General Provisions Applicable to Financial Technology Institutions

GENERAL PROVISIONS APPLICABLE TO FINANCIAL TECHNOLOGY INSTITUTIONS Published in the Official Gazette of the Federation on September 10, 2018, modified through resolutions published in the said Gazette on March 25, 2019; December 15, 2021; January 20, 2023; September 2, 2024; July 24 and September 9, 2025, as well as July 6, 2026.

The National Banking and Securities Commission, prior to the opinion of the Interinstitutional Committee, based on the provisions of articles 17, 18, fractions I, II and III, 19, fraction IV, 36, fraction IV, 39, fractions V, VI, XI, XII and XVI, 41, 44, 45, 48, first paragraph, 49, first paragraph, 54 and 64 of the Law to Regulate Financial Technology Institutions; 4, fractions XXXVI and XXXVIII, 16, fraction I and 19 of the Law of the National Banking and Securities Commission, and

CONSIDERING

That in accordance with article 78 of the General Law for Regulatory Improvement and with the purpose of reducing the compliance cost of these provisions, the National Banking and Securities Commission, through a resolution published in the Official Gazette of the Federation on July 24, 2017, reformed the General Provisions applicable to stock brokerage houses to flexibilize an accounting criterion and establish as a fortuitous scenario that these financial entities may consider, when selling or reclassifying securities held to maturity, the deterioration of the issuer's credit rating, as well as changes in tax laws that affect the tax treatment of the instrument's yields and, therefore, its value;

That on March 9, 2018, the “Decree establishing the Law to Regulate Financial Technology Institutions and reforming and adding various provisions of the Credit Institutions Law, the Securities Market Law, the General Law of Organizations and Auxiliary Credit Activities, the General Law for Transparency and Order of Financial Services, the Law to Regulate Credit Information Societies, the Law for the Protection and Defense of Users of Financial Services, the Law to Regulate Financial Groupings, the Law of the National Banking and Securities Commission, and the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin” was published in the Official Gazette of the Federation;

That the Law to Regulate Financial Technology Institutions incorporates financial technology institutions into the national financial system while empowering the National Banking and Securities Commission to issue general provisions, under the principles of inclusion and financial innovation, promotion of competition, consumer protection, preservation of financial stability and technological neutrality, and that such provisions refer to diverse matters such as requirements for authorization to act as a financial technology institution, minimum capital, accounting, exceptions for receiving cash resources or making or receiving national or international transfers, mandates and commissions for operational matters regarding crowdfunding institutions, authorizations to obtain financing to allocate resources to schemes for aligning incentives of crowdfunding institutions, statements on risks, methodologies for assigning risk grades to resource applicants in crowdfunding institutions, and business continuity plans, among others;

That in order to have timely regulation for financial technology institutions, the aforementioned Decree established deadlines for the Commission to issue the applicable regulations, and in accordance with such mandate, as well as the aforementioned principles contained in the Law, the provisions are issued that will allow, on the one hand, to have a clear regulatory framework that provides legal certainty to participants, fostering the growth of financial technology institutions, and on the other hand, safeguarding the interests of their clients and the financial system as a whole;

That in this way, the information and documentation that applicants intending to maintain a participation in the share capital of financial technology institutions must present are established, as well as that related to the sole administrator or board members and general manager, including the financial situation and origin of resources in the case of shareholders, as well as that which allows verifying the honorability, credit history and satisfactory business history of all the aforementioned persons; likewise, the requirements for those persons or investment vehicles intending to acquire or grant as collateral securities representing the share capital of the aforementioned financial entities are determined;

That additionally, the minimum capital amount for financial technology institutions is fixed, taking into account the type of operations authorized to them, as well as the additional activities they intend to carry out and the risks they face;

That in view of the fact that there are currently companies carrying out activities reserved by the aforementioned Law and allowing the receipt and delivery of cash resources, as well as transfers of resources with persons other than financial entities, a simple procedure is established in order to continue incentivizing the financial technology institution sector without obstructing their operations, specifying the limits and necessary conditions for these financial technology institutions to continue receiving cash resources and making the aforementioned transfers, while always ensuring the consistency of these provisions with those established to prevent money laundering and terrorism financing;

That in order to have transparent, reliable and comparable financial information, for the benefit of the financial technology institutions themselves, as well as for the supervision functions that the National Banking and Securities Commission will carry out regarding these entities, and for the general public, specific accounting criteria applicable to these institutions are established, which are consistent with the type of operations they carry out, even those involving virtual assets; such accounting criteria generally recognize the financial information standards issued by the Mexican Council of Financial Information Standards for the non-specialized operations of financial technology institutions, and regarding specific ones, the Commission developed specific criteria;

That in this same order of ideas, the treatment related to the preparation of financial information is specified, making consistent the application of accounting criteria with the preparation and formulation of financial statements and their submission to the Commission;

That it is indispensable, for the benefit of investors in crowdfunding institutions, to establish the minimum characteristics that electronic statements of knowledge of risks must contain, which such institutions must obtain from them, which will result in them clearly knowing the risks to which their investment will be subject;

That it is deemed necessary to provide the requirements that crowdfunding institutions must observe to comply with the obligations to establish and make known to potential investors the criteria applied for the selection of applicants and projects subject to financing, the information and documentation analyzed for such purposes, the activities carried out to verify the truthfulness and authenticity of such information and documentation, as well as to issue the minimum elements that evaluation and qualification methodologies for applicants and projects will contain, in order to determine their risks, which will result in a more transparent provision of services;

That it is convenient to establish limits for operations in crowdfunding institutions, taking into consideration the regulation applicable to other figures in the financial system, even the amount of those capital securities issuances registered in the National Securities Register kept by the National Banking and Securities Commission, as well as the principles contained in the Law itself regarding innovation, competition and financial inclusion, therefore, in view of this, the limits that crowdfunding institutions must observe regarding the resources that investors may allocate to each financing operation and those that applicants or projects may require through the aforementioned institutions are determined, thereby fostering the growth of these and avoiding the placement of resources without the same standards applicable to others carrying out similar activities, in protection of the interests of the investing public;

That equally, in order to ensure adequate, transparent and equitable provision of services by crowdfunding institutions, granting greater legal certainty and security to operations, the terms for the execution of mandates and commissions carried out are indicated, so that their clients carry out operations, particularly regarding those used for the reinvestment of resources, the extrajudicial collection of granted financings, and the representation of investors in assemblies or other collegiate decision-making bodies of applicants;

That since the infrastructure used by crowdfunding institutions is technological and susceptible to failures due to unforeseen situations or events, it is necessary to provide for the obligation to have a business continuity plan that must be implemented in contingency situations, in order to have minimum standards that reduce the risks to which they are exposed, providing greater legal certainty to their operations and clients, considering the lessons learned due to emergency situations in Mexico and other countries, and

That it is opportune to issue a single legal instrument containing the provisions applicable to financial technology institutions, systematizing their integration and homologating the terminology used, in order to thereby provide legal certainty regarding the regulatory framework to which the aforementioned institutions must adhere in the development of their operations, which will also facilitate consultation, compliance and observance of the provisions applicable to them, has resolved to issue the following:

GENERAL PROVISIONS APPLICABLE TO FINANCIAL TECHNOLOGY INSTITUTIONS

FIRST TITLE
General Provisions

SECOND TITLE
Common Provisions for FTIs

Chapter I
On additional information and documentation to request authorization to act as an FTI

Chapter II
On minimum capital

Chapter III
On limits for receiving cash resources and transferring resources

(7) Chapter IV
(7) On accounting, valuation of Securities and other financial instruments, as well as virtual assets, financial information and its disclosure

(7) First Section
(7) On Accounting Criteria

(7) Second Section
(7) On the valuation of Securities and other financial instruments, as well as virtual assets

(7) Section A
(7) General Provisions

Section B
On the contracting of Price Providers

Section C
On Internal Valuation Models

Section D

(9) (Repealed)

Third Section
On financial statements, disclosure of financial information and texts to be noted at the foot

THIRD TITLE
On crowdfunding institutions

Chapter I
On the electronic statement on risks

Chapter II
On the evaluation, selection and qualification methodology for applicants and projects

Chapter III
On the resource limits that crowdfunding institutions may maintain in the name of their Clients

Chapter IV
On mandates and commissions

Chapter V
On the Business Continuity Plan

(2) Chapter VI
(2) On information security

(2) Chapter VII
(2) On the use of electronic media

(2) Chapter VIII
(2) On the contracting of services with third parties

(2) Chapter IX
(2) On the disclosure of information

(2) First Section
(2) On the disclosure of information in the publication of applications and projects

(2) Second Section
(2) On the disclosure of payment behavior and performance of the Applicant or project

(2) Third Section
(2) On the disclosure of information to the general public

(2) FOURTH TITLE
(2) On regulatory reports

(2) Chapter I
(2) On reports in general

(2) Chapter II
(2) On delivery means

List of Annexes

ANNEX 1 Format of curriculum information for persons proposed to occupy the positions of sole administrator or, in their case, board member and general manager of an FTI.

ANNEX 2 Format of protest letter for persons proposed to occupy the positions of sole administrator or, in their case, board member and general manager of an FTI.

ANNEX 3 Format of information for persons or Private Capital Funds intending to participate in the share capital of an FTI, or intending to receive as collateral, shares of the share capital of an FTI.

ANNEX 4 Format of protest letter for persons or Private Capital Funds intending to participate in the share capital of an FTI, or intending to receive as collateral shares of the share capital of an FTI.

ANNEX 5 Format of protest letter for managers of Private Capital Funds.

(16) ANNEX 6 Accounting criteria for crowdfunding institutions.

(16) ANNEX 7 Accounting criteria for electronic payment fund institutions.

(3) ANNEX 8 Instruction for obtaining electronic statements of knowledge of risks.

(3) ANNEX 9 Format of declarations regarding compliance with requirements to be considered as an Experienced Investor.

ANNEX 10 Minimum requirements to develop the Business Continuity Plan.

(2) ANNEX 11 Incidents affecting information security

(2) ANNEX 12 Information Security Incident Report

(2) ANNEX 13 Information security indicators

(2) ANNEX 14 Format of information on systems and applications

(2) ANNEX 15 Guidelines for the disclosure of information for Crowdfunding of Business Loan Debt between Persons and for Real Estate Development

(2) ANNEX 16 Guidelines for the disclosure of information for Crowdfunding of Capital

(2) ANNEX 17 Aggregated information of crowdfunding institutions for disclosure to the general public

(10) ANNEX 18 Regulatory reports of crowdfunding institutions (CFI)

(13) ANNEX 19 Regulatory reports of electronic payment fund institutions (EPFI)

(2) ANNEX 20 Designation of responsible persons for the submission and quality of information

(18) ANNEX 21 Formats for the submission of information to the National Banking and Securities Commission

FIRST TITLE
General Provisions

Article 1.- These provisions aim to establish the regulatory framework applicable to the organization of FTIs and the operation of crowdfunding institutions.

(1) Article 2.- In addition to the definitions contained in the Law, for the purposes of these provisions, the following shall be understood, in singular or plural:

(1) I. Authentication, the set of techniques and procedures used to verify the identity of a Client and their authority to carry out operations through the Electronic Medium in question or a Technology Infrastructure User to access, use or operate any component of the Technology Infrastructure.

(1) II. Blocking, the process by which the crowdfunding institution disables the use of an Authentication Factor or Client Identifier temporarily or permanently.

(1) III. Encryption, the mechanism that crowdfunding institutions must use to protect the confidentiality of information through cryptographic methods in which algorithms and encryption keys are used.

(1) IV. Investment Commitments, the contributions that Investors have committed to make in favor of Applicants during the Crowdfunding Financing Application Period, regardless of whether the corresponding contributions are delivered to the crowdfunding institutions during said period or to the Applicants after its term.

(1) V. Cloud Computing, the model of external provision of on-demand computing services and shared infrastructure, regardless of the physical location of the third party's technological infrastructure providing the service, which may be one or more of the following digital service schemes: infrastructure as a service, platform as a service, or software as a service.

(1) VI. Operational Contingency, any event that hinders, limits or prevents a crowdfunding institution from providing its services or carrying out those processes that could affect its Clients.

(1) VII. Password, the alphanumeric and special character string that authenticates a Client in the Electronic Medium of the crowdfunding institution.

(8) VIII. Accounting Criteria, the “Accounting Criteria for Crowdfunding Institutions and Accounting Criteria for Electronic Payment Fund Institutions” referred to in Title Two, Chapter IV, First Section, contained in Annexes 6 and 7 of these provisions.

(7) IX. Destination Accounts, the accounts receiving monetary resources that Clients of the crowdfunding institution register in the corresponding Electronic Medium to carry out Operations.

(7) X. Unblocking, the process by which the crowdfunding institution enables the use of an Authentication Factor or Client Identifier that was previously blocked.

(7) XI. Access Device, the equipment that allows a Client to access the corresponding Electronic Medium of the crowdfunding institution.

(7) XII. Information Security Event, any internal or external event related to Clients, third parties contracted by the crowdfunding institution itself, persons and operational processes, as well as components of the Technology Infrastructure, devices, physical media or other elements that store information, among others, that may imply an impact on the confidentiality, integrity or availability of the information that the institution manages or knows, or in the Technology Infrastructure itself.

(7) XIII. Authentication Factor, the Authentication mechanism based on the physical characteristics of the Client, devices or information that only the Client possesses or knows.

(7) XIV. Crowdfunding of Capital, the crowdfunding operation through which Applicants obtain resources from Investors in exchange for securities representing their share capital.

(7) XV. Crowdfunding of Co-ownership or Royalties, the crowdfunding operation through which Investors and Applicants enter into participation agreements or any other type of agreement whereby Investors acquire a proportional share or participation in a present or future asset or in the income, profits, royalties or losses obtained from the realization of one or more activities or from the Applicants' projects.

(7) XVI. Crowdfunding of Business Loan Debt between Persons, the crowdfunding operation in which Applicants are legal entities or natural persons with business activity and Investors make contributions:
a) With the aim that Applicants receive a loan or credit to finance their activities, being obligated to pay the principal and, in their case, accessories to each Investor in proportion to their contributions in the Operation. b) With the object of carrying out a financial leasing operation, in which an asset is acquired in the name of the Investors, or by the crowdfunding institutions in their own name, but on their behalf, and is given in financial lease to the Applicant. For the purposes of the financial leasing operation, the provisions of the General Law of Securities and Credit Operations shall apply. c) With the aim of carrying out a factoring operation, in which they acquire part of some credit right that the Applicant has in their favor, with the Applicant remaining jointly liable for their debtor, without such right deriving from loans, credits or loans previously granted by the Applicant. For the purposes of the factoring operation, the provisions of the General Law of Securities and Credit Operations shall apply.

(7) XVII. Crowdfunding of Personal Loan Debt between Persons, the crowdfunding operation in which the Applicant is a natural person who obtains a loan of the resources contributed by the Investors, being obligated to pay the principal and, in their case, accessories, to each Investor in proportion to their contributions in the Operation.

(7) XVIII. Crowdfunding of Debt for Real Estate Development, the crowdfunding operation whereby Investors grant a loan or credit to Applicants intended for financing real estate development activities, being obligated to pay the principal and, in their case, accessories, to each Investor in proportion to their contributions in the Operation.

(7) XIX. Private Capital Fund, an investment vehicle, trust, mandate, commission or similar figures constituted under Mexican or foreign laws, whose purpose is to invest

in the capital of companies not listed on stock exchanges at the time of the investment to promote their development and provide them with financing.
(7) XX. Customer Identifier, the alphanumeric or special character string, information from a device or any other information known by both the crowdfunding institution and the Customer, which allows identifying the Customer in the Electronic Medium of the crowdfunding institution.
(7) XXI. Information Security Incident, the Information Security Event in the crowdfunding institution when it updates any of the following assumptions:
a) It has compromised the confidentiality, integrity or availability of a component or the entirety of the Technological Infrastructure with an adverse effect for the crowdfunding institution, its Customers, third parties, suppliers or counterparties, among others. b) It violates the Technological Infrastructure compromising the information that processes, stores or transmits. c) It constitutes a violation of the information security policies and procedures. d) It represents the materialization of a loss, whether by extraction, alteration or loss of information; due to failures derived from the use of hardware, software, systems, applications, networks and any other channel of information transmission; by unauthorized accesses resulting in the improper use of information or systems; by fraud, theft, or interruption of services, attacks on interconnected infrastructures, known as cyberattacks, among others. (7) XXII. Sensitive Information, the personal information of Customers containing names, addresses, telephone numbers, email addresses or any other data that identifies the Customer, together with account numbers, card numbers and other data of a financial nature, as well as Customer Identifiers or Authentication information. (7) XXIII. Investor, the natural or legal person who contributes resources or virtual assets to the Applicants for the celebration of crowdfunding operations. (7) XXIV. Experienced Investor, any of the following:
a) Financial entities referred to in article 21, third paragraph of the Law, as well as other financial entities that according to their legal regime may act as Investors in the Operations in question. b) Foreign financial entities, provided that the crowdfunding institution has obtained authorization from the CNBV to receive or make transfers in terms of article 10 of these provisions. c) Departments and entities of the Federal Public Administration. d) Persons who declare themselves to be in the situation indicated in Annex 9 of these provisions. (7) XXV. Related Investor, one who declares to crowdfunding institutions having kinship with the Applicant by blood, affinity or civil law up to the fourth degree or being their spouse, concubine or concubinary.

(7) XXVI. Law, the Law to Regulate Financial Technology Institutions.
(7) XXVII. Electronic Media, the equipment, optical media or any other technology, automated data processing systems and telecommunications networks, whether public or private, including the Platform, that crowdfunding institutions use to provide their services.
(7) XXVIII. Personal Identification Number (PIN), the Password that authenticates a Customer in the Electronic Medium of the crowdfunding institution through a string of numerical characters.
(7) XXIX. Administrative Body, the sole administrator or the board of directors of an FTI.
(7) XXX. Business Continuity Plan, the set of strategies, procedures and actions that allow, upon verification of Operational Contingencies, the continuity of the Operations, activities or the execution of critical processes of crowdfunding institutions, or their timely restoration, as well as the mitigation of the effects resulting from such Operational Contingencies. (7) XXXI. Security Master Plan, the document that establishes the security strategy of a crowdfunding institution in the short, medium and long term to ensure correct management of information security and prevent Information Security Events from materializing as Information Security Incidents. (7) XXXII. Platform, computer applications, interfaces, Internet pages or any other electronic or digital communication medium that crowdfunding institutions use to operate with their Customers. (7) XXXIII. Crowdfunding Application Period, the period during which a crowdfunding application can remain published on the Platform of a crowdfunding institution for the purpose of offering Investors the celebration of an Operation with Applicants. (7) XXXIV. Credit Information Report, any of the credit reports issued by credit information societies referred to in article 36 Bis of the Law to Regulate Credit Information Societies, namely:
a) The one issued by a credit information society that includes the information contained in the databases of other credit information societies. b) Those issued by each of the credit information societies.
(7) XXXV. Session, the period during which Customers can carry out queries and Operations, once they have entered the Platform with their Customer Identifier.
(7) XXXVI. SITI, the Interinstitutional Information Transfer System, which is part of the CNBV's official records office.
(7) XXXVII. Applicant, the natural or legal person who has requested resources or virtual assets from Investors, through crowdfunding institutions.
(7) XXXVIII. UDI, the account units called “Investment Units” established in the “Decree establishing the obligations that may be denominated in Investment Units and reforming and adding various provisions of the Federal Tax Code and the Income Tax Law”, published in the Official Gazette of the Federation on April 1, 1995, as it may be modified or added from time to time.

(7) XXXIX. User of the Technological Infrastructure, the person, Customer or physical or logical component that accesses, uses or operates any component of the Technological Infrastructure of crowdfunding institutions.”
TITLE SECOND
General Provisions for FTIs
Chapter I
Regarding information and additional documentation to request authorization to act as an FTI
Article 3.- Authorization requests to organize and operate as an FTI must
be accompanied, in addition to the information and documentation indicated in article 39 of the Law, by the following:
I. Regarding the positions of possible sole administrator or members of the board of
directors and general manager, they must present the information indicated in Annexes 1 and 2 of these provisions, attaching the documentation indicated in them.
II. Business plan, which must contain at least the following:
a) The operations to be carried out in accordance with articles 16 and 19 of the Law for the case of crowdfunding institutions and with articles 22 and 25 of the same legal instrument, regarding electronic payment fund institutions. b) The commissions and any other charges or withholdings to be charged for the services provided. c) Regarding electronic payment fund institutions, the link costs with payment systems, as well as the technical and security characteristics of such links. d) The characteristics of its Technological Infrastructure.
III. Financial viability study for the first three years of operation of the FTI, which
must contain, at least, the following:
a) The general description of the financial model used, indicating the main assumptions used, as well as expected income from the collection of commissions and corresponding consideration. b) The projected financial statements for the first three years of operation of the FTI, in which it is shown that it has sufficient resources to maintain adequate operation for at least that period, which must be prepared in accordance with Annexes 6 or 7 of these provisions, as applicable.
IV. The proposed name for the FTI, as well as the trade name or brand it will use
when offering its services to the public.
V. The draft manuals for operations, internal control and risk management,
as well as the bases regarding the organization and internal control of the FTI, including the structure of its administrative and oversight bodies.
VI. The copy of the document issued by the CNBV, in which the valid certification
of the compliance officer to be appointed by the FTI is stated, obtained in terms of the “General Provisions for the certification of independent external auditors, compliance officers and other professionals in matters of prevention of operations with proceeds of illicit origin and financing of terrorism”, published in the Official Gazette of the Federation on October 2, 2014 and their respective modifications.
VII. If applicable, the requests referred to in articles 9, 10 and 11 of these provisions.
Article 4.- Interested parties wishing to subscribe to the share capital of the company seeking authorization to organize and operate as an FTI must present the following information to the CNBV, as applicable:
I. When it is intended to directly or indirectly subscribe 10% or more of the share capital of an
FTI, the number, series, class and nominal value of the shares to be subscribed, unless the latter is omitted in terms of the articles of incorporation, as well as the amount and percentage that such shares will represent with respect to the share capital of the FTI.
Additionally, they must present the forms contained in Annexes 3 and 4 of these provisions, accompanied by the documentation indicated in them.
In the event that the subscription is intended to be carried out by a Private Equity Fund, the form contained in Annex 5 of these provisions must also be presented, accompanied by the documentation indicated in it.
In case of indirect participation schemes in the share capital of the FTI, the CNBV will evaluate, in terms of the Law, the suitability of any person or investment vehicle, trusts, mandates, commissions or other similar figures, that participate directly or indirectly up to the ultimate beneficiaries, for which all of them must present the information referred to in the second paragraph of this section.
II. When it is intended to directly subscribe shares representing less than 10% of the
share capital of an FTI, only their full name or, if applicable, designation or corporate name, nationality, address, Unique Population Registry Key, federal taxpayer registry or, if applicable, tax identification number or equivalent, as well as the country or countries that assigned them and occupation they perform or activities they carry out must be provided. As an exception to the above, when it is intended to directly subscribe shares representing less than the percentage indicated in the first paragraph of this section and more than 5% of the share capital of the FTI and such subscription exceeds an amount equivalent in national currency to 1,500,000 UDI’s, the information referred to in the first and second paragraphs of the previous section I must be presented. Regarding indirect participations less than 10% of the share capital of the FTI, only the information indicated in the first paragraph of this section must be provided.
III. For the case of Private Equity Funds whose direct participation in the share capital of the
FTI is greater than 10% but less than 50% and by an amount equivalent in national currency equal to or less than 833,000 UDI’s, they must only present Annex 3 regarding the Private Equity Fund and those persons who would maintain an indirect participation of 20% or more in the share capital of the FTI through the aforementioned fund, as well as the forms of Annexes 4 and 5 of these provisions.
IV. When potential shareholders of the FTI have the status of financial entity
supervised by the CNBV or by any other Supervisory Commissions, or these are shareholders of such entities and their participation has been authorized in a period no greater than five years prior to their request, they must only present a statement under oath of truthfulness stating that their financial situation has not changed in relation to that previously sent to the CNBV or the aforementioned Supervisory Commissions, in such a way that it prevents them from carrying out the acquisition in question. The foregoing, regardless of the powers with which the CNBV is endowed to corroborate the truthfulness of the information provided.

Without prejudice to the exceptions indicated in sections II to IV of this article, in all cases the potential shareholders must declare the origin of their investment resources, as well as present the information referred to in the first paragraph of section I above.
Article 5.- Any natural or legal person or Private Equity Fund may, through one or
multiple simultaneous or successive operations, acquire or receive in guarantee shares of the share capital of an FTI, provided that it is subject to the following:
I. Notify the CNBV, indicating their full name or, if applicable, designation or corporate
name, nationality, address, Unique Population Registry Key, federal taxpayer registry or, if applicable, tax identification number or equivalent, as well as the country or countries that assigned them, occupation they perform or activities they carry out, and origin of the investment resources, when:
a) The acquisition or receipt in guarantee of shares represents a direct participation less than 10% of the share capital of the FTI.
As an exception to the above, when it is intended to acquire or receive in guarantee directly shares representing less than the percentage indicated in the previous paragraph and more than 5% of the share capital of the FTI and is by an amount superior equivalent in national currency to 1,500,000 UDI’s, the authorization provided in the following section II will apply. b) The acquisition or receipt in guarantee of shares represents an indirect participation, through Private Equity Funds, less than 20% of the share capital of the FTI, provided that the direct participation in the share capital of the FTI of such funds represents more than 10% and less than 50% and does not exceed an amount equivalent in national currency to 833,000 UDI’s.
II. Obtain prior authorization from the CNBV, regarding persons intending to acquire,
directly or indirectly, shares representing 10% or more of the share capital of an FTI, or receive in guarantee shares representing such percentage, for which they must present with the respective request, the information and documentation referred to in section I of article 4 of these provisions.
III. Obtain prior authorization from the CNBV when a person or Group of Persons,
shareholders or not, intends to obtain Control of an FTI, having to present with the respective authorization request, the following information and documentation:
a) That referred to in section I of article 4 of these provisions. b) The list of directors or sole administrator they would appoint in the FTI from which they intend to obtain Control, to which must be attached the information referred to in section I of article 3 of these provisions, in order to prove that such persons meet the requirements established by the Law for those positions. c) The business plan of the FTI in question, which must contemplate the aspects indicated in section II of article 3 of these provisions. d) The documentation referred to in section V of article 3 of these provisions. Persons intending to indirectly acquire securities representing the share capital of an FTI due to the acquisition of shares of a controlling society of a financial group, are exempt from presenting to the CNBV the information referred to in the second paragraph of section I of article 4 of these provisions, provided that such persons have sent the information referred to in article 28 of the Law to Regulate Financial Groups to the Secretariat, in the respective authorization procedure before said dependency. For the purposes of the corresponding evaluation, the CNBV will take into account the information that it sends the Secretariat in accordance with said legal provision and other applicable provisions. The same exception will apply to the case of persons intending to indirectly acquire shares of an FTI due to the acquisition of shares of a financial entity supervised by the CNBV that requires authorization to carry it out. What is provided in the previous paragraph is without prejudice to the powers with which the CNBV is endowed to corroborate the truthfulness of the information provided, as well as to require in any case the presentation of the information and documentation referred to in the second paragraph of
section I of article 4 of these provisions.
Chapter II
Regarding minimum capital
Article 6.- The minimum capital with which crowdfunding institutions that have been authorized to carry out only one type of Operation in national currency indicated in sections I to III of article 16 of the Law must have, will be the equivalent in national currency to 500,000 UDI’s.
Regarding electronic payment fund institutions that have been authorized to carry out their Operations in national currency and whose authorization does not contemplate the carrying out of additional operations indicated in the second paragraph of article 7 of these provisions, the minimum capital with which they must have will be that indicated in the previous paragraph. In the event that an FTI obtains authorization to carry out additional operations referred to in article 7 of these provisions, it must have the minimum capital established in accordance with said article. FTIs that have obtained such authorization must present to the CNBV the data of inscription in the Public Commerce Registry of the reform to their articles of incorporation, in which additional operations are provided, within a period of 10 business days following the date of their registration.
Article 7.- The minimum capital with which crowdfunding institutions that have been authorized to carry out two or more types of Operations indicated in sections I to III of article 16 of the Law; carry out operations with virtual assets or foreign currency in accordance with what is established in article 16, fourth paragraph of the Law or, operate, design or commercialize financial derivative instruments that have virtual assets as underlying in accordance with article 33, second paragraph of the Law, will be the equivalent in national currency to 700,000 UDI’s.
Regarding electronic payment fund institutions that have been authorized to carry out their Operations in national currency, as well as to carry out any of the following:
operations with virtual assets; operations in foreign currency; acting as a clearing house in the networks of payment means in accordance with the Law for Transparency and Order of Financial Services, as well as operate, design or commercialize financial derivative instruments that have virtual assets as underlying in accordance with article 33, second paragraph of the Law, the minimum capital with which they must have will be that indicated in the preceding paragraph. When FTIs obtain the inscription of their Debt Securities in the National Registry of Securities of the CNBV, the minimum capital with which they must have will be the equivalent in national currency to 700,000 UDI’s, regardless of whether they fall under the situations provided in article 6 of these provisions. In the event that an FTI referred to in the first and second paragraphs of this article modifies its articles of incorporation to provide for the carrying out of only the Operations referred to in article 6 of these provisions, as applicable, it must have the minimum capital provided in the first paragraph of that article, also sending to the CNBV the agreement of the shareholders' meeting, the modified articles of incorporation insofar as they concern with the data of

registration in the Public Commerce Registry and the documentation accrediting the liquidation, conclusion, or assignment of obligations derived from the operations it has ceased to perform, within the 10 business days following the latest update thereof.

Article 8.- The minimum capital amount that ITFs must have must be subscribed and paid no later than the last business day of the relevant year. To this end, the value of the UDI corresponding to December 31 of the immediately preceding year will be considered.

Chapter III
Of the limits for the receipt of cash resources and transfer of resources

Article 9.- Electronic payment fund institutions must request authorization from the CNBV to receive or deliver cash resources in national currency to or from their Clients, indicating the means and mechanisms through which the receipt or delivery of said resources will be carried out. The aforementioned authorization will be granted for amounts that do not exceed the equivalent in national currency to 10,000 UDI’s monthly per Client regarding the receipt of cash resources and when they intend to deliver cash resources, the amount will be up to 1,500 UDI’s daily per Client. In any case, electronic payment fund institutions must observe the account levels established by the Bank of Mexico in general provisions.

Electronic payment fund institutions that hire third parties for the receipt or delivery of their Clients' resources must, in addition to what is provided in this chapter, adhere to the provisions issued under terms of article 54, first paragraph of the Law.

Regarding collective financing institutions, they must request authorization from the CNBV to receive cash resources in national currency from their Clients through deposits in accounts opened at Financial Entities authorized for such effects, in the name of the institution itself, so that Clients pay their credits or loans, up to a monthly amount equivalent in national currency to:
I. 3,000 UDI’s when the Clients' contracts are classified as low risk under terms of the general provisions referred to in article 58 of the Law, issued by the Secretariat.
II. 10,000 UDI’s when it concerns Clients' contracts, other than those indicated in the previous fraction I.

In the authorization requests referred to in this article, ITFs must indicate the controls they will implement to comply with the limits established in this article.

Article 10.- ITFs must request authorization from the CNBV to send or receive transfers of resources in national or foreign currency, to or from deposit accounts opened at financial entities abroad or at other entities in foreign territory authorized to carry out operations similar to those of the ITFs themselves, indicating the means and mechanisms to be used under the following terms:
I. Up to an amount equivalent in national currency to 1,700 UDI’s monthly per Client, when it concerns accounts or contracts classified as low risk under terms of the general provisions referred to in article 58 of the Law, issued by the Secretariat.
II. Without limit of amount, when it concerns accounts or contracts other than those indicated in the previous fraction I.

Article 11.- In the cases of the previous article, the transfers must originate from or be directed to financial entities or entities authorized to carry out operations similar to ITFs that are not located in countries or jurisdictions of high risk or with strategic deficiencies in their regimes to prevent, detect, and combat operations with resources of illicit origin or terrorist financing, as pointed out by the Financial Action Task Force.

In the authorization request referred to in the previous article, ITFs must indicate the controls they will implement to comply with what is established in this article and the previous one.

(7) Chapter IV
(7) Of accounting, the valuation of Securities and other financial instruments, as well as virtual assets, financial information and its disclosure First Section (7) Of Accounting Criteria (7) Article 12.- ITFs will adhere to the Accounting Criteria referred to in the provisions of this chapter.
(7) Unless otherwise specified, the terms defined in article 2 of these provisions are not applicable to this chapter nor to Annexes 6 and 7 of these provisions. Likewise, the terms defined in the aforementioned annexes are not applicable to the rest of these provisions.
(7) Article 13.- The Accounting Criteria for collective financing institutions attached to these provisions as Annex 6 are divided into the series and criteria indicated below:

Series A
Criteria relative to the general scheme of accounting for collective financing institutions A-1 Basic scheme of the set of accounting criteria applicable to collective financing institutions.
A-2 Application of particular norms.
A-3 Application of general norms.
A-4 Supplementary application to accounting criteria.

Series B
Criteria relative to the concepts that integrate financial statements B-1 Cash and cash equivalents.
B-2 Reports.
B-3 Custody and administration of goods.
B-4 Mandates.
(9)B-5 (Repealed)

Series C
Criteria applicable to specific concepts
C-1 Securitization operations.

Series D
Criteria relative to basic financial statements D-1 Statement of financial position.
D-2 Statement of comprehensive income.
D-3 Statement of changes in equity.
D-4 Statement of cash flows.

(7) Article 14.- The Accounting Criteria for electronic payment fund institutions attached to these provisions as Annex 7 are divided into the series and criteria indicated below:

Series A
Criteria relative to the general scheme of accounting for electronic payment fund institutions A-1 Basic scheme of the set of accounting criteria applicable to electronic payment fund institutions.
A-2 Application of particular norms.
A-3 Application of general norms.
A-4 Supplementary application to accounting criteria.

Series B
Criteria relative to the concepts that integrate financial statements B-1 Cash and cash equivalents.
B-2 Reports.
B-3 Custody and administration of goods.
B-4 Mandates.
(9)B-5 (Repealed)

Series C
Criteria applicable to specific concepts
C-1 Securitization operations.

Series D
Criteria relative to basic financial statements D-1 Statement of financial position.
D-2 Statement of comprehensive income.
D-3 Statement of changes in equity.
D-4 Statement of cash flows.

(14) Article 15.- The Commission may authorize ITFs with special accounting criteria on a temporary basis regarding the application of the accounting criteria contained in Annexes 6 and 7 of these provisions, when competent authorities issue declarations of emergency or natural disaster upon the occurrence of perturbing natural phenomena that generate effects on the economy that, in the judgment of the Commission, could cause an adverse impact on the solvency or liquidity of two or more ITFs and, if applicable, on the stability of the financial system. (14) For the purposes of the foregoing paragraph, a perturbing natural phenomenon shall be understood as referred to in the General Law of Civil Protection or the one that replaces it. (14) To obtain the authorization for the application of special accounting criteria, the following must be sent to the Commission at least:
(14)
I. Detailed description of the special accounting criteria requested, as well as the period and geographic area of application.
(14)
II. Detailed narrative of the economic effects that the perturbing natural phenomenon has caused or is estimated to cause.
(14)
III. Estimation of the impact that the economic effects could cause on the solvency, liquidity indicators, and those related to the application of the special accounting criteria of the affected ITFs and, if applicable, the impact on the stability of the financial system.
(14)
IV. Explanation of how the special accounting criteria will help reduce or prevent the effects referred to in the previous fractions.
(17) The authorization request must be sent to the Commission in accordance with the format contained in Annex 21 of these provisions and signed with a handwritten signature, or by means of an advanced or reliable electronic signature, in accordance with the Commercial Code, by the legal representative of the financial technology institutions or, if applicable, by the legal representative of the self-regulatory bodies recognized by the Commission or of any trade representation body. (17) The Commission will resolve the authorization request referred to in the previous paragraph, within a period of sixty business days counted from the day following its receipt. Until the respective resolution is notified, financial technology institutions must continue to use the accounting criteria established in Annexes 6 and 7 of these provisions, as applicable. If this period elapses without the Commission issuing or notifying the corresponding resolution, it will be understood in a negative sense and the request will be considered dismissed. (14) The validity for the application of the authorized special accounting criteria may be extended for a single occasion by a period that cannot exceed the originally granted term, when, in the judgment of the Commission, the applicants prove that the economic effects persist at the date of the extension request. (15) Article 15 Bis.- The Commission may authorize ITFs regarding the application of the accounting criteria provided in Annexes 6 and 7 of these provisions, to carry out special accounting records, when, in the judgment of the Commission, these are necessary to ensure the stability and correct functioning of ITFs during processes of Financial Rehabilitation or Corporate Restructuring, provided that such processes do not result from non-compliance with the regulatory framework applicable to them and that the ITF in question is not applying special accounting records at the date of the request. (17) The request to obtain the authorization for the application of special accounting records must be sent to the Commission in accordance with the format contained in Annex 21 of these provisions and signed with a handwritten signature, or by means of an advanced or reliable electronic signature, in accordance with the Commercial Code, by the legal representative of the financial technology institutions, and must contain at least the following:
(15)
I. Detailed description of the special accounting records requested, indicating at least the items of the financial statements that would be affected, amounts, and period for their application.
(15)
II. Detailed explanation of the causes that have generated the need to carry out the process of Financial Rehabilitation or Corporate Restructuring.
(15)
III. The solvency, liquidity, capital indicators, and those related to the application of the special accounting records, determined at the date of the request, as well as a detailed description of the effects that said indicators could present in case of not having the requested authorization.
(15)
IV. The actions and remediation measures that constitute the processes of Financial Rehabilitation or Corporate Restructuring required by the ITF.
(15) V. Evidence that the actions and measures indicated in the request have the approval of the Administration Body of the requesting ITF.
(15) For the purposes of this article, it must be understood by:
(15) a) Financial Rehabilitation, the reorganization process for the improvement of the financial situation of an ITF, which results from an effect on its solvency, stability, or liquidity that puts the continuity of the ITF at risk.
(15) b) Corporate Restructuring, the set of actions that transform the legal structure of an ITF and which result from an effect on its solvency, stability, or liquidity that puts its business continuity at risk and are carried out with the purpose of obtaining an economic effect aimed at its recovery, such as mergers, spin-offs, and discontinued operations. (17) The Commission will resolve the authorization request referred to in the previous paragraph, within a period of sixty business days counted from the day following its receipt. Until the respective resolution is notified, financial technology institutions must continue to use the accounting criteria established in Annexes 6 and 7 of these provisions, as applicable. If this period elapses without the Commission issuing or notifying the corresponding resolution, it will be understood in a negative sense and the request will be considered dismissed. (15) Article 15 Bis 1.- ITFs that have obtained authorization from the Commission to apply special accounting criteria or special accounting records, under terms of articles 15 and 15 Bis respectively, must disclose in the explanatory notes to the annual audited and quarterly consolidated basic financial statements corresponding to the periods in which these are applied and in the public communications of financial information, the following:
(15)
I. That they have authorization from the Commission to apply special accounting criteria or special accounting records, specifying, if applicable, the period for which they have authorization for their application.
(15)
II. The description of the special accounting criteria or special accounting records authorized and how they have been applied, as well as the records that should have been made in accordance with the accounting criteria contained in Annexes 6 and 7 of these provisions, as applicable.
(15)
III. The amounts that would have been recorded and presented both in the statement of financial position and in the statement of comprehensive income if they did not have the authorization to apply the special accounting criteria or special accounting records.
(15)
IV. The detail of the concepts and amounts for which the accounting effect was made.
(15) V. The impact that the application of the special accounting criteria or special accounting records generates on the solvency, liquidity, capital indicators, and those related to the application of these.
(15) VI. The additional information that the Commission determines in the authorization of the special accounting criteria or special accounting records.
(15) Regarding the annual financial statements referred to in this article, the disclosure must be made through a specific note.
(15) The Commission may revoke the special accounting criteria or special accounting records authorized referred to in articles 15 and 15 Bis, respectively, when ITFs fail to comply with what is provided in any of the fractions I to VI of this article regarding the information to disclose, or with the requirements contained in the authorized special accounting criteria or special accounting records, as applicable. (15) In case it is applicable, ITFs to which the Commission has revoked the authorization to apply special accounting criteria, will have the obligation to maintain the agreements they have made with their clients as a consequence of the application of the aforementioned criteria, prior to the date on which the revocation is determined. Second Section (7) Of the valuation of Securities and other financial instruments, as well as virtual assets
Section A
(7) General Provisions
(7) Article 16.- The provisions provided in this Section have the object of establishing the requirements that ITFs must observe in matters of valuation of Securities and other financial instruments, as well as virtual assets that form part of their statement of financial position.
Article 17.- For the purposes of this chapter, it will be understood by:
I. Virtual Assets, those considered as such under terms of article 30 of the Law.
II. Input Data, the information that the ITF uses to fix the price of Securities and other financial instruments, as well as Virtual Assets.
(7) III. Observable Input Data, the data available in the market, such as public information on events, facts, real transactions, or reference rates that are reflected in the price of Securities and other financial instruments, as well as virtual assets.
(7) IV. Internal Valuation Model, the mathematical procedure developed by ITFs to determine the Current Price for Valuation of Securities and other financial instruments, as well as virtual assets. In no case, an Internal Valuation Model may be used to determine the Current Price for Valuation of the financial instruments indicated in fractions I to III of article 18 of these provisions. (7) V. Structured Operations, those considered as such by the Accounting Criteria applicable to ITFs. (7) VI. Packages of Derivative Financial Instruments, those considered as such by the Accounting Criteria applicable to ITFs. (7) VII. Current Price for Valuation, the market price or theoretical price, obtained based on algorithms, technical and statistical criteria, for each of the Securities and other financial instruments, as well as virtual assets, contained in a methodology developed by a Price Provider or in an Internal Valuation Model developed by the ITF. (7) VIII. Price Provider, the legal entity authorized by the CNBV to operate with such character, under terms of the Securities Market Law. (7) IX. Direct Vector Valuation, the procedure of multiplying the number of titles or contracts in position by the Current Price for Valuation provided by a Price Provider. (7) X. Securities, those considered as such by the Law and the Securities Market Law. (7) Article 18.- ITFs must apply Direct Vector Valuation on Securities and other financial instruments that, in accordance with their investment regime and applicable provisions, may form part of their statement of financial position. (7) ITFs will use Internal Valuation Models to obtain the Current Price for Valuation, provided they adjust to what is established in these provisions and it is not one of the following financial instruments:
I. Securities registered in the National Securities Registry, or authorized, registered, or recognized under terms of the General Provisions applicable to international quotation systems, published in the Official Gazette of the Federation on December 22, 2016, or those that replace them.
(7) II. Derivative financial instruments that trade on national derivatives exchanges or that belong to markets recognized by the Bank of Mexico.
III. Underlying assets and other financial instruments that form part of Structured Operations or Packages of Derivative Financial Instruments, when it concerns Securities or financial instruments provided in the previous fractions I and II.
For the financial instruments indicated in fractions I to III of this article, ITFs must consider the Current Price for Valuation provided by the Price Provider they have contracted.
In the case of Virtual Assets, when there is no valuation model authorized by the Price Provider, nor an Internal Valuation Model for the ITF under terms of Section C of this section, regarding the valuation of a Virtual Asset that has been authorized by the Bank of Mexico, it must be valued at the lower of its acquisition cost, that is, the consideration paid at the time of its acquisition, and its fair value determined in accordance with the applicable accounting regulation. In any case, the option referred to in this paragraph will cease to be applicable from the moment a valuation model is authorized for the specific Virtual Asset to a Price Provider, or to the ITF itself. (7) Article 19.- ITFs will recognize the Current Prices for Valuation daily in their accounting for the determination of the fair value of Securities and other financial instruments, as well as virtual assets that form their statement of financial position, considering the Current Price for Valuation that they calculate daily from Price Providers, or the calculated through Internal Valuation Models when applicable under terms of these provisions.
Section B
Of the hiring of Price Providers

(7) Article 20.- The Administrative Body shall approve the hiring of a single Price Provider for the purposes of this Section.

(7)) Article 21.- ITFs shall notify the CNBV in writing, using a free-format form and within ten business days following the execution of the respective contract, the name of the Price Provider they have hired, attaching a copy of the service contract.

In the event of a substitution of the Price Provider, the notification referred to in the preceding paragraph shall be made thirty days in advance of the hiring in question.

(7) Article 22.- ITFs shall request from their Price Provider the necessary information to comply with the disclosure requirements regarding the determination of the Updated Price for Valuation, contained in the Accounting Criteria.

Section C
Of Internal Valuation Models

Article 23.- When ITFs prepare financial statements containing information on Securities and other financial instruments, as well as Virtual Assets whose Updated Price for Valuation has been determined through the application of Internal Valuation Models, they shall comply with the following:

I. The Administrative Body shall approve:
(7) a) The Internal Valuation Models and their modifications, which must be homogeneous and consistent for all financial entities that make up the financial group.
(7) b) The methods for estimating the variables used in the Internal Valuation Models that are not provided directly by their Price Provider. c) The Securities and other financial instruments, as well as Virtual Assets to which the Internal Valuation Models are applicable.

The information indicated in this subsection shall be delivered to the CNBV through digital format images, or on optical or magnetic media, within thirty days following its approval.

When the Internal Valuation Models, as well as their modifications, do not meet the requirements provided for in this Section, the CNBV may veto said models within a period of twenty business days counted from the date of receipt of the information referred to in the preceding paragraph.

(7) II. In the Internal Valuation Models, ITFs shall use information regarding interest rates, exchange rates, volatilities, and other inputs provided, where applicable, by their Price Provider, regardless of their characteristics, including information regarding those underlying assets and other financial instruments referred to in Article 18, subsection III of these provisions. When the Price Provider does not issue such information, information issued by other sources may be used, documenting the policies for its obtaining, and prioritizing the use of Observable Input Data.

(7) III. Maintain a record in which the Updated Price for Valuation calculated for each of the Securities and other financial instruments, as well as for virtual assets, is entered daily, along with the information used to perform said calculation. The information referred to in this subsection shall be preserved by ITFs for a period of five years.

IV. The Administrative Body of the ITFs shall be informed about the possible uncertainties involved in the valuation of positions with Internal Valuation Models, within risk measurement and business performance.

V. The persons or units responsible for the development of the Internal Valuation Models shall be independent of those responsible for carrying out the reviews and validations referred to in subsection VI of this Article.

(7) VI. Review and validate their Internal Valuation Models prior to the approval referred to in subsection I of this Article, as well as carry out periodic review and validation of the Internal Valuation Models, in order to verify that they remain accurate and adequate, including the periodic review of the validity and update of the interest rates, exchange rates, volatilities, and other reference inputs used by said models and provided by the ITF's Price Provider. The aforementioned review and validation shall be carried out by qualified units independent of the persons or business units, which may be the internal audit area or its equivalent, the unit in charge of carrying out said task.

(7) When, in accordance with the Accounting Criteria issued by the CNBV applicable to ITFs, these must disaggregate Structured Operations and Packages of Derivative Financial Instruments, they shall adhere to the procedures indicated in said Accounting Criteria for the purpose of their disaggregation. Said disaggregation may be carried out internally by the ITFs or through the contracted Price Provider.

(8) The information indicated in the preceding subsection I shall be delivered through digital format images, on optical or magnetic media to the CNBV within thirty natural days following the approval of the Administrative Body, with the exception of modifications to the Internal Valuation Models, which shall be delivered to this authority within two natural days following their approval.

(8) The CNBV shall have the power of veto regarding the Internal Valuation Models, as well as regarding modifications to the models themselves or to the inputs used for the determination of the Updated Price for Valuation; said power shall be exercised within a period of ten business days counted from the date of receipt of the information referred to in the preceding paragraph.

Likewise, the information referred to in this Article shall be duly documented and made available to the CNBV when it requests it.

(7) Article 24.- ITFs shall establish and maintain adequate systems and controls to verify that their valuations are prudent and reliable, as well as document the policies and procedures used in the valuation of their positions, including within the referenced documentation, at least the following:

I. The responsibilities of the various areas involved in the valuation process, which shall be clearly defined and stipulated.

II. The guidelines for the use of estimation methodologies for variables that are not provided directly by the ITF's Price Provider referred to in Article 23, subsection I, item b) of these Provisions.

III. The time at which the closing price of the positions is determined.

IV. Evidence of verification actions carried out in compliance with the provisions contained in this Section.

(7) Article 25.- The internal audit area or its equivalent of the ITFs shall carry out periodic and systematic reviews in accordance with their annual work program, which allow verifying due compliance with what is established in this Section.

(9) Article 26.- (Repealed)

(9) Section D

(9) (Repealed)

(9) Article 27.- (Repealed)

(9) Article 28.- (Repealed)

(9)

Article 29.- (Repealed)

Third Section
Of financial statements, financial information disclosure and texts to be noted at the foot

(7)

Article 30.- ITFs shall prepare their basic financial statements in accordance with the Accounting Criteria referred to in these provisions.

The basic financial statements shall be expressed in thousands of pesos, which shall be indicated in the header thereof.

When these provisions refer to the concept of consolidated basic financial statements of ITFs and it concerns those that lack entities subject to consolidation in accordance with the Accounting Criteria, it shall be understood that reference is made to individual financial statements.

Article 31.- In the case of collective financing institutions, these shall note at the foot of their consolidated basic financial statements, the following statements:

I. Statement of financial position:
"This statement of financial position was prepared in accordance with the accounting criteria for collective financing institutions, issued by the National Banking and Securities Commission, based on what is provided for in articles 48 and 49 of the Law to Regulate Financial Technology Institutions, of general observance and mandatory application, applied consistently, reflecting the operations carried out by the collective financing institution up to the aforementioned date, which were carried out and valued in compliance with sound practices and applicable legal and administrative provisions.

This statement of financial position was approved by the sole administrator or, where applicable, the board of directors or the general manager, as appropriate, under the responsibility of the executives who sign it."

II. Statement of comprehensive income:
"This statement of comprehensive income was prepared in accordance with the accounting criteria for collective financing institutions, issued by the National Banking and Securities Commission, based on what is provided for in articles 48 and 49 of the Law to Regulate Financial Technology Institutions, of general observance and mandatory application, applied consistently, reflecting all income and expenses derived from the operations carried out by the collective financing institution during the aforementioned period, which were carried out and valued in compliance with sound practices and applicable legal and administrative provisions.

This statement of comprehensive income was approved by the sole administrator or, where applicable, the board of directors or the general manager, as appropriate, under the responsibility of the executives who sign it."

III. Statement of changes in equity:
"This statement of changes in equity was prepared in accordance with the accounting criteria for collective financing institutions, issued by the National Banking and Securities Commission, based on what is provided for in articles 48 and 49 of the Law to Regulate Financial Technology Institutions, of general observance and mandatory application, applied consistently, reflecting all movements in the equity accounts derived from the operations carried out by the collective financing institution during the aforementioned period, which were carried out and valued in compliance with sound practices and applicable legal and administrative provisions.

This statement of changes in equity was approved by the sole administrator or, where applicable, the board of directors or the general manager, as appropriate, under the responsibility of the executives who sign it."

IV. Statement of cash flows:
"This statement of cash flows was prepared in accordance with the accounting criteria for collective financing institutions, issued by the National Banking and Securities Commission, based on what is provided for in articles 48 and 49 of the Law to Regulate Financial Technology Institutions, of general observance and mandatory application, applied consistently, reflecting the cash inflows and cash outflows derived from the operations carried out by the collective financing institution during the aforementioned period, which were carried out and valued in compliance with sound practices and applicable legal and administrative provisions.

This statement of cash flows was approved by the sole administrator or, where applicable, the board of directors or the general manager, as appropriate, under the responsibility of the executives who sign it."

Article 32.- In the case of electronic payment fund institutions, these shall note at the foot of the consolidated basic financial statements, the following statements:

I. Statement of financial position:
"This statement of financial position was prepared in accordance with the accounting criteria for electronic payment fund institutions, issued by the National Banking and Securities Commission, based on what is provided for in articles 48 and 49 of the Law to Regulate Financial Technology Institutions, of general observance and mandatory application, applied consistently, reflecting the operations carried out by the electronic payment fund institution up to the aforementioned date, which were carried out and valued in compliance with sound practices and applicable legal and administrative provisions.

II. Statement of comprehensive income:
"This statement of comprehensive income was prepared in accordance with the accounting criteria for electronic payment fund institutions, issued by the National Banking and Securities Commission, based on what is provided for in articles 48 and 49 of the Law to Regulate Financial Technology Institutions, of general observance and mandatory application, applied consistently, reflecting all income and expenses derived from the operations carried out by the electronic payment fund institution during the aforementioned period, which were carried out and valued in compliance with sound practices and applicable legal and administrative provisions.

III. Statement of changes in equity:
"This statement of changes in equity was prepared in accordance with the accounting criteria for electronic payment fund institutions, issued by the National Banking and Securities Commission, based on what is provided for in articles 48 and 49 of the Law to Regulate Financial Technology Institutions, of general observance and mandatory application, applied consistently, reflecting all movements in the equity accounts derived from the operations carried out by the electronic payment fund institution during the aforementioned period, which were carried out and valued in compliance with sound practices and applicable legal and administrative provisions.

IV. Statement of cash flows:
"This statement of cash flows was prepared in accordance with the accounting criteria for electronic payment fund institutions, issued by the National Banking and Securities Commission, based on what is provided for in articles 48 and 49 of the Law to Regulate Financial Technology Institutions, of general observance and mandatory application, applied consistently, reflecting the cash inflows and cash outflows derived from the operations carried out by the electronic payment fund institution during the aforementioned period, which were carried out and valued in compliance with sound practices and applicable legal and administrative provisions.

(7)

Article 33.- ITFs shall include in explanatory notes to the consolidated basic financial statements, the facts considered relevant in accordance with the Accounting Criteria, expressing such circumstance at the foot thereof with the following statement: "The explanatory notes attached form an integral part of this financial statement."

Likewise, ITFs shall note at the foot of the basic financial statements referred to in Articles 31 and 32 of these provisions, as applicable, the Internet site corresponding to the ITF, also indicating the link through which one can directly access the financial information referred to in Articles 36 to 39 of these provisions, as well as the CNBV Internet site https://www.gob.mx/cnbv where that financial information, provided periodically to the CNBV in compliance with general provisions, can be consulted.

Article 34.- Consolidated basic financial statements with figures as of March, June, and September shall be presented for approval by the Administrative Body within the month immediately following the date to which they correspond, accompanied by the necessary supporting complementary documentation, in order that the social body in question has sufficient elements to know and evaluate the most important operations determining the fundamental changes occurred during the respective fiscal year or period.

Regarding the consolidated basic annual financial statements, they shall be presented to the Administrative Body within ninety days following the closing of the respective fiscal year.

Article 35.- The consolidated quarterly and annual basic financial statements of ITFs shall be signed, at least, by the person authorized by the Administrative Body.

(7)

Article 36.- ITFs shall disseminate through their Internet page the audited consolidated basic annual financial statements with figures as of December of each year, including their notes, as well as the external audit report performed by the independent external auditor, within ninety natural days following the closing of the respective fiscal year.

Additionally, ITFs shall disseminate jointly with the aforementioned information, the following:

(7)

I. The annual report of the sole administrator or the general manager, as applicable, which shall include the comments and analysis of the administration regarding the operating results and financial situation of the ITF. Said report shall contain all information that facilitates the analysis and understanding of the important changes occurred in the operating results and in the financial situation of the ITF.

The aforementioned report shall be signed by the sole administrator or, where applicable, the general manager, including at the foot the following legend:

(7)

"I, the undersigned, declare under oath that, within the scope of my functions, I prepared the information regarding the [collective financing institution / electronic payment fund institution] contained in this annual report which, to the best of my knowledge and belief, reasonably reflects its financial situation, its operating results, its changes in equity, and its cash flows."

(7)

The information that must be included in said report is complementary to that expressly appearing in the consolidated basic financial statements, so it must not only mention the growth or decrease of the different items that make up the consolidated basic financial statements, but the reason for these movements, as well as those events known by the administration that could cause the disseminated information not to be indicative of the financial situation, operating results, changes in equity, and cash flows of the ITF.

Likewise, the report must identify any known trend, commitment, or event that could significantly affect the liquidity of the ITF, its operating results, or its financial situation, such as changes in market share, incorporation of new competitors, regulatory modifications, launch or change in products, among others.

(8)

The analysis and comments on the financial information shall refer, among others, to the following topics:

(8)

a) The financial situation, liquidity, and capital resources, providing information regarding:

The description of internal and external sources of liquidity, as well as a brief description of any other important source of resources not yet used.
The dividend payment or profit reinvestment policy that the ITF intends to follow in the future.
The policies governing the treasury of the ITF.
Tax credits or debts held in the last fiscal year, indicating whether they are current in payment.
Relevant capital investments committed to at the end of the last fiscal year, as well as the details associated with such investments and the source of financing necessary to carry them out.
(8) b) In the case of crowdfunding institutions, the recent behavior of items related to off-balance sheet accounts, indicating the main changes occurring in customer account operations, as well as the details associated with deposits from applicants and investors.
(8) c) A brief description of the ITF's internal control system.
II. If applicable, the composition of the board of directors, identifying independent and non-independent directors in accordance with Article 59 of the Law, as well as those holding the status of owner or substitute. It must also include the professional profile and work experience of each member of said board.
III. The total amount representing together the compensations and benefits of any kind received from the ITF during the last fiscal year by the persons comprising the Administration Body, the General Manager, if applicable, and the main officials.
(7)
IV. A description of the type of compensations and benefits received collectively by the ITF by the persons mentioned in fraction III of this article. If part of the compensation is paid through bonuses or share delivery plans of the ITF itself, a brief description of such plans must be provided. Similarly, the total amount expected or accumulated by the ITF for pension, retirement, or similar plans for the persons mentioned must be indicated.
(7) Article 37.- ITFs, in addition to what is provided in these provisions, must disseminate through their Internet page the consolidated basic financial statements with figures for March, June, and September, within the month immediately following their date, including their notes, which, considering relative importance as a characteristic associated with the relevance referred to in Financial Information Standard A-4 “Qualitative Characteristics of Financial Statements” or the one that replaces it, from the Financial Information Standards issued by the Mexican Council of Financial Information Standards, A.C., must at minimum contain the following information:
I. The nature and amount of items in the statement of financial position and the statement of comprehensive income that have substantially modified their structure and have produced significant changes in the financial information of the interim period.
II. The main characteristics of the issuance or amortization of long-term debt, carried out during the interim period being reported.
III. Increases or reductions in capital and payment of dividends.
IV. Subsequent events that have not been reflected in the issuance of financial information at interim dates, which have produced a substantial impact.
V. Amount of investments in financial instruments, according to the business model of each ITF, as well as of the Securities that are restricted as collateral.
VI. Amount, type, and quantity of Virtual Assets, as well as a brief description of the determination of their fair value and their accounting effect.

VII. Reclassifications among categories of investments in financial instruments, as well as a description of the changes in the business model that gave rise to such reclassifications.
VIII. Average interest rates of bank loans and from other entities, identified by type of currency, terms, and guarantees. Furthermore, significant changes in the main credit lines must be included within the notes, even if these have not been utilized.
(7) IX. Nominal amounts of financial derivative instruments by type of instrument and by underlying.
(7) X. Valuation results and, if applicable, from buying and selling, recognized in the reference period, classified according to the type of operation that gave rise to them, such as investments in financial instruments, repurchase agreements, and financial derivative instruments, among others.
XI. Amount and origin of the main items that, with respect to the net result of the reference period, integrate the items of other income (expenses) from operations.
XII. Amount of deferred income taxes and deferred profit-sharing for workers according to their origin.
XIII. Capitalization ratio.
XIV. Transactions carried out with related parties, in accordance with Financial Information Standard C-13 “Related Parties”, revealing in aggregate the following information:
a) Nature of the relationship considering the definition of related parties. b) Generic description of the transactions. c) Global amount of transactions, balances, and their characteristics. d) Effect of changes in the conditions of existing transactions. e) Any other information necessary for the understanding of the transaction. For the purposes of this fraction, related parties are understood to be those indicated in Financial Information Standard C-13 “Related Parties”. (7) XV. The modifications made to the policies, practices, and Accounting Criteria according to which the consolidated basic financial statements were prepared. In case of relevant changes in the application of such policies, practices, and Accounting Criteria, the reasons and their impact must be revealed.
XVI. Adjusted assets and the leverage ratio.
(8) XVII. Shareholding by subsidiary.
(8) The information referred to in fraction XIV regarding transactions with related parties must be disseminated jointly with the consolidated basic financial statements referred to in this article, only when there are relevant modifications to the information required herein.
(8) Without prejudice to the foregoing, ITFs must disseminate jointly with the consolidated basic financial statements referred to in this article, the provisions of Article 36, fraction I of these provisions. Furthermore, they must disseminate with the aforementioned consolidated quarterly financial statements, the provisions of Article 36, fractions II to IV of these provisions, only when there are relevant modifications to the information required in these. (8) Regarding the annual report concerning the comments and analysis of management on the operating results and financial situation of ITFs, referred to in Article 36, fraction I of these provisions, an update to said report must be made, comparing the figures of the quarter in question, at least with those of the immediately preceding quarter, as well as with those of the same quarter of the immediately preceding fiscal year, except regarding the statement of financial position, in which case the comparison must be made of the figures of the interim period in question, with those of the immediately preceding annual closing. Furthermore, the information required in subsection c), regarding internal control, must be incorporated into the aforementioned update only when there are relevant modifications in the cited information. (8) Such update must be signed by the same officials referred to in Article 36, fraction I of these provisions and include at the bottom the legend provided in the aforementioned fraction. (7) Article 38.- ITFs, in the dissemination of the information referred to in Articles 36 and 37 of these provisions, must reveal the information that the CNBV has requested, in the issuance or authorization, if applicable, of criteria or special accounting records based on the Accounting Criteria for ITFs, as well as the other information that the CNBV itself determines when it considers relevant, in accordance with the Accounting Criteria.
Article 39.- In the event that an ITF decides to make public, through its Internet page, any type of financial information that, in accordance with applicable provisions, is not obligated to disclose, the analytical details and methodological bases must be accompanied, allowing clear understanding of such information, thereby facilitating its adequate interpretation.
(7) ITFs, when disseminating through their Internet page the information referred to in Articles 36, 37, and 38 of these provisions, as well as in the first paragraph of this article, must maintain it in said dissemination medium for at least five subsequent quarters in the case of information published quarterly, and for three subsequent years in the case of annual information. The period for which the information referred to in the preceding paragraph must be maintained will be independent of that which, in terms of applicable legal provisions, ITFs must observe. (7) Article 40.- ITFs that are part of a financial group will not be obligated to disseminate the information indicated in Article 36, fraction I of these provisions and the update referred to in the penultimate paragraph of Article 37 of these provisions, as well as that contained in the fractions of said Article 37, provided that the controlling company of the financial group to which the ITF belongs prepares and disseminates that corresponding to said company, in compliance with the provisions issued in that matter by the competent authorities.
Article 41.- ITFs may disseminate on their Internet page the unaudited consolidated statement of financial position and statement of comprehensive income, provided they have been approved by the Administration Body, and this circumstance is specified in the notes. Such disclosure may be made as long as the audited financial statements referred to in Article 36 of these provisions are not yet available.
In addition to what is stated in the previous paragraph, ITFs must include, in both cases, the certificates referred to in Articles 31 and 32 of these provisions.
(7) Article 42.- The CNBV may order corrections to the consolidated basic financial statements subject to dissemination or publication, in the event that facts considered relevant exist in accordance with the Accounting Criteria.

Financial statements regarding which the CNBV orders corrections and which have already been published or disseminated, must be republished or disseminated through the same medium, with the pertinent modifications, within five business days following the notification of the corresponding resolution, indicating the corrections made, their impact on the figures of the financial statements, and the reasons that motivated them. THIRD TITLE Of Crowdfunding Institutions
Chapter I
Of the electronic certificate on risks
Article 43.- Crowdfunding institutions must obtain from Investors an electronic certificate in which they declare that they know the risks of their investment, considering the content of Annex 8 of these provisions. The aforementioned electronic certificate must be collected through the Platform, only once, prior to the celebration of the contract that allows them to perform Operations.
Chapter II
Of the methodology for evaluation, selection, and qualification of applicants and projects
Article 44.- Crowdfunding institutions will establish and make known to their potential Investors, through their Platform, at minimum the following:
I. The criteria they will use to select Applicants and projects subject to financing by type of Operation involved.
II. The method for verifying the identity and location of potential Applicants.
III. The type of information and documentation that will be collected to carry out the respective analysis and valuation of potential Applicants and, if applicable, the activities to verify the veracity of such documentation and information.
IV. The term and method for the crowdfunding institution to notify the potential Applicant regarding the acceptance or rejection of their application.
V. The general description of the methodology they will use to analyze and determine the degree of risk of potential Applicants and, if applicable, of projects.
Article 45.- The methodology to analyze and determine the degree of risk of potential Applicants and, if applicable, of projects, must consider, at minimum, the following aspects:
I. Regarding Crowdfunding Debt Operations for Personal Loans between Persons, a quantitative and qualitative evaluation regarding solvency, credit history, and payment capacity, the estimated income of the probable borrower and their relationship with other credits and liabilities they hold, as well as the term of these. In case the financing is destined for the development of a project, the business history or technical knowledge of the administrators or executors of the project will be analyzed; if the source of payment of the loan or credit depends on this and if such information cannot be verified, the crowdfunding institution will increase the risk degree of the Applicant.
For the purpose of evaluating the solvency, credit history, and payment capacity of potential Applicants, the crowdfunding institution will review, at least, their Credit Information Report, which is not older than three months. In case the Applicant does not have a credit history, crowdfunding institutions may publish a financing request on their Platform, provided they have the degree and risk evaluation determined by the institutions themselves, in accordance with the methodology established by them. When guarantors or joint obligors are required to perform any Operation, crowdfunding institutions must verify their identity. Furthermore, in the case of real guarantees, they will ensure the proper ownership of the asset granted as guarantee and its freedom from encumbrances, as well as that its value is sufficient to back the payment obligations of the Operation, in accordance with the valuation policies established by the crowdfunding institution itself.
II. In Crowdfunding Debt for Business Loans between Persons carried out to celebrate a factoring operation, in addition to what is provided in the previous fraction I:
a) The credit evaluation of the debtor of the credit rights that Investors will acquire, in accordance with what is provided in fraction I of this article, or based on publicly available information or generated through the Platform. In case of not having information on the debtor of the credit rights, this situation will be revealed to Investors and the risk degree of the Applicant will be increased. b) In case the rights to be transmitted to Investors derive from an invoice, the verification that it contains the data enabling its electronic identification in the Tax Administration System, as well as being valid. c) The verification that the credit rights have not been previously transmitted, assigned, or affected as guarantee by the potential Applicant in favor of a third party, as well as ensuring with the debtors that the document containing the credit rights is approved by them, that they are notified of the Operation, and that they will be paid to Investors, through the crowdfunding institution, in accordance with the conditions established with the potential Applicant. Crowdfunding institutions that do not implement mechanisms to verify that the resources of the Operations are destined to finance the business activities of individuals with business activity, will consider these Operations as Crowdfunding Debt for Personal Loans between Persons.
III. In case of Crowdfunding Debt for Real Estate Development, in addition to what is provided in fraction I of this article:
a) The determination of the maximum financing amount that can be obtained regarding the value of the project, as well as the proportion that guarantees granted must represent regarding the amount to be financed, according to the result of the evaluation referred to in fraction I above and the valuation of the guarantee, in accordance with the policies established by the crowdfunding institution itself. b) In case a mortgage guarantee is granted by the Applicant, obtaining the certificate of freedom from encumbrances before the Public Registry of Property and Commerce of the corresponding real estate and the documentation accrediting the ownership of said real estate, as well as verifying that there is no procedure for extinction of domain or expropriation in progress. c) The development stage of the project, the market studies presented by the potential Applicant, as well as the verification of the existence or feasibility of obtaining permits, licenses, land use, and, if applicable, water and sewage supply, among others, that support the viability of the project.

IV. In case of Crowdfunding Capital and Co-ownership or Royalties, the proper legal existence of the legal entity involved or the validity of the agreements under which the potential Applicant operates, as applicable; the financial viability of the company or project subject to crowdfunding, as well as the business history or, in default, technical knowledge of the administrators or executors of the project.
V. The mechanisms to verify that the deposit account destined to receive the resources of the Operation required from the potential Applicant is open in their name at a financial entity authorized to receive deposits in national or foreign territory, in the latter case, provided that the crowdfunding institution has authorization to perform transfers to or from foreign financial entities, in accordance with Article 10 of these provisions.
Crowdfunding institutions, when performing the analysis and determination of the risk degree referred to in this article, will consider whether the Applicant is in the process of obtaining financing from any other person.
Article 46.- Crowdfunding institutions will ensure that the information made known to potential Investors meets the following minimum characteristics:
I. Use clear and easy-to-understand language, without technical terms or legal formalisms that are complex for a person who does not have specialized knowledge in the matter.
II. Avoid the use of superlative terms and value judgments.
III. Ensure that the information intended to be transmitted includes graphical or symbolic representations that facilitate its understanding.
IV. Use a font size similar to that of the text of the main contents of the publications made through the Platforms.
V. Include a frequently asked questions section regarding the way the crowdfunding institution operates, the applications and projects published on it, as well as, if applicable, dispute resolution or clarification methods between Applicants, Investors, and the crowdfunding institution.
Chapter III
Of the resource limits that crowdfunding institutions may hold in the name of their Clients
Article 47.- Crowdfunding institutions may publish on their Platforms financing requests made by an Applicant during the Crowdfunding Financing Request Period, provided they do not exceed per Operation in the institution itself, of the following limits:
I. Regarding Crowdfunding Debt Operations for Personal Loans between Persons, the equivalent in national currency to 50,000 UDI’s.
II. In the case of Crowdfunding Debt Operations for Business Loans between Persons, for Debt for Real Estate Development, for Capital, and for Co-ownership or Royalties, the equivalent in national currency to 1,670,000 UDI’s.
Crowdfunding institutions may request authorization from the CNBV for the Operations referred to in this fraction to be celebrated for amounts equivalent in national currency higher than 1,670,000 UDI’s and up to 6,700,000 UDI’s. A

to grant the respective authorization, the CNBV will analyze whether the methodology of the crowdfunding financing institution incorporates additional elements to those referred to in Title Three, Chapter II of these provisions, enabling it to adequately evaluate financing requests.

For the purposes of the foregoing, the calculation of maximum financing limits shall be performed taking into account the value in pesos of the UDI (Investment Unit), on the last day of the calendar month immediately preceding the month of the financing request, considering the value published by the Bank of Mexico in the Official Gazette of the Federation.

Article 48.- Under no circumstances may crowdfunding financing institutions publish financing requests on their Platforms when, as a result, the same Applicant obtains resources through crowdfunding financing institutions that exceed the equivalent in national currency to 7,370,000 UDI’s.

Article 49.- Crowdfunding financing institutions must establish controls on their Platforms to prevent the same Investor from making Investment Commitments that exceed the percentages referred to in the following table, once the indicated formula is applied:

Type of Crowdfunding Financing Operation	Individual Investor (Persona Física)	Legal Entity Investor (Persona Moral)
Personal Loan Debt between Individuals	7.5 %	20 %
Business Loan Debt between Individuals or for Real Estate Development	15 %	20 %
Capital, Co-ownership or Royalties	15 %	20 %

Where:
NCI = Investment Commitments to be made in a single financing request.
IE = Effective investments made by the Investor previously through the crowdfunding financing institution.
CI = Investment Commitments previously made in other financing requests by the Investor through the crowdfunding financing institution.

For the purposes of this article, effective investments shall be understood as:
I. The outstanding balance to which an Investor is a creditor on the date on which the new Investment Commitment is to be made, in the case of Crowdfunding Debt Operations.
II. The amount of the total of the Values or rights whose ownership remains with the Investor according to the most recent information available to each crowdfunding financing institution or provided by the Investors, considering the nominal amount effectively invested in national currency at the moment the Investor acquired each Value or right through the crowdfunding financing institution, in the case of Crowdfunding Capital Operations or Crowdfunding Co-ownership or Royalties Operations.

When an Investor performs Crowdfunding Operations of different types through the same crowdfunding financing institution, the percentage applicable to which new Investment Commitments will be subject shall be that corresponding to the type of financing in question according to the table indicated in this article, and the effective investments and Investment Commitments made in any type of Crowdfunding Financing Operation must be summed in the denominator of the formula provided.

Article 50.- The percentages provided in the previous article shall not apply in the following circumstances:

I. When Investors maintain an aggregate amount of effective investments and Investment Commitments that does not exceed the equivalent in national currency to 2,000 UDI’s in the respective crowdfunding financing institution, this will allow them to make Investment Commitments per Investor in a single financing request up to the equivalent in national currency to 667 UDI’s, in the case of Crowdfunding Debt Operations for Personal Loans between Individuals or Business Loans between Individuals.
II. When Investors maintain an aggregate amount of effective investments and Investment Commitments that does not exceed the equivalent in national currency to 8,300 UDI’s in the respective crowdfunding financing institution, this will allow them to make Investment Commitments per Investor in a single financing request up to the equivalent in national currency to 4,150 UDI’s, in the case of Crowdfunding Debt Operations for Real Estate Development, Capital, and Co-ownership or Royalties.
III. When there are 25 or fewer crowdfunding financing requests published on the Platform, the Investment Commitment to be made by the same Investor to an Applicant may not exceed the greater of 5% of the required financing amount or the equivalent in national currency to 167,000 UDI’s.
IV. When the crowdfunding financing institution, as part of schemes to share risks with Investors, makes Investment Commitments in any Applicant or project, it may increase the percentages referred to in Article 49 of these provisions by adding the percentage of investment that the institution itself is committing to in such Applicant or project, or 25%, whichever is lower.
V. In the case of Related and Experienced Investors. Additionally, these Investors shall not be subject to the limits of the preceding subsections.
Crowdfunding financing institutions shall request the information that accredits such status.

(7) In the case of Experienced Investors referred to in subsection d) of subsection XXIV of Article 2 of these provisions, crowdfunding financing institutions shall obtain the statement contained in Annex 9 of these provisions, as well as the supporting documentation, at the beginning of their contractual relationship or at the moment when Investors request to obtain the status of Experienced Investor in accordance with these provisions.

The CNBV will periodically evaluate the limits established in this article and in the preceding Articles 47 to 49 and may modify them, in order to reflect the sound and adequate development of crowdfunding institutions and the Operations that can be carried out through them.

Article 51.- Crowdfunding financing institutions may request authorization from the CNBV to obtain loans and credits referred to in Article 19, subsection IV of the Law, in order to allocate the obtained resources to schemes that allow sharing with Investors the risks of the projects provided for in the Law, indicating in their request the following:

I. The maximum financing amount they will obtain through the loans and credits they intend to contract, as well as the general characteristics of these, specifying, if applicable, the terms of the financial structures to be used.
II. The detailed description of the scheme to share with Investors the risks of the Operations.

(1) The CNBV will grant the corresponding authorization provided that the crowdfunding financing institution demonstrates that the terms of the loans or credits it intends to enter into will not put its solvency and financial stability at risk.

When crowdfunding financing institutions have obtained the authorization referred to in this article and use the corresponding resources to act as Investors, the rate paid for the loan or credit resources may not be used as a reference in crowdfunding financings in which they participate.

Chapter IV
Of Mandates and Commissions

Article 52.- Crowdfunding financing institutions that enter into mandates or commissions with their Clients for the performance of activities related to Operations for operational matters and other activities intended to facilitate the exercise of their Clients' rights derived from Operations, as well as the celebration of new Operations, shall be subject to the following terms:

I. Refrain from privileging the interests of any Client over another or acting with conflicts of interest in the execution thereof.
II. Keep Clients informed of the acts performed in the execution of the mandates or commissions in question.
III. Clearly disclose the consideration, if any, that would be charged for the execution of the mandate.

Article 53.- Crowdfunding financing institutions must agree in the mandates or commissions they enter into for the purpose of having their Clients perform Operations, the following terms:

I. In the case of Applicants, the Crowdfunding Financing Request Period, the duration of which must be revealed at all times and during said period to Investors on the Platform.
II. The period in which the delivery or execution of the necessary procedures will take place for the delivery of resources to which Investors are entitled when:
a) The required amount has not been obtained to celebrate the Operation at the end of the Crowdfunding Financing Request Period. b) If so agreed, when the Applicant has not confirmed the celebration of the Operation at the end of the Crowdfunding Financing Request Period. c) The Applicant makes the corresponding payments for the Operations performed.
III. The delivery, or execution of the necessary procedures, for the delivery of resources contributed by Investors to Applicants at the end of the Crowdfunding Financing Request Period or, if so agreed, when the Applicant's confirmation for the celebration of the Operation is obtained.
IV. For the case of mandates or commissions referred to in Article 54 of these provisions, which shall be revocable at the moment the Investor decides.

Article 54.- Crowdfunding financing institutions, in the execution of mandates or commissions intended to automatically invest, on behalf of Investors, their resources or virtual assets resulting from payments made by Applicants for financing granted or from unperfected Operations, must:

I. Have prior express consent to perform automatic investments of resources on their behalf and for their account, which must be requested independently from the initial contract celebrated between Investors and crowdfunding financing institutions for the provision of services offered.
II. Previously inform the manner and terms in which investments would be carried out, the criteria used to select Applicants or projects on which resources will be invested, the level of risk to which investments will be exposed according to their risk methodology, as well as the amount or percentage of resources that may be invested.
III. Keep visible and available on the Investor's homepage, once they have logged into the Platform, the request for revocation of this type of mandate or commission; the simple request shall suffice for the revocation to take effect.

Article 55.- Crowdfunding financing institutions, for the execution of mandates or commissions intended to perform extrajudicial collection of collection rights held by Investors, as well as to renegotiate the terms and conditions of financings, must inform the Investors themselves:

I. The actions to be carried out, by themselves or through third parties, to perform extrajudicial collection, as well as the scope and objectives intended with such management, including the resolution of disputes through conciliation or arbitration.
II. The terms and conditions under which modifications to the original conditions may be agreed with Applicants to restructure or renew credits, make concessions or receive goods in payment, perform factoring operations, sale or assignment of collection rights held by Investors, during extrajudicial recovery, as well as inform those to consider a credit as uncollectible.

For the purposes of this chapter, extrajudicial collection shall be understood as actions aimed at maintaining permanent communication with Applicants, intended to reduce the probability of payment default, including reminders sent by text messages, emails, or phone calls, as well as those that allow the recovery of credits through conciliation or arbitration.

Article 56.- In the case of mandates or commissions intended to represent Investors in shareholders' meetings, partners' meetings, or any other collegiate decision-making body of Applicants, crowdfunding financing institutions shall inform Investors about the items listed on the agenda to be discussed in the corresponding sessions.

Article 57.- Crowdfunding financing institutions must inform, through their Platforms, the activities carried out in the execution of mandates or commissions celebrated, detailing, as applicable, the following:

I. In the case of the investment of resources referred to in Article 54 of these provisions, the project(s) or Applicant(s) in which such investment was made, including new Investment Commitments and investments that have become final, the amounts, the Crowdfunding Financing Request Period, and other related information.
II. For the case of extrajudicial collection, the status of any process being carried out and the acts being performed for the collection of financing granted, by themselves or through third parties.
III. Regarding the representation referred to in the preceding Article 56, the agreements and decisions taken in shareholders' meetings, partners' meetings, or any other collegiate decision-making body.

Article 58.- Crowdfunding financing institutions that perform extrajudicial collection of their Investors' credits by themselves or through third parties, shall have a collection manual that incorporates policies, guidelines, and procedures in this matter, which must contain, at least, the following:

I. Procedures to follow up on the fulfillment of payment obligations by Applicants.
II. Strategies and actions to be performed to carry out extrajudicial collection.
III. If applicable, procedures to follow for selecting and contracting third-party services that perform extrajudicial collection activities and acts.
IV. The circumstances and conditions that must be met to perform extrajudicial collection, and the terms and conditions under which modifications to the original conditions may be agreed with debtors to restructure or renew credits or loans, make concessions or receive goods in payment, requiring the crowdfunding financing institution, in these cases, to perform a new credit evaluation of the debtor according to its risk methodology; those under which factoring, sale, or assignment of collection rights held by Investors will be performed during extrajudicial recovery, as well as those used to consider a credit as uncollectible.

Chapter V
Of the Business Continuity Plan

Article 59.- Crowdfunding financing institutions must have a Business Continuity Plan that allows, in the event of Operational Contingencies, the continuity in the provision of their services and the performance of their processes, their timely restoration, as well as the mitigation of effects resulting from such contingencies.

Article 60.- To develop the Business Continuity Plan, crowdfunding financing institutions must comply with the minimum requirements established in Annex 10 of these provisions.

Article 61.- The Administrative Body of crowdfunding financing institutions, regarding the Business Continuity Plan, must perform at least the following functions:

I. Designate and, if applicable, remove the person serving as the risk administration officer. This person must have knowledge in operational risk matters and may be an employee of the crowdfunding financing institution itself, or a third party contracted for such effect.
II. Approve the Business Continuity Plan, as well as its modifications.
III. Design and establish the communication policy for the timely notification of Operational Contingencies to Clients and within the crowdfunding financing institution, as well as with the CNBV and other competent Financial Authorities, considering the nature of the Operational Contingency in question. The aforementioned communication policy must consider all moments of Operational Contingencies, from their occurrence and containment, to their resolution and evaluation, considering the nature of said contingencies and the different recipients of their communications.
IV. Inform the CNBV of Operational Contingencies that occur in any of the public attention channels or within the crowdfunding financing institution itself. The foregoing, always provided that these interruptions last at least 30 minutes.

The notification referred to in the preceding paragraph must be made within 60 minutes following the occurrence of the Operational Contingency in question, and must include the date and time of the start of the Operational Contingency; the indication of whether it continues or, if applicable, if it has concluded and its duration; the affected processes, systems, and channels; a description of the event that occurred; and an initial assessment of the impact or severity. The mentioned notification must be communicated via email sent to the accounts contingencias@cnbv.gob.mx and supervisionfintech@cnbv.gob.mx or through other means available to the Commission itself, and an electronic receipt of acknowledgment must be generated.

V. Approve the methodologies for estimating the quantitative and qualitative impacts of possible Operational Contingencies presented by the risk administration officer, in terms of these provisions, for use in the impact analysis referred to in Annex 10.

When the administration of the crowdfunding financing institution is in charge of a board of directors and a general manager, the latter shall be responsible for carrying out the provisions of subsections III and IV above.

For the purposes of the foregoing, operational risk shall be understood as potential loss due to failures or deficiencies in internal controls, errors in the processing and storage of Operations or in the transmission of information, as well as due to fraud or theft, and includes, among others, technological risk. On the other hand, technological risk shall be considered as potential loss due to damage, interruption, alteration, or failures resulting from the use of hardware, software, systems, applications, networks, and any other channel of information transmission in the provision of services to Clients of the crowdfunding financing institution.

Article 62.- The person holding the position of risk administration officer, regarding the Business Continuity Plan, shall have the following functions:

I. Define and present for approval by the Administrative Body, the methodologies for estimating the quantitative and qualitative impacts of Operational Contingencies. For these purposes, the risk administration officer may be assisted by other areas of the crowdfunding financing institution itself or by third parties contracted for such effect who are specialists in the matter.
II. Verify annually the effectiveness of the methodologies by comparing their estimates against Operational Contingencies actually observed and, if applicable, carry out necessary corrections.
III. Prepare, review, and, if applicable, update or propose the update of the Business Continuity Plan, to submit it for approval by the Administrative Body, at least once a year or with a higher frequency as determined by the Administrative Body itself.

In the event that the administration of the crowdfunding financing institution is in charge of a board of directors and a general manager, the latter shall be responsible for preparing, reviewing, and, if applicable, updating or proposing the update of the Business Continuity Plan to the board of directors, with the periodicity indicated in the preceding paragraph.

IV. Test the functioning and sufficiency of the Business Continuity Plan, in the terms established in said plan and, at least annually, or earlier if a significant change occurs in the Technological Infrastructure, processes, products, and services, or internal organization of the crowdfunding financing institution that may affect the recovery strategy, and, if applicable, update such plan.

V. Establish procedures for recording, attending to, following up, and disseminating to personnel whose functions are affected by the Operational Contingency or are related to the execution of the Business Continuity Plan, the findings, incidents, or observations resulting from the tests referred to in the preceding subsection, or the execution of the plan itself in the event that an Operational Contingency has occurred.

VI. Report to the Administrative Body, at least once a year, on the results of the tests referred to in fraction IV of this article.

VII. Evaluate the scope and effectiveness of the Business Continuity Plan, and report the results of such evaluation to the Administrative Body and to the areas responsible for critical operational processes, identifying, if applicable, the necessary adjustments for its update and strengthening.

In the event that the crowdfunding institution has an audit committee, the functions provided for in this fraction shall be carried out by said committee.

In the event that crowdfunding institutions contract with third parties for services necessary to support their operation, in substitution of what is provided in fractions IV, V, and VII of this article, and solely with respect to the services provided by these third parties, such institutions must have documentation accrediting that such third parties hold a valid certification issued in accordance with international standards regarding their capacity to maintain the continuity of their services. This is without prejudice to compliance with the general provisions referred to in Article 54 of the Law.

(2) Chapter VI

(2) On Information Security

(2) Article 63.- The General Manager or, if applicable, the sole administrator of the crowdfunding institution, shall be responsible for the implementation of internal controls regarding information security that ensure its confidentiality, integrity, and availability. The management framework referred to in this paragraph must ensure that the Technological Infrastructure of said institution, whether owned or provided by third parties, adheres to the following requirements:

(2) I. That each of its components performs the functions for which it was designed, developed, or acquired.

(2) II. That its processes, functionalities, and configurations, including its development or acquisition methodology, as well as the record of its changes, updates, and the detailed inventory of each component of the Technological Infrastructure, are documented.

(2) III. That information security aspects have been considered in the definition of projects to acquire or develop each of its components, including them during the various stages of the lifecycle. This shall comprise the elaboration of requirements, design, development or acquisition, implementation testing, acceptance testing by Users of the Technological Infrastructure, release processes including vulnerability testing and code analysis prior to going into production, periodic testing, change management, replacement, and destruction of information.

(2) Regarding communication and computing components, security aspects must include, at least, the following:

(2) a) Logical segregation, or logical and physical segregation of different networks in different domains and subnets, depending on the function they perform or the type of data transmitted, including segregation of production environments from development and testing environments, as well as perimeter and network security components that ensure that only authorized traffic is permitted. In particular, in those segments with links to the outside, such as the Internet, providers, authorities, other networks of the crowdfunding institution or parent company, and other third parties, all of which refer to those services defined as critical by the institution itself, whether payment systems, Encryption equipment, Operation Authorizers, among others, they must consider secure zones, including those known as demilitarized zones (DMZ in English).

(2) b) Secure configuration according to the type of component, considering at least, ports and services, permissions granted under the principle of least privilege, use of removable storage media, access lists, manufacturer updates, and reconfiguration of factory parameters. The principle of least privilege shall be understood as the enabling of access only to the information and resources necessary for the development of the functions of each User of the Technological Infrastructure.

(2) c) Security mechanisms in applications that ensure that, during their execution, they are protected from attacks or intrusions, such as code injection, session manipulation, information leakage, alteration of access privileges, among others. Such mechanisms must be implemented for both applications provided by third parties and for applications developed, implemented, and maintained by the crowdfunding institution itself.

(2) IV. That each of its components be tested before being implemented or modified, using quality control mechanisms that prevent the use of real production environment data in such tests, the disclosure of confidential or security information, or the introduction of any functionality not recognized for said component.

(2) V. That it has the licenses or usage authorizations, if applicable.

(2) VI. That it has security measures for its protection, as well as for the access and use of the information that is received, generated, transmitted, stored, and processed in the Technological Infrastructure, including at least the following:

(2) a) Identification and Authentication mechanisms for all and each of the Users of the Technological Infrastructure, which allow them to be recognized unequivocally and ensure access only to persons expressly authorized for this purpose, under the principle of least privilege.

(2) For this purpose, relevant controls must be included for those Users of the Technological Infrastructure with greater privileges, derived from their functions, such as database administration, operating systems, and applications.

(2) Furthermore, policies and procedures for exception access authorizations must be provided for in manuals, such as users of development environments with access to production environments and access due to contingency events, among others. Such policies and procedures must be approved by the Chief Information Security Officer.

(2) b) Encryption of information according to the degree of sensitivity or classification of the information that the crowdfunding institution determines and establishes in its policies, when such information is transmitted, exchanged, and communicated between components or stored in the Technological Infrastructure or accessed remotely.

(2) Crowdfunding institutions must encrypt at least the information they have classified as critical in terms of these provisions.

(2) c) Access keys with composition characteristics that prevent unauthorized access, considering processes that ensure that only the User of the Technological Infrastructure knows them, as well as security measures, Encryption in storage, and mechanisms to request the change of access keys every ninety days or less. Regarding Clients, the period referred to shall be that defined by the crowdfunding institutions themselves in the manuals referred to in the last paragraph of this article. In the case of Users of the Technological Infrastructure assigned to applications or components to authenticate with each other, the change referred to in this subsection must be carried out at least once a year. In the event that any User of the Technological Infrastructure has knowledge of the access keys and ceases to provide their services to the crowdfunding institution, these must be disabled immediately.

(2) d) Controls to automatically terminate idle sessions, as well as to prevent simultaneous unauthorized sessions with the same User of the Technological Infrastructure identifier.

(2) e) Security mechanisms, both physical access, as well as environmental and electrical energy controls, that protect the Technological Infrastructure and allow operation in accordance with the specifications of the supplier, manufacturer, or developer.

(2) f) Validation measures to guarantee the authenticity of transactions executed by the different components of the Technological Infrastructure, considering at least the following:

(2) 1. The veracity and integrity of the information.

(2) 2. Authentication between components of the Technological Infrastructure, which ensures that only legitimate service requests are executed from their origin to their execution and registration.

(2) 3. Messaging, communication, and Encryption protocols, which must ensure the integrity and confidentiality of the information.

(2) 4. The identification of atypical transactions, ensuring that monitoring tools or automatic alert measures are available for attention by the corresponding operational areas.

(2) 5. The update and maintenance of digital certificates and components provided by service providers integrated into the transaction execution process.

(2) The measures referred to in this subsection must be established in accordance with the degree of risk that crowdfunding institutions define for each type of transaction.

(2) Crowdfunding institutions, in the classification of the information referred to in subsection b) of this fraction, must consider at least one category regarding critical information. In this category, they must include at minimum Sensitive Information and images of official identifications and biometric information of Clients, as well as any other they determine in accordance with their policies.

(2) VII. That it has backup mechanisms and information recovery procedures that mitigate the risk of operational interruption, in accordance with what is stipulated in its Business Continuity Plan referred to in Chapter V of Title Three of these provisions.

(2) VIII. That it maintains complete audit records, including detailed information on accesses or access attempts and the operation or activity carried out by Users of the Technological Infrastructure, this regardless of the level of privileges they have for accessing, generating, or modifying the information they receive, generate, store, or transmit in each component of the Technological Infrastructure, including automated process activity, as well as procedures for the periodic review of such records.

(2) Crowdfunding institutions must retain the audit records referred to in this fraction for a period of three years when such records refer to activities carried out on components that process or store information considered critical in accordance with the classification determined by the crowdfunding institution. Otherwise, the retention period for the records shall be a minimum of six months.

(2) IX. That for the handling of Information Security Events and Information Security Incidents, there are management processes that ensure detection, classification, handling, containment, investigation, and, if applicable, digital forensic analysis, diagnosis, reporting to competent areas, resolution, follow-up, and communication to authorities, Clients, and counterparties.

(2) For the detection and response to Information Security Incidents referred to in the previous paragraph, the General Manager or, if applicable, the sole administrator must designate a team that incorporates personnel from the different areas of the crowdfunding institution to participate in each activity of the aforementioned management process, which in all cases must include the Chief Information Security Officer in accordance with Article 66 of these provisions.

(2) In the event that vulnerabilities and deficiencies in the Technological Infrastructure are detected, corrective actions or compensatory controls must be taken in accordance with the level of risk involved, preventing Users of the Technological Infrastructure or the crowdfunding institution from being affected.

(2) X. That it be subjected to the realization of annual planning and review exercises that allow measuring its capacity to support its operation, ensuring that the needs for capacity increase detected as a result of such exercises are attended to promptly.

(2) Furthermore, the crowdfunding institution must evaluate the obsolescence of the components of the Technological Infrastructure, having a plan for its update.

(2) XI. That it has automated controls or, in the absence of these, that compensatory controls are carried out, such as double verification and reconciliation that, prior to or subsequent to the carrying out of the operation in question, minimize the risk of elimination, exposure, alteration, or modification of information, resulting from manual or semi-automated processes carried out by the personnel of the crowdfunding institution, with the objective of preventing errors, omissions, theft, or manipulation of information.

(2) XII. That it has controls that allow detecting the alteration or falsification of books, records, and digital documents related to Operations.

(2) XIII. That it has processes to measure and ensure levels of availability and response times, which guarantee the execution of Operations carried out; this including the cases in which crowdfunding institutions contract the provision of services by third parties for the processing and storage of information.

(2) XIV. That it has devices or automated mechanisms to detect and prevent Information Security Events and Information Security Incidents, as well as to prevent unauthorized incoming or outgoing data connections and flows and information leakage, considering, among others, removable storage media.

(2) Crowdfunding institutions must correlate the data obtained from the devices or automated mechanisms referred to in the previous paragraph with data from other sources, such as activity records of Information Security Events or Information Security Incidents.

(2) Additionally, crowdfunding institutions must maintain controls that prevent the leakage of information corresponding to the configuration of the Technological Infrastructure, such as IP addresses, firewall rules, as well as hardware and software versions.

(2) XV. That for the provision of information technology services to Users of the Technological Infrastructure, in their strategy, design, transition, operation, and continuous improvement phases, the integrity of the Technological Infrastructure is protected, as well as the integrity, confidentiality, and availability of the information received, generated, processed, stored, and transmitted by it. The General Manager or, if applicable, the sole administrator of the crowdfunding institution shall be responsible for documenting in manuals the policies and procedures provided for in this article.

(2) The General Manager or, if applicable, the sole administrator of the crowdfunding institution shall be responsible for documenting in manuals the policies and procedures provided for in this article.

(2) Article 64.- The General Manager or, if applicable, the sole administrator of the crowdfunding institution, shall be responsible for compliance with the following obligations regarding the Technological Infrastructure:

(2) I. Approve the Master Security Plan, as well as its updates, which must be aligned with the business strategy of the crowdfunding institution, as well as define and prioritize projects regarding information security, with the objective of reducing exposure to technological risks and the materialization of Information Security Incidents to acceptable levels as defined, in their case, by the board of directors or the sole administrator themselves, according to the case, based on an analysis of the current situation.

(2) For the approval of the Master Security Plan, the General Manager or, if applicable, the sole administrator must verify that it contains initiatives aimed at improving existing work methods and may contemplate the controls required in accordance with applicable provisions.

(2) Regarding crowdfunding institutions that have a General Manager and a board of directors, the former must inform said board of the content of the Master Security Plan and have evidence of its approval and implementation.

(2) II. Carry out security reviews focused on verifying the sufficiency of controls applicable to the Technological Infrastructure. These reviews must include, at least, the following:

(2) a) Authentication mechanisms of Users of the Technological Infrastructure.

(2) b) Configuration and access controls to the Technological Infrastructure.

(2) c) Updates required for operating systems and software in general, prior to implementation and once implemented.

(2) d) Identification of possible unauthorized modifications to the original software.

(2) e) Devices, communication networks, systems, and processes associated with Electronic Media and customer service channels, in order to verify that there are no vulnerabilities or that there are tools or procedures that allow knowing the Authentication credentials of Users of the Technological Infrastructure, as well as any information that, directly or indirectly, could give access to the Technological Infrastructure on behalf of the User of the Technological Infrastructure.

(2) The reviews referred to in this fraction must be carried out, at least, once a year or sooner if significant changes occur in the Technological Infrastructure. To determine if it is a significant change, the opinion of the Chief Information Security Officer must be obtained for this purpose.

(2) III. Prepare an annual calendar for the performance of vulnerability scanning tests of the components of the Technological Infrastructure that store, process, or transmit information, prioritizing them according to the result of the information classification exercise determined by the crowdfunding institution. The calendar must provide for the bi-monthly review of the components of the Technological Infrastructure so that, by the end of the year, all components that store, process, or transmit information cataloged by the crowdfunding institution as critical have been reviewed, as well as those it considers necessary. The General Manager or, if applicable, the sole administrator shall be responsible for monitoring that such tests are carried out, either through the crowdfunding institution itself or a third party contracted for this purpose. Additionally, when new components of the Technological Infrastructure are incorporated, the General Manager or, if applicable, the sole administrator shall be responsible for monitoring that a vulnerability scanning test is performed prior to going into production.

(2) IV. Contract an independent third party, with personnel who have verifiable technical capacity through industry certifications in the matter, to perform penetration tests on the different systems and applications of the crowdfunding institution with the aim of detecting errors, vulnerabilities, unauthorized functionality, or any code that puts or may put at risk the information and assets of Clients and of the crowdfunding institution itself. Such review must include the verification of the integrity of hardware and software components that allow detecting alterations thereof. Penetration tests must consider, at least, the following:

(2) a) Their scope and methodology, which must be validated by the Chief Information Security Officer.

(2) b) Be carried out, at least, two per year on different components, systems, or applications that have been determined by the crowdfunding institution as higher risk, or when ordered by the CNBV having detected vulnerabilities or factors that may affect the systems and applications or the information received, generated, processed, stored, or transmitted in them. In this latter case, the CNBV will determine the scope of the tests, as well as the deadlines for carrying them out.

(2) Additional tests may be carried out at the discretion of the General Manager or, if applicable, the sole administrator, with the opinion of the Chief Information Security Officer, when there are significant changes in the systems and applications, or carried out on systems and applications previously carried out when there are critical vulnerabilities.

(2) The General Manager or, if applicable, the sole administrator of the crowdfunding institution must send to the CNBV within twenty business days of the completion of the tests, a report with the conclusions of these. In the submission made, care must be taken to use mechanisms that prevent unauthorized personnel from accessing the content of this report.

(2) V. Classify the detected vulnerabilities according to the methodology approved by the person responsible for the risk administration of the crowdfunding institution.

(2) VI. Prepare remediation plans regarding the findings of the reviews and tests referred to in fractions II, III, and IV above, considering the classification of fraction V of

present article, as well as implement defense mechanisms that prevent unauthorized access and use of the Technological Infrastructure.

(2) The remediation plans referred to in the preceding paragraph must be validated by the Chief Information Security Officer. Furthermore, such plans must contain, at a minimum, the indication of the personnel responsible for their implementation and execution, as well as deadlines for such, details of activities performed and to be performed, as well as the technical, material, and human resources used. The aforementioned remediation plans must be prepared once vulnerabilities are identified and sent to the CNBV within a period of ten business days.

(2) In addition to what is stated in the preceding paragraph, in the case of short, medium, or long-term projects in the remediation plans, they must be incorporated into the Master Security Plan.

(2) VII. Implement monitoring processes for compliance with the aforementioned remediation plans, which must be verified by the Chief Information Security Officer, who must additionally corroborate that the aforementioned plans have succeeded in correcting the identified vulnerabilities.

(2) VIII. Implement annual training programs directed at all personnel, as well as awareness programs regarding information security towards Clients, including, where applicable, third parties providing services to them, in which aspects such as the roles and responsibilities that Users of Technological Infrastructure have in this regard are contemplated.

(2) IX. Proactively and interactively search for fraud alerts, as well as threats, such as phishing email campaigns, fake websites, disclosure of databases with Client information, mobile applications, and, where applicable, alteration of devices used to carry out Operations, among others, that could affect the information security of Clients, as well as actions for their protection considering, at a minimum, the following:

(2) a) The continuous investigation, collection, processing, and analysis of information coming from any source related to the products and services offered by the collective financing institution, which may constitute indications or evidence that security controls have been evaded, representing a threat to the Client's information or resources.

(2) The indications or evidence referred to in the preceding paragraph will be maintained in a record, which must be contained in the database referred to in the first paragraph of article 68 of these provisions.

(2) b) The implementation of proactive processes to protect Client information or resources when the indications or evidence indicated in the preceding subsection a) occur, such as Blocking and replacement of disposal means, change of Authentication data, and notifications, among others.

(2) c) That it has communication procedures and security recommendations with affected Clients, to inform them about the remediation processes that the collective financing institution will carry out and, where applicable, the measures that the Client themselves must adopt, such as changing passwords, verifying balances and transactions, installing antivirus, installing malware detection software, reviewing devices, and reinstalling applications, among others.

(2) The terms and conditions for carrying out the processes through which the activities indicated in this subsection are performed must be documented in the respective policies and procedures manuals, in which it must be provided that the collective financing institution will maintain evidence of the performance of such activities.

(2) X. Implement controls that allow the collective financing institution to ensure the confidentiality, integrity, and availability of Client information and of the collective financing institution itself or access to the Technological Infrastructure, by its employees or personnel who have access to it, which guarantee that such information and Technological Infrastructure are not altered or cause an impact on the collective financing institution or its Clients' resources. Such controls must be implemented from the respective hiring until termination.

(2) XI. Establish policies and procedures to ensure that the Chief Information Security Officer obtains from the business units of the collective financing institution the necessary information and documentation for compliance with the functions established in these provisions.

(2) Article 65.- Collective financing institutions must have a person who, among their functions, serves as the Chief Information Security Officer, known as CISO by its acronym in English (Chief Information Security Officer).

(2) The Chief Information Security Officer must be appointed by the General Manager or, where applicable, by the sole administrator, and must report to them, and must not have conflicts of interest with respect to the person responsible for audit and information technology functions within the collective financing institution. Furthermore, they may not perform functions related to the operation of the information security of the collective financing institution itself.

(2) The functions of the Chief Information Security Officer may be performed by a third party, provided that it complies with what is stated in this article.

(2) The Chief Information Security Officer may support, in the exercise of their functions, representatives from the different business units.

(2) Collective financing institutions may appoint the General Manager or, where applicable, the sole administrator as the Chief Information Security Officer for a maximum period of twelve months, counted from the date they obtain authorization to act as such.

(2) Article 66.- The Chief Information Security Officer of the collective financing institution must, at a minimum:

(2) I. Participate in the definition and verify the implementation and continuous compliance with the security policies and procedures indicated in article 63 of these provisions.

(2) II. Prepare the Master Security Plan, which must contain, for each project defined, the project name, objective, scope, start and end dates, involved areas, and projected investment. This plan must be reviewed and updated at least annually.

(2) III. Verify, at least annually, the definition of access profiles to the Technological Infrastructure of the collective financing institution, whether its own or provided by third parties, according to job profiles (functional segregation), including those with high privileges, such as operating system administration, databases, and applications.

(2) IV. Ensure at least annually, or sooner in the event of an Information Security Incident, the correct assignment of access profiles to Users of the Technological Infrastructure. The function referred to in this subsection may be carried out through representative and random samples.

(2) Furthermore, they will be responsible for the temporary authorization of exceptional accesses, such as those of users in development environments with access to production environments, accesses due to contingency events, or any other privileged access that does not correspond to the policy determined by the collective financing institution. Likewise, they must have a record containing the name of the Technological Infrastructure User, associated application, environment, reason for the exception, and start and end dates of the assignment.

(2) V. Approve and verify compliance with the measures adopted to remedy deficiencies detected in connection with the functions referred to in subsections III and IV of this article, as well as the findings of audits carried out related to Technological Infrastructure and information security.

(2) VI. Manage information security alerts communicated by the CNBV or other means, as well as Information Security Incidents, considering the stages of identification, protection, detection, response, and recovery.

(2) VII. Coordinate and preside over the team for the detection and response to Information Security Incidents within the collective financing institution.

(2) VIII. Inform the Administrative Body or, if there is an audit committee and a risk committee, at their next immediate session, as applicable, upon verification of the Information Security Incident, regarding the actions taken and the follow-up on measures to prevent or avoid the recurrence of the aforementioned incidents.

(2) IX. Propose and coordinate training programs directed at all personnel, as well as awareness programs regarding information security towards Clients, and verify their effectiveness.

(2) X. Present monthly to the General Manager or, where applicable, the sole administrator, the management report on information security. This report must be submitted to the audit committee and the risk committee or, in the absence of these, to the board of directors of the collective financing institution.

(2) XI. Consider, at a minimum, the risk indicators in the field of information security established in Annex 13 of these provisions, and report the results of the evaluation of such indicators to the Administrative Body, and where applicable, to the audit committee or risk committee.

(2) XII. Be responsible for implementing the regulations, in the field of information security, issued by other Financial Authorities.

(2) XIII. Respond to requirements formulated by authorities and within the collective financing institution regarding information security.

(2) Collective financing institutions must ensure that the Chief Information Security Officer has access to the records of persons who have access to information related to the operations in which the collective financing institution itself intervenes, including those located abroad and Users of the Technological Infrastructure who have high privileges, such as operating system administration, databases, and applications, as well as their service providers.

(2) Collective financing institutions that belong to a financial group subject to the supervision of the CNBV, or that are part of Consortia or Business Groups that have a financial entity subject to the supervision of the CNBV itself, may assign the functions of the Chief Information Security Officer to the person performing such activities in the financial entity supervised by the CNBV, provided that such person complies with what is established in article 65 of these provisions.

(2) Article 67.- When an Information Security Event or Information Security Incident occurs in: (i) the components of the Technological Infrastructure of the collective financing institution; (ii) Client service channels, such as Electronic Means, or (iii) the technological infrastructure of any third party that affects the operation or the Technological Infrastructure of the collective financing institution, the General Manager or, where applicable, the sole administrator must:

(2) I. Provide for what is necessary to make the CNBV aware, immediately, of Information Security Incidents, via email sent to the account Ciberseguridad-CNBV@cnbv.gob.mx or through other means indicated by the CNBV itself. In such notification, at a minimum, the date and time of the start of the Information Security Incident in question must be indicated, and where applicable, an indication of whether it continues or has concluded and its duration; a description of such event or incident, as well as an initial assessment of the impact or severity.

(2) Additionally, collective financing institutions must send via email to the CNBV, to the account Ciberseguridad-CNBV@cnbv.gob.mx or through other means indicated by the CNBV itself, within five business days following the identification of the Information Security Incident in question, the information contained in Annexes 11 and 12 of these provisions.

(2) In the case of Information Security Events, they must be reported through the means indicated in the first paragraph of this subsection only those that, according to the policies and procedures established by the collective financing institution itself, are classified as relevant due to potential impact on the collective financing institution, its Clients, counterparties, suppliers, or other entities in the financial system, as well as those related to Sensitive Information, images of official identification, and biometric information of Clients. This report must only contain the date and time of start, as well as the description of the event in question.

(2) II. Carry out an immediate investigation into the causes that generated the Information Security Incident and establish a work plan that describes the actions to be implemented to eliminate or mitigate the risks and vulnerabilities that caused the aforementioned incident. This plan must indicate, at a minimum, the personnel responsible for its design, implementation, execution, and monitoring, deadlines for its execution, as well as technical, material, and human resources, and send it to the CNBV within a period not exceeding fifteen business days after the Information Security Incident concluded.

(2) When the Information Security Incident refers to Sensitive Information held by the collective financing institution or third parties providing services to it, being extracted, lost, deleted, altered, or if collective financing institutions suspect the commission of any act involving unauthorized access to such information, the General Manager or, where applicable, the sole administrator or the person designated by either of them, must notify Clients of the possible loss, extraction, alteration, loss, or unauthorized access to their information, within the following forty-eight hours after the Information Security Incident occurred or after knowledge of it was obtained, through the notification means indicated by the Client for such effect, in order to prevent them from the risks derived from the misuse of information that has been extracted, lost, deleted, or altered, informing them of the measures they must take and, where applicable, making the replacement of the corresponding disposal means or the substitution of necessary Authentication Factors. The evidence of this notification must be included in the result of the investigation indicated in the preceding paragraph.

(2) Article 68.- Collective financing institutions must maintain a database record of Information Security Events classified as relevant, Information Security Incidents, failures, or vulnerabilities detected in the Technological Infrastructure, which includes, at a minimum, information related to the detection of failures, operational errors, attempts at computer attacks, and those effectively carried out, as well as loss, extraction, alteration, loss, or misuse of information by Users of the Technological Infrastructure, where the date of the event and a brief description of it, its duration, affected service or channel, affected Clients and amounts, as well as corrective measures implemented are contemplated.

(2) The information of Information Security Events classified as relevant and Information Security Incidents referred to in this article must be backed up in the means determined by collective financing institutions and preserved for at least ten years.

(2) Chapter VII

(2) On the use of electronic means

(2) Article 69.- Collective financing institutions, for the use of Electronic Means, must inform their Clients, at a minimum, of the following:

(2) I. The Operations and services that can be performed.

(2) II. The identification and Authentication mechanisms and procedures.

(2) III. The responsibilities of the Client and the collective financing institution regarding the use of the corresponding Electronic Medium.

(2) IV. The mechanisms and procedures for notifying Operations performed and services provided by collective financing institutions.

(2) V. The limits on Operation amounts, without exceeding those established in articles 49 and 50 of these provisions.

(2) VI. The inherent risks, terms, and conditions for the use of the corresponding Electronic Medium, as well as suggestions to avoid the misuse of Authentication data to prevent irregular or illegal operations that detriment the Clients' and collective financing institutions' assets.

(2) VII. The mechanisms and procedures that the collective financing institution will make available to Clients to address clarifications related to Operations and services.

(2) VIII. The notification procedures and terms and conditions for Client acceptance of modifications to the conditions indicated in the preceding subsections of this article.

(2) Article 70.- Collective financing institutions, to allow the start of a Session, must request and validate at a minimum the following:

(2) I. The Client Identifier, and

(2) II. An Authentication Factor referred to in article 72 of these provisions.

(2) The Client Identifier must be unique for each Client and allow collective financing institutions to identify all Operations performed by the respective Client.

(2) Article 71.- Collective financing institutions, in the use of the Client Identifier and Authentication Factors, must comply, at a minimum, with the following:

(2) I. Have the necessary mechanisms to prevent the reading on the Access Device screen of the identification and Authentication information provided by the Client.

(2) II. Have procedures that ensure that, in the generation, delivery, storage, unlocking, and restoration of Authentication Factors, only the Client receives, activates, knows, unlocks, and restores them.

(2) III. Ensure that when there is more than one Authentication Factor, they are independent, meaning that the compromise of one does not compromise the reliability of the others.

(2) IV. Have procedures to restore a blocked Password, in which the Client's identity is identified without compromising their Sensitive Information.

(2) V. Have procedures to invalidate Authentication Factors and the Client Identifier to prevent their use in the corresponding Electronic Medium when a Client ceases to be one.

(2) Article 72.- Collective financing institutions must use Authentication Factors to verify the identity of their Clients and their authority to perform Operations through the corresponding Electronic Medium. Such Authentication Factors must be any of the following:

(2) I. Information such as Passwords and Personal Identification Numbers (PIN), which collective financing institutions provide to the Client or allow the Client to generate and which only the Client knows to enter the Platform and start the corresponding Session, and which must have the following characteristics:

(2) a) Its length must be at least six characters and include alphanumeric and special characters, when the Access Device allows it.

(2) b) In no case may the following information be used as such:

(2) i. The Client Identifier.

(2) ii. The name of the collective financing institution.

(2) iii. More than three identical characters consecutively.

(2) iv. More than three sequential numeric and alphabetic characters.

(2) Collective financing institutions must allow the Client to change their Passwords, Personal Identification Numbers (PIN), and other static Authentication information, when the Client so requests, under the terms provided in these provisions.

(2) Regarding Passwords defined or generated by collective financing institutions during their restoration, the institutions themselves must provide mechanisms and procedures through which the Client must modify them immediately after starting the corresponding Session and prior to performing any Operation, validating that the Passwords are different from those defined by the collective financing institutions themselves.

(2) II. Information contained, received, or generated by electronic means or devices that only the Client possesses, including that obtained or received by devices or applications generating one-time passwords (OTP, one time password by its acronym in English), such means or devices must be provided, validated, and registered by collective financing institutions for their Clients, and the information contained or generated by them may be provided, among other formats, in response codes

rapid (QR, quick response in English). In any case, the following characteristics must be met:

(2) a) Possess properties that prevent duplication or alteration.
(2) b) Be dynamic information that cannot be used more than once.
(2) c) Have a validity period that cannot exceed two minutes.
(2) d) Not be known in advance by officials, employees, representatives of the crowdfunding institution, or third parties before its generation and use.

(2) Crowdfunding institutions may provide their Clients with means or devices that generate One-Time Dynamic Passwords, which use information from the Destination Account, through data capture, so that such Password can only be used for the requested Operation. In this case, the provision in subsection c) of this section shall not apply.

(2) III. Information derived from physical characteristics, such as fingerprints, hand geometry, iris or retina patterns, and facial recognition. For the use of this information, prior authorization from the CNBV must be obtained.

(2) Crowdfunding institutions that use this information as an Authentication Factor must ensure that the biometric data of their employees, executives, or officials is not used in substitution of the Client's data.

(2) Article 73.- Crowdfunding institutions may request the CNBV to approve Authentication Factors with characteristics different from those indicated in Article 72, sections I and II of these provisions, or in the use of the information indicated in section III of said Article, provided they demonstrate that the technology used, in the judgment of the CNBV itself, is reliable for authenticating their Clients.

(2) The request to obtain CNBV approval, as applicable, must contain the following:

(2) I. A detailed description of the processes related to the use of the technology utilized.

(2) II. A description of its technical and functional specifications, and if applicable, the certifications it holds.

(2) III. Evidence of the approval of the use of the technology by the Administrative Body.

(2) Article 74.- Crowdfunding institutions must establish mechanisms and procedures so that their Clients can verify the authenticity of the crowdfunding institutions themselves at the start of a Session, subject to the following:

(2) I. Provide Clients with personalized information so that they can verify, before entering all identification and Authentication elements, that it is indeed their Platform on which the Session will begin. To this end, crowdfunding institutions must use at least one of the following:

(2) a) Information that the Client knows or has provided to the crowdfunding institution, or that they have indicated for this purpose, such as name, alias, images, among others.

(2) b) Information that the Client can verify through a device or Electronic Medium provided by the crowdfunding institution for this purpose.

(2) II. Once the Client verifies that it is the crowdfunding institution and starts the Session, it must provide in a prominent and visible manner to the Client, at least the following information:

(2) a) Date and time of entry to their last Session, and

(2) b) Client's first and last name.

(2) Article 75.- Crowdfunding institutions must make necessary provisions so that, once the Client is authenticated in the corresponding Electronic Medium, the Session cannot be used by a third party. For the purposes of the foregoing, crowdfunding institutions will establish, at least, the following mechanisms:

(2) I. Terminate the Session immediately and automatically and inform the Client of the reason in any of the following cases:

(2) a) When there is inactivity for more than five minutes.

(2) b) When during the course of a Session, the crowdfunding institution identifies relevant changes in communication parameters, such as identification of the Access Device, range of communication protocol addresses, geographic location, among others.

(2) II. Prevent simultaneous access on the same Electronic Medium, by using the same Client Identifier and informing the Client thereof.

(2) III. In the event that crowdfunding institutions offer third-party services through links, they must inform their Clients that, upon entering said services, they will be entering another link whose security does not depend on nor is the responsibility of said crowdfunding institution.

(2) Article 76.- Crowdfunding institutions, for the celebration of Operations, will request from their Clients a second Authentication Factor from those established in Article 72 of these provisions, additional and different from the one used to start the Session and on each occasion when any of the following operations are intended to be carried out:

(2) I. Instructions to make investment commitments or withdraw their resources.

(2) II. Registration or modification of Destination Accounts for the service in question.

(2) III. Change and Unblocking of Passwords or Personal Identification Numbers (PIN).

(2) IV. Registration and modification of the notification medium referred to in Article 79 of these provisions.

(2) V. Inquiries into account statements of one or more periods that allow knowing information related to the Client and their Operations. It will not be necessary to use the aforementioned second factor, for the case of account statement inquiries, provided that the Client has started their Session with an Authentication Factor as referred to in sections II and III of Article 72 of these provisions.

(2) Crowdfunding institutions, when agreeing with their Clients that account statement inquiries will be through email, the information transmitted must be Encrypted or with mechanisms that prevent its reading by unauthorized third parties, and for the Client to have access to said information, they will require an Authentication Factor as established in sections II and III referred to in Article 72 of these provisions.

(2) Article 77.- Crowdfunding institutions that offer services to their Clients through call centers, electronic messaging channels, or automated agents, may identify their Clients and verify their identity through questionnaires, in which case they must observe the following:

(2) I. They must request data that the Client knows and that the crowdfunding institutions can validate, maintaining the due confidentiality of said information.

(2) II. Have procedures to conduct random questionnaires in an automated manner or remotely by operators, in the latter case, preventing them from being used discretionarily.

(2) III. Define a set of open questions in questionnaires of at least three questions, and in the event that the answer to one of them is incorrect, an additional question may be formulated. In no case can the answers to these questions be data displayed on the Electronic Medium or found in printed or electronic communications sent by the crowdfunding institutions to their Clients.

(2) IV. Validate the answers provided by their Clients through computer tools, without the operator being able to consult or access the Client's Authentication data.

(2) Crowdfunding institutions may use questionnaires to unblock Authentication Factors that have previously been Blocked in the cases contemplated in Article 80 of these provisions. In case of asking Clients secret questions, whose answers have been previously provided by the Client, these will be stored in Encrypted form. For the purposes of the provision in this paragraph, a secret question shall be understood as the questioning defined by the Client or the crowdfunding institution, regarding which information is generated as an answer. Each secret question defined can only be used once.

(2) Article 78.- Crowdfunding institutions must request that their Clients confirm the Operation and its characteristics, prior to its execution, making the information explicit to give certainty to the Client of the Operation being performed.

(2) Regarding the making of automatic investments referred to in Article 54 of these provisions, the confirmation referred to in the previous paragraph will only be required to contract said service.

(2) Article 79.- Crowdfunding institutions will notify their Clients immediately, through the communication means made available to them, such as mobile phone number or email address, which they have chosen for this purpose, regarding the performance of Operations. For the change of notification medium, a notice must be sent to both the previous and the new medium.

(2) Article 80.- Crowdfunding institutions will establish automatic processes and mechanisms to Block the Authentication Factors, at least for the following cases:

(2) I. When an attempt is made to enter the Electronic Medium in question using incorrect Authentication information. In no case can failed access attempts exceed three consecutive occasions; once the established number of attempts is reached, automatic Blocking must be generated.

(2) II. When the Client does not access the Electronic Medium in question, for a period determined by each crowdfunding institution in its operating policies. In no case, said period can be greater than one year.

(2) Article 81.- Crowdfunding institutions, in the handling of Authentication Factors, will be subject to the following:

(2) I. They must maintain procedures that provide security for the information contained in the Authentication devices in their custody, as well as in the distribution, assignment, and replacement of said Authentication Factors to their Clients.

(2) II. They are prohibited from having mechanisms, algorithms, or procedures that allow them to know, recover, or decipher the values of any information related to Authentication.

(2) III. They are prohibited from requesting from their Clients, through their officials, employees, or representatives, partial or complete information of the Authentication Factors referred to in Article 72 of these provisions.

(2) IV. In case of obtaining approval for the use of the Authentication Factors of section III of Article 72 of these provisions, they must incorporate into the Authentication information obtained by biometric devices, elements that ensure that said information is different each time it is generated in order to constitute One-Time Passwords, which in no case can be used again or duplicated with that of another Client.

(2) Article 82.- Crowdfunding institutions will foresee procedures and mechanisms so that their Clients report the theft or loss of their identification and Authentication information, which allow the crowdfunding institutions themselves to prevent their improper use.

(2) Likewise, they must establish policies that define the responsibilities of both the Client and the crowdfunding institution, regarding Operations that have been carried out prior to a report of theft or loss of their identification or Authentication information.

(2) Each report of theft or loss will generate a file number that will be made known to the Client and that allows them to follow up on said report.

(2) Article 83.- Crowdfunding institutions that have remote channels such as call centers or electronic messaging channels, must:

(2) I. Maintain physical or logical security controls or both, as appropriate, in the Technological Infrastructure of the remote channels, including the recording devices of communications and the storage and backup media thereof, which protect at all times the confidentiality and integrity of the information provided by their Clients.

(2) II. Delimit the functions of the operators, so that they are independent with respect to other operational functions.

(2) III. Prevent operators from having mechanisms that allow them to register the information provided by their Clients in media different from those provided by the crowdfunding institution itself for Authentication purposes. To this end, crowdfunding institutions must ensure that persons who have access to the remote channels do not use electronic equipment or other devices, external email services, instant messaging programs, computer programs, or through these have access to unauthorized Internet pages, or to any other mechanism that allows them to copy, send, or extract by any means or technology information related to Clients.

(2) IV. Register in logs, the accesses and activities that operators of call centers or electronic messaging channels carry out with Clients, as well as preserve the logs.

(2) The provisions of this Article must be foreseen in the information security manuals established by crowdfunding institutions referred to in Article 63, last paragraph of these provisions.

(2) Article 84.- Crowdfunding institutions must have trained personnel or technical and operational support infrastructure, that attend and follow up on service requests that their Clients have in the use of Electronic Media.

(2) Chapter VIII

(2) On the contracting of services with third parties

(2) Article 85.- Crowdfunding institutions will only require authorization from the CNBV to contract with third parties the provision of services that have the following characteristics:

(2) I. That involve the transmission, storage, processing, safeguarding, or custody of Sensitive Information, images of official identifications, or biometric information of Clients, provided that the contracted third party has access privileges to know said information or to security configuration information, or to access control administration.

(2) II. That carry out processes abroad related to accounting or treasury, as well as with the recording of transactional movements of Clients.

(2) Crowdfunding institutions, both in the contracting of the services referred to in the aforementioned sections and in any other, must ensure at all times that the third parties providing them services maintain the due confidentiality of the information regarding the Operations celebrated with their Clients, as well as that regarding the latter, in case of having access to it.

(2) The general manager or, if applicable, the sole administrator of the crowdfunding institution will be responsible for approving the contracting of third parties.

(2) Crowdfunding institutions must maintain the data of the third parties that provide them services, in the registry referred to in Article 88 of these provisions.

(2) Article 86.- Crowdfunding institutions must accompany the authorization request referred to in the previous Article with the following:

(2) I. A detailed description and flowcharts of the processes of the services to be contracted, considering the activities to be performed by the crowdfunding institution, as well as by the service provider; the areas of the crowdfunding institution itself and the third party that participate in the service flow; name, description, and functionality of the systems that, if applicable, will be contracted for the provision of the service, or the systems of the crowdfunding institution that will be used by the respective provider.

(2) II. The draft service provision contract, in which the probable date of its celebration, the rights and obligations of the crowdfunding institution and the third party must be indicated, including the determination regarding intellectual property regarding the designs, developments, or processes used for the provision of the service. Said draft contract must be presented in Spanish.

(2) Likewise, it must be recorded within the contract, the express acceptance by the third party of the following obligations:

(2) a) Adhere to what is provided in Article 54 of the Law.

(2) b) Deliver in the development of an audit and at the request of the crowdfunding institution itself, to the independent external auditor of the crowdfunding institution itself and to the CNBV, the books, systems, records, manuals, and documents in general, related to the provision of the service in question. Likewise, allow the independent external auditor or CNBV personnel access to their offices and installations in general, related to the provision of the service in question.

(2) c) Inform the crowdfunding institution regarding any modification to its corporate purpose or any other change that could affect the provision of the service subject to the contracting, with at least thirty days' advance notice before such modification or change occurs.

(2) d) Maintain confidentiality regarding the information that has been received, transmitted, processed, or stored during the provision of the services. Likewise, accept that said information can only be used and exploited for the purposes agreed upon in the provision of the service.

(2) e) In case the third party carries out subcontracting for the partial or total provision of any of the services provided to the crowdfunding institutions, the obligation to notify the institution itself regarding said subcontracting; likewise, that it will establish mechanisms so that the subcontractor complies with the obligations agreed upon and provides the information for the purposes of Article 88 of these provisions.

(2) f) Comply with the terms, conditions, and processes so that the third party guarantees to the crowdfunding institution the transfer, return, and secure elimination of the information subject to the contracted service when it ceases to provide it.

(2) g) Maintain complete audit records that include detailed information of accesses or access attempts and the operation or activity carried out by Users of the Technological Infrastructure. Such records must be available to authorized personnel of the crowdfunding institution.

(2) h) Have access controls to information according to the access levels and profiles determined by the crowdfunding institution.

(2) i) Allow the crowdfunding institution to carry out the security reviews indicated in Article 64, sections II, III, and IV of these provisions on the contracted services or provide evidence of the carrying out of these reviews.

(2) III. The following documentation regarding the Technological Infrastructure:

(2) a) The description of the communication links used by the crowdfunding institution to connect with the service provider, which includes the name of the provider, bandwidth, and type of service provided, among others.

(2) b) A telecommunications diagram showing the existing connection between each of the participants in the provision of the service (providers, data centers, crowdfunding institution, among others), including redundancy schemes.

(2) c) The complete address of the place where each of the services will be carried out, as well as the primary and secondary data centers where information will be stored and processed. In case the indicated place is located in national territory, it must include, at least, street, exterior and interior number, neighborhood, borough or municipality, postal code, and federative entity. Regarding a site located abroad,

foreign entities must include similar data that allows the location to be identified with certainty. In the case of Cloud Computing services, only the information specified in subsection b) of fraction VI of this article must be provided.

(2) d) In applicable cases, the scheme of interrelation of applications or systems subject to the contract, including the institution's own systems.

(2) e) The mechanisms for continuity of the contracted service.

(2) IV. The mechanisms that will allow the collective financing institution to maintain on its premises detailed records of all Operations carried out, as well as its accounting records at the daily close. These records must be maintained in a format that allows their consultation and use, regardless of whether the service contracted with the third party is unavailable.

(2) V. When the third party has access privileges to images of official identification or biometric information of Clients, provide evidence of the controls it will maintain to guarantee the confidentiality, integrity, and availability of this information.

(2) VI. In the case of contracting Cloud Computing services, additionally describe the following:

(2) a) Type of cloud, whether public, private, or hybrid.

(2) b) Specific regions where information will be stored and processed.

(2) c) In public cloud schemes or virtualization in infrastructure shared with other clients, the description of the control mechanisms that will be used to guarantee the confidentiality, integrity, and availability of Sensitive Information.

(2) VII. Description of the mechanisms to monitor the performance of the contracted third party and the compliance with its contractual obligations, including at least those provided in these provisions.

(2) VIII. Plans to evaluate and report to the Administrative Body or, in applicable cases, to the audit committee of the collective financing institution, depending on the importance of the contracted service, the third party's performance, and compliance with the applicable regulation related to said service.

(2) IX. Evidence that allows verifying that third parties have and implement personal data protection and information confidentiality policies that allow the collective financing institution to comply with the legal provisions governing it in this matter. In the case of services that are processed, provided, or executed wholly or partially outside national territory, collective financing institutions must accompany the documentation that accredits that the third parties reside in countries whose internal law provides protection for personal data, safeguarding its proper confidentiality, or that said countries have signed international agreements with Mexico in this matter or on the exchange of information between supervisory bodies, in the case of Financial Entities.

(2) The CNBV will have a period of twenty-five business days to resolve regarding the authorization request referred to in this article; if this period elapses without any pronouncement, the resolution will be understood as positive. Any request for additional information by the CNBV will interrupt the period indicated in this paragraph.

(2) Article 87.- Collective financing institutions for the contracting of services with third parties that are subject to authorization by the CNBV in terms of these provisions, as well as those related to operational processes and the administration of databases and computer systems, must comply with the following:

(2) I. In the case of third parties that provide services related to operational processes and the administration of databases and computer systems, agree to what is stated in fraction II of article 86 and keep the respective contract.

(2) II. Carry out, at least annually, internal or external audits on the contracted service or have evidence that the contracted third party carries them out.

(2) III. Maintain in their main offices, at least, the documentation and information related to the evaluations, audit results, and, in applicable cases, the remediation plans that correspond, as well as the performance reports of the contracted third parties, including documentation regarding compliance with what is stated in fraction I of this article.

(2) IV. Update the description or respective documentation when there are modifications that are considered to have a relevant impact on the service provided or that are related to the systems, equipment, and applications subject to the contract or their technical characteristics.

(2) V. Regarding Technological Infrastructure and information security, in addition to the information determined in article 86, fraction III, subsections b) and d) of these provisions, have the following documentation:

(2) a) The description of the technical characteristics of the systems, equipment, and applications subject to the contract that contains at least what is stated in Annex 14 of these provisions.

(2) b) That which details the mechanisms to ensure the transmission and storage of information in Encrypted form, in applicable cases, including the version of the Encryption protocols and security components in the Technological Infrastructure.

(2) c) That which contains the detail of the type of information of the collective financing institution and Clients, specifying, in applicable cases, the type of Sensitive Information that will be stored by the third party in its equipment or facilities, or to which it may have access, in applicable cases.

(2) d) The description of the control and monitoring mechanisms for access to computer systems and Sensitive Information transmitted, stored, processed, safeguarded, or custodied in said systems, as well as the logs, databases, and security configurations established for this purpose.

(2) e) The evidence of the controls and of the control mechanisms referred to in fractions V and VI, subsection c) of article 86 of these provisions.

(2) VI. Have the evidence referred to in fraction IX of the previous article 86.

(2) The general director or, in applicable cases, the sole administrator will be responsible for the implementation of the evaluations and remediation plans referred to in fraction III of this article.

(2) Article 88.- Collective financing institutions must have a registry of all service providers, including those subcontracted by them, which includes, at least, the following information:

(2) I. Name, denomination, or corporate name of the service provider.

(2) II. Name of the legal representative of the service provider.

(2) III. Description of the service contracted with the third party, including the data or information that, in applicable cases, are stored, processed, or transmitted by it.

(2) IV. In applicable cases, information on the systems that support the service contracted with the third party, which includes at least the name, version, and function or purpose.

(2) V. In applicable cases, interfaces with other systems and the purpose of these, including the detail of the information exchanged.

(2) VI. Location where the service is performed and where the personnel responsible for carrying it out are located.

(2) VII. In applicable cases, location of the main data center where the processing equipment of the contracted system is located.

(2) VIII. In applicable cases, location of the alternative data center where the processing equipment is located, in the case of recovery of the contracted service.

(2) IX. In applicable cases, number and date of the letter with which the CNBV granted the authorization.

(2) Collective financing institutions must keep the registry referred to in this article updated.

(2) Chapter IX

(2) On the disclosure of information

(2) First Section

(2) On the disclosure of information in the publication of applications and projects

(2) Article 89.- Collective financing institutions will include in the publications on the financing offers they make on their Platforms, information regarding the general analysis carried out and any other variable that proves useful for Investors to make an informed investment decision.

(2) Article 90.- Collective financing institutions that carry out Collective Financing Operations of Personal Loan Debt among Persons must reveal, for each financing application, the following information:

(2) I. Amount of financing requested.

(2) II. Term of the Collective Financing Application.

(2) III. Description of the destination of the financing.

(2) IV. Term of the collective financing.

(2) V. Payment schedule of principal and interest, as well as their amount.

(2) VI. Ordinary interest rate and, in applicable cases, default interest rate.

(2) VII. In applicable cases, guarantees.

(2) VIII. Risk rating determined according to the risk evaluation methodology defined by the collective financing institution, accompanied by a simple explanation of how to interpret it.

(2) IX. Schemes to share with Investors the risks of collective financing Operations.

(2) X. Data regarding the Applicant that are important for the decision-making of possible Investors, such as their age, sex, occupation, residence, and sources of income.

(2) Article 91.- Collective financing institutions that carry out Collective Financing Operations of Corporate Loan Debt among Persons and for Real Estate Development must reveal for each Application or financing project, in addition to fractions I to IX of the previous article 90, the information corresponding to the type of collective financing in question, as detailed in Annex 15 of these provisions.

(2) Article 92.- Collective financing institutions that carry out Collective Financing Operations of Capital must reveal for each project they promote on their Platform, the following information, as detailed in Annex 16 of these provisions:

(2) I. Amount of financing requested.

(2) II. Term of the Collective Financing Application.

(2) III. Description of the ultimate purpose of the resources.

(2) IV. Description of the titles representing the share capital and the rights acquired by the Investor, as well as the way in which they will be rewarded for the contributions they make.

(2) V. Risk rating determined according to the risk evaluation methodology defined by the collective financing institution, accompanied by a simple explanation of how to interpret it.

(2) VI. Name and business activity of the legal entity, legal nature, date of incorporation, address of main offices, and, in applicable cases, Internet site.

(2) VII. Description of the main elements that make up the business model or plan of the legal entity.

(2) VIII. Description of the dividend policy, as well as the risk factors that can significantly affect the performance and profitability of the legal entity.

(2) IX. Name of the administrator or administrators and, in applicable cases, of the general director, as well as of the persons who exercise Control of the legal entity.

(2) X. Description of the financial situation, at the time of the financing application, of the legal entity considering aspects such as profitability, leverage, liquidity, and operational efficiency. At least the amount of equity capital, the main items of assets and liabilities, as well as the result of the previous exercise must be included. In the case of newly created companies, such situation must be indicated and, in applicable cases, include information related to the business history or technical knowledge of the administrators or executors of the project, as well as the financial projections, in applicable cases, that are available.

(2) XI. The price of the titles representing the share capital of the legal entity offered, including a description of the way to determine it and any limitation that exists for its acquisition.

(2) XII. In case they exist, the schemes to share with Investors the risks of collective financing Operations.

(2) Article 93.- Collective financing institutions that carry out Collective Financing Operations of Co-ownership or Royalties must reveal, for each project they promote on their Platform, the following information:

(2) I. Amount of financing requested.

(2) II. Term of the Collective Financing Application.

(2) III. Description of the destination of the financing including, in applicable cases, a description of the current state or financial situation of the project to be financed, as well as a model or business or investment plan for the resources and the way to achieve the proposed objectives, as well as the indicators on which the progress of the project or the achievement of results will be measured.

(2) IV. Explanation of the participation that the Investor will have in the present or future goods, income, profits, royalties, or, in applicable cases, losses derived from the project to be financed.

(2) V. Risk rating determined according to the risk evaluation methodology defined by the collective financing institution, accompanied by a simple explanation of how to interpret it.

(2) VI. Information regarding the Applicant:

(2) a) In the case of natural persons, the aspects stated in fraction X of article 90 of these provisions must be revealed, as well as a description of their productive activities.

(2) b) In the case of legal entities, the aspects stated in fractions VI, VII, IX, and X of the previous article 92 must be revealed, to the extent applicable.

(2) c) Information regarding the strategic participants that, in applicable cases, the Applicant or the person responsible for the execution of the project has, indicating the relationship that those have with the latter, as well as a description of the scope of their participation or contributions to the project.

(2) VII. In case they exist, the schemes to share with Investors the risks of collective financing Operations.

(2) Second Section

(2) On the disclosure of information on the payment behavior and performance of the Applicant or project

(2) Article 94.- Collective financing institutions on whose Platforms Corporate Loan Debt Operations among Persons, Personal Loans among Persons, and Real Estate Development Operations are carried out, must reveal to the Investors who are part of said Operations, the following information:

(2) I. Indicators of the annualized return obtained by participating in the financing, including a description of its method of calculation.

(2) II. Payment and default indicators, indicating at minimum, if the credit is current in its principal and interest payments, or in its defect, how many payments it has historically defaulted on and the total amount owed at the time of reporting, broken down by principal and financial accessories. For the purposes of the above, default will be understood as that event that occurs when the payment made by the Applicant is not enough to cover the payment that was committed according to the payment schedule programmed and agreed upon when the Operation was agreed.

(2) III. In applicable cases, update of the indicators on which it was defined that the progress of the financed project or the achievement of results would be measured.

(2) Collective financing institutions must update the information referred to in fractions I and II above in accordance with the payment periodicity defined in each Operation agreed.

(2) Article 95.- Collective financing institutions that carry out Collective Financing Operations of Capital must make available to the Investors who have participated in the Operation in question, at least for the two years following the concretization of the Operation, the following data:

(2) I. The annual information of the administrators of the financed legal entity referred to in article 172 of the General Law of Commercial Societies or equivalent.

(2) II. The risks and challenges faced by the financed legal entity.

(2) III. Financial indicators at the close of the reported annual exercise compared to the previous period, including a brief description of the method of calculation and its interpretation according to the following:

(2) a) Profitability, which is the result of dividing annual net profits by average capital to determine return on equity (ROE) or, the result of dividing annual net profits by average assets to determine return on assets (ROA).

(2) b) Leverage, which is the result of dividing total liabilities by total assets.

(2) c) Liquidity, which is the result of dividing liquid assets by total assets. Liquid assets are the sum of cash and banks.

(2) d) Operational efficiency, which is the result of dividing annual administrative expenses by total annual income.

(2) The data referred to in the previous fractions must be made available through their Platform no later than April 30 of each year. Once the disclosure period referred to in the previous paragraph concludes, the collective financing institution must inform investors of such circumstance.

(2) In the case of collective financing institutions that are also Investors through the implementation of risk-sharing schemes referred to in article 21, second paragraph of the Law, what is provided in this article will be applicable for the entire time the institution is an Investor.

(2) Article 96.- Collective financing institutions that carry out Collective Financing Operations of Co-ownership or Royalties must make available to the Investors who have participated in the Operation in question, at least for the following two years after the Operation was concretized, a report on the business progress or project advancement, as well as disclose, at least annually, the indicators referred to in article 94, fraction III of these provisions.

(2) Third Section

(2) On the disclosure of information to the general public

(2) Article 97.- Collective financing institutions must maintain in a site of easy access for consultation by the public, within the Platforms they use to operate with their Clients, the aggregated information by type of financing granted in accordance with what is stated in Annex 17 of these provisions.

(2) TITLE FOUR

(2) On regulatory reports

(2) Chapter I

(2) On reports in general

(2) Article 98.- Collective financing institutions must provide to the CNBV, with the periodicity established in the following article 99, the information attached to these provisions as Annex 18, which is identified with the series and reports listed below:

(2) Series R01 Minimum Catalog.

(2) A-0112 Minimum Catalog.

(2) Series R08 Bank loans and from other organisms.

(2) D-0842 Disaggregated loans obtained.

(2) Series R10 Reclassifications.

(2) A-10112 Reclassifications in the statement of financial position.

(2) A-10122 Reclassifications in the statement of comprehensive income.

(8) Series R12 Consolidation

(8) A-12192 Consolidation of the statement of financial position of the collective financing institution with its subsidiaries

(8) A-12202 Consolidation of the statement of comprehensive income of the collective financing institution with its subsidiaries

(2) Series R13 Financial statements.

(2) A-13112 Statement of changes in equity.

(2) A-13162 Statement of cash flows.

(2) B-13212 Statement of financial position.

(2) B-13222 Statement of comprehensive income.

(2) Series R27 Claims.

(2) A-2702 Claims.

(2) Article 99.- Collective financing institutions will present the information referred to in the previous article 98, with the periodicity indicated below:

(7)

I. Monthly, the information related to series R01, R08, R10, R12, and R13, exclusively with respect to reports B-13212 and B-13222, which must be provided within the month immediately following the close of the calendar month being reported.

(2) II. Quarterly, the Information related to series R13, exclusively with respect to reports A-13112 and A-13162, and R27, which must be provided within the month immediately following the close of the calendar quarter being reported.

(2) Article 100.- Electronic payment fund institutions must provide to the CNBV, with the periodicity established in the following article 101, the information attached to these provisions as Annex 19, which is identified with the series and reports listed below:

(2) Series R01 Minimum Catalog.

(2) A-0111 Minimum Catalog.

(2) Series R08 Bank loans and from other organisms.

(2) D-0843 Disaggregated loans obtained.

(2) Series R10 Reclassifications.

(2) A-10111 Reclassifications in the statement of financial position.

(2) A-10121 Reclassifications in the statement of comprehensive income.

(2) Series R13 Financial statements.

(2) A-13111 Statement of changes in equity.

(2) A-13161 Statement of cash flows.

(2) B-13211 Statement of financial position.

(2) B-13221 Statement of comprehensive income.

(12) Series R24 Operational information.

(12) G-2470 Information regarding Clients and Operations

(2) Series R26 Commissionaire information.

(2) A-2610 Registrations and cancellations of commissionaire administrators.

(2) A-2611 Disaggregated registrations and cancellations of commissionaires.

(2) B-2612 Disaggregated registrations and cancellations of commissionaire modules or establishments.

(2) C-2613 Disaggregated monitoring of commissionaire operations.

(2) Series R27 Claims.

(2) A-2701 Claims.

(2) Article 101.- Electronic payment fund institutions will present the information referred to in the previous article 100, with the periodicity indicated below:

(11)

I. Monthly:

(11)a. The Information related to series R24, which must be provided within the first 10 business days of the month immediately following the period being reported.

(11)b. Information regarding series R01, R08, R10, R13, exclusively with respect to reports B-13211 and B-13221, and R26, which must be provided within the month immediately following the close of the calendar month being reported.
(2) II. Quarterly, Information regarding series R13, exclusively with respect to reports A-13111 and A-13161, and R27, which must be provided within the calendar month immediately following the close of the quarter being reported.
(9)
III. (Repealed)
(2) Article 102.- ITFs will require prior authorization from the CNBV to open new concepts or levels that are not included in the corresponding series, exclusively for the submission of information regarding new operations authorized to them by the Secretariat, in accordance with the relevant legislation, for which they will request said authorization via free-form letter within fifteen business days following the authorization granted by the Secretariat. Likewise, in the event that changes in applicable regulations require establishing concepts or levels additional to those provided for in these provisions, the CNBV will inform ITFs of the opening of the respective new concepts or levels. (2) In the two cases provided for in the preceding paragraph, the CNBV will notify via SITI the mechanism for recording and sending the corresponding information. (2) Chapter II (2) Of the delivery methods (11) Article 103.- ITFs, unless expressly provided otherwise, must send the CNBV the information mentioned in this title, by electronic transmission using SITI. In the event that there is no information for any report, institutions must send an empty submission, a functionality available in said system. In the case of the regulatory report corresponding to Series R24 G-2470 of Annex 19, it must adhere to the format and specifications for report and information transfer that the CNBV itself indicates to electronic payment fund institutions. (2) The information must comply with the validations established in SITI, as well as the quality standards indicated by the CNBV through said system, and there must be consistency between the information that Institutions include in one or more regulatory reports referred to in these provisions, even if they are at a different level of integration. Likewise, the information must be sent only once and will be received assuming it meets all required characteristics, for which reason it cannot be modified, with SITI generating an electronic receipt. (2) Once the information is received, it will be reviewed, and if it does not meet the required quality and characteristics or is presented incompletely, the obligation to present it will be considered unfulfilled, and consequently, the corresponding sanctions will be imposed. (2) ITFs, via electronic submission to the address “cesiti@cnbv.gob.mx”, the name of the person responsible for the quality and submission of the information referred to in this title, in the manner indicated in Annex 20 of these provisions. The designation of the person responsible for information quality must fall to executives who are within the two hierarchies below that of the general director or sole administrator of the ITF, who have responsibility for the management of the information. Likewise, they may designate more than one person as responsible for the submission of the information, depending on the type of information in question.

(2) ITFs may request new user keys or access to regulatory reports in SITI, via electronic submission to the address “cesiti@cnbv.gob.mx” in the same manner as indicated in Annex 20.
(2) Once the email referred to in this article is sent, the CNBV will notify the ITF via the same means, within five business days following receipt of the request, the confirmation of the registration of the corresponding responsible person, as well as, where applicable, the access of users for the requested regulatory reports.
(2) The notification or substitution of any of the persons responsible for the submission and quality of the information referred to in this article must be notified to the CNBV in the terms mentioned above, within three business days following their designation or substitution.
TRANSITIONAL PROVISIONS
FIRST.- These provisions will enter into force fifteen days following their publication in the Official Journal of the Federation.
SECOND.- ITFs that intend to hire third parties in accordance with what is provided in article 9 of these provisions, until the relative provisions are issued, must present to the CNBV at the moment they request the authorization referred to in said article, the documentation specifying the operational schemes and the draft contract they will use for this purpose. THIRD.- The articles contained in Chapter IV of Title Two of this instrument will enter into force on January 1, 2020. FOURTH.- The effects on results and equity capital derived from the application of the accounting criteria contained in these provisions must be recognized by making the corresponding adjustments to equity capital within the results of prior exercises. (4) FIFTH.- Collective financing institutions may consider their Clients as Experienced Investors in terms of article 2, fraction XXIII, subsection d) of these provisions, if such Clients had carried out Operations through one or more of the persons referred to in the EIGHTH Transitional Provision of the Law to Regulate Financial Technology Institutions. SIXTH.- The persons referred to in the EIGHTH Transitional Provision of the Law to Regulate Financial Technology Institutions, will have a period of six months counted from the obtaining of their authorization to act as a collective financing institution, to modify the mandates or commissions they have entered into with their Clients prior to obtaining said authorization, in order to adjust them to these provisions. (5) SEVENTH.- Repealed. TRANSITIONAL PROVISIONS (Resolution modifying the General Provisions applicable to Financial Technology Institutions, published in the Official Journal of the Federation on March 25, 2019) FIRST.- This Resolution will enter into force the day following its publication in the Official Journal of the Federation. SECOND.- The Fourth Title added to the General Provisions applicable to financial technology institutions by this Resolution will enter into force on January 1, 2020, so that financial technology institutions will begin to deliver the information referred to in articles 98 and 100, with the periodicity and deadlines established in articles 99 and 101, respectively, on the dates indicated below, and only for the purpose of the first submission, with the information detailed in each case:
I. Regarding collective financing institutions:
a) Information regarding regulatory reports of series R01, R08, R10 and R13, exclusively with respect to reports B-13212 and B-13222, no later than January 31 of 2020, with information covering the period from December 1 to December 31 of 2019. b) Information regarding regulatory reports of series R13, exclusively with respect to reports A-13112 and A-13162 and R27, no later than January 31 of 2020, with information covering the period from October 1, 2019 to December 31 of 2019.
II. Regarding electronic payment fund institutions:
a) Information regarding regulatory reports of series R01, R08, R10 and R13, exclusively with respect to reports B-13211 and B-13221, no later than January 31 of 2020, with information covering the period from December 1 to December 31 of 2019. b) Information regarding regulatory reports of series R13, exclusively with respect to reports A-13111 and A-13161 and R27, no later than January 31 of 2020, with information covering the period between October 1, 2019 to December 31 of 2019. c) Information regarding the regulatory report of series R26, on January 2, 2020 with closing information as of December 31, 2019. THIRD.- The obligation provided for in article 97 added in this Resolution to the General Provisions applicable to financial technology institutions will enter into force on September 1, 2020. TRANSITIONAL PROVISIONS (Resolution modifying the General Provisions applicable to Financial Technology Institutions, published in the Official Journal of the Federation on December 15, 2021) SINGLE.- This Resolution will enter into force from December 15, 2021. TRANSITIONAL PROVISIONS (Resolution modifying the General Provisions applicable to Financial Technology Institutions, published in the Official Journal of the Federation on January 20, 2023) FIRST.- This Resolution will enter into force on January 1, 2024, except as indicated in the following SECOND TRANSITIONAL ARTICLE. SECOND.- Article 101, fraction I modified with this instrument will enter into force the day following its publication in the Official Journal of the Federation with respect to the periodicity of regulatory report R26.

TRANSITIONAL PROVISIONS
(Resolution modifying the General Provisions applicable to Financial Technology Institutions, published in the Official Journal of the Federation on September 2, 2024) FIRST. – This Resolution will enter into force the day following its publication in the Official Journal of the Federation, except as provided in the following transitional article. SECOND. – Electronic payment fund institutions will have until January 1, 2025 to take the necessary actions to present the regulatory report G-2470 Information regarding Clients and Operations belonging to Series R24 Operational Information. TRANSITIONAL PROVISIONS (Resolution modifying the General Provisions applicable to Financial Technology Institutions, published in the Official Journal of the Federation on July 24, 2025) SINGLE.- This Resolution will enter into force the day following its publication in the Official Journal of the Federation. TRANSITIONAL PROVISIONS (Resolution modifying the General Provisions applicable to Financial Technology Institutions, published in the Official Journal of the Federation on September 09, 2025) SINGLE.- This Resolution will enter into force on January 1, 2026. The accounting changes caused by the start of the validity of this Resolution must adhere to what is established in Financial Information Standard B-1 “Accounting changes and corrections of errors”, referred to in Annex 6, Series A, Criterion A-2 “Application of particular standards, regarding collective financing institutions; and in Annex 7, Series A, Criterion A-2 “Application of particular standards, regarding electronic payment fund institutions. TRANSITIONAL PROVISIONS (Resolution modifying the General Provisions applicable to Financial Technology Institutions, published in the Official Journal of the Federation on July 6, 2026) FIRST.- This Resolution will enter into force from the day following its publication in the Official Journal of the Federation. SECOND.- Financial technology institutions that, prior to the entry into force of this modifying Resolution, have presented to the Commission their authorization request in terms of what is established by articles 15 or 15 Bis, as applicable, will continue their process in accordance with what is provided in the “General Agreement by which simplification and administrative improvement actions are established for procedures carried out before the National Banking and Securities Commission” published in the Official Journal of the Federation on December 31, 2025, in the case of those authorization requests that were entered prior to the entry into force of the aforementioned Agreement will be processed in accordance with the second transitional article of the same. THIRD.- Financial technology institutions that, prior to the entry into force of the present modifying Resolution, hold authorization issued by the Commission in terms of what is established in articles 15 or 15 Bis, as applicable, will remain valid until the date of their conclusion.

CONSIDERING
(Reform published on March 25, 2019)
That the National Banking and Securities Commission issued the resolution published in the Official Journal of the Federation on July 24, 2017, through which the General Provisions applicable to brokerage houses were reformed, to extend the deadline with which these have to sell or reclassify their retained titles to maturity from 28 to 90 days, thus satisfying article 78 of the General Law of Regulatory Improvement regarding the cost of compliance with this resolution; That on the other hand, in order to be able to face risks and attacks that could cause damage to collective financing institutions and to the carrying out of operations with their clients, it is convenient to incorporate the regulatory framework on the security of their systems and technological infrastructure, determining the internal controls they must have, establishing also a regime that seeks to guarantee the security of the technological infrastructure on which their operations are supported and the confidentiality, integrity and availability of information; That one of the fundamental characteristics of collective financing institutions is that they precisely operate through remote electronic or digital communication means, that is, technological devices, computer applications, interfaces, Internet pages and similar; therefore, it is indispensable in light of the Law to Regulate Financial Technology Institutions, to regulate the functioning and use of equipment, electronic, optical or any other technology means, automated data processing systems and telecommunications networks, including the norms pertaining to the forms of authenticating both the institutions themselves and their clients, complying with the principles of technological neutrality and consumer protection established in the Law;

That in terms of the Law to Regulate Financial Technology Institutions, collective financing institutions may agree with third parties the provision of services necessary for their operation, in accordance with the provisions issued for this purpose by the National Banking and Securities Commission, so the corresponding norms for said contracting are established, as well as those services that will require the authorization of the Commission itself taking into account the due protection of the sensitive information of the clients of these financial entities; That in order for clients to have the necessary information to identify the risks they incur in the celebration of operations and investment decision-making, it is indispensable to incorporate the regime applicable to collective financing institutions for the disclosure of information regarding financing applicants, in accordance with the authority held by the National Banking and Securities Commission to issue norms in matters of transparency of the services of these financial entities; That at the same time, in terms of the Law to Regulate Financial Technology Institutions, once any operation has been carried out in collective financing institutions, these must have available to investors information regarding the payment behavior of the applicant, their performance or any other that is relevant in terms of the provisions issued for this purpose by the National Banking and Securities Commission; That in this vein, it is indispensable to establish the content of the information, the form and periodicity of this, in order for investors to always have that information that allows them to continue the operation in which they have participated, in congruence with the principles established in the Law itself regarding consumer protection and financial inclusion, and That in order for the National Banking and Securities Commission to have the corresponding information regarding the activities and operations of financial technology institutions, the obligation to present the corresponding reports is established, to designate the person responsible for their submission and the quality of their content, as well as the deadlines and means for their presentation, has resolved to issue the following:
CONSIDERING
(Reform published on December 15, 2021)
That, in attention to article 78 of the General Law of Regulatory Improvement and with the purpose of reducing the cost of compliance with this Resolution, the National Banking and Securities Commission through a resolution published in the Official Journal of the Federation on December 26, 2017, reformed the “General Provisions applicable to credit institutions”, with the objective of granting an extension to the deadline to which multiple banking institutions were subject to constitute their capital requirements for operational risk; That, in terms of the current accounting criteria, the National Banking and Securities Commission instructs entities subject to its regulation, that the exchange rate to be used to establish the equivalence of the national currency with the United States dollar, be the FIX (Fixed Exchange Rate) exchange rate published by the Bank of Mexico in the Official Journal of the Federation, a situation that allows maintaining uniform criteria among said entities; That the FIX exchange rate is determined by the Bank of Mexico based on an average of wholesale foreign exchange market quotations for operations liquidable on the second subsequent banking business day and that are obtained from foreign exchange transaction platforms and other electronic means with representativeness in the foreign exchange market. The Bank of Mexico makes the FIX known from 12:00 hours of all banking business days, it is published in the Official Journal of the Federation one banking business day after the date of determination and is used to settle obligations denominated in dollars liquidable in the Mexican Republic the day following the publication in said medium of dissemination;

That, due to the time difference between the schedules established for taking samples used to determine the FIX exchange rate in accordance with the applicable regulations issued by the Bank of Mexico (from 9:00:00 to 9:59:00 hours; from 10:00:00 to 10:59:00 hours, and from 11:00:00 to 12:00:00 hours) and the exchange rate value at the close of the trading day used by entities to close their operations (14:00 hours), differences arise between the exchange rate for financial reporting purposes and the exchange rates used in treasury areas;

That, in light of the above, it is necessary to use an exchange rate published by the Bank of Mexico that considers a broader sample window in order to be consistent with the close of the trading day, and therefore has resolved to issue the following:

CONSIDERING
(Reform published on January 20, 2023)

That, in accordance with Article 78 of the General Law for Regulatory Improvement and with the purpose of reducing the compliance cost of this Resolution that modifies the General Provisions Applicable to Financial Technology Institutions (Provisions), the National Banking and Securities Commission (Commission), through this regulatory proposal, repeals Articles 26, 27, 28, and 29, in addition to making clarifications in Articles 23, fractions I and II, 24, and 25 of the aforementioned provisions, in order to eliminate various obligations for financial technology institutions, such as the obligation to request the Commission, when using Internal Valuation Models to obtain the updated price for the valuation of their securities and other financial instruments, the confirmation of the update of the assumptions in cases of disordered conditions or high volatility in financial markets, as well as liquidity or valuation problems; the one consisting of the methodologies used needing to be consistent with only two approaches determined by the regulation, giving freedom to these entities to choose the methodology and establish the valuation models that are most appropriate, and the one of recognizing on a monthly basis in their accounting the Updated Prices for Valuation of Securities and other financial instruments;

That during the financial crisis that began in 2008, insufficient and late recognition of credit losses was identified as one of the weaknesses in the existing accounting standards, so in July 2014, International Financial Reporting Standard 9 “Financial Instruments” (International Financial Reporting Standards or IFRS9, by its name and acronym in English) was issued, which was adopted by the Mexican Council for Financial Reporting Standards, A.C. (CINIF), publishing eight new Financial Reporting Standards (NIF) that entered into force on January 1, 2018:

That, due to the evolution of the accounting regulations applicable to virtual assets, it has been determined to homologate the recognition, valuation, and disclosure rules applicable to these operations with the regulations issued by CINIF, thereby promoting the comparability of information among entities in the country, and

That, based on the NIF, the National Banking and Securities Commission has undertaken the task of adapting the regulations applicable to entities under its supervision to the new international framework, in order to have transparent financial information comparable with other countries. In this sense, it is necessary to modify the regulatory framework applicable to financial technology institutions, in order to incorporate updates in matters of accounting criteria, approval, dissemination, and content of financial statements, as well as norms in matters of financial information disclosure, and therefore has resolved to issue the following:

CONSIDERING
(Reform published on September 2, 2024)

That, in accordance with Article 78 of the General Law for Regulatory Improvement and with the purpose of reducing the compliance cost of these provisions, the National Banking and Securities Commission issued the Resolution that modifies the general provisions applicable to investment funds and to the persons who provide services to them, published in the Official Journal of the Federation on October 4, 2017, through which it eliminated from the aforementioned provisions the regulatory action consisting of processing the certificate of registration data issued by the Attorney General's Office of the Republic, as well as the certificate of no criminal record;

That the National Banking and Securities Commission has the authority to issue norms within its competence regarding the information that Financial Technology Institutions must provide to it periodically, including that related to their activities and operations;

That, on March 25, 2019, the Resolution that modifies the General Provisions Applicable to Financial Technology Institutions was published in the Official Journal of the Federation, through which it establishes, among other aspects, the obligation of financial technology institutions to present various reports, including the accounting information reports of electronic payment fund institutions, the reports related to the operations they carry out through commissionaires, as well as the reports regarding their clients' claims, in addition to the designation of the person responsible for sending and the quality of the content of said reports, all of the above with the purpose that the National Banking and Securities Commission has relevant financial and operational information of said institutions;

That currently, for supervisory purposes, it is opportune to incorporate into the reporting obligations established in Annex 19 of the General Provisions Applicable to Financial Technology Institutions, various information related to the operations that electronic payment fund institutions carry out with their clients, which allows knowing in greater detail the activities of said institutions in matters of issuance, administration, transmission, and redemption of electronic payment funds; granting overdrafts and charging commissions, among other essential regulatory aspects;

That, in this sense, through this Resolution, Annex 19 of the General Provisions Applicable to Financial Technology Institutions is replaced, in order to establish the R24 Operational Information series and its G-2470 Report Information relative to Clients and Operations, in which various operational information of electronic payment fund institutions is required, including transactional information of the electronic payment fund accounts that these institutions maintain for their clients, information of the accounts that these institutions maintain for the handling of their clients' resources, and information of the accounts they maintain for the handling of their own resources; overdrafts granted and commissions charged to their clients, among other aspects, this under a systematic reporting modality through a tool for transmitting information whose object is to optimize and reduce to a minimum the regulatory burden and the volumes of information requested from institutions, in addition to facilitating data processing and the validation processes of the report, and

That, in light of the above, this Resolution also seeks the efficient exploitation of the operational information of electronic payment fund institutions for the automated generation of analysis indicators or metrics, as well as standardized supervisory reports and the incorporation of automated regulatory validators; adapted to the specific needs and with the flexibility required to carry out the technological supervision of said institutions, and therefore has resolved to issue the following:

CONSIDERING
(Reform published on July 24, 2025)

That, in accordance with Article 78 of the General Law for Regulatory Improvement and with the purpose of reducing the compliance cost of this modifying resolution, the National Banking and Securities Commission, through the issuance of the “Resolution that modifies the General Provisions Applicable to Credit Institutions”, published in the Official Journal of the Federation on July 23, 2021, recognized the methodology for estimating preventive reserves and credit portfolio classification, the lower risk in which credit institutions incur when granting loans to women, adjusting the risk parameters of probability of default and severity of loss that are taken into account for the classification of the credit portfolio and the calculation of preventive reserves for credit risks of non-revolving consumer credit portfolios and housing mortgages granted to women;

That, it is necessary to make adjustments to the regulations applicable to financial technology institutions regarding special accounting criteria and special accounting records, with the object of providing legal certainty regarding natural phenomena that update the assumption for their authorization and the requirements they must meet to prove the adverse impact on the solvency or liquidity of those financial institutions and, in their case, on the stability of the financial system as a whole, or when those financial institutions are carrying out financial rehabilitation or corporate restructuring processes;

That, in this sense, and in order to provide better elements to financial technology institutions, the information they must present to obtain the authorization and application of said special accounting criteria and special accounting records is established, which will result in the benefit of the stability of the financial system as a whole, and which in turn allows the National Banking and Securities Commission to better exercise its authorization and supervision powers; and therefore has resolved to issue the following:

CONSIDERING
(Reform published on September 9, 2025)

That, in accordance with what is provided in Article 78 of the General Law for Regulatory Improvement and with the purpose of reducing the compliance cost of this modifying resolution, the National Banking and Securities Commission, through the issuance of the “Resolution that modifies the General Provisions Applicable to General Deposit Warehouses, Exchange Houses, Credit Unions, and Regulated Multiple-Object Financial Societies”, as well as of the “Resolution that modifies the General Provisions Applicable to Credit Institutions”, published in the Official Journal of the Federation on April 26, 2021, and July 23, 2021, respectively, proceeded to extend the deadlines for credit unions, general deposit warehouses, exchange houses, and regulated multiple-object financial societies to present their basic consolidated annual financial statements before their council; as well as the modifications to the methodologies that multiple-bank institutions use to effect the estimation of preventive reserves and credit portfolio classification, to adjust the risk parameters in the probability of default and severity of the loss, regarding the housing mortgage credit portfolios granted to women;

That it is necessary to make adjustments to the normative framework in accounting matters applicable to collective financing institutions and electronic payment fund institutions, in order to incorporate the recording of the valuation of capital investments that are not traded in the short term, but that are classified as tradable financial instruments in the formats of the financial statements and regulatory reports that must be presented before the National Banking and Securities Commission, with the objective of decreasing the volatility in the result of the exercise, caused by valuations not performed, as well as to ensure the convergence of the accounting framework with the Financial Reporting Standards, and

That, in order to provide collective financing institutions and electronic payment fund institutions with greater elements that allow them to comply with the regulations applicable to them, it is opportune to make clarifications and adjustments to the content of the accounting criteria and regulatory reports that these entities must observe, in relation to the conceptual framework of the Financial Reporting Standards, and therefore has resolved to issue the following:

CONSIDERING
(Reform published on July 6, 2026)

That, on July 24, 2025, the "Resolution that modifies the General Provisions Applicable to Financial Technology Institutions" was published in the Official Journal of the Federation, through which adjustments were made to the regulations regarding special accounting criteria and special accounting records, with the object of providing legal certainty regarding natural phenomena that update the assumption for their authorization and the requirements they must meet to prove the adverse impact on the solvency or liquidity of financial technology institutions and, in their case, on the stability of the financial system as a whole, or when said financial entities are carrying out financial rehabilitation or corporate restructuring processes, and

That, in compliance with what is established in the “General Agreement by which simplification and administrative improvement actions are established for procedures carried out before the National Banking and Securities Commission” published in the Official Journal of the Federation on December 31, 2025, as well as Article 24, second paragraph of the National Law to Eliminate Bureaucratic Procedures, it is necessary to modify the “General Provisions Applicable to Financial Technology Institutions” to establish the application formats for procedures related to the authorization of special accounting records and special accounting criteria, as well as to reduce the maximum response times of the authority regarding said authorizations, has resolved to issue the following:

REFERENCES
1) Reformed by Article First of the Resolution published in the Official Journal of the Federation on March 25, 2019.
2) Added by Article First of the Resolution published in the Official Journal of the Federation on March 25, 2019.
3) Substituted by Article First of the Resolution published in the Official Journal of the Federation on March 25, 2019.
4) Reformed by Article Second of the Resolution published in the Official Journal of the Federation on March 25, 2019.
5) Repealed by Article Second of the Resolution published in the Official Journal of the Federation on March 25, 2019.
6) By Resolution published in the Official Journal of the Federation on December 15, 2021, Annex 6, Accounting Criteria A-2, paragraph 10 and D-4, paragraphs 30, 40, 41, 44, 45, and Annex 7, Accounting Criteria A-3, paragraph 21 and D-4, paragraphs 27, 35, and 36 are REFORMED.
7) Reformed by Resolution published in the Official Journal of the Federation on January 20, 2023.
8) Added by Resolution published in the Official Journal of the Federation on January 20, 2023.
9) Repealed by Resolution published in the Official Journal of the Federation on January 20, 2023.
10) By Resolution published in the Official Journal of the Federation on January 20, 2023, Annexes 6, 7, 18, and 19 are SUBSTITUTED.
11) Reformed by Resolution published in the Official Journal of the Federation on September 2, 2024.
12) Added by Resolution published in the Official Journal of the Federation on September 2, 2024.
13) By Resolution published in the Official Journal of the Federation on September 2, 2024, Annex 19 is SUBSTITUTED.
14) Reformed by Resolution published in the Official Journal of the Federation on July 24, 2025.
15) Added by Resolution published in the Official Journal of the Federation on July 24, 2025.
16) By Resolution published in the Official Journal of the Federation on September 9, 2025, Annex 6, Series A “Criteria relative to the general scheme of accounting for collective financing institutions”, its criteria; Series B “Criteria relative to the concepts that integrate the financial statements”, criterion B-2 “Reportos”, and Series D “Criteria relative to the basic financial statements”, and its criteria; Annex 7, Series A “Criteria relative to the general scheme of accounting for electronic payment fund institutions”, its criteria; Series B “Criteria relative to the concepts that integrate the financial statements”, criterion B-2 “Reportos”, and Series D “Criteria relative to the basic financial statements”, its criteria; Annex 18, Series R01 “Minimum Catalog”, the regulatory report A-0112 “Minimum Catalog”; Series R10 “Reclassifications”, its regulatory reports; Series R12 “Consolidation”, its regulatory reports, and Series R13 “Financial Statements”, its regulatory reports; as well as Annex 19, Series R01 “Minimum Catalog”, the regulatory report A-0111 “Minimum Catalog”; Series R10 “Reclassifications”, its regulatory reports, and Series R13 “Financial Statements” are SUBSTITUTED.
17) Reformed by Resolution published in the Official Journal of the Federation on July 6, 2026.
18) By Resolution published in the Official Journal of the Federation on July 6, 2026, Annex 21 is ADDED.

Lineage: Amended

Timeline

Similar documents from other regulators