procedures of that Issuing Client, in accordance with the applicable provisions issued by the CNBV in case said Participant has the character of Credit Institution, or with the 71st of these Rules, in any other case. Regarding the Sending Requests corresponding to CoDi Transfer Orders, the Issuing Participant must carry out the identification and authentication procedures referred to in this paragraph within a maximum period of 5 seconds counted from when said Participant receives, through the software program established for this purpose, the information necessary for this. … …

(Second Section) OFFICIAL GAZETTE Monday, May 20, 2019 As an exception to what is provided in the preceding paragraph, in case of Sending Requests corresponding to CoDi Transfer Orders generated as a result of the acceptance of Charge Messages, the maximum term to inform the respective Issuing Client will be one second counted from when said Issuing Participant receives the respective Sending Request.” 14a. … “In the case of Sending Requests corresponding to CoDi Transfer Orders, the Issuing Participant must, in addition to what is previously established in this Rule, generate and send to the Administrator a notice of processing with the result of the respective CoDi Transfer Order, in accordance with what is specified in Appendix AD of the Manual, and, in the event that the respective Sending Requests have been rejected, the Issuing Participant must inform the Issuing Client within a maximum period of one second after that in which the validation and verification referred to in the previous Rule concludes.” … “15a. Calculation of the number of deposit accounts.- For the purposes of those scenarios that make reference to numbers of money demand deposit accounts provided for in the 9th Bis, fraction II, 11a., fraction III, second paragraph, 19a., fraction II, second paragraph, and fraction IV, 25a., fraction III, second paragraph, of the these Rules, 46a. fraction IV, subsection b), said number of accounts that Participants that have the character of Credit Institution maintain open in favor of their Clients will correspond to those that said Participants register at the close of the calendar quarter in question, based on the information that they report to the Bank of Mexico in response to information requests made by the Directorate of Information of the Financial System or, if applicable, to those that the Bank of Mexico corroborates derived from the verification that it carries out in exercise of its supervisory attributes.” … “17a. Sending of Transfer Orders.- The Issuing Participant must send to the Administrator, through the automated processes of SPEI, the Transfer Order corresponding to the Sending Request accepted by said Participant, during the thirty seconds counted from the moment when the Participant itself has accepted it in accordance with what is indicated in the 13th of these Rules. The Issuing Participant must comply with the above, except in case that it has agreed with its Issuing Client that it will carry out the sending of the Transfer Order at a later hour or date than that of the receipt of the Sending Request and, in the latter case, the term of thirty seconds mentioned will begin to count from the hour agreed for this purpose or, if no specific hour is agreed, from 06:00:00 hours of the day that, if applicable, has been agreed in accordance with the above. In case of not agreeing on a specific hour, the Issuing Participant must inform its Issuing Client that the payment will be made at 06:00:00 hours of the agreed date. The term of thirty seconds referred to in the preceding paragraph will not be applicable regarding the Transfer Orders that are sent by those Participants that have the character of Clearing House for Transfers Through Mobile Devices, or of Credit Institution. In these cases, the Issuing Participants referred to in this paragraph must send the indicated Transfer Orders at the latest within five seconds counted from the moment when the Participants themselves have accepted the corresponding Sending Requests in accordance with what is indicated in the 13th of these Rules. The Issuing Participant may send to the Administrator, through SPEI, instructions to cancel Transfer Orders that it has previously sent. Transfer Orders can only be cancelled when they have not been settled through SPEI in terms of the 18th of these Rules. Additionally, the Administrator will automatically eliminate, through SPEI, the following Transfer Orders: I. Those that have not been settled at the close of SPEI operations. II. Those other than CoDi Transfer Orders that have not been settled at the conclusion of the number of clearing cycles that correspond in accordance with section 5.7 of the Manual due to insufficient balance in the SPEI Account of the Issuing Participant or as a result of the disconnection of the Receiving Participant. III. Those corresponding to CoDi Transfer Orders that have not been settled after the immediate clearing cycle following the receipt of said CoDi Transfer Orders by the Administrator. IV. Those that have not been settled due to impediments of the Administrator in their processing. In the event that the Transfer Orders are eliminated in the scenarios indicated in fractions I, II and IV above, the respective Issuing Participant must inform the Issuing Client, through a

Monday, May 20, 2019 OFFICIAL GAZETTE (Second Section)

message that they send through the means they have agreed upon for this purpose, within ten seconds following the moment that said Participant receives the message from the Administrator indicating this situation.

With respect to that Transfer Order that has been eliminated in any of the scenarios in fractions II and IV above, the Participant may allow its Issuing Client to reissue the Sending Request. In this case, said Sending Request must be issued with a new Tracking Key and must be subject to the identification, authentication, and verification that the Issuing Participant carries out in accordance with what is established in the 13th of these Rules. Additionally, in this scenario, the Participant must inform its Issuing Client of what is indicated in the last paragraph of the 13th of these Rules, in accordance with what is provided herein.

Regarding CoDi Transfer Orders eliminated in accordance with the preceding fraction III, the Issuing Participant must send a processing notice to the Administrator informing of the elimination of the CoDi Transfer Order, in accordance with what is specified in Appendix AD of the Manual, within a maximum period of one second following the receipt of the elimination notice thereof by the Administrator.

As an exception to what is provided in the first paragraph of this Rule, in the event that a CoDi Transfer Order is generated as a result of the acceptance of a Collection Message, the period during which the Issuing Participant must send to the Administrator the corresponding CoDi Transfer Order for the Sending Request accepted by said Participant shall be one second counted from the moment that said Participant accepted it in accordance with what is indicated in the 13th of these Rules.”

19th. …

I. “Within thirty seconds following the moment that the Administrator has made available to it, through the SPEI, the Settlement Notice regarding the Transfer Order Accepted by SPEI in question, on the corresponding Banking Business Day, during the period between 06:00:00 and the time corresponding to the closing of SPEI operations specified in the 35th of these Rules.

…

As an exception to what is provided in the preceding paragraph, with respect to those individual transfers for amounts equal to or greater than fifty thousand pesos, or those referred to the same Client Account corresponding to the Beneficiary Client in question, that are received during the same SPEI operation day and that, due to the sum of their respective amounts, reach or exceed said amount, in the event that any Receiving Participant determines to carry out, in accordance with its internal processes, validations additional to those provided in these Rules to carry out the crediting referred to in this fraction, it may request authorization from the Administrator, through the Business Continuity and Operations Management of the Payment Systems, for a period not exceeding six months, to carry out said crediting within a period longer than those referred to in the first and second paragraphs of this present fraction, as the case may be, which it determines for these purposes. The Participants that request the indicated authorization must state in their request that they are in the process of automating the validations, for the purposes referred to in this Rule, within the timeframes indicated in this fraction, once the period of the requested authorization concludes.

…

II. …

The Participant that has the status of Credit Institution and that maintains fewer than three thousand demand deposit accounts shall be exempt from the schedule established in this fraction and must credit the Transfer Orders Accepted by SPEI within five seconds following the moment that the Administrator has made available to it through the SPEI the Settlement Notice regarding the Transfer Order Accepted by SPEI in question corresponding to a Low Value Transfer Order, on the corresponding Banking Business Day, during the schedule from 06:00:00 to that corresponding to the closing of SPEI operations specified in the 35th of these Rules.

III. At the latest by 06:00:30 hours of the Banking Business Day corresponding to the SPEI operation date, always that it concerns Transfer Orders Accepted by SPEI received by those Participants that have a status other than that of Credit Institution or Clearing House for Transfers Through Mobile Devices between the opening schedule of the SPEI specified in the 35th of these Rules and 05:59:59 hours of the referred Banking Business Day corresponding to the SPEI operation date.

(Second Section) OFFICIAL GAZETTE Monday, May 20, 2019

IV. …

V. At the latest by 06:00:05 hours of the Banking Business Day corresponding to the SPEI operation date, always that it concerns Transfer Orders Accepted by SPEI corresponding to Scheduled Payments, received between the opening schedule of the SPEI provided for in the 35th of these Rules and 05:59:59 hours of the Banking Business Day corresponding to the SPEI operation date.

VI. Within the next second following the moment that the Administrator has made available to it through the SPEI the Settlement Notice regarding the Transfer Order Accepted by SPEI corresponding to CoDi Transfer Orders, 24 hours of all days of the year.

Regarding operations that include a second Beneficiary Client, the crediting must be carried out in the Client Account corresponding to the second Beneficiary Client within the same timeframes and schedules indicated in the preceding paragraph.”

…

…

20th. …

…

“In addition to the Crediting Confirmation provided for in the preceding paragraph, regarding CoDi Transfer Orders, the Receiving Participant must generate a processing notice, in accordance with what is specified in Appendix AD of the Manual, by which it confirms the crediting of the amount corresponding to the CoDi Transfer Order in question in the Client Account corresponding to the Beneficiary Client of the amount of the respective Transfer Order Accepted by SPEI, which said Participant must send to the Administrator within a maximum period of one second following the moment that it carries out said crediting.

As an exception to the timeframe established in the first paragraph of this Rule, regarding the Transfer Order generated to verify the Client Account that the Beneficiary Client in question has registered through the computer program provided for in these Rules for the generation of Collection Messages, the Receiving Participant must generate and send the Crediting Confirmation within a maximum period of sixty seconds.

Regarding CoDi Transfer Orders, in the event that the Receiving Participant: (i) has not carried out the crediting in the Beneficiary Client Account in accordance with what is provided for in the 19th of these Rules or (ii) has not sent the processing notice specified in the third paragraph of this Rule, within five seconds following the moment that the Administrator has made available to it through the SPEI the settlement notice regarding the Transfer Order Accepted by SPEI in question, the Receiving Participant itself must send a Transfer Order of the type of return of transfer not credited in Client Accounts respective in accordance with what is provided for in the 24th of these Rules and must send to the Administrator, within a maximum period of two seconds following when said Receiving Participant is located in the scenarios provided for in numerals (i) or (ii) of this present paragraph, a processing notice in accordance with what is specified in Appendix AD of the Manual, indicating that the Transfer Order was returned due to problems of the Receiving Participant in the crediting thereof.

What is provided for in this Rule shall not be applicable in the case where the Receiving Participant is the Bank of Mexico, acting in its own name and on its own account or in its capacity as trustee of any trust, a securities depository institution or an operator of an international system for the settlement of foreign exchange operations that include the national currency among the participants in said system.”

“21st. Rejection of Crediting Confirmation.- The Administrator will reject those Crediting Confirmations when it detects that they do not meet the scenarios and specifications established in these Rules and Appendix D of the Manual.”

…

“23rd. Causes for the return of Transfer Orders Accepted by SPEI not credited in Client Accounts.- The Receiving Participant must send a new Transfer Order of the type return of transfer not credited in the Client Account, regarding a Transfer Order Accepted by SPEI, in any of the following scenarios:

I. to VI. …

Monday, May 20, 2019 OFFICIAL GAZETTE (Second Section)

VII. In the event that the Participant has not previously established with the Client corresponding the Client Accounts of the Beneficiary Clients to where the Participants must credit the resources when the balance per Client reaches the limit established in the 70th, fraction I, of these Rules;

VIII. In the event that it is not possible to credit the amount of the Transfer Order Accepted by SPEI in the Client Account corresponding to the Beneficiary Client, for any of the causes established in section 9 of the Manual;

IX. In the event that the Receiving Participant receives a Transfer Order Accepted by SPEI corresponding to a CoDi Transfer Order and this is not located in the scenarios indicated in fractions I and II of Rule 9th Bis, or

X. In the event that the Receiving Participant identifies that the Tracking Key of the Transfer Order corresponds to a Tracking Key sent by the same Issuing Participant on the same SPEI operation date.”

“24th. Return of Transfer Orders Accepted by SPEI not credited in Client Accounts.- In the scenarios referred to in the preceding Rule 23rd, the Receiving Participant must send the Transfer Order of the type of return of transfer not credited in Client Accounts respective, in accordance with section 8 of the Manual and must indicate the cause of the return in accordance with the catalog contained in section 9 of the Manual, as well as ensure that the amount included corresponds:

I. …

II. To that of the original Transfer Order Accepted by SPEI that is the object of said return, plus the amount corresponding to the compensation specified in the 86th of these Rules, for returns of transfers not credited in Client Accounts that are late.”

“25th. Timeframes for the return of Transfer Orders Accepted by SPEI not credited in Client Accounts.- The Receiving Participant that is located in any of the scenarios referred to in the 23rd of these Rules must send the Transfer Order of the type of return of transfer not credited in the Client Account in question in accordance with what is provided for in the 24th of these Rules, at the latest during the sixty seconds following the moment that the Administrator has made available to it, through the SPEI, the Settlement Notice of the Transfer Order Accepted by SPEI object of the return.

…

I. …

II. Those that are received by Participants that do not have the status of Credit Institution or Clearing House for Transfers Through Mobile Devices between the opening schedule of the SPEI specified in the 35th of these Rules and 05:59:00 hours of the Banking Business Day corresponding to the SPEI operation date. In this case, the Receiving Participant must send the Transfer Order of the type of return of transfer not credited in the Client Account at the latest by 06:01:00 hours corresponding to said day;

III. …

The timeframe referred to in the preceding paragraph shall be applicable only during the schedule between 06:00:00 and 17:59:50 hours of the Banking Business Day corresponding, regarding the Settlement Notices of the Transfer Orders Accepted by SPEI regarding Low Value Transfer Orders that the Administrator has made available through the SPEI to Participants that have the status of Credit Institution that maintain fewer than three thousand demand deposit accounts. For the period between 17:59:51 of any Banking Business Day and 05:59:59 of the following Banking Business Day, the Participants referred to in this paragraph must send the Transfer Orders of the type of return of transfers not credited in Client Accounts at the latest by 06:00:10 hours of said following Banking Business Day;

(Second Section) OFFICIAL GAZETTE Monday, May 20, 2019

IV. Those that correspond to Scheduled Payments. In this case, the Receiving Participant must send the Transfer Order of the type of return referred to in this Rule at the latest by 06:00:10 hours of the Banking Business Day corresponding to the SPEI operation date;

V. …

a) Regarding those Transfer Orders Accepted by SPEI that are received between the opening schedule of the SPEI specified in the 35th of these Rules and 05:59:59 hours of each Banking Business Day corresponding to the SPEI operation date, the respective Transfer Orders of the type of return of transfers not credited in Client Accounts must be sent at the latest by 06:01:00 hours of that same Banking Business Day.

b) Regarding those Transfer Orders Accepted by SPEI that are received between 06:00:00 and the closing schedule of the SPEI specified in the 35th of these Rules, the respective Transfer Orders of the type of return of transfers not credited in Client Accounts must be sent at the latest in said closing schedule of the SPEI;

VI. Those that correspond to Transfer Orders Accepted by SPEI received by Participants that have the status of Credit Institution or Clearing House for Transfers Through Mobile Devices for amounts greater than eight thousand pesos, between the opening schedule of the SPEI specified in the 35th of these Rules and 05:59:59 hours of the referred Banking Business Day corresponding to the SPEI operation date. In this case, the Transfer Order of the type of return of transfer not credited in the Client Account must be sent at the latest by 06:00:10 hours of said following Banking Business Day, or

VII. Those that correspond to CoDi Transfer Orders. In this case, the timeframe to send the Transfer Order of the type of return referred to in this Rule shall be two seconds, during the 24 hours of any day of the year, counted from the moment that the Administrator has made available to the Participant, through the SPEI, the respective Settlement Notice. In this case, the Receiving Participant must generate and send to the Administrator, within the same timeframe indicated in this fraction, a processing notice with the result of the CoDi Transfer Order, in which it informs of the return in accordance with what is specified in Appendix AD of the Manual.”

“25th Bis. Timeframes for the retry of returns of Transfer Orders Accepted by SPEI.- The Issuing Participant of a Transfer Order of the type of return provided for in the Manual, regardless of whether this has been credited or not in the respective Client Account and whether it has been late or not, that receives from the Administrator a notice indicating that said Transfer Order has been eliminated without settlement must send a new Transfer Order of the type of return that corresponds, in accordance with the following:

I. When the elimination is due to the disconnection of the Receiving Participant in SPEI, this must send the new Transfer Order referred to within five seconds following the moment in which it has received from the Administrator the notification that its connection has been reestablished or, in case it does not receive said notification, within sixty minutes following the moment in which it receives from the Administrator, through the SPEI, the notification of the elimination of the Transfer Order.

II. When the elimination is due to the balance in the SPEI Account of the Issuing Participant being insufficient to cover the Transfer Order referred to, it must send the new Transfer Order within five seconds following the moment in which it receives from the Administrator, through the SPEI, the notification of the elimination of the Transfer Order.”

“26th. Late return of Transfer Orders not credited in Client Accounts.- In the event that, for any circumstance, the Receiving Participant does not send the Transfer Order of the type of return that it has been obliged to send within the timeframe that results applicable in accordance with what is established in the 25th of these Rules, it must send a Transfer Order of the type of late return of transfer not credited in the Client Account, in accordance with section 8 of the Manual, and must ensure that the amount included in that Transfer Order corresponds to the sum of the amount included in the original Transfer Order Accepted by SPEI that is the object of said return, plus the amount corresponding to the compensation specified in the 86th of these Rules. The Participant referred to in this Rule shall be obliged to the foregoing only if it sends the referred Transfer Order of the type of return on any SPEI operation day following the day on which said Participant has received the respective Transfer Order.”

“27th. Crediting of the Transfer Order of the type of return or late return of transfer not credited in Client Accounts.- The Issuing Participant of the Transfer Order object of a return or late return of transfer not credited in the Client Account”

Monday, May 20, 2019 OFFICIAL GAZETTE (Second Section)

shall, within five seconds after the Administrator has made it available to it, through SPEI, the Settlement Notice of the Transfer Order of the type of return or late return of uncredited transfer in the Client Account in question, credit the amount of said Transfer Order to the Client Account corresponding to the Issuing Client who transmitted the respective Sending Request.

As an exception to the provisions of the preceding paragraph, regarding CoDi Transfer Orders subject to a return or late return of uncredited transfer in Client Accounts, the maximum time limit to make the credit shall be one second.

In the event that the Issuing Participant cannot carry out the crediting of the funds referred to in the first paragraph of this Rule, said Participant shall:

I. Refrain from generating a new Transfer Order of the type of return or late return of uncredited transfer in Client Accounts regarding that other Transfer Order of the type of return or late return of uncredited transfer in Client Accounts that, in turn, it has received from the Receiving Participant, and

II. …

The Issuing Participant of the Transfer Order subject to a return or late return of uncredited transfer in Client Accounts shall inform the Issuing Client, at no cost to this client, who transmitted the respective Sending Request, through the means they have agreed upon for this purpose and by the same means by which the latter presented the respective Sending Request, regarding the re-crediting of the respective funds in its Client Account that has been carried out due to the return or late return, as well as the cause thereof as indicated by the Receiving Participant of the Transfer Order subject to a return or late return, no later than five seconds counted from the moment the credit was made.”

Section V

“Return of Accepted Transfer Orders by SPEI credited in Client Accounts

28a. Return of Accepted Transfer Orders by SPEI credited in Client Accounts.- In the event that a Beneficiary Client does not recognize an Accepted Transfer Order by SPEI credited in its Client Account, the respective Receiving Participant shall allow said Beneficiary Client to return the funds by presenting a Sending Request corresponding to a Transfer Order of the type of return of credited transfer in Client Accounts in accordance with section 8 of the Manual. Additionally, when the result of the application of the Collaboration Agreement for the Protection of the Issuing Client indicates that the funds should be returned, the Receiving Participant of this Accepted Transfer Order by SPEI shall carry out the return of the corresponding funds for this Accepted Transfer Order by SPEI by sending a Transfer Order of the type of return of credited transfer in Client Accounts, in accordance with section 8 of the Manual.

Receiving Participants shall make available to their Beneficiary Clients, through the software programs installed on the mobile devices referred to in 9a. Bis, fraction I, of these Rules, information regarding the sending of the Transfer Orders referred to in the preceding paragraph, in accordance with what is specified in Appendix AD of the Manual.

Regarding the return of an Accepted Transfer Order by SPEI, corresponding to a CoDi Transfer Order credited in the respective Client Account, the Receiving Participant shall generate and send to the Administrator the processing notice informing about said return, in accordance with what is specified in Appendix AD of the Manual, within a maximum time limit of one second after the moment it receives the instruction from the Beneficiary Client to carry out said return in accordance with what is provided in the first paragraph of this Rule.”

“29a. Late Return of Accepted Transfer Orders by SPEI credited in Client Accounts.- In the event that, for any circumstance, the Receiving Participant does not send the Transfer Order of the type of return corresponding on the same SPEI operation day on which said Participant received the original Transfer Order subject to the return, the Transfer Order sent on any subsequent day shall be of the type late return of credited transfer in the Client Account, in accordance with section 8 of the Manual.”

“30a. Time Limits for the Return of Accepted Transfer Orders by SPEI credited in Client Accounts.- The Receiving Participant shall send the Transfer Order of the type of return of credited transfer in the Client Account or of the type late return of credited transfer in the Client Account referred to in 28a. and 29a. of these Rules, no later than thirty seconds following the moment it receives the corresponding Sending Request from its Beneficiary Client, or within the time limit agreed in the Collaboration Agreement for the Protection of the Issuing Client.”

“31a. Time Limits for the Crediting of Returns of Accepted Transfer Orders by SPEI credited in Client Accounts.- The Issuing Participant of the Transfer Order subject to a return of credited transfer in the Client Account shall, within thirty seconds after the Administrator has made it available to it, through SPEI, the Settlement Notice of the corresponding Transfer Order of the type of return of credited transfer in the Client Account, credit the amount of said Transfer Order to the Client Account corresponding to the Issuing Client who transmitted the Sending Request subject to the return.

Regarding returns of Accepted Transfer Orders by SPEI credited in Client Accounts corresponding to CoDi Transfer Orders, the maximum time limit to carry out the aforementioned crediting shall be one second.

In the event that the Issuing Participant cannot carry out the crediting of the funds referred to in the first paragraph of this Rule, said Participant shall:

I. to II. …

…

“43a. Collaboration Mechanism for the Protection of Issuing Clients.- Participants shall enter into a Collaboration Agreement for the Protection of Issuing Clients pursuant to which said Participants agree among themselves on the procedure they must follow to present requests for support to Receiving Participants in order to provide protection to Issuing Clients in the event that Accepted Transfer Orders by SPEI that were not requested by said Clients are processed. Participants may determine the conditions of the aforementioned collaboration agreement in the Participants Forum or by any other means that Participants agree upon for this purpose.

Participants must request prior authorization from the Administrator for the celebration of the Collaboration Agreement for the Protection of Issuing Clients or for any modification thereto. For these purposes, they must attach to their request the draft agreement which must contain, at least, the following information:

I. to V. …

VI. The mechanism for the return to Issuing Clients of the funds corresponding to Accepted Transfer Orders by SPEI credited in the respective Client Accounts. In the event that the respective Participants have sufficient elements to presume that an Accepted Transfer Order by SPEI is part of a possibly fraudulent operation, the Receiving Participant in question shall send a Transfer Order of the type of return of credited transfer in the Client Account or late return of credited transfer in the Client Account, in accordance with what is provided in 28a. and 29a. of these Rules, respectively;

VII. In its case, the characteristics under which an Accepted Transfer Order by SPEI will be considered as part of a possibly fraudulent operation, as well as the obligation assumed by the respective Receiving Participant to return it, by means of a type of return of uncredited transfer in the Client Account or late return of uncredited transfer in Client Accounts, in accordance with 24a. of these Rules, and

VIII. …

…

The Participant that operates an international system for the settlement of foreign exchange operations that include the national currency among the participating currencies shall not be obliged to celebrate the Collaboration Agreement for the Protection of Issuing Clients.”

45a. …

I. to III. …

Monday, May 20, 2019 OFFICIAL GAZETTE (Second Section)

IV. “Put into operation the contingency procedure called “SPEI Alternate Operation Procedure” (POA-SPEI), in accordance with what is provided in section 5 of the Manual, for which Participants will be obliged to continue with the operation of SPEI through the use of said procedure. The Bank of Mexico, acting in its own name and on its own behalf or in its capacity as trustee in any trust, and the operator of an international system for the settlement of foreign exchange operations that include the national currency among the participating currencies, shall be exempt from what is established in this fraction;

V. Extend the operating hours of SPEI;

VI. Notify all Participants, through the electronic communication means established in the Manual, notices regarding situations in which they must elevate their monitoring and alert mechanisms with respect to the fund transfers they process through SPEI, under the terms and subject to the conditions that, for this purpose, the Manual establishes, or

VII. Instruct a Participant on the technical parameters that the latter must observe to re-establish its connection to SPEI in accordance with the procedures established in section 5 of the Manual.”

46a. …

…

…

“In those cases where the SPEI Application of a Participant presents an event that affects its operation or connection with SPEI, said Participant shall be obliged to execute the contingency procedure called “SPEI Alternate Operation Client” (COA-SPEI), in accordance with the procedures and times provided in section 5 of the Manual.

Participants who, in accordance with 90a. of these Rules, at the close of the Calculation Period prior to the one in which they are, have observed a participation percentage, determined in accordance with said Rule, greater than three percent, in an event that affects the processing of Transfer Orders, shall execute contingency procedures in accordance with the specifications and times provided in Appendix AI of the Manual.

The Bank of Mexico, acting in its own name and on its own behalf or in its capacity as trustee in any trust, and the operator of an international system for the settlement of foreign exchange operations that include the national currency among the participating currencies, shall be exempt from what is established in the immediately preceding paragraph.

The Participant that has received authorization or instruction from the Administrator to operate by one of the contingency procedures established by this, shall be exempt from observing the processing times indicated in 17a., 19a., 20a., 25a., 27a. and 30a. of these Rules and, instead, shall:

I. Send the Transfer Orders referred to in 17a. of these Rules, within a time limit not greater than sixty minutes counted from the moment said Participant has accepted the corresponding Sending Request;

II. Carry out the credit in the respective Client Account corresponding to the Beneficiary Client indicated in the Sending Request, of the amount of the Accepted Transfer Order by SPEI in the terms established in 19a. of these Rules, within the time limit corresponding in accordance with the following:

a) Within a time limit not greater than sixty minutes counted from the moment the Administrator has made it available to it, through SPEI, the Settlement Notice regarding the Accepted Transfer Order by SPEI in question, other than Scheduled Payments, or

b) No later than 7:00:00 hours of the Banking Business Day corresponding to the SPEI operation day, regarding an Accepted Transfer Order by SPEI corresponding to Scheduled Payments, received between the opening hour of SPEI provided in 35a. of these Rules and 05:59:59 hours of the same SPEI operation day.

In the cases referred to in this fraction, the Participant shall send to the Administrator, through SPEI, a Confirmation of Credit in the terms established in 20a. of these Rules, within sixty minutes counted from the moment it has carried out the credit in the Client Account corresponding to the Beneficiary Client of the respective Accepted Transfer Order by SPEI.

(Second Section) OFFICIAL GAZETTE Monday, May 20, 2019

III. Send the return of Accepted Transfer Order by SPEI not credited in Client Account in question in accordance with what is provided in 25a. of these Rules, no later than during the one hundred twenty minutes following the moment the Administrator has made it available to it the Settlement Notice of the Accepted Transfer Order by SPEI subject to the return.

The time limit indicated in the preceding paragraph shall not be obligatory for the following Accepted Transfer Orders by SPEI:

a) Those that the Participant receives who does not have the status of Credit Institution or Clearing House for Transfers Through Mobile Devices and said reception occurs from 17:00:00 hours of any Banking Business Day and 05:59:00 hours of the next Banking Business Day corresponding to the SPEI operation day. In this case, the Participant shall send the respective return of Accepted Transfer Order by SPEI not credited in Client Account in question no later than 08:00:00 hours of the same SPEI operation day referred to above;

b) Those that the Participant receives who has the status of Credit Institution and maintains less than three thousand demand deposit bank accounts, in accordance with what is provided in 15a. of these Rules, and said reception occurs from 17:00:00 hours of any Banking Business Day and 05:59:00 hours of the next Banking Business Day corresponding to the SPEI operation day. In this case, the Receiving Participant of the respective Transfer Order shall send the return of Accepted Transfer Order by SPEI not credited in Client Account in question no later than 08:00:00 hours of the same SPEI operation day referred to above;

c) Those corresponding to Scheduled Payments. In this case, the Receiving Participant of the respective Transfer Order shall send the return of Accepted Transfer Order by SPEI not credited in Client Account referred to in this fraction no later than 08:00:00 hours of the Banking Business Day corresponding to the SPEI operation date, or

d) Those corresponding to Accepted Transfer Orders by SPEI other than Scheduled Payments received in the Alternate SPEI Account. In this case, the Receiving Participant of the respective Transfer Order shall send the return of Accepted Transfer Order by SPEI not credited in Client Account referred to in this fraction in accordance with the following:

i. Regarding those Accepted Transfer Orders by SPEI that are received from 16:00:00 of any Banking Business Day and until 05:59:59 hours of each Banking Business Day corresponding to the SPEI operation day, the respective Transfer Orders of the type of return in question shall be sent no later than 08:00:00 hours of that same SPEI operation day.

ii. Regarding those Accepted Transfer Orders by SPEI that are received from 06:00:00 hours and until 16:00:00 hours of the same Banking Business Day, the respective returns of Accepted Transfer Orders by SPEI not credited in Client Accounts in question shall be sent no later than five minutes before the closing time of SPEI specified in 35a. of these Rules.

e) Those that the Participant receives who has the status of Credit Institution or Clearing House for Transfers Through Mobile Devices for amounts greater than eight thousand pesos, and said reception occurs from 16:00:00 hours of any Banking Business Day and 05:59:59 hours of the next Banking Business Day corresponding to the SPEI operation day. In this case, the Participant shall send the respective return of Accepted Transfer Order by SPEI not credited in Client Account in question no later than 08:00:00 hours of the same SPEI operation day referred to above.

IV. Credit in the Client Account corresponding to the Issuing Client who transmitted the Sending Request subject to the late return of Accepted Transfer Order by SPEI not credited in Client Account referred to in 27a. of the Rules within sixty seconds after the Administrator has made it available to it, through SPEI, the Settlement Notice of the Transfer Order in question.

Monday, May 20, 2019 OFFICIAL GAZETTE (Second Section)

V. Inform the Issuing Customer about the re-entry of the respective funds into their Customer Account that has been made due to the return of a Transfer Order Accepted by SPEI not credited to a Customer Account or the late return of a Transfer Order Accepted by SPEI not credited to a Customer Account, in accordance with what is established in the 27th of these Rules, no later than sixty minutes counted from the moment the deposit was made.

VI. Send the return of a Transfer Order Accepted by SPEI not credited to a Customer Account credited to the Customer Account referred to in the 30th of these Rules, no later than sixty minutes following the moment the Participant receives the corresponding Send Request from their Beneficiary Customer, or within the term agreed in the Collaboration Agreement for the Protection of the Issuing Customer.

In the event that the Participant falls under any of the scenarios in fractions I and II of the 9th Bis of these Rules and operates through the contingency procedure known as “Alternative Operation Customer SPEI” (COA-SPEI), it must suspend the processing of CoDi Transfer Orders from the moment it begins to execute said procedure and inform its Clients about this situation through the means they have agreed upon for this purpose. Once the Participant ceases to operate through the COA-SPEI contingency procedure, it must restart the processing of CoDi Transfers, which it must inform its Clients of through the aforementioned means.

In those cases where the Administrator determines that a Participant must operate from the Administrator's facilities, said Participant must follow the procedure provided for in section 5 of the Manual. In this case, the Participant must pay the Administrator a consideration for this concept in accordance with fraction IV of the 97th of these Rules.”

“46th Bis Retransmission of information. Participants are obliged to maintain in their SPEI Application the information that allows knowing, at all times, the position of the last complete message received in SPEI as indicated in section 5 of the Manual.

The Participant may request the retransmission of information corresponding to the SPEI operation day in order to obtain the necessary messages to restore its operation with SPEI from the position of the last complete message received, for which it must use the mechanisms indicated in the Manual.

In the event that the Participant requires the retransmission of messages sent and received on an SPEI operation day prior to the one in which it is located, it may present to the Administrator, in terms of what is established in the 98th of these Rules, its request for said information in accordance with the model contained in the Manual.

The Participant that requests the retransmissions of the information in accordance with the above must pay the Administrator a consideration for this concept, prior to the delivery of the required information. This consideration will be determined in accordance with the rate per byte retransmitted in accordance with the 90th of these Rules.”

“51st Bis Accounts for CoDi Transfers.- The Participant that offers its Clients the receipt of CoDi Transfer Orders, in order to make the deposit of the respective amounts in the Customer Accounts corresponding to them as Beneficiary Customers, must send to the Administrator, in the form and terms established for it in Appendix AE of the Manual, the amount corresponding to it in accordance with what is indicated in said Appendix, in order to generate the Transfer Orders to verify said Customer Accounts as provided for in the following paragraph.

For the purposes of what is provided in the previous paragraph, the Administrator will keep the aforementioned resources in a SPEI Account of the aforementioned Participant with the sole object of using said resources to generate, in the name of the Administrator itself, the referred Transfer Order for one cent of a peso, in order to verify the Customer Account corresponding to the respective Beneficiary Customer that has been registered through the computer program for the generation of Collection Messages, in accordance with the data included in the respective Electronic Payment Receipt that has been obtained as a result of said Transfer Order.

At the close of SPEI operations, the Administrator will transfer the balance of the SPEI Account mentioned in the immediate previous paragraph to a consolidating account that, for such purposes, the Bank of Mexico holds in its capacity as Central Bank. The resources deposited in said account will not generate interest and will be credited again in the SPEI Account provided for in the previous paragraph, on the immediate next SPEI operation day.

In the event that the Participant does not have sufficient resources in the aforementioned SPEI Account to carry out the indicated transfers, the Administrator, without any responsibility on its part, will abstain from carrying out the referred validation, in which case the holders of the Customer Accounts of the Clients

(Second Section) OFFICIAL GAZETTE Monday, May 20, 2019 corresponding to Beneficiary Customers who have requested to generate Collection Messages without carrying out the referred validation will be prevented from doing so.”

52nd. … I. … II. “Sign and send Transfer Orders in the name and on behalf of the respective Participant; III. Modify the Reserved Balance and send any other type of information to SPEI as specified in the Manual, and IV. Sign and send Credit Confirmations and processing notices.”

53rd. … “In addition to what is provided in the previous fractions, the Participant must present to the Administrator a criminal record certificate of the person who intends to be registered as an Operator, issued by the Disaggregated Administrative Body for Prevention and Social Reintegration of the National Security Commission or by the federal authority that replaces it, with an issuance date not greater than one year prior to its presentation to the Administrator, which must include the electronic signature of the SPEI regulatory compliance officer of the respective Participant in case said certificate is prepared in electronic format. Additionally, the Participant must present a communication signed by the SPEI regulatory compliance officer of the respective Participant, in accordance with the form established in Appendix L of the Manual, in which it indicates that the person who intends to be designated as an Operator is not disqualified from holding a job, position, or commission in the Mexican financial system, with an issuance date not greater than one month prior to its presentation to the Administrator. The registration of the person that the respective Participant has communicated to the Administrator will take effect once the Administrator has verified that the request presented in accordance with the above meets the requirements established in this Rule. The sending of the communications referred to in this Rule, by the Participant to the Administrator, must be subject to what is established in the 98th of these Rules.”

“54th Number of Operators.- Each Participant must maintain, at all times, at least two Operators duly enabled to carry out the functions corresponding to them under that status. Each Participant must verify that, upon deregistering an Operator in accordance with the following 55th Rule, it has at least two others to operate in the SPEI. In the event that upon deregistering one or more Operators, a Participant is left with fewer than two Operators, said Participant must register the necessary number of Operators to again have at least two Operators, within a term not greater than five Banking Business Days following the one in which it has presented to the Administrator the respective request for the referred deregistration. Additionally, each year, Participants must confirm to the Administrator the validity and update of their respective Operators, on the dates and in accordance with the procedure established in section 5 of the Manual, except for those Participants that, during the period in which they must carry out said confirmations, have been acting as Participants for less than one calendar year.”

58th. … I. to II. … III. … … a) to d) … e) “Accredit that it can continue with its operation upon the activation of the “Alternative SPEI Operation Procedure” (POA-SPEI), as well as operate through the contingency procedure known as “Alternative Operation Customer SPEI” (COA-SPEI). Participants referred to in the 56th fraction IV, of these Rules are exempt from the requirement established in this subsection. IV. … A. and B. … C. The interested parties must have celebrated the Collaboration Agreement for the Protection of the Issuing Customer authorized by the Administrator, in accordance with what is provided in the 43rd of these Rules, subject to the condition that they obtain authorization to be admitted as a Participant in accordance with these Rules.”

V. and VI. …

Monday, May 20, 2019 OFFICIAL GAZETTE (Second Section) “62nd Compliance Evaluation.- The interested party that presents the admission request to act as a Participant, in accordance with what is provided in the 57th of these Rules, must accredit in said request compliance with the requirements of information security, operational risk management, protection of the Issuing Customers of the respective interested party, of Additional Risks management, and interoperability to operate with SPEI established in fractions I, II, IV, V and VI of Rule 58th, as well as in the 68th of these Rules. For such purposes, the interested party must attach to the referred admission request, in the terms established in Appendix N of the Manual, the following documentation: I. and II. … III. A compliance report signed by an Independent External Auditor indicating the level of compliance by that interested party of each of the requirements referred to in this Rule, as well as any other risk identified by said Independent External Auditor, different from those indicated in the first paragraph of this Rule.”

… … 68th. … … “Participants that have the status of securities deposit institutions, the departments and entities of the Federal Public Administration other than development banking institutions, as well as those referred to in the 56th, fractions III and IV of these Rules, are exempt from what is provided in this Rule.”

72nd. … I. “Collect from each of the Customers that carry out operations through the SPEI, at least, their name, denomination or trade name, as well as the Unique Population Registry Key (CURP) or the Federal Taxpayer Registry with homoclave for natural persons and legal entities, except in the case that the Customers, by their nature, cannot have these data, and they must include said information in the Send Requests that the Issuing Customers present;” I. Bis to IV. ... … “74th Periodic Report and Evaluation.- Each Participant must verify compliance with the requirements of information security, operational risk management, and protection of the Issuing Customers of the Participant, of Additional Risks and interoperability to operate in the SPEI established in the 58th of these Rules, as well as inform about any other risk identified, through reviews carried out every two years, alternately, by the head of the internal audit area of the respective Participant and the Independent External Auditor(s), in the immediate next evaluation period. Said reviews must observe what is provided in fractions II and III of the 62nd of these Rules. In the event that the Participant does not have an internal audit area, it must carry out the aforementioned reviews in all cases by Independent External Auditors.

… The report and certificate referred to in the previous paragraph must be sent through the Business Operation and Continuity Management of the Payment Systems in terms of what is established in Appendix N of the Manual, within sixty natural days following the close of the exercise in question.”

… … 83rd. … I. … a) to c) …

(Second Section) OFFICIAL GAZETTE Monday, May 20, 2019 d) “The CLABE, the debit or credit card number or the mobile phone line number indicated in the Transfer Order to identify the respective Customer Account corresponding to the Beneficiary Customer; e) Name, denomination or trade name of the respective beneficiary, as it has remained indicated by the Issuing Customer in the respective Send Request, followed by the following phrase: “(Data not verified by this institution)”, except for CoDi Transfer Orders, for which the aforementioned phrase must not be included; f) … g) The information of the Numerical Reference field indicated for the Send Request that, in its case, has been provided by the Issuing Customer or the Beneficiary Customer in the case of Send Requests corresponding to CoDi Transfer Orders; h) In its case, the information of the Payment Concept field indicated for the Send Request, and i) In the case of CoDi Transfers, the information of the folio field of the Digital Collection Scheme in accordance with Appendix AD of the Manual. II. In the case of the Receiving Participant, it must provide to the Beneficiary Customer the information indicated in subsections b), c), f), g), h) and i) of the previous fraction I, as well as the following information: a) … b) The CLABE of the Customer Account corresponding to the Issuing Customer that has presented the Send Request to the Issuing Participant, and c) … III. … In the case of CoDi Transfer Orders, Participants must indicate to their respective Clients that the operation corresponds to the CoDi scheme through the following phrase “Operation processed by CoDiⓇ ”

84th. … I. and II. … III. “In addition to what is provided in the previous fractions, Participants must include the information referred to in the previous Rule in the same means that they have made available to their respective Clients to present Send Requests and said means, in turn, allow them to consult the details of the movements of the respective Customer Accounts that they hold. Regarding this, Participants must include said information in the referred means, no later than sixty seconds following the moment the Administrator has made available to the Participant the respective Liquidation Notice of the Transfer Order in question, as well as keep it for consultation in said means for a period not less than two months following the one in which the referred liquidation has been carried out. Participants are exempt from including the referred information when Issuing Customers have presented the Send Requests through automated teller machines;” IV. to VI. …

86th. … I. … II. “In the event that the Receiving Participant has failed to meet the term provided in the 19th of these Rules, said Participant must pay the amount resulting in accordance with what is provided in the 87th of these Rules. In this scenario, the Participant must credit, no later than the close of the immediate next SPEI operation day following the one in which the referred non-compliance occurred, the amount referred to in this subsection in the same Customer Account corresponding to the Beneficiary Customer of the Transfer Order in question, and III. In the event that the Receiving Participant has failed to meet any of the terms provided in the 25th and 30th of these Rules, said Participant must pay to the Issuing Participant of the Transfer Order

Monday, May 20, 2019 OFFICIAL GAZETTE (Second Section) Transfer Order subject to the return referred to in said Rules, the amount resulting in accordance with what is provided in the 87th of these Rules. In this scenario, the Receiving Participant must send to the Issuing Participant the Transfer Order of the type of non-credited return to the Customer Account late or, as the case may be, the type of credited return to the Customer Account late, for an amount equal to the sum of the original amount plus the amount resulting in accordance with what is provided in the 87th of these Rules. The Issuing Participant is obliged to carry out the credit of the amount of the cited Transfer Order of the respective return type, in the Customer Account corresponding to the Issuing Customer that has instructed the Transfer Order subject to the return.

… As an exception to what is provided in this Rule, in the event that Participants receive the Transfer Orders Accepted by SPEI during the five consecutive minutes immediately prior to the end of the SPEI operation schedule specified in the 35th of these Rules, which require being returned in accordance with what is established in the 23rd or 30th of these Rules, Participants may send the Transfer Orders of the corresponding return type no later than in the first 5 minutes of the immediate next SPEI operation day following the one in which they have received the original Transfer Orders. In this case, the referred Participants are exempt from paying the compensation referred to in the 87th of these Rules.”

88th. … “Issuing Participants must abstain from charging any commission to their Issuing Customers for the sending of CoDi Transfer Orders, as well as for the receipt and processing of the Collection Messages that said Customers receive. Receiving Participants must abstain from charging any commission to their Beneficiary Customers for the generation and sending of the Collection Messages.”

“90th Fee for use of SPEI.- Each Participant must pay to the Administrator, for the use of the SPEI in each month, no later than the tenth Banking Business Day of the immediate next month following the one to which it corresponds, the fixed fee determined in accordance with what is provided in this Rule, which will allow it to send any quantity of Transfer Orders and receive any quantity of Transfer Orders Accepted by the SPEI, provided that this does not affect the proper functioning of the system. Likewise, each Participant must pay, for each month, no later than the tenth Banking Business Day of the immediate next month following the one to which it corresponds, a fee for operations related to the number of transfer requests sent, returns received of Transfer Orders Accepted by SPEI not credited to Customer Accounts, late or not, Transfer Orders sent to the CLS and bytes retransmitted.”

… … … … “97th Additional scenarios corresponding to fees and other considerations.- The fees that the Administrator charges Participants will be subject to the following: I. The fees corresponding to Transfer Orders of the return type, late or not, of Transfer Orders Accepted by SPEI credited or not credited to Customer Accounts will be borne by the Issuing Participants of the original Transfer Orders. II. Transfer Orders corresponding to CoDi Transfers will not be considered for the calculation of the fees for the use of the SPEI referred to in the 90th, 91st and 93rd of these Rules. III. In the event that the Administrator determines that the application of any rate or fee established in these Rules is not appropriate, derived from the contingency operation and the analysis of the situation that arises, it will inform said Participants in writing to whom it is applicable. IV. With respect to the consideration that the Participant must pay to the Administrator for the use of the latter's facilities in the scenario referred to in the last paragraph of the previous 46th Rule, the Administrator will inform said Participant of the corresponding rates for the calculation of the referred consideration. The Administrator will inform Participants of said rates through electronic communication that the Administrator sends to the email addresses that they have made known to it, in accordance with the model contained in the Manual, no later than the last

(Second Section) OFFICIAL GAZETTE Monday, May 20, 2019

Business Day of the month of November of the year immediately preceding that to which they correspond in accordance with what is provided in Rule 90a of these Rules.

During the period in which the Participant in question carries out its operation in the SPEI at the Administrator's facilities, in accordance with what is provided in Rule 46a of these Rules, the Administrator will inform monthly the amount of the consideration that said Participant must pay, no later than the fifth Business Day of the month immediately following that in which the calculation is made, through an electronic communication sent to the email addresses that the Participant has made known to the Administrator in accordance with the model included in the Manual for these purposes.

The Participant previously referred to must cover the applicable consideration no later than the tenth Business Day of the month immediately following that in which the respective calculation was made.”

“98a. Sending of digital communications to the Administrator. The communications referred to in Rules 37a, 40a, 46a, 46a Bis, 53a, 54a, 55a, 57a, 60a, 66a, 69a, 70a, 72a, 73a, 74a, 78a, 95a, and Annex I of these Rules must be sent by the Participants via email to the Payment Systems Help Center in accordance with what is established in section 5 of the Manual.

…

…

…

In cases where the Participant does not have access to the necessary elements to send digitally signed requests, it may deliver to the Operations and Business Continuity Management of the Payment Systems the communications in original, in duplicate, and signed by persons whose signature has been previously registered with said Management for the management of operations and various requests to operate with the Bank of Mexico, adding a communication in which they specify the reason why they are in the need to send communications by this alternative means, as well as the date on which they will remedy the situation that prevents them from sending digital communications in accordance with the first and second paragraphs of this Rule.”

“98a. Bis Communications from the Administrator to the Participants. The communications that the Administrator sends to the Participants from the email address of the Payment Systems Help Center, established as casp@banxico.org.mx, which contain the digital signature of the officials with the authority to do so, will be considered as communications validly sent on behalf of the Administrator for all legal purposes.

“100a. Confidentiality of information by the Participant.- Participants must maintain strict confidentiality regarding all information, whether expressed orally, in writing, graphically, electronically, or in any other form, that is provided to them by their Clients, any other Participant, or the Administrator in connection with their operation in the SPEI.

Participants must use the information referred to in the preceding paragraph exclusively for the purposes provided in these Rules. Likewise, Participants are obligated to give access to the information only to the necessary persons for the compliance with these Rules and will be responsible for the use that their personnel, representatives, administrators, directors, employees, agents, dependents, or any person related to the Participant, make of the aforementioned information. The obligation provided in this Rule will continue to be applicable to the Participants even if they cease to act as such.”

…

TRANSITIONAL PROVISIONS

FIRST.- The provisions of these Rules will enter into force on September 30, 2019.

SECOND.- During the period between the date of publication in the Official Gazette of the Federation of this Circular and the date specified in the first transitional article, Participants may offer their respective Clients to send and receive fund transfers derived from CoDi Transfer Orders, provided that they comply with what is provided regarding this in this Circular. For these purposes, Participants interested in offering their Clients the aforementioned must present their respective request to the Administrator formulated in accordance with the Model established in Annex 1 of Appendix AE of the Manual, as well as certify the certification tests in terms of Appendix O of the Manual.

Monday, May 20, 2019 OFFICIAL GAZETTE (Second Section)

The presentation of the aforementioned request, as well as the certification of the tests of the Participants who offer their Clients the sending or receipt of CoDi Transfer Orders comprised between the date of entry into force indicated in the first paragraph of the previous Transitional Rule and the date specified in the second paragraph thereof, implies the acceptance by the respective Participant to obligate themselves to comply with the Rules established in this Circular and with what is specified regarding this in the Manual.

THIRD.- From the entry into force of these Rules and for a period of 120 Business Days, a deadline of up to three seconds must be observed in those cases contemplated in Rule 17a, last paragraph, and 19a, fraction VI, of these Rules regarding the sending to the Administrator of the CoDi Transfer Order generated as a result of the acceptance of Collection Messages, as well as to carry out the credit to the respective Client Account corresponding to the Beneficiary Client indicated in the CoDi Transfer Order itself.

FOURTH.- From the entry into force of these Rules and for a period of 120 Business Days, a deadline of up to three seconds must be observed in those cases contemplated in Rule 25a, fraction VII, of these Rules, regarding the sending of Transfer Orders of the return type referred to in said Rule, as well as the processing notices, in relation to CoDi Transfer Orders.

FIFTH.- Until such time as the Participants and, if applicable, the Administrator do not modify the documentation they use in their operation in the SPEI, including the Collaboration Agreement for the Protection of Issuing Clients referred to in Rule 43a of these Rules, the references to the term “Return” will be understood as the issuance of Transfer Orders of the return type for transfers credited to Client Accounts and, on the other hand, the references to the term “Return” (Devolución) will be understood as the issuance of Transfer Orders of the return type for transfers not credited to Client Accounts.

SIXTH.- The provisions of Rule 58a, fraction IV, literal C, and 43a of these Rules, regarding the obligation of Participants to celebrate a Collaboration Agreement for the Protection of Issuing Clients, will enter into force 120 Business Days after the date provided in the first transitional article.

SEVENTH.- During the period between the date of publication in the Official Gazette of the Federation of this Circular and the date specified in the first transitional article, with respect to those entities that, on the date of entry into force of the Rules issued by the Bank of Mexico through Circular 14/2017, published in the Official Gazette of the Federation on July 4, 2017, have the status of SPEI Participants in accordance with the “Rules of the Interbank Electronic Payment System”, issued by the Bank of Mexico through Circular 17/2010 published in the Official Gazette of the Federation on June 15, 2010, in terms of the corresponding modifications made known through Circulares 24/2011, 4/2013, 6/2014, 20/2014, 2/2015, 4/2015 and 13/2015, published in said Gazette on December 2, 2011, December 6, 2013, April 29, 2014, December 12, 2014, January 16, 2015, March 6, 2015 and August 31, 2015, respectively, must celebrate with the Administrator a unilateral confidentiality contract in terms of the clauses that the Administrator, through the Operations and Business Continuity Management of the Payment Systems, makes available to them in accordance with what is provided in Rule 57a of the Rules, no later than the fortieth Business Day following the date of publication of these Rules in the Official Gazette of the Federation, for which they must present to said Management, a certified and simple copy of the deed in which the granting of power for acts of domain of the person or persons who intend to sign the contract is recorded, as well as a simple copy of their official identification, no later than the fifteenth Business Day following the date of publication of these Rules in the Official Gazette of the Federation.

The aforementioned entities must deliver to the Bank of Mexico the respective contracts duly signed by their representatives with at least five Business Days in advance of the date on which the period referred to in the previous paragraph concludes.

EIGHTH.- The provisions of Rule 17a, third paragraph and its fractions I, II, III and IV, as well as the fifth paragraph, Rule 25a Bis, the seventh and ninth paragraphs of Rule 46a, Rule 53a, Rule 86a, Rule 97a, Rule 98a and Rule 98a Bis of these Rules will enter into force on the Business Day following the publication of these Rules in the Official Gazette of the Federation.

NINTH.- For the case of Participants other than Credit Institutions that have the status of Participants on the day of publication of these Rules, the obligations established in Rule 45a, fraction IV, what is established in the fourth and eighth paragraphs of Rule 46a and what is established in Rule 58a, fraction III, literal e) will enter into force on the last Business Day of the month of March 2020.

(Second Section) OFFICIAL GAZETTE Monday, May 20, 2019

TENTH.- The provisions of the fifth and sixth paragraphs of Rule 46a of these Rules will enter into force on September 30, 2020.

ELEVENTH.- As an exception to what is provided in the first paragraph of fraction IV of Rule 97a, the Administrator will inform the Participants of the tariffs corresponding to the service established in the last paragraph of Rule 46a that the Participants must cover from the date of notification of the tariffs by the Administrator to the Participants and until the last day of the year of publication of this Circular. For such purposes, the Administrator will notify the Participants of the aforementioned tariffs, through an electronic communication that the Administrator itself sends to the email addresses that the Participants have made known to it, in accordance with the model contained in the Manual, no later than the tenth Business Day following the publication of these Rules in the Official Gazette of the Federation.

Mexico City, May 13, 2019.- The General Legal Director, Luis Urrutia Corral.- Rubric.- The Director of Payment Systems, Manuel Miguel Ángel Díaz Díaz.- Rubric.

For any queries regarding the content of this Circular, please contact the Central Bank Authorizations and Consultations Management, at the phones (55) 5237-2308, (55) 5237-2317 or (55) 5237-2000 Ext. 3200.