General Provisions Applicable to Securities Depository Institutions

GENERAL PROVISIONS APPLICABLE TO SECURITIES DEPOSITORY INSTITUTIONS Published in the Official Gazette of the Federation on January 12, 2017, amended by resolution published in the Official Gazette of the Federation on April 26, 2018.

The National Banking and Securities Commission, based on articles 279 and 280, fractions I, subsection b) and II of the Securities Market Law; as well as 4, fractions III, XXXVI and XXXVIII, 16, fraction I and 19 of the Law of the National Banking and Securities Commission, and

CONSIDERING

That the Securities Market Law establishes the authority of the National Banking and Securities Commission to issue provisions applicable to securities depository institutions regarding internal controls, risk management, prevention of conflicts of interest, corporate and audit practices, transparency and equity regarding the services they offer, and therefore it is necessary to strengthen the secondary regulatory framework applicable to these financial entities that ensures the best performance in the provision of their services for the benefit of the securities market as a whole;

That on the other hand, it is opportune to provide that securities depository institutions have the necessary measures to prevent possible conflicts of interest, as well as expressly establish the obligation for said institutions to provide equitable treatment in the conduct of their activities and in the provision of their services in order to grant unrestricted equality of treatment among participants of the securities market in order to promote transparency and foster a deeper securities market;

That additionally, it is considered convenient to provide the controls, policies and procedures that securities depository institutions must have in order for their information systems to incorporate the necessary mechanisms that allow them to support their processes and carry out their operations and the provision of their services in a secure and efficient manner;

That in this vein, it is essential to point out a series of measures that securities depository institutions must implement in order to ensure the continuity of their critical operations in contingency situations that hinder or disable the conduct of their operations and the provision of their services, as well as incorporating rules regarding both the identification of possible sources of risk of said contingencies, and the strategies to establish to respond to them, considering the lessons learned in connection with emergency situations in Mexico and other countries, and

That it is opportune to issue a single legal instrument containing the provisions applicable to securities depository institutions, systematizing their integration and homologating the terminology used, in order to thereby provide legal certainty regarding the regulatory framework to which the aforementioned institutions must adhere in the development of their operations, which will also facilitate consultation, compliance and observance of the provisions applicable to them, for which reason the norms regarding the services that securities depository institutions may contract with foreign credit institutions or foreign securities depository institutions are also included, as well as the rules regarding the disclosure and presentation of financial information, has resolved to issue the following:

GENERAL PROVISIONS APPLICABLE TO SECURITIES DEPOSITORY INSTITUTIONS

INDEX

FIRST TITLE
General Provisions
Single Chapter
Definitions

SECOND TITLE
On Financial Information
Single Chapter
On Financial Information in General

THIRD TITLE
On the Provision of Services
Chapter I
On the characteristics of the entities, institutions and persons to whom securities depository institutions may provide their services
Chapter II
On the services that securities depository institutions may contract with foreign credit institutions or foreign securities depository institutions
Chapter III
On Business Conduct

FOURTH TITLE
On Prudential Provisions
Chapter I
On the administration and control of Technological Infrastructure
Chapter II
On the Business Continuity Plan
Chapter III
On the administration of treasury liquidity
Chapter IV
Additional Regulation
Annex 1 Minimum Requirements of the Business Continuity Plan.

FIRST TITLE
General Provisions
Single Chapter
Definitions

Article 1.- For the purposes of these provisions, the following shall be understood:
I. Commission: the National Banking and Securities Commission.
II. Operational Contingency: any event that hinders, disables or prevents a securities depository institution from providing the services or carrying out the activities referred to in article 280 of the Law.
III. Technological Infrastructure: the computing infrastructure, telecommunications networks, operating systems, databases, software and applications used by securities depository institutions to support their operations.
IV. Law: the Securities Market Law.
V. Business Continuity Plan: the set of strategies, procedures and actions referred to in article 26 of these provisions that allow the continuity in the provision of services or in the execution of critical processes of securities depository institutions in the face of Operational Contingencies or their timely restoration, as well as the mitigation of the effects resulting from such contingencies.
VI. Registry: the National Securities Registry referred to in the Law.

SECOND TITLE
On Financial Information
Single Chapter
On Financial Information in General

Article 2.- The financial statements of securities depository institutions must be prepared in accordance with one of the following options:
I. International Financial Reporting Standards “International Financial Reporting Standards” issued by the International Accounting Standards Board “International Accounting Standards Board”.
II. Financial Information Standards recognized and issued by the Mexican Council of Financial Information Standards, A.C.
(2) Article 3.- Repealed.

Article 4.- Securities depository institutions must submit to the Commission, within twenty natural days of each month, the financial statements corresponding to the immediately preceding month, signed by the general manager and the head of the finance area or their equivalent.
(2) Article 5.- Repealed.

THIRD TITLE
On the Provision of Services
Chapter I
On the characteristics of the entities, institutions and persons to whom securities depository institutions may provide their services

Article 6.- Securities depository institutions may provide their services, in addition to the persons established in article 280, fractions I and II of the Law, to the following:
I. Those institutions of foreign nationality responsible for the deposit, custody, administration, clearing, settlement and transfer of securities, which have automated systems for the management of securities, both locally and internationally.
II. Foreign stock exchanges.
III. Other entities whose statutes expressly identify in their object the provision of any of the services of deposit, custody, administration, clearing, settlement or transfer of securities.

Article 7.- The persons referred to in the previous article must be constituted and organized in accordance with the laws of the country in which they are domiciled, have authorization to carry out their activities and be subject to inspection and supervision by an authority that performs functions similar to those of the Commission.

Article 8.- Securities depository institutions must verify that the persons referred to in article 6 of these provisions meet the characteristics indicated in the previous article 7, prior to the signing of the contract that formalizes the legal relationship between them. It is the responsibility of securities depository institutions that the corresponding contracts comply with the legal, regulatory and administrative provisions governing their operation.

Article 9.- Securities depository institutions, in addition to providing the services of deposit, custody, administration, clearing, settlement and transfer of securities registered in the Registry in favor of national or foreign financial entities, in accordance with the Law, may provide their services to:
I. Societies that administer electronic negotiation mechanisms for shares of investment funds authorized by the Commission in accordance with the provisions of article 40, fourth paragraph of the Investment Funds Law, provided that securities depository institutions only open accounts in favor of said societies on behalf of third parties.
II. Trusts that act as a clearing house for derivative contracts in terms of the “Rules to which participants in derivative contracts markets must adhere” issued by the Ministry of Finance and Public Credit, the Bank of Mexico and the Commission and published in the Official Gazette of the Federation on December 31, 1996 and their respective modifications.

Article 10.- When any security is cancelled from the international quotation system established by the stock exchanges referred to in the Law, securities depository institutions may continue to provide their services with respect to the securities in question, but in no case will they admit new deposits of the same securities while they are not relisted in the aforementioned system.
As an exception to the above, securities depository institutions may only accept new deposits when such increase derives from a payment of rights in kind decreed by the issuer or from a corporate event.

Article 11.- Securities depository institutions, on the day they become aware of it, must provide to the stock exchanges simultaneously and through electronic means that leave irrefutable proof, the information related to the exercise of property rights derived from foreign securities listed in the international quotation system established by the stock exchanges and with respect to which the aforementioned securities depository institutions are provided with deposit services, which must include the payment of dividends or distributions, increases or decreases in share capital or the number of securities, among others. For the purpose of complying with the foregoing, securities depository institutions may enter into contracts with information providers, foreign credit institutions or foreign securities depository institutions, in which said entities are obligated to deliver sufficient and timely information related to the exercise of property rights of securities listed in said international quotation systems.
The information that securities depository institutions make known regarding the exercise of property rights of foreign securities listed in the international quotation system established by the stock exchanges will depend exclusively on the information provided by the aforementioned entities. This, without prejudice to the responsibility of securities depository institutions for any error, omission or delay in the delivery of information to the stock exchanges, for causes attributable to said institutions, including failures or interruptions in their information systems. Without prejudice to the foregoing, when securities depository institutions have elements to consider that the information provided to them presents discrepancies, they will proceed in accordance with the terms established by said institutions in their internal regulations.

Article 12.- Securities depository institutions must publish on their Internet page the updated catalog of types of securities on which they provide their services of deposit, custody, administration, clearing, settlement and transfer and keep it updated, informing it simultaneously to the Commission, stock exchanges, securities market intermediaries, price providers and derivative contract clearing houses, central securities counterparties and other market participants, with at least thirty business days in advance.

Chapter II
On the services that securities depository institutions may contract with foreign credit institutions or foreign securities depository institutions

Article 13.- Securities depository institutions may contract the services of deposit, custody, administration, clearing, settlement and transfer of securities that they have deposited, as well as the provision of other services inherent to the functions peculiar to them, including services related to the provision of information regarding the exercise of property rights of foreign securities listed in the international quotation system established by the stock exchanges, both with foreign credit institutions and with foreign securities depository institutions, that offer such services and that meet the characteristics established in these provisions.
In the contracts entered into by securities depository institutions with the institutions referred to in the previous paragraph, exclusivity agreements may not be established.

Article 14.- Foreign credit institutions and foreign securities depository institutions that enter into contracts with securities depository institutions must be constituted and organized in accordance with the laws of the country in which they are domiciled, have authorization to carry out their activities and be subject to inspection and supervision by a specialized authority.

Article 15.- Securities depository institutions may only contract the services of the institutions referred to in the previous article 14, provided that the latter have automated systems for the centralized management of securities.

Article 16.- Securities depository institutions must review the audited financial statements of foreign credit institutions and foreign securities depository institutions corresponding to each fiscal year, during the period in which they maintain securities on deposit in said institutions, in order to corroborate their financial strength, as a condition for signing and, if applicable, for the validity of the contract.

Article 17.- Securities depository institutions, for the celebration of a contract with a foreign credit institution or with a foreign securities depository institution, must verify that the following requirements are met:
I. That the contracts to be entered into contemplate the following obligations:
a) The performance of external audits, as well as the obligation to deliver to securities depository institutions audited financial statements during the validity of the contract. b) The definition of procedures that allow the delivery or replacement of securities to securities depository institutions, in the event that the foreign credit institution or foreign securities depository institution in question enters into a commercial bankruptcy or liquidation, or equivalent, or if they are lost, stolen or destroyed. c) The legal prohibition that the custodied securities can be taken by the foreign credit institution or foreign securities depository institution in question or by its creditors to cover any type of right, debt, judicial claim or encumbrance and the existence of systems that prevent this from occurring.
II. The existence of a legal provision to the effect that the securities of clients custodied under the contract to be entered into, are adequately segregated with respect to the assets of the foreign credit institution or foreign securities depository institution in question.
III. The existence of a legal provision regarding the existence of a regime for the free convertibility of currencies in the country where the foreign credit institution or foreign securities depository institution in question is domiciled.
IV. The accreditation of adequate performance of the corresponding foreign credit institution or foreign securities depository institution, in accordance with the criteria established for such purposes by securities depository institutions in their internal regulations.
V. The security, transparency, efficiency and automation in the provision of services of the foreign credit institution or foreign securities depository institution in question.

Article 18.- Securities depository institutions, in contracting the services referred to in article 13 of these provisions, must enter into a service provision contract with the foreign credit institution or foreign securities depository institution in question, with the responsibility of the former that said contract complies with the legal, regulatory and administrative provisions governing their operation.

Article 19.- Securities depository institutions must submit to the Commission the contracts they intend to enter into under this Chapter, as well as their respective modifications, ten business days in advance of the date of their celebration, accrediting compliance with these provisions and specifying the reasons on which the choice of the institution in question was based. The Commission itself may object to said contracts or their modifications, within the time limit referred to in this article, when they do not comply with or contravene what is established in this legal order and other applicable provisions.

Article 20.- Securities depository institutions must transfer the securities they have deposited in a foreign credit institution or a foreign securities depository institution to another institution that meets the requirements provided in this Chapter, when in their opinion there is a risk to the security of the deposited securities, of the securities depository institutions themselves or of their depositors.

Chapter III
On Business Conduct

Article 21.- Securities depository institutions must establish, with prior approval of their board of directors with the favorable vote of the majority of independent directors, the necessary measures to prevent conflicts of interest that could arise in relation to their depositors and other market participants to whom they offer their services.

Article 22.- Securities depository institutions must establish the same conditions, as well as an unrestricted treatment of equality among and for depositors and other participants of the securities market to whom they offer their services. Additionally, they must ensure efficient communication and connection with them, including the availability and equality of information that, if applicable, may be disseminated to the respective participants of the market. Additionally, securities depository institutions must ensure that their information systems allow efficient communication and connection with the persons referred to in the previous paragraph, adhering in the event of Operational Contingencies, to what is established in the Business Continuity Plans established for such effect.

FOURTH TITLE
On Prudential Provisions
Chapter I
On the administration and control of Technological Infrastructure

Article 23.- Securities depository institutions must elaborate, document and implement the policies and procedures necessary so that the Technological Infrastructure they use to carry out their processes and provide their services, complies with the following:
I. Each element of the Technological Infrastructure performs at all times the functions for which it was designed, developed or acquired.
II. Include controls that allow equitable and timely access to all its users in accordance with what each of them will perform in the information systems to which they have access.
III. Have documented processes, functionalities and configurations, including their development or acquisition methodology, as well as records of their changes and the inventory of all elements of the Technological Infrastructure.
IV. Incorporate information security aspects and a project control mechanism of each element of the Technological Infrastructure during the various stages of the life cycle, considering the elaboration of requirements, design, development or acquisition, implementation testing, periodic testing, change management, replacement and destruction of information. Such security aspects must include, at least:
a) Logical and physical segregation of different networks in different domains depending on the function they perform or the type of data transmitted. b) Secure configuration according to the type of element, considering at least, ports, services, permissions, access lists, manufacturer updates and factory configuration.
V. Each element of the Technological Infrastructure is tested before being implemented or when modified, using quality control mechanisms that prevent real data from the production environment from being used in such tests, sensitive or security information from being revealed, or any unrecognized functionality from being introduced for said element.
VI. Have the necessary licenses or use authorizations.
VII. Contain strict security measures for the access and use of information that is transmitted, stored and processed in the Technological Infrastructure that supports it, considering at least the following:
a) Identification and authentication mechanisms for each and every one of the users of the Technological Infrastructure of securities depository institutions that allow them to be recognized unequivocally and ensure access only to persons

authorized expressly for that purpose. Both mechanisms must include specific controls for those users with greater privileges, derived from their functions, such as those for database and operating system administration.

b) Allow the segregation of functions through the establishment of user profiles that limit access only to the functionality of the Technological Infrastructure and information required, based on the responsibilities and powers of each user's position.

c) Mechanisms for encrypting information according to the degree of sensitivity that securities depository institutions determine, when such information is transmitted or stored.

d) Robust composition of passwords and access keys.

e) Control of unattended sessions, as well as simultaneous sessions with the same user identifier.

f) Security mechanisms, both physical, environmental, and electrical energy, that protect and allow operation in accordance with the specifications of the provider, manufacturer, or developer of each element of the Technological Infrastructure of securities depository institutions.

VIII. Minimize the risk of operational interruption based on backup mechanisms and information recovery procedures, as well as of the Technological Infrastructure and alternate means for information exchange, in accordance with Article 26 of these provisions.

IX. Maintain audit logs, including detailed information of accesses and the operation or activity carried out by users, that prevent their repudiation, regardless of the level of privileges they have for accessing, generating, or modifying the information they receive, generate, store, or transmit in each element of the Technological Infrastructure, as well as procedures for the periodic review of said logs.

X. Contemplate the carrying out of tests aimed at detecting vulnerabilities and threats, as well as penetration in the different elements of their Technological Infrastructure, in order to implement defense mechanisms that prevent unauthorized access and use of this. Such tests will be carried out at least once a year or when they make substantive modifications to any element of the Technological Infrastructure.

XI. Processes for reaction and handling of security incidents that ensure the detection, classification, attention, investigation, diagnosis, reporting to competent hierarchical levels, resolution, follow-up, and communication of said incidents.

XII. Have planning exercises that allow measuring the capacity of the Technological Infrastructure that supports their operation, defined by the securities depository institutions themselves, as well as adhering to the results of said exercises regarding the needs for capacity increase.

XIII. Contemplate automated controls that minimize the risk that user personnel commit errors or omissions in the manual or semi-automated processes they must perform in the applications of the Technological Infrastructure.

XIV. Allow detecting the alteration or falsification of records in the Technological Infrastructure.

XV. Implement mechanisms that measure and ensure levels of availability and response times, which guarantee the execution of operations and services performed.

Article 24.- Securities depository institutions must establish and implement policies and procedures for the classification of information and its treatment, according to the degree of risk that such information implies and which will be determined by each of their operational areas. Such classification must be used to evaluate and implement the necessary controls in the Technological Infrastructure and in operational processes, in order to ensure the confidentiality, integrity, and availability of the information of securities depository institutions and participants.

Article 25.- Securities depository institutions must designate a person to serve as the information security officer, who must enjoy independence with respect to the areas of operation, administration, audit, and systems, and will have in charge, at least, the functions mentioned below:

I. Authorize and monitor access to the institution's computer systems, including that used for the storage, processing, and transmission of information, according to the profile corresponding to each type of user.

II. Participate in the definition of security policies and procedures, mentioned in Article 23 of these provisions.

III. Review at least quarterly, or earlier in case of security events or incidents, the activities carried out by users and by service providers in the different elements of the Technological Infrastructure of securities depository institutions, including technical personnel who have high privileges, such as administration of operating systems and databases.

IV. Verify the implementation and continuous compliance of information security policies and procedures in the Technological Infrastructure of securities depository institutions, contemplating, at least, those included in Article 23 of these provisions.

Securities depository institutions must ensure that the information security officer has at their disposal the records of persons who have access to information related to the operations in which the securities depository institutions themselves intervene, including those of those located abroad and of users who have high privileges, such as administration of operating systems and databases, as well as their service providers.

Chapter II
Of the Business Continuity Plan

Article 26.- Securities depository institutions must draw up action and contingency plans to restore their operation in the event of an Operational Contingency, which must be included in the Business Continuity Plan. Such plans must be consistent with the criticality of business processes and with the business impact analysis referred to in fraction I of Annex 1 of these provisions.

Article 27.- The general manager of securities depository institutions must draw up the Business Continuity Plan observing what is established in Annex 1 of these provisions. Said plan and its modifications will be presented for approval by the board of directors through the audit committee.

The general manager will be responsible for:

I. The implementation, as well as the continuous updating and dissemination of the Business Continuity Plan within the securities depository institution. To this effect, they must establish a program to train personnel on the actions they will take in the event that an Operational Contingency occurs, as well as during the development of the plan itself.

II. Design and carry out a communication policy regarding the verification of Operational Contingencies, which must be part of the Business Continuity Plan. This policy must provide for immediate communication with their clients, central counterparties of securities, and with the different administrative and business units within the securities depository institution itself, as well as with the Commission and other competent authorities in attention to the nature of the contingency in question.

III. Provide for what is necessary to make known to the Commission and the Bank of Mexico the Operational Contingencies that occur in any of their systems or channels of attention to their clients, authorities, and central counterparties of securities.

In the notice referred to in this fraction, at least the date and time of start of the Operational Contingency, the indication of whether it continues or has concluded and its duration, as well as a description of the event that has been registered, must be stated.

Likewise, the general manager must send to the Commission and the Bank of Mexico within a period not exceeding fifteen calendar days following the conclusion of the Operational Contingency, the description of said contingency, an analysis of the causes that motivated it, the impact caused in qualitative and quantitative terms, the processes, systems, and channels affected, as well as a work plan indicating the detail of the actions that will be implemented to minimize the impact or damage in similar subsequent situations and the dates on which each of them will be fulfilled.

IV. Ensure that the Business Continuity Plan is subjected to effectiveness tests at least once a year, in which market participants related to each of the processes to be evaluated are included, and made known to their personnel. Likewise, they must ratify it in its terms or update it, at least once a year, according to what is determined to this effect by the board of directors itself or as a result of the effectiveness tests.

In any case, for the performance of the responsibilities referred to in this article, the general manager may be assisted by the personnel they determine, in which case they must make it known to the Commission within a period not exceeding five business days from their appointment, maintaining at all times an adequate segregation of functions that avoids conflicts of interest.

Article 28.- Securities depository institutions must have a methodology to estimate the quantitative and qualitative impacts of Operational Contingencies, which must be used in the impact analysis referred to in Annex 1, fraction I, subsection d) of these provisions, which must have the prior approval of the board of directors.

The audit committee must verify annually the effectiveness of the methodology by comparing its estimates against the observed Operational Contingencies and, if necessary, carry out the necessary corrections.

The audit committee must inform the board of directors, the Commission, and the Bank of Mexico of the results of the effectiveness tests and of the evaluation of the scope of the Business Continuity Plan, its adequate dissemination among the relevant areas, and the identification, if any, of the necessary adjustments for its updating and strengthening. Such report must be carried out at least once a year or earlier if relevant results are detected.

Chapter III
Of the management of treasury liquidity

Article 29.- Securities depository institutions may invest their treasury surpluses in the following securities:

I. Investments in securities issued or guaranteed by the United Mexican States, as well as those issued by the Bank of Mexico whose maturity term does not exceed one year.

II. Investments in bank deposits of demand money and debt securities issued by credit institutions that have a minimum rating of AA, on a national scale, granted by any securities rating agency and whose maturity term does not exceed one year.

III. Investments in shares representing the social capital of investment funds in debt instruments with daily settlement.

Chapter IV
Additional Regulation

Article 30.- Securities depository institutions, without prejudice to what is provided in these provisions, will be subject, insofar as applicable, to the general provisions issued by the Commission and, if applicable, to their modifications, which are listed below:

I. General rules for the integration of files containing the information that accredits compliance with the requirements that persons performing jobs, positions, or commissions in financial entities must satisfy, published in the Official Gazette of the Federation on March 1, 2002.

II. General provisions applicable to the international quotation system, published in the Official Gazette of the Federation on December 18, 2003.

III. General provisions applicable to the entities and persons referred to in articles 3, fractions IV, V, VI, VII, and VIII, and 4, fraction XXX, of the Law of the National Banking and Securities Commission as well as to the General Public, in the delivery and receipt of documents at the National Banking and Securities Commission, published in the Official Gazette of the Federation on October 5, 2011, modified by Resolution published in the same Gazette on December 22, 2015.

IV. General provisions that regulate self-correction programs, published in the Official Gazette of the Federation on October 20, 2014.

V. General provisions applicable to securities operations carried out by councilors, executives, and employees of financial entities and other obligated persons, published in the Official Gazette of the Federation on November 4, 2014.

VI. General provisions applicable to investment funds and to the persons who provide them with services, published in the Official Gazette of the Federation on November 24, 2014.

VII. General provisions that indicate the days of the year, in which financial entities subject to the supervision of the Commission, must close their doors and suspend operations, published in the Official Gazette of the Federation for each fiscal year.

(1) VIII. General provisions applicable to entities and issuers supervised by the National Banking and Securities Commission that hire external audit services for basic financial statements.

TRANSITORY PROVISIONS
FIRST.- These Provisions will enter into force the day following their publication in the Official Gazette of the Federation, except for what is provided in the following transitory articles.

SECOND.- Securities depository institutions will have the same period referred to in the last paragraph of the Third Transitory Article of the “General Provisions applicable to the international quotation system” issued on December 13, 2016 to provide stock exchanges with the information related to the exercise of rights referred to in Article 11, second paragraph of these provisions.

THIRD.- Securities depository institutions will have the periods indicated in the following fractions, counted from the publication of this instrument in the Official Gazette of the Federation to comply with the provisions indicated below:

I. Six months for compliance with Article 25 of Chapter I of Title Four of these Provisions.

II. Twelve months for compliance with Chapter II of Title Four of this instrument.

III. Eighteen months for compliance with Articles 23 and 24 of Chapter I of Title Four of this instrument.

FOURTH.- Upon the entry into force of these Provisions, the “General Provisions applicable to securities depository institutions”, published in the Official Gazette of the Federation on January 18, 2011, and reformed by resolutions published in the cited Gazette on March 16, 2011 and December 22, 2015, will be repealed.

TRANSITORY PROVISION
(Resolution that modifies the general provisions applicable to securities depository institutions, published in the Official Gazette of the Federation on April 26, 2018)

SOLE.- This Resolution will enter into force on August 1, 2018.

CONSIDERING
(Resolution published on April 26, 2018)

That it is necessary to repeal the norms pertaining to the independent external audit services that securities depository institutions must hire, due to the fact that these are integrated into a new regulatory body called “General provisions applicable to entities and issuers supervised by the National Banking and Securities Commission that hire external audit services for basic financial statements”, it has resolved to issue the following:

REFERENCES
1) Added by Resolution published in the Official Gazette of the Federation on April 26, 2018.
2) Repealed by Resolution published in the Official Gazette of the Federation on April 26, 2018.