GENERAL PROVISIONS REGARDING STANDARDIZED APPLICATION PROGRAMMING INTERFACES REFERENCED IN THE LAW FOR REGULATING FINANCIAL TECHNOLOGY INSTITUTIONS

Published in the Official Gazette of the Federation on June 4, 2020.

The National Banking and Securities Commission, based on the provisions of articles 76, paragraphs third, eighth, eleventh, twelfth, and thirteenth of the Law for Regulating Financial Technology Institutions, as well as articles 4, sections XXXVI and XXXVIII; 16, section I; and 19 of the Law of the National Banking and Securities Commission,

AND CONSIDERING

That in accordance with article 78 of the General Law for Regulatory Improvement and with the aim of reducing the compliance cost of these provisions, the National Banking and Securities Commission, through a resolution published in the Official Gazette of the Federation on January 22, 2018, amended the "General Provisions Applicable to Credit Institutions," with the purpose of flexibilizing the deadline for establishing capital requirements and establishing such requirements gradually;

That on March 9, 2018, the "Decree by which the Law for Regulating Financial Technology Institutions is issued and various provisions of the Credit Institutions Law, the Securities Market Law, the General Law of Organizations and Auxiliary Credit Activities, the Law for Transparency and Ordering of Financial Services, the Law for Regulating Credit Information Societies, the Law for Protection and Defense of Users of Financial Services, the Law for Regulating Financial Groups, the Law of the National Banking and Securities Commission, and the Federal Law for Prevention and Identification of Operations of Illicit Origin" was published in the Official Gazette of the Federation;

That article 76 of the Law for Regulating Financial Technology Institutions establishes the obligation for financial entities, money transmitters, and societies authorized to operate with Novel Models to exchange data through the use of standardized application programming interfaces in order to foster competition in markets, as well as financial inclusion, while empowering the National Banking and Securities Commission to issue general provisions in this matter;

That in order to ensure that the exchange of information is carried out in an adequate, transparent, and equitable manner, the procedure for authorizing and registering the counterconsiderations to be charged for the use of standardized application programming interfaces is established;

That taking into account that open financial data does not contain information considered confidential, as it refers to products and services offered to the general public, the location of offices and branches, as well as information about ATMs, among others; sharing it freely does not constitute a risk for those who generate it;

That with the purpose of establishing forms of compliance simpler than those provided in the Law, as well as to avoid the creation of unnecessary procedures that represent additional costs to the recipients of the norm, a more expeditious way is provided to obtain, from the National Banking and Securities Commission, the authorization to access open financial data through standardized application programming interfaces;

That in exercise of the power referred to in article 76 already cited of the Law for Regulating Financial Technology Institutions and with the object of allowing that, in case of non-compliance by financial entities, money transmitters, and societies authorized to operate with Novel Models, the information continues to be exchanged through standardized application programming interfaces, it is indispensable to regulate the requirements of regularization programs that must be observed in case of non-compliance; has resolved to issue the following:

GENERAL PROVISIONS REGARDING STANDARDIZED APPLICATION PROGRAMMING INTERFACES REFERENCED IN THE LAW FOR REGULATING FINANCIAL TECHNOLOGY INSTITUTIONS

CHAPTER I

Common Provisions

CHAPTER II

Of Data Applicants

CHAPTER III

Of Data Providers

CHAPTER IV

Of Regularization Programs

Annex 1 Security Guidelines for Open Data to be Observed by Data Providers and Data Applicants
Annex 2 Data Architecture Guidelines for the Exchange of Open Data Information
Annex 3 Dictionary of ATM Open Data.

Chapter I

Common Provisions

Article 1.- For the purposes of these provisions, in addition to the definitions provided in the Law, the following shall be understood, in singular or plural:

I. API, by its acronym in English (Application Programming Interface), for the standardized application programming interfaces that enable the exchange of Data.

II. Authentication, for the set of techniques and procedures used by the Data Provider to verify the identity of a Data Applicant and their condition to access the Data available through APIs.

III. Data, for the open data referred to in section I of article 76 of the Law.

IV. Information Security Event, for any event, internal or external, related to Clients, third parties contracted by Data Applicants or Data Providers, persons or operational processes, as well as with components of the Infrastructure, or other elements that store information, among others, that could imply an impact on the confidentiality, integrity, or availability of the information that said Data Provider or Data Applicant manages or knows, or in the Infrastructure itself.

V. Information Security Incident, for the Information Security Event of the Data Provider when any of the following situations occurs:
a) The confidentiality, integrity, or availability of one or more components of the Infrastructure used by a Data Applicant or Data Provider, or of the Data sent or received through said Infrastructure, has been compromised, with an adverse effect for any of them, or for third parties contracted by the Data Provider to administer or develop APIs, among others. b) It violates the Infrastructure, compromising the Data it processes, stores, or transmits. c) It constitutes a violation of the security policies and procedures referred to in article 5 of these provisions. d) It constitutes the materialization of a detriment, whether by extraction, alteration, or loss of information; by failures derived from the use of hardware, software, systems, applications, networks, and any other channel of information transmission; by unauthorized accesses that result in the improper use of information or systems; by fraud, theft, or interruption of services, attacks against interconnected infrastructures, known as cyberattacks.

VI. Infrastructure, for the computer equipment, data processing and communications facilities, communication equipment and networks, operating systems, databases, applications, and systems used by Data Applicants or Data Providers to support the operation of APIs.

VII. Law, for the Law for Regulating Financial Technology Institutions.

VIII. Data Providers, for Financial Entities, ITFs, societies authorized by the CNBV to operate with Novel Models, and money transmitters, that pursuant to the first paragraph of article 76 of the Law, are obligated to establish APIs in order to share Data.

IX. Data Applicants, for Financial Entities, ITFs, societies authorized to operate with Novel Models, money transmitters, and third parties specialized in information technologies.

X. Users, for the persons who use the products or services offered by Data Applicants.

Chapter II

Of Data Applicants

Article 2.- Data Applicants whose APIs developed or administered by them comply with what is established in Annexes 1, 2, and 3 of these provisions, shall be deemed authorized by the CNBV, without the need for any declaration, to access the Data of the different Data Providers to which they request access through said APIs.

Chapter III

Of Data Providers

Article 3.- Data Providers, in the development or administration of their APIs, must comply with Annexes 1, 2, and 3 of these provisions.

Data Providers will publish, clearly, precisely, and in Spanish, on their Internet page or any other electronic communication medium, computer applications, or digital applications, the process that Data Applicants must follow to access Data through APIs and the counterconsiderations that, if applicable, they must pay for the exchange of Data.

The terms and conditions that Data Providers establish with Data Applicants to carry out the exchange of Data through APIs must establish mechanisms and controls that ensure the confidentiality and integrity of Data in their access, processing, and storage by Data Applicants.

Article 4.- Data Providers must have an information security policy that protects at all times the Infrastructure, own or of third parties contracted by them, as well as the confidentiality and integrity of the Data that, if applicable, they share through APIs. The aforementioned security policy must contain continuous procedures, mechanisms, and controls considering, at least, the following:

I. Secure configuration of the technological components of their Infrastructure, including, among others, closing ports and services, installation of mechanisms for detection and prevention of viruses, malicious codes, and intrusion detection, as well as manufacturer updates.

II. Mechanisms for identification and authentication of personnel responsible for handling APIs under the principle of least privilege. The principle of least privilege shall be understood as enabling access only to the information and resources necessary for the performance of the functions of the referred personnel.

III. Encryption of stored information and of the channels through which Data is sent, as well as identification and authentication mechanisms, that comply with Annexes 1 and 2 of these provisions.

IV. Management processes for addressing Information Security Incidents that occur in the operation of APIs, which ensure detection, attention, and containment, investigation, and, if applicable, digital forensic analysis, diagnosis, solution, follow-up, and reporting to the CNBV referred to in article 6 of these provisions.

V. Vulnerability and threat scanning program for access and administration of APIs, which may be carried out by a third party. The mentioned program must consider carrying out such tests at least once every 3 months, as well as having a remediation plan for critical vulnerabilities detected.

VI. Penetration testing program, which establishes that at least two tests per year will be carried out on systems and applications that are related or connected to APIs, or whenever ordered by the CNBV. These tests must be carried out by an independent third party that has personnel with verifiable technical capacity through specialized industry certifications in the matter. Likewise, a remediation plan for critical vulnerabilities detected must be available.

VII. Backup mechanisms and information recovery procedures that mitigate the risk of operational interruption.

VIII. Complete audit logs, including detailed information of accesses or attempted accesses and the operation or activity carried out by the Data Applicant with the obtained information.
The information referred to in this section must be preserved for at least one year.
In the case of Data Providers whose regulatory regime establishes provisions in matters of information security, what is provided in this article must be incorporated into the policies and procedures they must establish pursuant to said regime.

Article 5.- Data Providers must ensure that their Infrastructure for sharing Data through APIs complies with the following:

I. Have a configuration that guarantees that access to shared Data is read-only.

II. That the Infrastructure is segregated from that which supports any operation and has security mechanisms that limit access from the API service to the latter, under the principle of least privilege.
The principle of least privilege shall be understood as enabling access only to the information and resources necessary for the performance of the functions of the personnel responsible for handling APIs.

III. Have procedures that guarantee the availability of the service related to the exchange of Data.

IV. Complete audit logs, including detailed information of accesses or attempted accesses and the operation or activity carried out in the Infrastructure.

Article 6.- In cases where an Information Security Incident occurs, Data Providers must report it to the CNBV immediately, through the email address ciberseguridad-cnbv@cnbv.gob.mx. In such notification, at least the date and time of start of the Information Security Incident in question must be indicated, and if applicable, indication of whether it continues or has concluded and its duration; a description of said incident, as well as an evaluation of it.

Article 7.- Data Providers, in cases where they interrupt information access due to the Data Applicant's non-compliance with the terms and conditions agreed upon for the exchange of Data, must notify it via email to the CNBV general directorate in charge of its supervision. In such notification, the reasons justifying the interruption of information access and the circumstances of non-compliance with the agreed terms and conditions must be stated, attaching evidence of such non-compliances.

Article 8.- Data Providers must present to the CNBV, for its authorization, registration, and, if applicable, modification, the counterconsiderations they intend to charge Data Applicants for the exchange of Data, providing, for each type of API, the method, information, and variables used to determine the counterconsiderations, as well as any other consideration used in such determination.

For the purposes of registering counterconsiderations, Data Providers must present the following information:

I. Name, denomination, or corporate name, without abbreviations.
II. If applicable, trade name.
III. Federal Taxpayer Registry.
IV. Name of the API to which the counterconsideration will apply.
V. Description of the method used to determine the counterconsideration.
VI. Amount of the counterconsideration, in national currency.
VII. Telephone number of the persons in charge of implementing the API.
VIII. Email of the persons in charge of implementing the API.
IX. Periodicity with which the counterconsideration will be due, or any other parameter used.

The procedure for the authorization of counterconsiderations, as well as for their increase or reduction, will adhere to what is established in article 76 of the Law.

Chapter IV

Of Regularization Programs

Article 9.- Financial Entities, ITFs, societies authorized by the CNBV to operate with Novel Models, and money transmitters, in the situation provided for in the twelfth paragraph of article 76 of the Law and upon exercising their right to be heard, may present, for approval by the CNBV, a regularization program, which must contemplate, at least, the following requirements:

I. Indicate the actions that will be implemented to observe the obligations provided for in these provisions that have been violated.
II. Specify the stages and deadlines for each of the actions to be implemented, as well as the persons responsible for carrying out such actions. Under no circumstances shall the execution and compliance of the regularization program exceed 3 months counted from its authorization.
III. Measures aimed at preventing new violations.

The CNBV will have 20 business days, counted from receipt of the respective regularization program, to resolve regarding it. The CNBV may warn the interested party, on a single occasion and within the 10 business days of the deadline it has to resolve, of the lack of requirements in the content of the program or to request more information; therefore, in these cases, the deadline for the CNBV to resolve accordingly will be extended by 5 more business days.

The interested party will have 5 business days counted from receipt of the CNBV's warning to attend to the information request; otherwise, the CNBV will resolve with the information it has.

TRANSITORY

SOLE. - These provisions will enter into force the day following their publication in the Official Gazette of the Federation.