General Provisions to Regulate the Numerical Valuation Service Provided by Credit Reporting Agencies

Insurgentes Sur No. 1971, Plaza Inn, Col. Guadalupe Inn C.P. 01020, Delegación Álvaro Obregón, Ciudad de México Tel.: 5255 1454-6000 www.gob.mx/cnbv DISPOSICIONES DE CARÁCTER GENERAL PARA REGULAR EL SERVICIO DE VALORACIONES NUMÉRICAS PRESTADO POR LAS SOCIEDADES DE INFORMACIÓN CREDITICIA Publicadas en el Diario Oficial de la Federación el 9 de enero de 2015

Insurgentes Sur No. 1971, Plaza Inn, Col. Guadalupe Inn C.P. 01020, Delegación Álvaro Obregón, Ciudad de México Tel.: 5255 1454-6000 www.gob.mx/cnbv The National Banking and Securities Commission, with prior agreement of its Board of Directors, based on the provisions of articles 13, third and fourth paragraphs, and 17, second paragraph of the Law to Regulate Credit Reporting Agencies, as well as 4, section XXXVI, 12, section XV, 16, sections I and VII, and 19 of the Law of the National Banking and Securities Commission, and CONSIDERING that the Decree published in the Official Journal of the Federation on January 10, 2014, amended, among other regulations, the Law to Regulate Credit Reporting Agencies and granted powers to the National Banking and Securities Commission to regulate the terms under which credit reporting agencies may carry out, in the credit rating service, numerical valuations regarding the clients of the users of said agencies, and That likewise, through the Decree mentioned in the previous paragraph, the National Banking and Securities Commission was empowered to establish the cases and terms under which financial entities may access said numerical valuations without the express authorization of the client, provided that the personal data of the client is protected at all times, therefore, taking into account these powers, it is necessary to issue norms that contemplate such scenarios so that credit reporting agencies provide the corresponding services; That in addition to the above, through the aforementioned Decree, powers were granted to the National Banking and Securities Commission to establish, through general provisions, the information and documentation that credit reporting agencies must provide to users and clients, has resolved to issue the following:
GENERAL PROVISIONS TO REGULATE THE NUMERICAL VALUATION SERVICE PROVIDED BY CREDIT REPORTING AGENCIES INDEX
Chapter I
Generalities
Chapter II
On the Provision of Credit Rating Services through Numerical Valuations

Insurgentes Sur No. 1971, Plaza Inn, Col. Guadalupe Inn C.P. 01020, Delegación Álvaro Obregón, Ciudad de México Tel.: 5255 1454-6000 www.gob.mx/cnbv
Chapter III
On the Request and Delivery Process
Chapter IV
On the Management of Models
Chapter V
On Security Measures
Chapter I
Generalities
Article 1.- These provisions aim to regulate the terms under which the Agencies may carry out, within the credit rating service, the Numerical Valuations regarding the Clients of the Users of said Agencies.
Article 2.- For the purposes of these provisions, the definitions set forth in article 2 of the Law to Regulate Credit Reporting Agencies shall apply, and additionally, the following shall be understood in singular or plural:
I. Confidential Data: refers to the financial or patrimonial data of the Client, understood as any information related to their assets, liabilities, as well as information on the operations and services contracted with the Users, including those protected by confidentiality provisions established in laws related to the Mexican financial system.
II. Law: refers to the Law to Regulate Credit Reporting Agencies.
III. Model: refers to the set of statistical and analytical procedures and methods used to estimate the payment capacity or indebtedness of Clients.
IV. Numerical Valuation: refers to the result expressed in natural or cardinal numbers, in relation to a rating scale, obtained from the application of the Models and used to determine the eligibility of a Client for the User's product offerings.

Insurgentes Sur No. 1971, Plaza Inn, Col. Guadalupe Inn C.P. 01020, Delegación Álvaro Obregón, Ciudad de México Tel.: 5255 1454-6000 www.gob.mx/cnbv
Chapter II
On the Provision of Credit Rating Services through Numerical Valuations
Article 3.- The Agencies may offer their Users and Clients credit rating services through Numerical Valuations using the evaluation methodologies they determine for such purpose and subject to what is provided in these provisions.
Article 4.- The Agencies, in the provision of credit rating services, may deliver Numerical Valuations to Financial Entities that are Users without the authorization referred to in article 28 of the Law.
Additionally, the Agencies must deliver Numerical Valuations to the Commission when requested by it in the exercise of its inspection and surveillance functions in accordance with applicable legal provisions.
Article 5.- The Agencies may deliver Numerical Valuations in the provision of the credit rating service to Commercial Entities and SOFOMES E.N.R. that are their Users, provided that these have the express authorization of the Client, through their autograph signature or through mechanisms authorized by the Bank of Mexico for the substitution of the autograph signature, in accordance with what is established in article 28 of the Law.
Article 6.- The Agencies must consider all available information in their databases for the formulation of the Models used to calculate Numerical Valuations, unless the type of credit rating service requires segregating certain types of information.
Chapter III
On the Request and Delivery Process
Article 7.- The Agencies must request from Users the information that allows them to reasonably identify Clients within their databases, for the purpose of providing Numerical Valuations.
In the provision of the credit rating service through Numerical Valuations, the Agencies must refrain from sending Users Personal and Confidential Data other than those that the Users themselves have provided. The provisions of this paragraph shall not apply when Users have the authorization of the Client referred to in article 28 of the Law.

Insurgentes Sur No. 1971, Plaza Inn, Col. Guadalupe Inn C.P. 01020, Delegación Álvaro Obregón, Ciudad de México Tel.: 5255 1454-6000 www.gob.mx/cnbv Under no circumstances, in the provision of the credit rating service through Numerical Valuations, may the Agencies deliver sensitive personal Data to Users, as these are defined in the Federal Law on Protection of Personal Data Held by Private Parties.
Article 8.- Numerical Valuations may be delivered as part of the Special Credit Report or in any other document agreed upon for such purposes.
The Agencies must refrain from imposing differentiated charges or commissions based on the volume of Numerical Valuations provided to Users. The tariffs or consideration charged by the Agencies to Clients and Users for the credit rating service through Numerical Valuations must be based on the recovery of costs incurred in providing said service, without being able to impose charges or commissions outside the market. Prior to the formalization of the Clients' requests, the Agencies must inform them, through the medium by which the credit rating service through Numerical Valuations is offered, in a clear and precise manner of the price, tariff, or commission that will be specifically charged for the Numerical Valuation service, distinguishing it from charges made for any other service, including the issuance of the Special Credit Report. The Agencies must include a breakdown of the main risk components of the Numerical Valuations when these are contained in the Special Credit Report. Likewise, in the instructions annexed to the Special Credit Report that the Agencies make available to Clients in terms of what is provided in article 40 of the Law, the manner in which Numerical Valuations must be interpreted, as well as their main risk components, must be clearly explained.
Chapter IV
On the Management of Models
Article 9.- The Agencies may contract with third parties the development of the Model used for the calculation of Numerical Valuations, as well as the processing of requests for such valuations.
Article 10.- The Agencies are responsible for maintaining the control measures, policies, and documentation necessary to ensure the effectiveness and predictive capacity of the Models used in the estimation of Numerical Valuations.
Article 11.- The Agencies must establish mechanisms that allow them to identify and administer the potential risks of the Models used to calculate their Numerical Valuations. To this effect, they must have policies, processes, and procedures

Insurgentes Sur No. 1971, Plaza Inn, Col. Guadalupe Inn C.P. 01020, Delegación Álvaro Obregón, Ciudad de México Tel.: 5255 1454-6000 www.gob.mx/cnbv properly documented and authorized by the board of directors or the body to whom this delegates such function, which allow:
I. To confirm that the general manager knows the functioning of the Models, identifying in detail their limitations and assumptions, as well as the conditions under which they operate deficiently.
II. To ensure that the information used in the development of the Models is truthful, complete, and of quality.
III. To establish a validation process to evaluate the development, use, implementation, and documentation of the Models employed, as well as their quality in the estimation of Numerical Valuations, which must include quantitative and qualitative analyses and tests that are sufficient to assess the predictive power and performance of the Models. Such validations must be carried out at least every three years and consider the information referred to in the previous section, as well as be carried out by qualified personnel who are independent of the areas responsible for the development of the Models.
To carry out the validation mentioned in the previous paragraph, the Agencies may contract third parties, provided they have the appropriate experience and professional qualification.
IV. Implement corrective plans for their Models based on the results observed in the validation processes.
V. Update, adjust, and calibrate the methodological elements that allow maintaining an adequate performance of the Models.
VI. Document the results of the Model validation processes and communicate them to the general manager of the Agency and, when significant deficiencies are observed at the judgment of the qualified personnel referred to in section III of this article, additionally communicate them to the board of directors and, if applicable, to the Model providers.
Article 12.- The general manager of each Agency shall be responsible for:
I. Defining the acceptable policies and practices for the development, implementation, and use of their Models.
II. Determining acceptable tolerance levels regarding the existence of distortions in the results of the Models, as well as the process to review, adjust, or restrict their use when such levels are exceeded.

Insurgentes Sur No. 1971, Plaza Inn, Col. Guadalupe Inn C.P. 01020, Delegación Álvaro Obregón, Ciudad de México Tel.: 5255 1454-6000 www.gob.mx/cnbv
III. Submit the developed Models to the approval of the board of directors or the body to whom this has delegated such function.
IV. Determine and document the assumptions under which, if applicable, external providers of the Models may cease to provide their services to the Agency.
V. Establish mechanisms to inform the Users of the Agency who request Numerical Valuations of the limitations and assumptions of their Models, as well as the results of the performance tests applied and the main findings observed in the validation processes.
Chapter V
On Security Measures
Article 13.- When offering credit rating services through Numerical Valuations, the Agencies must adopt the necessary security and control measures to guarantee the integrity, security, and confidentiality of the information that is processed, stored, and transmitted, including that which will be delivered to their Users.
Article 14.- The Agencies must inform their Users, through instructions, of the minimum security measures they must adopt to formulate requests for information on the credit rating service through Numerical Valuations, in accordance with the request reception means established by the Agencies themselves for such purposes.
When such requests are made through electronic, magnetic, optical, or other technologies, encryption processes must be applied to said means or to the content of the transmitted information in order to guarantee its confidentiality and security, using cryptographic keys that ensure that such information cannot be known by third parties. The Agencies must not deliver information to their Users when the request is made without having any of the security measures mentioned in the previous paragraph.
Article 15.- The Agencies must foresee the measures they deem necessary so that the computer systems or technological platforms they use to carry out their processes and for the provision of credit rating services through Numerical Valuations, comply with the following:
I. Perform, at all times, the functions for which they were designed, developed, or acquired, maintaining controls that ensure in their operation an adequate segregation of functions and adequate authorization schemes for operations.

Insurgentes Sur No. 1971, Plaza Inn, Col. Guadalupe Inn C.P. 01020, Delegación Álvaro Obregón, Ciudad de México Tel.: 5255 1454-6000 www.gob.mx/cnbv
II. Have their applications and processes properly documented, including their development methodology, as well as records of their changes.
III. Be tested before being implemented, when changes are made to them, as well as when applying updates, using quality control mechanisms that prevent them from being used in production environments or unauthorized functionalities.
IV. Have information access controls, considering at least:
a) User authentication mechanisms that ensure access only to persons expressly authorized for such purpose, including adequate considerations for users with higher privileges derived from their database and operating system administration functions. b) Information encryption mechanisms when this is transmitted. c) Robust composition of passwords and access keys, as well as controls in the storage and use of user authentication factors, both internal and external. d) Control of unattended sessions, as well as simultaneous sessions with the same user identifier. e) Physical security mechanisms applicable to the infrastructure for storage, processing, and transmission of information.
V. Minimize the risk of operational interruption based on backup mechanisms and information recovery procedures, as well as of the technological infrastructure for its processing.
VI. Maintain audit logs containing detailed information of the operation or activity carried out by the Agency's personnel, including those with high privileges, as well as procedures for the periodic review of said logs.
VII. Contemplate the performance of tests aimed at detecting vulnerabilities in electronic media, telecommunications, and automated equipment, which prevent unauthorized access and use. Such tests must be carried out at least once a year or when substantial modifications are made to the technological infrastructure.
VIII. Consider the capacity planning of the technological infrastructure that supports their operation.

Insurgentes Sur No. 1971, Plaza Inn, Col. Guadalupe Inn C.P. 01020, Delegación Álvaro Obregón, Ciudad de México Tel.: 5255 1454-6000 www.gob.mx/cnbv TRANSITIONAL SINGLE.- These provisions shall enter into force one hundred and eighty calendar days after their publication in the Official Journal of the Federation.