Modifications and Additions to the General Provisions on the Operations of the Retirement Savings Systems

If the document is presented incomplete on the right margin, it is because it contains tables that exceed the default width. If this is the case, click here to view it correctly.

DOF: 21/06/2024

MODIFICATIONS and additions to the General Provisions on the Operations of the Retirement Savings Systems

At the margin, a seal with the National Coat of Arms, which says: United Mexican States.- TREASURY.- Ministry of Finance and Public Credit.- National Commission of the Retirement Savings System.

MODIFICATIONS AND ADDITIONS TO THE GENERAL PROVISIONS

ON

THE MATTER OF

OPERATIONS OF THE RETIREMENT SAVINGS SYSTEMS

The President of the National Commission of the Retirement Savings System, based on what is provided in articles 1, 2, 5 fractions I, II, III, IV, VI, VII, XIII bis and XVI, 12 fractions I, VI, VIII and XVI, 18, 18 bis, 19, 20, 21, 25, 26, 29, 30, 31, 36, 37, 37 A, 37 C, 39, 40, 41, 43, 47, 47 bis, 53, 57, 58, 59, 64, 64 bis, 64 ter, 65, 70, 74, 74 bis, 74 ter, 74 quáter, 74 quinquies, 76, 77, 78, 79, 80, 88, 89 , 90 fractions II, IV and XIII, 91, 99, 111 and 113 of the Law of the Retirement Savings Systems; 167, 175, 176, 177, 179, 181, 182, 187, 188, 191 fraction II, 192, 195, 198 and 200 of the Social Security Law; 2, 13, 21, 26, 64, 76, 77, 78, 83, 87, 91, 93, 97, 98, 100, 101, 102, 105 fraction VII, 106, 108 fraction II, clause c, 119 and 123 fraction II, as well as Fifth, Seventh, Tenth, Eleventh, Twenty-second, Twenty-fourth, Twenty-fifth, Twenty-sixth and Twenty-seventh Transitory Provisions of the Decree by which the Law of the Institute of Security and Social Services for State Workers is issued; 1, 5 last paragraph, 29 fraction II, 34, 38, 40, 43, 43 bis and Eighth Transitory Provision of the Law of the National Housing Fund for Workers; 1, 14, 15, 16, 23, 25, 28, 29, 30, 31, 32, 33, 34, 35, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 59 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 106, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 139, 140 and 154 of the Regulations of the Law of the Retirement Savings Systems; 1, 2 fraction III and 8 first paragraph of the Internal Regulations of the National Commission of the Retirement Savings System, and

CONSIDERING

That the Law of the Retirement Savings Systems establishes the public order and social interest character on the regulation of the functioning of the retirement savings systems and their participants, among which are the Retirement Fund Administrators (Afores);

That said Law establishes that the National Commission of the Retirement Savings System is authorized to coordinate, regulate, supervise and monitor the retirement savings systems by issuing general provisions, related to their operation, as well as to the receipt, deposit, transmission and administration of the contributions and payments corresponding to said systems;

That in recent years, advances in the use of Information and Communication Technologies (ICT) in the Financial System, have undoubtedly brought multiple benefits for governments, companies and the population, however these advances have also brought risks, which has caused the possibility of cyberattacks, affecting the reputation, credibility, trust and assets of some financial sectors and affecting end users of services, so it is necessary that, both financial authorities and their regulated entities, take actions that allow, not only to detect these risks in a timely manner and prevent them, but if they occur, to have the necessary controls to contain them and mitigate their impact;

That the Retirement Savings System is not exempt from risks associated with information technologies, so it is necessary to strengthen digital structures and implement more robust controls to ensure the confidentiality of the information of the personal data of Workers and their beneficiaries;

That, in this context, and in harmony with the implementation in other areas of the Mexican financial sector, the geolocation factor, also known as georeferencing, is incorporated into the operation of the retirement savings systems, which aims to align with international standards to combat activities linked to operations with proceeds of illicit origin;

That, to contribute to avoiding bad practices to the detriment of Workers and the information that constitute the databases of the retirement savings systems, it is necessary to improve the processes for the identification and authentication of Workers, beneficiaries and other users, as well as develop effective policies that better protect pension assets;

That, to strengthen security in the operations of the Retirement Savings Systems, the Document Risk Qualification Card has been implemented, which must consider the parameters established in Annex Q that is added, which will allow establishing alerts and procedures to facilitate the detection of documents that could generate inconsistencies in the procedures and services provided to users in general of the retirement savings systems;

That the right of Workers to have timely access to all information related to their Individual Account, must be a fundamental axis that guides the functioning of the Retirement Savings System, under this premise, the Commission seeks to guarantee the proper exercise of that right, through the creation of an automated communication tool as a mechanism for information exchange, through which the Administrators and the Operating Companies, will keep Workers informed, through messages and notifications, all regarding the course and resolution of procedures and services related to their Individual Account;

That, to make the Retirement Savings System a more inclusive environment, in which it is guaranteed to Workers access to services on equal terms, it is necessary to implement the operational and technological structure that facilitates access for Workers in vulnerable situations, due to their condition, sensory or motor limitation, to the services provided by the Administrators and the Operating Companies. With the same objective, through the design of Electronic Models, it is sought to bring these services closer to Workers, regardless of the geographic zone in which they reside, considering for this the technical and service needs;

That in order to ensure the effective compliance of the proposed changes to these Provisions, the Policy and Procedure Manuals are strengthened, establishing as a requirement the favorable opinion of the Regulatory Comptroller and, if applicable, of the internal committees or working groups of the Administrators; additionally, Annex P is incorporated as the basic format that participants in the retirement savings systems must consider for the preparation and updating of the Policy and Procedure Manual;

That to continue protecting the interests of Workers, the possibility that the disposition of resources derived from the individual account is allowed through bank accounts whose contracting took place abroad, at the request of the interested parties, is regulated in a specific and express manner, in terms of the regulations, and

That to comply with what is established in article 78 of the General Law of Regulatory Improvement, as well as to article Fifth of the "Agreement that establishes the guidelines that must be observed by the dependencies and decentralized organisms of the Federal Public Administration, as to the issuance of general administrative acts to which article 69-H of the Federal Law of Administrative Procedure applies", the deregulation actions relative to articles 165 and 210 of these Modifications and additions to the General Provisions on the matter of operations of the retirement savings systems and article 16 of the various modifications to said provisions must be considered, reserved and dictated through the letter CONAMER/20/1832 dated April 23, 2020, in terms of the corresponding Regulatory Quality Annex, has deemed it appropriate to issue the following:

MODIFICATIONS AND ADDITIONS TO THE GENERAL PROVISIONS ON THE MATTER OF

OPERATIONS OF THE RETIREMENT SAVINGS SYSTEMS

SINGLE. The articles 1 in its fraction XLIX; 14 bis third paragraph; 112; 121 third paragraph; 140 bis; 140 quáter; 149 bis fraction I clause e. subclause iii; 210 fraction I clause b., clause n. subclause iii, as well as fraction II second paragraph and fractions V, VI and VI; 210 bis third paragraph; 216 paragraphs first and second; 243 sexies first paragraph; the denomination of Section III, Chapter IV, of Title Six of these General Provisions; 251 paragraphs first, third and fourth; 252 first paragraph; 326; 345 first paragraph; 385 fraction I clause h.; 387 third paragraph; 388 second paragraph; 391 first paragraph; 406 fraction II and last paragraph; 406 bis first paragraph; 406 ter clause e), subclause iii. and last paragraph; 407 first paragraph; 410 paragraphs second and third; 413; 419 paragraphs second and third; 423 fraction IV; 427 third paragraph; 429 fourth paragraph; 437 fraction II clause b.; 438 first paragraph; 439 second paragraph; 446; 457 first paragraph; and Annex D Section B last paragraph; are MODIFIED; articles 1, with the fractions I bis, XXIV bis and LXXVIII bis; 4 with fractions VI, VII, VIII, IX and X, with a third, fifth and eleventh paragraph, shifting the current third to fourth, the current fourth to sixth, the current fifth to seventh, the current sixth to eighth, the current seventh to ninth, and the current eighth to tenth paragraph; 5 with a seventh paragraph with three fractions, shifting the current seventh and eighth paragraphs to eighth and ninth respectively; 15 ter; 23 quáter; 92 with a second paragraph in its first paragraph, fraction II, clause c.; 122 with a second paragraph, shifting the current second to third; 198 with fraction VI; 202 with fraction IV; 204 with a second paragraph, shifting the current second to third; 204 bis; 209 with paragraphs second and third; 210 with a fraction VIII; 216 bis; 234 bis; 243 quáter in its fraction I with a clause e.; 243 quinquies with fraction IV; 243 sexies with a third and fourth paragraph, remaining in this order due to the repeal of the current third; 251 in its third paragraph with clauses i) and ii); with a Section II bis in the Chapter VI of Title Six of these General Provisions integrating said section articles 279 bis, 279 ter, 279 quáter and 279 quinquies; 345 with paragraphs third, fourth, fifth, sixth, seventh, eighth and ninth; 387 with paragraphs fourth, fifth and sixth, shifting the current fourth to seventh, the current fifth to eighth, the current sixth to ninth, the current seventh to tenth, the current eighth to eleventh and the current ninth to twelfth paragraphs; 390 with a fifth paragraph; 391 with paragraphs second, sixth and seventh, shifting the current second to third, third to fourth, fourth to fifth and fifth to eighth paragraphs; 395 with a second paragraph; 438 with a second paragraph; Annex D Section B with fraction VI; the Annex P and Annex Q; and articles 165; 243 sexies third paragraph; 429 fifth paragraph with its fractions; Annex D Section A in its fractions II, IV and V; are REPEALED; all of the General Provisions on the matter of operations of the retirement savings systems, with their modifications and additions in force, to remain as follows:

" Article 1. ...

I. ...

I bis. Operational Accessibility, to the set of operational and technological elements that facilitate the services to workers in vulnerable situations due to their condition, deficiency or limitation sensory or motor, allowing to expand the operational coverage of the services provided by the administrators, generating equal conditions, secure access, autonomy and functionality.

II. to XXXIV. ...

XXXIV. bis CLABE Account, to the Standardized Banking Key of eighteen digits that is used to identify a bank account in accordance with the provisions issued by the Bank of Mexico;

XXXV. to XLVIII. ...

XLIX. Net Performance Document, the document in which the Net Performance Indicator for Transfers and the commission on the current balance of the Investment Societies that corresponds according to the year of birth of the Worker at the date of the signature of the Registration and Transfer Request, as well as its period of validity and the other information that the Commission determines. The Commission will notify the Operating Companies, through Electronic Means, the information and format of the Net Performance Document. These Operating Companies must make it available to the Administrators; this document will have a validity from the 15th day of each calendar month, to the 14th of the next month;

L. to LXXVIII. ...

LXXVIII bis. Georeferencing, to the process that allows determining the position of an element in a spatial coordinate system different from the one in which it is located.

LXXIX. to CLXIV. ... "

" Article 4.

...

...

I. to V. ...

VI. Information security, operational continuity and Operational Risk,

VII. Internal dissemination channels and training methodology between internal areas regarding the information established in the Policy and Procedure Manual,

VIII. Update periods,

IX. Processes, channels and tools that allow the accessibility of vulnerable groups to the Retirement Savings System and

X. That which is established in accordance with the other general provisions that the Commission issues.

For the compliance with the above items, the Administrators, the Operating Companies and the Service Providers must consider the use of the content established in Annex P of these General Provisions.

...

In the section on Unique and Portable Electronic File, referred to in fraction IV, the activities of its formation must be specified, including those corresponding to the integration of the Mobile File, the security levels for access to these and those responsible for their validation.

...

...

...

...

...

As a preventive practice, the Policy and Procedure Manual must have the favorable opinion of the Regulatory Comptroller and, if applicable, of the internal committees or working groups of the Administrator, regarding the integration, structure and general content of the processes contained in it. Without this implying that the Regulatory Comptroller ceases to develop its surveillance function regarding the compliance with internal regulations " .

" Article 5.

...

...

...

...

...

...

The Transactional Procedures Manual must contain as part of its documentation:

I. The body of authorized operational models that are part of the processes described in the manual. As part of this information, it must specify the versions of the models and dates on which they remained operating.

II. For each process, the rejection diagnoses, reasons for rejection, and, for those that are determined as recoverable, or solution or attention procedures.

III. Coexistence of processes and attributes of Individual Accounts.

...

... "

" Article 14 bis.

...

...

Operating Companies must register, safeguard, administer and update in the National SAR Database the information of the beneficiaries they receive from the Administrators in accordance with what is established in the preceding paragraph, as well as the date of designation and the type of procedures and services that have been requested as a beneficiary.

...

... "

" Article 15 ter.

Operating Companies and Administrators will develop Operational Accessibility models that use information technologies in order to provide autonomy and access to the services of the SAR to workers who so require.

The Operating Companies and Administrators that develop the models referred to in this article must submit a request for authorization to the Commission based on the specifications established in article 337 bis of these general provisions, in addition to the above they must consider at least the following:

i. Work Plans that define the criteria to identify, in a quantifiable manner, the accessibility of workers regardless of the geographic zone in which they reside, considering technical and service needs, guaranteeing transparency, objectivity and security of the same;

ii. Electronic devices and wireless network technology;

iii. Technical Support. Technological devices and materials that allow enabling or compensating for one or more functional, motor, sensory or intellectual limitations of people with disability;

iv. Offer alternatives for biometric authentication of the identity of people with disability and

v. Offer alternatives for the recognition of the autograph signature in people with disability visual, severe motor or other condition in which the autograph signature is affected.

vi. Administrators and Operating Companies will provide various inclusive communication channels through operational access functionalities, as well as guarantee that the interface of the equipment and automated or telecommunications systems are designed in such a way that it is effective, efficient and satisfactory for workers, regardless of their condition or disability, including the use of support technologies, which must be detailed in their Policy and Procedure Manuals, as well as generate and make available to this Commission, auditable logs containing the information derived from the planning, execution and results of their application, which allow verifying the correct management and measure the effectiveness of their implementation.

vii. Operating Companies and Administrators must consider at least one language simple, Mexican sign language, text visualization, Braille system, tactile communication, macrofonts, digital voice media, text reader, voice dictation and other modes, means, systems and formats augmentative or alternative communication, including technology of information and communications of easy access.

It will be the responsibility of Operating Companies and Administrators to generate auditable logs that allow verifying, at least, the place, date and exact time of the service transaction that the Worker requests, as well as that information that serves as evidence that determines the correct compliance of the procedure. These logs must be kept available to the Commission at all times " .

" Article 23 quáter. When Workers request any of the procedures established in the present provisions, Administrators must request the original of their official identification from Workers to verify their identity, in terms of what is established in the catalog of identifications provided in Annex " D " Section A. "

" Article 92.

...

I. ...

II. ...

a. and b. ...

c. Evaluate at least once a year, the vulnerability to which they may be exposed in the hardware, software, systems, applications, security, information recovery, networks and any other type of information technology they implement, due to errors of processing or operational, failures in procedures, inadequate capabilities and insufficiencies of the installed controls, among others.

Likewise, at least once a year, they must carry out an audit, through a qualified and certified company in information security by a standardization body, on the vulnerabilities referred to in the paragraph that precedes, reporting the results of the audit to the Commission by no later than the last business day of December of the current year, including the work programs to strengthen and minimize the detected vulnerabilities.

d. to f. ...

III. ... "

" Article 112. Operating Companies must integrate, safeguard, administer and update the databases that are necessary, related to Electronic Files, Biometric Signatures, as well as with the processes of opening, Registration, Transfer and disposition of resources of Individual Accounts, as well as of the other processes established in these general provisions.

Operating Companies must identify in the National SAR Database all the attributes that correspond to each Individual Account, as well as register the dates on which the Individual Account acquired each attribute and, if applicable, its validity.

In all cases, Operating Companies are responsible for guaranteeing the security, integrity, availability and confidentiality of the information that Administrators provide them for the integration into the databases of each of the processes they operate. "

" Article 121.

...

...

Administrators, in face-to-face services, must request the original of their official identification from Workers to verify their identity, in terms of what is established in the catalog of identifications provided in Annex " D " , Section " A " , of these general provisions, the Probatory Document and/or the CURP Certificate.

...

...

I. to III. ...

... "

" Article 122.

...

Cases identified and classified by Administrators as capture errors, must be preserved, under the terms that Administrators establish in their Policy and Procedure Manuals, the result of this identification must be contained in auditable logs that allow verifying the correct management and application, which must be available to the Commission at all times.

... "

" Article 140 bis. Administrators must implement the use of electronic models for authenticate the identity of a Worker, attorney, tutor, curator or Beneficiaries, whenever they present to manage the services provided for in articles 209 of these general provisions.

Administrators must use the information resulting from the formation of the Electronic Files to identify anomalous or risk situations in order to safeguard the information and the"

resources of the Individual Accounts of the Holders. If the Administradoras detect an anomalous situation, they must report it, at the moment of identification of the situation, to the Operating Company so that it is registered in the National SAR Database that that Individual Account is in the process of clarification. The Administradoras must establish control and information security measures that ensure adequate operation and verification of the processes carried out in the Individual Accounts, which must be established in their Policies and Procedures Manuals.

The Administradoras must authenticate Beneficiaries, Guardians, and Legal Representatives, using the information contained in the Electronic File that they have registered in their Individual Account, or by using mechanisms that allow them to verify them against official identification, identification files, and official databases operated by authorities of the Federal Public Administration, Autonomous Constitutional Bodies, and national entities authorized, supervised, and regulated by financial authorities of the Federal Public Administration, which allow their identification.

...

...

...

...

...

...

...

...

...

...

" Article 140 quater. Administradoras that require developing: 1) the electronic authentication models and biometric authentication models referred to in Articles 140 bis and 140 ter above, or 2) the services for the initiatives or projects described in Article 337 bis below, or 3) request services related to what is described in Article 209 from the Operating Companies, must submit a request for authorization to the Commission, which must contain at least the following:

I. to IX. ...

...

The authorization that the Commission may issue to the proposals for electronic authentication models and biometric authentication models established in Articles 140 bis and 140 ter above and initiatives or projects indicated in Article 337 bis below, or services requested from the Operating Company, will be subject to a demonstration in a pre-production environment by the Administradoras. The development of the demonstration aims to validate the proposals of the Administradoras or services requested from the Operating Company, from the current regulations and generate evidence of the controls established therein.

The start date of operation of the electronic authentication models, biometric authentication models, projects and initiatives, or services requested from the Operating Company will be conditioned to the delivery to the Commission of a test certificate issued by the Operating Company or the entities involved, as applicable, where the feasibility of implementation of the model proposal and the acceptance of the aforementioned demonstration are accredited.

...

In the event that the authorized electronic authentication models and biometric authentication models referred to in Articles 140 bis and 140 ter and initiatives or projects indicated in Article 337 bis below or the services requested from the Operating Company cease to meet the necessary requirements for their operation, the Administradoras may not use said models until they carry out the necessary actions to be in compliance again. For this purpose, the Administradoras must suspend the operation of the electronic authentication models, biometric authentication models, and initiatives or projects in question, immediately and notify the Commission no later than the next business day that the non-compliance event occurs.

The Administradoras must ensure that the functioning and operation of the electronic authentication models and biometric authentication models and initiatives or projects or services authorized to them under this article, are permanently subject to the regulation in force, as well as to the modifications that apply to it, as applicable.

Likewise, when the Administradoras decide to suspend the operation of the electronic authentication models and biometric authentication models referred to in Articles 140 bis and 140 ter and initiatives or projects indicated in Article 337 bis below, or those requested from the Operating Companies, they must inform the Commission in writing, at least ten business days before the suspension, detailing the reasons why they will cease to use them.

... "

" Article 149 bis.

...

I. ...

a. to d. ...

e. ...

i. to ii. ...

iii. Percentage assigned to each Beneficiary, which must invariably sum 100%.

II. ...

... "

" Article 165. Repealed. "

" Article 198.

...

...

I. to V. ...

VI. The validity of the Identification File, as an integral part of the Unique and Portable Electronic File.

...

a. and b. ...

...

...

...

... "

" Article 202.

...

I. to III. ...

IV. The verification of the validity of the Identification File, regarding the validity of the documents referred to in Annex D, section A, of these provisions, through the recognition tools implemented by the Operating Companies.

...

...

... "

" Article 204.

...

The validity of the Identification File will be subject to the validity of the documents referred to in Annex D, section A, of these provisions so that it remains updated.

... "

" Article 204 bis. The Operating Companies and the Administradoras must establish and use information technologies as well as applications and models that allow them to extract data from the documents requested in accordance with the Policies and Procedures Manuals and the Transactional Procedures Manual to safeguard the integrity and consistency of the data they register in the National SAR Database and generate and pre-fill the Requests for the procedures of the services referred to in Article 209 of these general provisions.

The data used for the aforementioned pre-filling will be extracted from the National SAR Database in order to compare them with those resulting from the consultation of official databases operated by authorities of the Federal Public Administration, Autonomous Constitutional Bodies, and national entities authorized, supervised, and regulated by financial authorities of the Federal Public Administration, which allow their identification.

The forms and requests collected to pre-fill the Unique and Portable Electronic Files must be designed for easy understanding and for the benefit of workers and documented through electronic models in accordance with Articles 140 quater and 337 bis of these provisions as part of their continuous improvement, which must be focused on inclusion and social development that allows them to promote operational accessibility schemes. The data that must be contained in the forms and requests must contain as minimum elements those referred to in Articles 210, 210 bis, 210 ter, and 210 quater of these general provisions as well as information that facilitates the identification of each operational process carried out by each request received, such as the date of the request, attention time, execution time, the name of the service provided, unique folio of the request sent and notified to the Operating Company, channel of attention, among other data required by their operational nature as well as those requested in the General Provisions on user service of the Retirement Savings System.

The content of the forms and requests must have referential integrity and equality of what is registered by the Operating Company and the Administradoras, with the intention of speeding up the reading and validation of data through verifying entities that allow them to verify the validity and validity of the received documents and maintaining the consistency of data in the requests for procedures and services provided for in the general provisions. "

" Article 209.

...

I. to X. ...

For each of the services provided, the Administradoras must incorporate a documentary risk assessment card in accordance with the parameters established in Annex Q of these general provisions, which refer to the minimum elements to consider.

The documentary risk assessment card must be used for each of the services provided by the Administradoras and must be incorporated into their respective Policies and Procedures Manuals, which must contain the procedure and calculation method considered to weight the risk values. Likewise, the Policies and Procedures Manual must consider the procedure to analyze the results yielded by the documentary risk assessment cards that allows the Administradoras to identify patterns and in turn establish alerts and procedures in the entry of procedures. "

" Article 210.

...

...

I. ...

a. ...

b. CURP, which must be consulted against the National SAR Database and verified against RENAPO;

c. to m. ...

n. ...

i. to ii. ...

iii. Percentage assigned to each Beneficiary, which must invariably sum 100%.

II. ...

a. to b. ...

The images of the worker's official identification integrated into the Worker's Identification File must be updated at least every 5 years;

III. to IV. ...

V.

The Biometric Enrollment of the Worker;

VI. The Biometric Signature and the Digital Handwritten Signature of the Pension Advisor who manages the procedure, as well as those of the Worker and, if applicable, the SAR Electronic Signature of the latter;

VII. CURP Certificate, a document issued by RENAPO whose delivery and authenticity must be carried out and verified by the Administradora, and

VIII. Georeferencing.

... "

" Article 210 bis. ...

I. to II. ...

...

The deposit of the resources referred to in fractions VI, VII, VII bis, and IX will be made in a CLABE Account or its equivalent when it comes to a bank account opened abroad.

...

...

...

...

... "

" Article 216. The Administradoras must verify if the Worker requires modifying or updating the information and elements referred to in numerals I, II, III, IV, and VII of Article 210 above, in accordance with the information provided for this purpose by the Operating Companies or, if applicable, the Workers.

For this purpose, the Administradoras, through their Pension Advisors, regardless of the type of modification made by the worker, must request that the Workers present the necessary documentation and information for the update of the Worker's Identification File, in accordance with what is provided in Annex "D", of these general provisions, as well as according to the technical characteristics established for this purpose by the Operating Companies.

...

...

...

... "

" Article 216 bis. The Operating Companies will implement processes that allow them to establish the updated use of the Worker's Electronic File and through which they can verify the validity of files and prove the data and elements referred to in fractions I, II, III, and IV of Article 210 of these General Provisions.

Likewise, the Operating Company must validate and authenticate that the information stored in Article 210, fraction I, subsection i of these general provisions corresponds to the holder of the Individual Account based on what is established in the Transactional Procedures Manual.

The processes implemented for the updated use of the Electronic File must consider the validation of the Worker's biometric elements through the use of the Biometric Signature and Digital Handwritten Signature or, if applicable, the SAR Electronic Signature. "

" Article 234 bis. The automated communication tool, which operates as an electronic mailbox, must carry out the following functions:

I. Notify Workers of the status, conclusion, and if applicable, the reason for rejection of the services requested by Workers, established in Article 209 of these General Provisions, and

II. Ratify to the Worker the information and images that have been updated in their Identification File.

The Operating Companies and the Administradoras must keep logs with the notification, made to Workers through the automated communication tool, which operates as an electronic mailbox. "

" Article 243 quater.

...

I. ...

a. to d. ...

e. Georeferencing. "

" Article 243 quinquies.

...

I. ...

II.

The image of the front and, if applicable, the back of the worker's official identification, in terms of what is established in the identification catalog provided in Annex "D", Section "A", subsection A, fractions I, II, III, and VI of these general provisions;

III. ...

IV. Georeferencing "

" Article 243 sexies. The Operating Companies will validate, online and in real time, the information and elements of the Self-Linking against the information registered in the National SAR Database including the attributes of the individual accounts, and in accordance with what is provided in the Transactional Procedures Manual. In the event that the biometric validation is successful, the Operating Companies must:

...

Notify the Administradoras of the result of the biometric validation including the degree of confidence that exists between the files, Mobile File, and Unique and Portable Electronic File, in accordance with what is provided in the Transactional Procedures Manual.

The above, in order for the Administradoras to identify similarities between the information contained in the Mobile File and the Unique and Portable Electronic File, so that they determine the risk thresholds for their documentary validation and, if applicable, conclude with the integration of the same or specify the reasons that did not allow the integration of the files according to what is established in their Policies and Procedures Manual. "

" Section III

On the transfer of resources from the Individual Accounts for the year of birth of the Workers "

" Article 251. The Administradoras must locate in their databases the Individual Accounts corresponding to Workers who, due to their year of birth, must have their resources transferred from one Investment Company to another on a quinquennial basis in accordance with the calendar and guidelines determined for this purpose by the Commission.

...

Without prejudice to the above, with respect to the Individual Accounts of the Workers who must transfer their resources to the Investment Company corresponding to their year of birth or to the Basic Pension Investment Company, the following will apply:

i) Of the balances invested in the Initial Basic Siefore, if the workers do not manifest their willingness to remain in said Investment Company in a prior period of three months to the transfer referred to in the first paragraph of this article, the resources must be transferred to the Investment Company corresponding to their year of birth, and

ii) Of the balances invested in a Basic Siefore that is closing, if the workers do not manifest their willingness to transfer their resources to another Investment Company in a prior period of three months to the transfer referred to in the first paragraph, the resources must be transferred to the Basic Pension Investment Company.

Likewise, the Administradoras must observe the instructions of the Workers regarding consolidating the balances of the Individual Accounts that are invested in different Investment Companies, and invest them according to the Worker's year of birth, or in the Investment Company that he determines, in accordance with the general financial provisions issued by the Commission.

... "

" Article 252. The Administradoras, in accordance with the calendar and guidelines determined for this purpose by the Commission, must obtain the net balance of the Individual Accounts to subsequently carry out the sale of the Shares of the Transferring Investment Company corresponding to the determined balance that will be transferred by age, in accordance with what is provided in Article 251 above.

... "

" Section II BIS

On the automated communication tool, which operates as an electronic mailbox "

" Article 279 bis. The Operating Companies must develop and operate an automated communication tool, which will function as an electronic mailbox, through which the Administradoras and the Operating Companies must send to the Workers the messages and notifications related to the procedures and services indicated in Article 209, fractions I, II, IV, V, VI, VII, VII bis, VIII, IX, and X, which they have carried out through in-person means, Web Portals, or Mobile Applications, indicated in Article 9 of these Provisions, without prejudice to other additional communication mechanisms that the Administradoras determine to use. "

" Article 279 ter. The Administradoras and the Operating Companies must use the automated communication tool as an additional communication means in all procedures and services of the Retirement Savings System, to notify Workers of the status of the procedures. "

" Article 279 quater .

The notifications and messages sent through the automated communication tool that operates as an electronic mailbox, must be sent at the same time to the worker's validated email address, in accordance with what is established in the Transactional Procedures Manual. "

" Article 279 quinquies.

The automated communication tool, in accordance with what is established for each procedure and service in the Transactional Procedures Manual, must allow workers to view notifications. "

" Article 326. The interest accrued by the Quotas and Contributions, during the time that the resources are in the Concentrator Account or the ISSSTE Account for the reconciliation and dispersion processes, will be transferred to the Administradoras. The Administradoras must register said interest in the Individual Accounts, on the first business day of the second month following the month in which the liquidation of said resources took place and invest the resources for interest in the Investment Company Chosen by the Worker or in the Investment Company corresponding to their year of birth. "

" Article 345 . In the case of Electronic Transfers and direct debit of Voluntary Savings Contributions, the Administradoras, and if applicable, the Operating Companies, must establish a mechanism that allows the resources of the Workers who have presented objections to the charges made to their bank accounts, to be returned to the credit institution that operates said accounts within the timeframes determined for this purpose by the applicable laws

...

The Operating Companies must reconcile the information of the Chargeback requests received from the Auxiliary Companies and identify the Administradora to which the Voluntary Savings contributions were dispersed on the same day they receive the request from the Auxiliary Companies.

Within the same timeframe indicated in the previous paragraph, the Operating Companies must identify the Individual Accounts as "Clarifications for Chargebacks" and notify the Administradoras of the requests for return of Voluntary Savings resources for Chargebacks that correspond to them.

The Administradoras must attend to the requests for return of Voluntary Savings for chargebacks and identify the Individual Accounts as "Clarifications for Chargebacks" no later than the next business day after receiving the notification from the Operating Companies.

The Administradoras through the Liquidating Credit Institutions will make available to the Operating Companies the corresponding resources of the Voluntary Savings returns for Chargebacks, when the voluntary savings balance is sufficient to carry out the return of the requested resources or to carry out the liquidation for the available resource in the voluntary savings subaccounts when the balance of these is less than the requested amount,

no later than five business days after the notification of the requests.

The Operating Companies must carry out the return of resources corresponding to Chargebacks to the Auxiliary Companies on the same day that the Administradoras make the resources available through the Liquidating Credit Institutions.

The Chargebacks registered by the Administradoras and Operating Companies must be kept in auditable logs that allow verifying the correct management and application, which must be available to the Commission at all times.

The Operating Companies must reconcile the information of the objections referred to in this article, received from the Auxiliary Companies and identify the Administradora to which the Voluntary Savings contributions were dispersed on the same day they receive the request from the Auxiliary Companies, in accordance with what is provided for this purpose in the Transactional Procedures Manual. "

" Article 385 B. ...

I. ...

a. to g. ...

h. CLABE Account Number or its equivalent when it comes to a bank account opened abroad owned by the Worker or, if applicable, their Beneficiaries.

II. ...

... "

" Article 387.

...

...

During the management of pension procedures and partial withdrawals from the Individual Account, the Administradoras must request the corresponding information for the resource disposal procedure; including the CLABE Account or its equivalent when it comes to a bank account opened abroad in the name of the Worker or, if applicable, the Beneficiary in which, if applicable, the resources to which they are entitled must be deposited.

The Operating Companies, in the case of Partial Withdrawals for unemployment under section A of Article 191 of the Social Security Law, who identify that the information of the last base salary for contribution provided by the Social Security Institutes, through the tools and systems

informatics, if there are discrepancies with what is registered in the individual account, they must mark the account with

the attribute of reconciliation with the Social Security Institutes, in accordance with what is established in the

Transactional Procedures Manual.

The Operating Administrator Companies will notify the Social Security Institutes and the

Administrators of the identified cases no later than the next business day in accordance with the characteristics

established in the Transactional Procedures Manual.

The mark with the attribute of reconciliation with the Social Security Institutes will remain in the National

SAR Database for a period of 20 calendar days in order for the Institute to issue the corresponding

response; if the response is not issued by the Social Security Institute, the account must

be unmarked from the National SAR Database, in order for the Worker to be able to request their

Partial Withdrawal procedure again, which will no longer be subject to these validations.

...

...

...

...

...

...

" Article 388.

...

The Previous Balances Inquiry System has the purpose of providing the Social Security Institutes,

as applicable, Online and in Real Time, the balances of the Individual Accounts, which will

be used to inform the Worker through the Offer Document of the preliminary amounts that each

social security regime and/or Pension Modality offers.

...

" Article 390.

...

...

...

...

The Administrators on the next business day after the one indicated in the first paragraph of this article must

send to the Operating Companies any of the following diagnoses resulting from the notification of the

balances of the Individual Account:

I. Accepted, or

II. Rejected. "

" Article 391. The Operating Companies and the Administrators on the next business day referred to in

article 390 must identify as " previous balance " the Individual Accounts that have been

diagnosed as " Accepted " in the DATA MART, for a period of thirty business days counted from

the date on which the Individual Account is notified by the Institute and will be cancelled by instructions of the

Institute or at the end of the period in question.

The Social Security Institutes during the period referred to in the previous paragraph may request that the

period of thirty business days be resumed.

...

...

The Operating Companies on the same day that the Individual Accounts are identified as "previous balance"

must notify the Housing Institutes of the information provided to them by the

Administrators.

The Operating Companies, regarding the Individual Accounts that have been diagnosed as "Accepted"

and "Rejected" by the Administrators, must send to the IMSS or the ISSSTE as applicable, on the next business

day referred to in article 390, the information that the Administrators provide to them.

Additionally, the Operating Companies will be responsible for keeping the information

contained in the DATA MART regarding the Pension Prospectuses updated, and must update the attributes of the

Individual Accounts at the end of the term established in this article. "

" Article 395.

...

The Operating Companies must validate that the right that the Social Security Institutes register

in the DATA MART contains the consultation of a valid previous balance, prior to accepting the request for

transfer. "

" Article 406.

...

I. ...

II. Request directly from the Administrator, through the corresponding Social Security Institute

or from the Federal Government departments determined by the Secretariat, that the

resources be transferred to the national origin bank account or its equivalent when it comes to

a bank account opened abroad in the name of the Worker or, if applicable, to the

Beneficiary. When it comes to information provided by the Social Security Institutes or the

Federal Government departments determined by the Secretariat, the responsibility of the

Administrator is limited to transferring the corresponding resources, prior to confirmation of

that the holder of the provided bank account corresponds with that of the Individual Account or, if applicable, the beneficiary in terms of the information provided to them by the Institutes of

Social Security or from the Federal Government departments determined by the Secretariat.

...

...

...

...

The Administrators or, as applicable, the Social Security Institutes and the Federal Government

departments determined by the Secretariat, will be responsible for verifying the identity of the holder or Beneficiary that

requests the disposal of resources from the Individual Accounts, as well as verifying that the Worker or

Beneficiary is the holder of the CLABE account or its equivalent when it comes to a bank account opened in the

foreign country where the resources will be deposited. "

" Article 406 bis. The resources of the Retirement Insurance and the housing sub-account 92, accumulated in the

Individual Account during the pension regime of the Social Security Law 73, as well as those

corresponding to the Retirement Savings Sub-account and the Housing Sub-account referred to in the

ISSSTE Law in force until December 31, 2007 as applicable, must be deposited by the

Administrators into a CLABE account or its equivalent when it comes to a bank account opened in the

foreign country provided by the Social Security Institutes or from the Federal Government departments

determined by the Secretariat, provided that it is previously confirmed that the holder of the account in which the

resources will be deposited, corresponds with that of the Individual Account or, if applicable, the Beneficiary, without

it being necessary the direct request of the latter, the use of electronic means and their Biometric Signature, provided that

the following requirements are met:

I. to VI. ... "

" Article 406 ter.

...

a) to d) ...

e) The CLABE account number or its equivalent when it comes to a bank account opened in the

foreign country of the Worker in which the deposit of resources referred to in

article 406 bis of these general provisions will take place.

...

...

I. to II. ...

i. to ii. ...

iii. When the worker requests the deposit in a CLABE account or its equivalent in the

foreign country, different from that provided by the Social Security Institutes or the

Federal Government departments determined by the Secretariat, the Administrator

must attend to the Worker in person, under the ordinary terms of the process

of disposal of resources and in accordance with fraction II of article 408 of the

present general provisions, and

iv. ...

...

...

...

When the deposit of the resources cannot be carried out due to causes attributable to the data of the

bank account, rejections of a banking nature or of any kind, the Administrators must reinvest the

resources in the source sub-account within a maximum period of three business days after the expiration of the

term. "

" Article 407. The Administrators that receive a request for disposal of resources must verify

the same day of its receipt that the Individual Account in question meets the requirements for the withdrawal

of the resources determined by the applicable legal provisions, likewise they must confirm

that the holder of the CLABE account or its equivalent when it comes to a bank account opened in the

foreign country provided, corresponds with that of the Individual Account, or in its case, the beneficiary, prior to

sending the request to the Operating Companies. Likewise, for the procedure of return of resources from the

housing sub-account, the Administrators must provide the Worker with a document of conformity

for the return of the balance of the housing sub-account, in which they indicate the identification data of the

Worker and the amount of resources to be returned, in order for the Worker to sign it if they are in

agreement. The Administrators will be responsible for verifying that the data entered in said

document correspond to those of the Worker and coincide with the data of the documents presented.

...

" Article 410.

...

Likewise, they must deposit in the CLABE account or its equivalent when it comes to a

bank account opened abroad provided by the Social Security Institutes or from the Federal Government

departments determined by the Secretariat or the housing institutes, provided that it is confirmed of

a prior manner that the holder of the bank account in which the resources will be deposited, corresponds with that of

the Individual Account or, if applicable, the Beneficiary, the withdrawal and housing resources that had been

requested by the Worker or, if applicable, the Beneficiary, through the Social Security Institutes or from the

Federal Government departments determined by the Secretariat or the housing institutes.

When the deposit of the resources cannot be carried out due to causes attributable to the data of the

bank account, rejections of a banking nature or of any kind, the Administrators must contact the

Worker, Pensioner or Beneficiary so that they correct the situation and be able to carry out the deposit

corresponding. In their case, if thirty calendar days have passed and the deposit of the

resources has not been made, the Administrator must reinvest the resources in the source sub-accounts within a maximum period of

three business days after. "

" Article 413. The Administrators, for the case of dispositions, must carry out the delivery of the

amount that make up the balance of the Associated Sub-accounts and make available to the Worker, no later than the third business day after the term established for the sending of the requests for disposal of

resources to the Operating Company, the resources that by law they are entitled to receive, as well as in their case

request from the housing institutes the deposit of the corresponding housing resources with the CLABE

account or its equivalent when it comes to a bank account opened abroad that for such effect the Worker has

indicated.

When the deposit of the resources cannot be carried out due to causes attributable to the data of the

bank account or rejections of a banking nature, the Administrators must contact the Worker,

Pensioner or Beneficiary so that they correct the situation and be able to carry out the deposit

corresponding. In their case, if thirty calendar days have passed and the deposit of the resources has not been made, the

Administrator must reinvest the resources in the source sub-accounts within a maximum period of three

business days after. "

" Article 419.

...

If the request for disposal of resources for help with marriage expenses for Workers affiliated

with the IMSS, as well as in the case of Partial Withdrawal for Unemployment, is presented by Electronic Means, there must be an electronic record that accredits the presentation of the request and the deposit in favor

of the Worker in the CLABE account or its equivalent when it comes to a bank account opened in the

foreign country that said Worker has designated for such effect and of which the Administrator must

verify previously, that it corresponds with the Holder of the Individual Account. These records must

remain available to the Commission.

When the deposit of the resources cannot be carried out due to causes attributable to the data of the

bank account or rejections of a banking nature, the Administrators must contact the Worker,

Pensioner or Beneficiary so that they correct the situation and be able to carry out the deposit

corresponding. In their case, if thirty calendar days have passed and the deposit of the

resources has not been made, the Administrator must reinvest the resources in the source sub-accounts within a maximum period of three

business days after. "

" Article 423.

...

I. to III. ...

IV. In their case, the data of the CLABE account or its equivalent when it comes to a bank

account opened abroad of the Worker in which the deposit of the

resources must be made, and

V. ...

...

...

" Article 427.

...

...

The Administrators must inform the Operating Companies about the payments referred to in

this article, on the next business day after having carried out the deposit of the resources in the CLABE account

indicated by the Worker. "

" Article 429.

...

When the Worker has requested the payment of the Partial Withdrawal for Unemployment and the Administrators cannot

carry out the deposit of the resources due to causes attributable to the data of the CLABE account or

rejections of a banking nature, they must contact the Worker so that they correct the situation and be able to carry out

the corresponding deposit, if thirty calendar days have passed and the deposit of the resources has not been made, the

Administrator must reinvest the resources in the source sub-accounts within a maximum period of three

business days after.

It is repealed. "

" Article 437.

...

I. ...

II. ...

a. ...

b. The data of the CLABE account or its equivalent when it comes to a bank account

opened abroad for the deposit, and

c. ...

III. to IV. ...

...

...

" Article 438. The Administrators that receive from the Workers or their beneficiaries the request for

disposal of Voluntary Savings contributions referred to in article 437 above must verify that

the Worker is registered with the Administrator and that the following is met:

I. to III. ...

The Administrators that receive requests for return of Voluntary Savings resources by Contra

charges, will not be subject to what is established in fraction I of this article. "

" Article 439.

...

When the deposit of the resources cannot be carried out due to causes attributable to the data of the

bank account or rejections of a banking nature, the Administrators must contact the Worker,

Pensioner or Beneficiary so that they correct the situation and be able to carry out the deposit

corresponding. In their case, if thirty calendar days have passed and the deposit of the resources has not been made, the

Administrator must reinvest the resources in the source sub-accounts within a maximum period of three

business days after. "

" Article 446. The Administrators that receive late contributions must validate bimonthly

with the Constitutive Amount, the Pension Start Date, social security regime and the Pension

Modality and inform the Operating Companies so that, if applicable, the corresponding transfer

is made, the above in accordance with the periodicity that is established in the Transactional Procedures Manual. "

" Article 457. The Administrators, no later than the next business day in which the registration referred to in

article 455 above is made, must send to the Operating Companies the information and data that

correspond.

...

...

...

...

" ANNEX D

CATALOGS OF INFORMATION AND PERSONAL IDENTIFICATION IN THE SYSTEMS

OF RETIREMENT SAVINGS

Section A

Catalog of official identifications

The Administrators must take as valid identifications:

A. For adults, with photo and signature:

I. Passport;

II. It is repealed.

III. Voter ID card, issued by the INE;

IV. It is repealed.

V. It is repealed.

VI. Consular ID.

B. ...

I. to II. ...

...

...

Section B

Catalog of proof of address

...

I. to V. ...

VI. Tax situation certificate of the Worker

...

The Operating Companies must establish the technical criteria and quality standards for the

formation, modification or update of the data and of the proof of address taking as a basis

the National Postal Codes Catalog published by the Mexican Postal Service on a weekly basis,

when applicable. "

" ANNEX P

OF THE STRUCTURE OF THE MANUAL OF POLICIES AND PROCEDURES

Objective of the Manual.

Version control.

a.

Table that contains the versions, the update dates (start of validity) and the

modifications made, which contain a general description of the

update performed by version.

Content.

Operational Processes:

a)

Opening, Registration and Transfer of Individual Accounts;

b)

Assignment and reassignment of Individual Accounts;

c)

Administration of the Individual Account and of the Individual Account with pension attribute;

d)

Single and portable Electronic File;

e)

Disposal of resources,

f)

Information security, continuity in operation and Operational Risk,

g)

Internal dissemination channels and training methodology between internal areas regarding the

information established in the Manual of Policies and Procedures,

h)

Responsibilities of Normative Controllers or Internal Committees regarding the review,

supervision and approval of the processes and information contained in the Manual of Policies

and Procedures,

i)

Update periods and notification to the Commission,

j)

Processes, channels and tools that allow the accessibility of vulnerable groups to the

Retirement Savings System and

k)

That which is established in accordance with the other general provisions that

the Commission issues.

Procedures (of each of the aforementioned items)

a. Flowchart of the Process and flowchart symbolism with the

description of the object

(ANSI, UML, or unified modeling languages, same

which must be indicated in the document according to the descriptive need

of the process where the actor - participant or entity is identified).

b. Specify, in the case of that process that implies calculations, the method, the

variables and the valuation method to determine the amounts.

c. Data model.

d. Chronological and Sequential Description (the sub-processes and the

inherent processes must be indicated).

e. Reports and Logs.

f. Specific identification of the information technology applications that support the process.

Data dictionary.

Glossary.

Annexes

Minimum necessary structure:

Header

Logo: The logo of the Administrator / Operating Company.

Administrator: Name of the Administrator / Operating Company.

Document code or key: This data must correspond to that of the Internal Control area.

Version: The version number corresponding to the current year derived from any

update accompanied by the year, example: 001.2024.

Date of last update: Date of the last update associated with the version of the document.

LOGO

Administrator / Operating Company.

Document code or key

POLICIES AND PROCEDURES MANUAL

Version

Date of last update

Macroprocess: Name of the operational process.

GENERAL PROCESS POLICIES

Description: The methods, procedures and internal controls that allow guaranteeing the

adequate control and process in accordance with current regulations and its internal policies

must be established

Objective

OBJECTIVE: (describe the objective of the process)

Scope

SCOPE:

It is established up to where the process extends and the participants, as well as the needs to be covered)

Responsible Areas

RESPONSIBLE AREAS:

According to the hierarchical or organizational structure of the Administrator or Operating Company.

Policies

POLICY

CONTROL ID

The general policy of the

process is established to comply with

regulatory compliance.

It is established through an acronym that associates the Macroprocess with the

sub-processes, as well as the type of execution (Manual, automatic through the

set of scheduled tasks, hybrid) and a unique and progressive identifier that

allows observing the control number of the process.

Example:

AAA-XXX-ZZZZ-01

Where AAA is the macroprocess, XXX the sub-process, ZZZ the type of execution and

the unique and non-repeating counter.

Control

CONTROL ID

AAA-XXX-01

NAME OF THE CONTROL

The generic name of the control is described.

OBJECTIVE

The name of the operational control is established.

DESCRIPTION

The control and its intention are described.

EVIDENCE

The types of evidence of the controls are indicated to identify in the data model or

as part of the activities of the responsible user(s).

FREQUENCY OF THE

APPLICATION OF THE CONTROL

The recurrence of application of the control is indicated.

FREQUENCY OF THE

REVIEW OF THE CONTROL

The recurrence of review of the application of the control is indicated.

TYPE OF CONTROL

It indicates whether the control is of the Corrective, Preventive, Reactive, Predictive or Quality and

consistency of the Information type or if the set of any of the types of control.

EXECUTION

It indicates whether the execution depends on any manual activity, or on a task

scheduled through the execution of the set of systems.

POSITION OR POSITION OF

WHO EXECUTES

Responsible for the process (name of the position or position occupied according to the

hierarchical or organizational structure)

POSITION OR POSITION OF

WHO AUTHORIZES THE

CONTROL

Responsible for the process (name of the position or position occupied according to the

hierarchical or organizational structure) "

" ANNEX Q

OF THE DOCUMENTAL RISK ASSESSMENT CARDS

The Administrators must specify through their Corporate Governance the functions and activities

of the areas that determine that will intervene in the evaluation of the cards of documentary risk assessment, in accordance with their respective strategic and tactical roles, as well as the levels of

responsibilities of these to create value chains within the areas involved of the

administrators

For the preparation of the documentary risk assessment cards, the Administrators must

consider at least the following:

1. Identification of Risk Factors.

Risk

factor:

are

the risks

inherent

that

may

occur

in

the Retirement Savings System

and

that

could have a certain impact on the savings of the workers.

The factors that the Administrators determine must be documented through a control table

that allows them to identify at least the following:

Risk

(Name

of the identified risk)

Definition

(What type of risk is

and its

consequences)

Matrix

(Methodology that allows it

to weigh the level and the

risk thresholds)

Control

(The actions that are carried

out in front of this risk)

The identification of risk factors must not compromise the operational and service levels.

2. Risk Scenario.

It refers to the graphical representation of the rating of each of the Risk Factors based on

the probability of occurrence and the level of impact determined by the Administrator. The rating serves

to weigh those

Risk

Factors

that result

from greater concern for the

Administrator.

The identified risk scenarios and their level of impact, their probability of

occurrence and must be weighed by the level of recurrence or latency of their possible materialization in accordance with their

order of priority and relevance.

3. Risk mitigation: are the controls or processes used to inhibit the level of inherent risk.

They must be identified based on each of the operational processes that impact the services identified in Article 209 of the Provisions; for this purpose, they must identify external and internal factors to evaluate the mitigation of risks.

4. Processes and risk factors.

Once the operational processes involved in each of the services identified in Article 209 of the Provisions have been identified, as well as their relationship with the risk factors, the Administrator must weigh the operational processes against the identified risk factors in a matrix to assign them a score in relation to the representativeness of each operational process involved in each of the services, regarding the risk factors.

Subsequently, the Administrator must assign them the value that allows determining the inherent risk and evaluating the residual risk, as well as the actions that the Administrator will carry out to mitigate them and provide compensation in accordance with what is provided in the Law of the Retirement Savings Systems, the Regulations of the Law of the Retirement Savings Systems, as well as what is provided in the General Provisions of the retirement savings systems.

Risk

Inherent:

are

potential

events

in

the

pension

system

that

could

cause

negative

impacts

on

workers' pensions or on the confidence in the system and that are inherent to

the design

of

the

operational

processes

or

the

activities

that

are

carried

out

in

it.

This

exists

in

all

processes

that

AFOREs

perform.

Inherent

risk

is

potential

risk,

that

which

exists

before

implementing

any corrective

or

mitigating

action.

Residual

Risk:

Is

the

level

of

risk

resulting

from

implementing

the

different

mitigants.

This

allows

identifying

the

vulnerabilities

of

the

participants

of

the

SAR.

The

resulting

level

of

risk

determines

the

prioritization

of

internal

control

resources

of

the

administrators

with

the

purpose

of

reducing

the

probability

of

risk

materialization.

TRANSITORY

ARTICLE FIRST. These modifications and additions to the General Provisions on the operations of the Retirement Savings Systems, will enter into force on the next business day following their publication in the Official Gazette of the Federation, with the exception of the following:

I.

They will enter into force 90 business days after their publication in the Official Gazette of the Federation:

The modifications, additions, or derogatory effects as appropriate provided for in

articles 4,

5 and 387.

II.

They will enter into force 110 business days after their publication in the Official Gazette of the Federation:

The modifications, additions, or derogatory effects as appropriate provided for in articles 14

bis, 140 bis and 149 bis.

III.

They will enter into force 120 business days after their publication in the Official Gazette of the Federation:

The modifications, additions, or derogatory effects as appropriate provided for in articles 23

quáter, 121, 122, 198, 202, 204, 204 bis, 209, 210, 216, 216 bis, 234 bis, 243 quáter, 243 quinquies,

243 sexies, 279 bis, 279 ter, 279 quáter, 279 quinquies, 388, 390, 391, 395 and 446.

ARTICLE SECOND. With the entry into force of these modifications and additions, all those provisions that contravene these are abrogated.

Mexico City, June 14, 2024. - The President of the National Commission for the Retirement Savings System, Master Julio César Cervantes Parra. - Signature.

In the document you are viewing, there may be text, characters, or objects that do not display correctly due to conversion to HTML format, so we recommend always taking the digitized image of the DOF or the PDF file of the edition as a reference. The content, form, and scope of published documents are the strict responsibility of their issuer.

CONSULT

BY DATE

Do Mo Tu We Th Fr Sa

INDICATORS

Exchange Rate and Rates as of 08/25/2026

DOLLAR

16.9647 UDIS

8.807141 CCP

6.12% CCP-UDIS

4.72% CPP

5.09% TIIE 28 DAYS

6.7559% TIIE 91 DAYS

6.7931% TIIE 182 DAYS

6.8474% TIIE OF FUNDING

6.50%

See more

SURVEYS

Did you like the new look of the Official Gazette of the Federation website?

No

Yes

Official Gazette of the Federation

Río Amazonas No. 62, Col. Cuauhtémoc, C.P. 06500, Mexico City Tel. (55) 5093-3200, where you can access our service menu

Electronic address: dof.gob.mx

111

LEGAL NOTICE | SOME RIGHTS RESERVED © 2026