Modifications and Additions to the General Provisions Regarding Operations of Retirement Savings Systems

Official Gazette of the Federation: 08/08/2023

MODIFICATIONS and additions to the General Provisions regarding operations of the retirement savings systems

In the margin a seal with the National Shield, stating: United Mexican States.- TREASURY.- Secretariat of Treasury and Public Credit.- National Commission of the Retirement Savings System.

MODIFICATIONS AND ADDITIONS TO THE GENERAL PROVISIONS REGARDING

OPERATIONS OF THE RETIREMENT SAVINGS SYSTEMS

The President of the National Commission of the Retirement Savings System, based on the provisions of articles 1, 2, 5 sections I, II, III, IV, VI, VII, XIII bis and XVI, 12 sections I, VI, VIII and XVI, 18, 18 bis, 19, 20, 21, 25, 26, 29, 30, 31, 36, 37, 37 A, 37 C, 39, 40, 41, 43, 47, 47 bis, 53, 57, 58, 59, 64, 64 bis, 64 ter, 65, 70, 74, 74 bis, 74 ter, 74 quater, 74 quinquies, 76, 77, 78, 79, 80, 88, 89 90 sections II, IV and XIII, 91, 99, 111 and 113 of the Law of the Retirement Savings Systems; 167, 175, 176, 177, 179, 181, 182, 187, 188, 191 section II, 192, 195, 198 and 200 of the Social Security Law; 2, 13, 21, 26, 64, 76, 77, 78, 83, 87, 91, 93, 97, 98, 100, 101, 102, 105 section VII, 106, 108 section II, subsection c, 119 and 123 section II, as well as Fifth, Seventh, Tenth, Eleventh, Twenty-Second, Twenty-Fourth, Twenty-Fifth, Twenty-Sixth and Twenty-Seventh Transitory Articles of the Decree issuing the Law of the Institute of Security and Social Services for State Workers; 1, 5 last paragraph, 29 section II, 34, 38, 40, 43, 43 bis and Eighth Transitory Article of the Law of the Institute of the National Housing Fund for Workers; 1, 14, 15, 16, 23, 25, 28, 29, 30, 31, 32, 33, 34, 35, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 59 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 106, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 139, 140 and 154 of the Regulation of the Law of the Retirement Savings Systems; 1, 2 section III and 8 first paragraph of the Internal Regulation of the National Commission of the Retirement Savings System, and

CONSIDERING

That, given the relevance of Individual Accounts, it is necessary to have the means and services for the proper functioning of the Retirement Savings Systems, in order to guarantee and facilitate the exercise of their rights relative to Individual Accounts, as well as the monitoring of corresponding procedures, while ensuring the confidentiality of the information of personal data of Workers and their Beneficiaries;

That said modifications add elements to improve the attention provided to Workers through the incorporation of technological solutions that allow strengthening the security of information;

That, in order to Transform the Retirement Savings System, provide certainty and simplify processes putting the interests of Workers at the center, with the purpose of enriching the legal framework that gives certainty and support to operations, the elements, documentation, information, images and biometric elements of the holders that make up the Electronic File are modified;

That it is convenient to implement elements to improve the Retirement Savings Systems that allow providing better attention to Workers, for this reason the Web Portal is incorporated, which must be developed, administered and operated by the Operating Company, the Administrators may define their own Web Portal as long as they have the authorization of the Commission. The main and particular characteristic of the Web Portal will be to facilitate access, resources, procedures and services to Workers or their Beneficiaries keeping them better informed, by allowing global communication in real time and at a distance, providing better quality services, breaking distance barriers and improving the efficiency and functioning of the Systems;

That in order to streamline, facilitate and improve the procedures currently carried out by Workers and their Beneficiaries, in accordance with the increasingly extensive implementation of technological elements that allow strengthening the security of information, the use of Electronic Models may be implemented to authenticate the identity of a Worker, attorney-in-fact, guardian, curator or beneficiary, provided that the services provided in these general provisions are managed. Said Models must base their operation on a double electronic authentication, which operates a confrontation and comparison, Online and in Real Time;

That with the implementation of Electronic Models, these replace the Account Statement Folio and depend on an authorization that guarantees and allows identifying Workers and their Beneficiaries when they request any service Online and in Real Time;

That to achieve better functioning of the Retirement Savings Systems the Unique Biometric Seal is replaced by Biometric Authentication Models that will allow identifying Workers when they request any service Online and in Real Time;

That to avoid identity usurpation and bad practices or deception in the Retirement Savings Systems the Personal Identification Number (NIP) is created, generated by the Operating Companies, which will be stored in the SAR National Database and whose main function is to authenticate Workers so that they can electronically sign procedures and services of their Individual Account expressing their will;

That to ensure that the transition process towards electronic procedures via remote is adequate and provides security for the identity of Workers and their Beneficiaries it was necessary to implement the use of Authentication Factors for services related to the administration of the Individual Account, that the Administrators grant to Workers guaranteeing and safeguarding at all times the identity of these frente a la confirmación y autenticación de cada usuario previniendo posibles malas prácticas;

That it is necessary to generate an authentication mechanism integrated by the Personal Identification Number (NIP), Biometric Signature and other digital elements stored in electronic media that produces the same legal effects as the autograph signature and before this need the SAR Electronic Signature is created, whose purpose is to mitigate fraud, identity usurpation and bad practices, generating security in the requests of Workers that are provided by the Administrators in person or remotely and that serves as a means of authentication and manifestation of exclusive will in the Retirement Savings Systems;

That with the objective that Participants in the Retirement Savings Systems have certainty of the figure of the Pensioner, the definition of this is included allowing to detail in these modifications that they are those Workers who have a Pension Resolution or a Pension Concession for retirement, old age and advanced age insurance, granted by IMSS or ISSSTE, as corresponds, in terms of Social Security Laws;

That given the relevance of the Complementary Transfer the definition of the same is made specifying that it is the transfer of resources that for any concept makes a Transferor Administrator or the Service Provider after liquidation, to an Individual Account that has been transferred and is already under the control of the Recipient Administrator;

That given the needs of workers and to attend to these the use of the CLABE Account is incorporated and made mandatory so that Afores carry out payments and deposits of resources, with this reduce costs, increase the security of resource provisions and streamline for workers the receipt of their savings in their bank accounts, with this the issuance of payment orders and checks is avoided, substantially more costly and less secure than a SPEI transfer;

That, to avoid excluding in the Retirement Savings Systems the figures of Attorneys-in-Fact, Pensioners and Beneficiaries, they are incorporated into these modifications with the intention that they be recognized and considered

That to comply with what is established in article 78 of the General Law of Regulatory Improvement, as well as article Fifth of the "Agreement that establishes the guidelines that must be observed by the dependencies and decentralized organisms of the Federal Public Administration, regarding the issuance of general administrative acts to which article 69-H of the Federal Law of Administrative Procedure applies", deregulation actions relative to articles 9, 176, 186, 192 bis F, 211, 406, 423, 437 of these Modifications and additions to the General Provisions regarding operations of the retirement savings systems must be considered, in terms of the corresponding Regulatory Quality Annex, has seen fit to issue the following:

MODIFICATIONS AND ADDITIONS TO THE GENERAL PROVISIONS REGARDING OPERATIONS OF THE RETIREMENT SAVINGS SYSTEMS

SINGLE. Articles 1, sections IX bis, XXVIII bis, LX, LXXIII, CLX bis; 8, section V and last paragraph; 9; 14, fourth paragraph now sixth; 15, third paragraph; 23 Ter; 62 bis, first paragraph, 92, section II, subsection c; 111, second paragraph; 120, first paragraph; 140 bis; 141, first paragraph; 145; 146; 148 section I; 149 bis first and last paragraphs; 149 bis B, last paragraph; 149 bis D, first paragraph and section III; 150 section III; 160 section VII; 161 second paragraph; 168 sections II and IV bis, subsection b; 170 first, second, fourth and fifth paragraphs; 173, section III; 176 first paragraph; 186 first and last paragraphs, and section I; 189 first paragraph, sections I and XI; 191 second paragraph; 192 bis; 192 bis A, first and third paragraphs; 192 bis D; 192 bis E; 192 bis F, section I; 192 bis H, first paragraph; 192 bis K, first paragraph; 192 bis L first paragraph; 192 bis M; 193 first paragraph; 209 sections VII, VIII and IX; 210, first paragraph and sections V and VI; 210 bis first, second, and current third (now fourth) paragraphs; 210 quater first paragraph; 211 second paragraph; 229 first and current second (now third) paragraphs; 231, second paragraph; 232, first paragraph; 234; 240, first paragraph; 243 quater, first paragraph; 243 quinquies, first paragraph and section III; 243 septies, second paragraph; 248; 249; 258 first, fourth and fifth (now sixth) paragraphs; 265; 266, first and fifth paragraphs; 269, last paragraph; 271, first paragraph; 274, first, second and third paragraphs; 274 bis; 274 ter; 274 quater; 277, second and third paragraphs; 337 bis, first, second and fourth paragraphs; 337 ter, first paragraph and section III; 342; 386; 387; 387 bis; 397, first and second paragraphs; 406; 406 bis, first paragraph; 406 ter, section II, subsection iv; 407, first paragraph; 410; 413; 419; 423, sections IV, V and last paragraph; 424, sections I and VI, subsection a and second paragraph; 429, third paragraph; 437, sections I, II and second paragraph; 439; 471, first paragraph; Annex B section II, second and third paragraphs, section V, subsection a); likewise the denomination of Section VI of Chapter IV corresponding to Title Fifth is modified; the denomination of Section VII of Chapter III, corresponding to Title Sixth is modified: Annex D, Section B second and third paragraphs, Section C, Section D, Section E, Section F, second paragraph; Annex L, section A, first paragraph, section I, second paragraph, sections II, III, subsection a), third paragraph, section B, first paragraph, sections I first paragraph, II, and III, first paragraph and subsection a); Articles 1, XXXIV bis, LVII bis, LXVI bis, CI bis, CV bis, CVII ter, CLX Ter; 9 bis; 14 with a fourth and fifth paragraphs, moving the current fourth to become sixth; 15 bis; 62 bis, with a last paragraph; 111, with a third and fourth paragraphs; 117 bis; 120, with a second paragraph; 132, with a third and fourth paragraphs, moving the current ones to become fifth and sixth; 140 ter; 140 quater; 145 bis; 149 bis D, with a second paragraph, moving the current second to become third; 173, with a last paragraph; 191, with a third and fourth paragraphs, moving the current third, to become fifth; 198, with a section I bis; 208 bis; 208 ter; 209, with sections VII bis and X; 210, with a second paragraph moving the current second to become third, as well as a section VII, 210 bis, third, fifth and sixth paragraphs, moving the current fourth and fifth to become seventh and eighth; 229, with a second paragraph moving the current second, to become fourth; 242 bis; 243 Ter A; 243 Ter B; 243 quinquies, section III, with subsections i and ii; Section IX Of the personal identification number or NIP, of Chapter III, corresponding to Title Sixth; 243 octies; 243 nonies; 243 decies; 243 undecies; 258, with a fifth paragraph, moving the current fifth to become sixth; 337 bis, with a ninth and tenth paragraphs; 387 ter; 437, section III, subsections a, b, and c; 471; with a last paragraph; Annex B, section VI; Annex D, section F with a last paragraph, and Articles 1, section LXI ter, LXXI; 62 bis, second and third paragraphs; 62 ter; 112, second paragraph; 147; 168, section IV bis, subsection d and its subsections; 173, section IV; 189, section IV and third paragraph; 210 quater sections i, ii, iii, iv, v, second, third, fourth, fifth and sixth paragraphs; 229, fourth paragraph; 231, section I; 271, third paragraph; 272; 343; 424 third and fourth paragraphs; 437, section III and as well as the third, fourth, fifth, sixth seventh and eighth paragraphs, all of the General Provisions regarding operations of the retirement savings systems, with their modifications and additions in force, are REPEALED, to remain as follows:

"Article 1. ...

I. to IX. ...

IX bis. Mobile Application, to the remote operation computer application implemented in Automated and telecommunications systems or equipment developed by the Operating Companies or by the Administrators, made up of a set of computer modules and security mechanisms that allow corroborating the data and information of Workers to carry out various procedures and access services, and provides Authentication Factors category 3 or higher referred to in Annex B of these general provisions and that partially or totally allows, through said modules process information generated by Workers directly or through Support Companies, same that is sent to the Administrators or to the Operating Companies for processing and verification;

X. to XXVIII. ...

XXVIII bis. Unique Service Key, to the unique code that Operating Companies assign to each request generated through the Web Portal that Operating Companies administer. The Unique Service Key will be created based on the guidelines, criteria and characteristics that for this effect determine the Operating Companies in the Transactional Procedures Manual;

XXIX. to XXXIV. ...

XXXIV. bis CLABE Account, to the Standardized Banking Key of eighteen digits that is used to identify a bank account in accordance with the provisions issued by the Bank of Mexico;

XXXV. to LVII. ...

LVII bis. Automated and telecommunications systems or equipment, to the Web Portal, the Mobile Application and others that are authorized by the Commission in terms of these general provisions;

LVIII. to LIX. ...

LX. Unique and Portable Electronic File, to the set of images, documents, personal data and individual information, that reside in the Identification File, Electronic File and in the Mobile File in addition to the biometric elements that have been stored through in-person means, digital means or electronic means securely, orderly and detailed in a single file, unique and portable that allows the identification of persons, their Beneficiaries and of the operations and procedures carried out in the Retirement Savings Systems;

LXI. to LXI bis. ...

LXI ter. Repealed.

LXII. to LXVI. ...

LXVI bis. SAR Electronic Signature, to the authentication mechanism integrated by the Personal Identification Number (NIP), Biometric Signature and other digital elements stored in electronic media that produce the same legal effects as the autograph signature and that serves as a means of authentication and manifestation of exclusive will in the Retirement Savings Systems;

LXVII. to LXX. ...

LXXI. Repealed.

LXXII. ...

LXXIII. Complaint or Service Folio, to the unique folio that Administrators must assign to each of the service requests or complaints presented by Workers or Beneficiaries, as applicable, either through the Specialized Unit, offices, branches, of the Administrator's telephone attention center, the Web Page, the Mobile Application, the Web Portal or any other means of attention that Administrators have available to Workers and the general public;

LXXIV. to CI. ...

CI bis. NIP, to the Personal Identification Number generated by the Operating Companies, and that is stored in the SAR National Database that authenticates Workers so that they can electronically sign procedures and services of their Individual Account expressing their will;

CII. to CV. ...

CV bis. Pensioner, in singular or plural, to Workers who have a Pension Resolution or a Pension Concession granted by IMSS or ISSSTE, as corresponds, in terms of Social Security Laws;

CVI. to CVII bis. ...

CVII ter. Web Portal, to the internet portal implemented in Automated and telecommunications systems or equipment that is developed, administered and operated by the Operating Companies, referred to in article 9 of these general provisions; those that Administrators develop and that transact through the Operating Companies will also be understood as such, prior authorization of the Commission;

CVIII. to CLX. ...

CLX bis. Mobile Transfer, is the process that is carried out, through the Mobile Application or Web Portal that Operating Companies or Administrators implement, prior authorization of the Commission, in terms of these general provisions, between the Recipient Administrator and the Transferor Administrator, through which the Worker exercises his right to choose which institution will administer his Individual Account in accordance with the Law, the Regulation and these general provisions;

CLX Ter. Complementary Transfer, to the transfer of resources that for any concept makes a Transferor Administrator or the Service Provider after liquidation of an Individual Account that has been transferred and is already under the control of the Recipient Administrator;

CLXI. to CLXIV. ..."

"Article 8. ...

I. to IV. ...

V. Information and advice on services and procedures offered through the Web Portal and the Mobile Application.

Operating Companies, within the first five business days of each month, must publish in two national circulation newspapers in electronic or printed form the information relative to telephone numbers that Workers may use to have access to information of the telephone attention center, the data that must be entered as applicable are the Social Security Number or their CURP, and inform the service schedule."

"Article 9. Operating Companies must develop, administer and operate the Web Portal or the Mobile Application, through which the services referred to in these general provisions and procedures will be provided to attend to Workers or their Beneficiaries, when applicable.

Administrators may define their own Web Portals or Mobile Application, providing various services and procedures to attend to Workers or their Beneficiaries, when applicable; as long as it refers to services and procedures corresponding to the Retirement Savings Systems and these are managed through the Operating Companies, prior express authorization of the Commission.

For this effect Administrators must present proposals through the models referred to in these general provisions, of those services or procedures that are required to incorporate in their Web Portal or the Mobile Application.

The Commission will have 60 business days to resolve on the authorization requests that Administrators present for the services and procedures that will be operated through their Web Portals or the Mobile Application. Said authorization will be granted for two years from the notification of the authorization, having to be updated according to the regulatory framework in force.

Operating Companies, in accordance with the technical and security criteria that for this effect are established in the Transactional Procedures Manual, must implement mechanisms through the Web Portal developed, administered and operated by the Operating Companies to carry out the following:

a) Authenticate the identity of Workers who enter the Web Portal developed, administered and operated by the Operating Companies with Authentication Factor category 2 or higher referred to in section II of Annex B of these general provisions;

b) Carry out corresponding validations in accordance with what is established in the Transactional Procedures Manual, to corroborate that the Worker can process the service in question, for which he must resort to information available in the SAR National Database and, as applicable, establish information exchange mechanisms with Administrators or Social Security Institutes to obtain data that are necessary;

c) Locate offices, branches or Specialized Unit of the Administrator based on information provided by the Worker;

d) Present in coordination with Administrators, a calendar so that the Worker generates an appointment indicating the day, time and office, branch or Specialized Unit of the Administrator in which he will attend to carry out a procedure or service, provided that so required; each Administrator will be responsible for administering the information displayed on the calendar in accordance with the

information exchange criteria established by the Operating Companies;

e) Generate and inform the Worker of the Unique Service Key for each appointment made on the Web Portal;

f) Carry out the necessary validations that allow verifying the PIN of the Worker associated with their CURP, in order for them to carry out procedures and services related to their Individual Account.

g) Carry out the necessary validations that allow the Worker:

i. Confirm their will and allow corroborating their identity in the Retirement Savings Systems, through biometric signature, the PIN or both;

ii. Activate their permanent PIN, from their temporary key, and

iii. Recover the PIN that they had generated previously to have access to digital platforms.

The foregoing in accordance with that established in the Transactional Procedures Manual.

Operating Companies must maintain auditable logs and make available to the Commission the information that is generated from the requests for services and procedures that the Worker requires through the Web Portal and the mechanisms specified in the previous paragraph.

Operating Companies must inform the Commission of the adjustments, new functionalities in the Web Portal or to the Mobile Application, no later than the immediate business day prior to their implementation."

" Article 9 bis. Administrators must respond Online and in Real Time to requests for services and procedures that Workers have required through the:

a)

Web Portal or the Mobile Application developed, administered and operated by the Operating Companies, in accordance with that established in the Transactional Procedures Manual, or

b)

Web Portal or Mobile Application developed by the Administrator itself and that transact through the Operating Companies, in accordance with that established in their Policies and Procedures Manuals.

Operating Companies and Administrators must develop reconciliation mechanisms in relation to the reception of requests for various services and procedures that Workers or their Beneficiaries carry out, through the Web Portal or the Mobile Application."

" Article 14. ... .

...

... .

Administrators, in accordance with the provisions in Annex L of these general provisions, must contact, in the following order: by telephone call, through electronic means or any other non-presential means that they establish in their Policies and Procedures Manuals, Pensioners, Workers, or where applicable their Beneficiaries who retain some resource in their Individual Account and who according to the right granted by the Social Security Institutes, have the right to dispose of the resource, in order to inform them that they may appear to make their disposition, the documents and procedures that they must carry out, as well as the means through which they may carry it out.

Contact must begin thirty business days after the Administrator receives the notification through DATAMART, for which it must make telephone contact at least three attempts at different times, two days of the week, for three consecutive weeks: contacts by electronic means and non-presential means established in the Policies and Procedures Manuals, must be at least one per week, for three weeks.

Administrators may only suspend the contact attempt and the sending of communications to the Worker Pensioner, or where applicable Beneficiaries established in the preceding paragraphs when they ascertain that the telephone number, electronic means or non-presential means that they establish in their Policies and Procedures Manuals does not exist, is incorrect, or does not belong to the person they seek to contact, as well as when they do not have data that allows them to carry out the contact."

" Article 15. ... .

...

The Commission, in exercise of its inspection and surveillance powers, may verify at any time compliance with the work programs for the attention of Workers referred to in the previous article 14, Administrators must keep their work programs and their results available to the Commission at all times."

" Article 15 bis. In the case of assigned Individual Accounts, Administrators must develop contact plans in which, at least, an attempt is made to locate Workers twice a year, for the purpose of effecting the registration of said accounts.

The referred plans must be adjusted to the internal operation policies of the Administrator and must contain auditable activities, as well as the specific actions that will be adopted for Workers, Pensioners and assigned Workers. Likewise, Administrators must keep their contact plans and their results available to the Commission."

" Article 23 ter. Administrators may implement the use of authentication models that use biometric validation elements to generate a folio that is used in substitution of the alternative authentication factor of the Unique Biometric Seal, in accordance with the specifications established in article 140 ter of these general provisions."

" Article 62 bis.- Administrators may develop biometric authentication models that substitute the Unique Biometric Seal and that allow identifying Workers when these request any service referred to in article 209 of these general provisions.

Repealed.

Repealed.

Administrators that require developing the biometric authentication models referred to in this article, must present to the Commission a request for authorization based on the specifications established in article 140 ter of these general provisions."

" Article 62 ter. Repealed."

" Article 92. ...

I. ...

II. ...

a. and b. ...

c. Evaluate at least once a year, the vulnerability to which they may be exposed in the hardware, software, systems, applications, security, information recovery, networks and any other type of information technology that they implement, due to processing or operational errors, failures in procedures, inadequate capacities and insufficiencies of the installed controls, among others. Likewise, at least once a year, they must carry out an audit, through a qualified and certified company in matters of information security by a standardization organization, on the vulnerabilities referred to in the preceding paragraph, having to report the results of the audit to the Commission no later than the last business day of the month of December of the current year, including the work programs to strengthen and minimize the detected vulnerabilities.

d. to f. ...

III. ..."

" Article 111. ... .

Operating Companies, for the due integration and updating of the information referred to in the previous paragraph, must carry out the planning and execution in a continuous and permanent manner of standardization and reconciliation processes based on the information that arises from the National Population Registry, and attributes of the Individual Accounts.

For such effects, Administrators in coordination with Operating Companies must, during the last quarter of each year, make available to the Commission the results of the standardization and reconciliation processes, based on the work plans that for such effects determine the Operating Companies and the Administrators.

The information that arises from the planning, execution and of the results must be contained in auditable logs that allow verifying the correct management and application, which must be available to the Commission at all times."

" Article 112. ... .

Repealed.

...

..."

" Article 117 bis. Operating Companies, when receiving information of procedures and services requested or of resources for their individualization in favor of some Worker whose Individual Account has been disabled, must inform the Administrators so that the corresponding management is carried out in accordance with that established in these general provisions and the Transactional Procedures Manual."

" Article 120. Administrators, no later than three business days following the date on which they have been duly notified that any of the Individual Accounts that they administer is subject to process before some judicial or administrative authority, must identify it in the attributes of the Administrator's database as well as must inform it to the Operating Companies, so that the latter can identify this characteristic in the attributes of the Individual Account in the National SAR Database as " Judicial Procedure ".

Administrators must maintain the attribute referred to in the previous paragraph until the process that generated it has concluded."

" Article 132. ...

...

Operating Companies, with the purpose of keeping the National SAR Database clean, must celebrate the legal acts that correspond with other authorities, non-governmental organizations or entities of the private sector, to obtain complementary information that they will make available to the Administrators, with the purpose of facilitating the contact of assigned Workers.

For effects of the foregoing, Operating Companies must ensure that the information that is obtained from the third parties referred to in the previous paragraph, comes from legal sources and can be obtained in the terms of the legislation on matters of personal data protection. In no case, Operating Companies may provide information of the National SAR Database to the referred third parties.

...

..."

" Article 140 bis. Administrators may implement the use of electronic models to authenticate the identity of a Worker, attorney-in-fact, tutor, curator or Beneficiary, provided that they appear to manage the services provided for in article 209 of these general provisions.

The operation of the electronic authentication models must base its use through a double electronic authentication, that operates a confrontation and comparison, Online and in Real Time, of a historical information database operated by authorized national entities, supervised and regulated by authorities of the Federal Public Administration, historical information databases operated by these, or information databases operated by autonomous constitutional bodies, against the data provided by the Worker for the processing of the services.

Administrators must ensure that the historical information databases that they use for the operation of the electronic models referred to in this article, comply with the following requirements:

A. That they are not constituted totally or partially with information coming from the National SAR Database or the databases that the Administrators have;

B. That the data that are contained in the historical information databases against which those provided by the Worker, attorney-in-fact, tutor, curator or Beneficiary are confronted and compared:

i. Have an age greater than three months in said database;

ii. Are not associated in any way with the own service requested of the Individual Account;

iii. Have their origin directly or indirectly from the integration of a file of information and documentation of the Worker;

iv. Are reliable, that is, that they are data that directly or indirectly have been provided by the Worker, attorney-in-fact, tutor, curator or Beneficiary and

v. Are verifiable, that is, that they are data that were directly or indirectly registered from a presential authentication with the Worker, attorney-in-fact, tutor, curator or Beneficiary.

C. That they are not constituted by bank accounts cataloged with level 1 or 2 in accordance with the regulation issued by the National Banking and Securities Commission and by the Bank of Mexico, and

D. That it is constituted by information that allows electronic authentication through the use of said historical information database.

In addition to the foregoing, the schemes on which the electronic authentication models are based, must comply, where applicable and as applicable, with the scheme defined in article 140 quater of these general provisions.

In case the authorized electronic authentication models referred to in this article cease to comply with the necessary requirements for their operation, Administrators may not use said electronic models until they carry out the necessary actions to be in compliance again. For such effect, Administrators must suspend the operation of the electronic models in question immediately and give notice to the Commission no later than the following business day on which the non-compliance event occurs.

Likewise, the Commission, in exercise of its supervision powers, may order the suspension of the operations of said electronic authentication models or revoke the authorization of the same when it detects that it has ceased to comply with the requirements demanded for its operation or puts at risk the information or the interests of the Workers.

Administrators must present to the Commission a corrective action program that addresses the non-compliances that motivated the suspension of the operation of the electronic authentication model, within a period of three business days counted from the date on which notice of the non-compliance was given or the order of suspension of the operation of the model was received from the Commission.

Administrators must ensure that the functioning and operation of the electronic authentication models that are authorized to them in terms of this article, is subject permanently to the regulation that is in force, as well as to the modifications that where applicable are applied to it, the foregoing with the purpose of conserving the authorization granted by the Commission, otherwise the same may be revoked.

Likewise, when Administrators decide to suspend the operation of the electronic authentication models referred to in this article, they must make it known to the Commission in writing, at least 10 business days before the suspension, indicating in a detailed manner the motives for which they will cease to use them.

Administrators that decide to operate again the suspended electronic authentication models, may do so notifying previously the Commission, at least 10 business days before their entry into operation. In case they decide to operate with a different model, they must submit it to the authorization of the Commission in accordance with that established in this article.

Administrators must ensure that the functioning and operation of the electronic authentication models and initiatives or projects that are authorized to them in terms of this article, are subject to the regulation in force in the Retirement Savings Systems."

" Article 140 ter. Administrators may implement the use of biometric authentication models that allow identifying Workers when these request any service referred to in article 209 of these general provisions.

For effects of this article, biometric authentication models are those authentication processes, Online and in Real Time that confront the biometric data provided by the Worker against official identifications, identification files and official databases operated by authorities of the Federal Public Administration, Autonomous Constitutional Bodies and authorized national entities, supervised and regulated by financial authorities of the Federal Public Administration, that allow identifying Workers, when these come to request any of the services to which article 209 of these general provisions refers.

Administrators that implement the models referred to in this article, must celebrate with the third parties referred to in the previous paragraph, the necessary confidentiality agreements so that the information of the Workers is used only for the management of the procedure that these request. Administrators will be responsible at all times for compliance with the regulations on matters of personal data protection that result applicable.

The biometric authentication models indicated in this article, must comply with the characteristics indicated in Authentication Factor category 5 of Annex B " Authentication Factors ", of these general provisions.

Operating Companies must accept the folios of the service requests issued by the biometric authentication models authorized by the Commission.

In addition to the foregoing, the schemes on which the biometric authentication models are based that where applicable are presented before the Commission for its authorization, must comply with the scheme defined in article 140 quater of these General Provisions.

Administrators must ensure that the functioning and operation of the electronic biometric authentication models and initiatives or projects that are authorized to them in terms of this article, are subject to the regulation in force in the Retirement Savings Systems."

" Article 140 quater. Administrators that require developing the electronic authentication models and biometric authentication models referred to in articles 140 bis and 140 ter previous or the initiatives or projects described in the following article 337 bis, must present to the Commission a request for authorization, which must contain at least the following:

I. Index;

II . Background;

III . Objective;

IV . Scope (Expected Results);

V . Regulatory Basis;

VI . Version Control;

VII . Model Generalities:

a. Premises;

b. Definitions;

c. Conceptual Model;

d. Flowchart;

e. Validation Matrix;

f. Obligations of the Administrator;

g. Obligations of the Operating Company;

h. Obligations of the Support Company (if applicable),

i. Security measures in the use of information (information security and personal data analysis),

j. Reporting System (logs),

k. Technical and operational documentation (feasibility), and

l. Data Model.

VIII. Implementation Plan, and

IX. Annexes (if applicable).

In the case that the model presented by the Administrators has the requirements before indicated,

the Commission will have a period no greater than 60 business days to attend the authorization requests presented by the Administrators, counted from the reception of the authorization request with the complete documentation; in case the Commission requires more information, it may require from the Administrators additional information; in this last supposition the periods to attend the authorization request will be suspended.

The authorization that where applicable the Commission issues to the proposals of electronic authentication models and biometric authentication models established in articles 140 bis and 140 ter previous and initiatives or projects indicated in the following article 337 bis, will be subject to a demonstration in pre-production environment by the Administrators. The development of the demonstration has as objective to validate the proposals of the Administrators, from the current regulation and generate evidence of the controls established in the same.

The start date of operation of the electronic authentication models, biometric authentication models, projects and initiatives, will be conditioned to the delivery to the Commission of a test certificate issued by the Operating Company or the entities involved in their case, where the viability of implementation of the proposal of the model and the acceptance of the demonstration referred to in the previous paragraph is accredited.

The authorization that where applicable the Commission issues, will have a validity of two years from when the authorization is notified, which may be renewed for equal periods, provided that the renewal request is presented by the interested Administrator at least 60 business days prior to its expiration.

While the Commission does not grant the corresponding renewal, the Administrator may not operate said model.

In case the authorized electronic authentication models and biometric authentication models referred to in articles 140 bis and 140 ter and initiatives or projects indicated in the following article 337 bis, cease to comply with the necessary requirements for their operation, Administrators may not use said models until they carry out the necessary actions to be in compliance again. For such effect, Administrators must suspend the operation of the electronic authentication models, biometric authentication models and initiatives or projects in question, immediately and give notice to the Commission no later than the following business day on which the non-compliance event occurs.

Administrators must ensure that the functioning and operation of the electronic authentication models and biometric authentication models and initiatives or projects that are authorized to them in terms of this article, are subject permanently to the regulation that is in force, as well as to the modifications that where applicable are applied to it.

Likewise, when Administrators decide to suspend the operation of the electronic authentication models and biometric authentication models referred to in articles 140 bis and 140 ter and initiatives or projects indicated in the following article 337 bis, must make it known to the Commission in writing, at least ten business days before the suspension, indicating in a detailed manner the motives for which they will cease to use them.

In case there are modifications or additions in the current regulation, Administrators must present to the Commission the update of their models or initiatives with their corresponding regulatory basis, within the 60 business days following its publication in the Official Gazette of the Federation. The update of the models and initiatives described in this paragraph, will be based on the implementation plan referred to in section VIII of this article and will not have an impact on the

"validity authorized previously by the Commission. "

" Article 141. The Administrators based on the type of operational process of the Registration shall

effect the opening of the Individual Accounts no later than two business days after the sending of the

result of the certification; in the case of those that go through the Transfer process, the opening shall

be carried out two business days before the liquidation day, in accordance with the operational

calendar defined for this purpose, provided that what is established in articles 160 and 189 of these

general provisions is not violated and in accordance with what is established in the Manual of

Transactional Procedures.

...

..."

" Article 145. The Administrators shall receive and manage the Registration when the Workers

exercise their right to choose for the first time the Administrator that operates their Individual Account or that of

minors, whether they are affiliated with some Social Security Institute or are

independent, in accordance with what is provided in the Law, the Regulation and these general provisions.

For this purpose, the Administrators shall provide the Workers with information

related to the Registration. "

" Article 145 bis. In order for the Administrators to verify and ensure the process of the Registration

of each Worker, before processing the corresponding request, the Operating Companies shall

make available to the Administrators a consultation system through which the latter may

know:

I. Name of the Worker that is found in the information that the Operating Companies receive

from the IMSS, relative to the National Insured Catalog of the IMSS;

II. That the NSS is found in the National Insured Catalog of the IMSS or if it is a special NSS

;

III. If the Worker is already registered;

IV. If the CURP of the Worker or base CURP data are different before RENAPO;

V. If the CURP is duplicated and the Administrator where it is duplicated, as well as

its pension regime;

VI. If it is in operational process and,

VII. Verifications that provide greater information, in accordance with what is established in the Manual of

Policies and Procedures on the account to be registered.

For this purpose the Retirement Advisor authorized by the Administrator may carry out the consultation referred to

in this article, for which he must provide his CURP and Biometric Signature, as well as in his

case, the NSS, CURP, the full name of the Worker and the information that for this purpose establish the

Operating Companies, in the Manual of Transactional Procedures.

The Operating Companies shall make available to the Administrators, online and in real time, the

result of the consultation carried out, as well as the type of consultation carried out, on the same day that the

same had been carried out.

The Operating Companies shall generate auditable logs of each consultation and implement the

necessary security measures, to guarantee that a consultation is generated for each Worker and that the

data and information that is made available is not manipulable. "

" Article 146. The Administrators shall ensure that they manage the Registrations of

Individual Accounts within a period not greater than five business days counted from the date of signature of the

Registration Requests and until the certification of the process.

The Administrators shall be responsible for verifying that in all Registrations that the

Workers and the Retirement Advisors carry out, including minors that they have registered, they have

an Electronic File.

The Operating Companies shall identify or associate the Electronic Files of minors

with that of the Worker who had registered them, even if they are managed in

different Administrators. "

" Article 147. Repealed. "

" Article 148. ...

I.

That the Worker has an Electronic File and that said File corresponds to the

same; to which articles 210, 210 bis, and 210 ter of these general provisions refer;

For the case of minors the File shall be formed in accordance with what is established in article

149 bis D of these general provisions.

II. a V. ..."

" Article 149 bis. The Administrators or the Operating Companies, through the Mobile Application or the

Web Portal developed, administered and operated by the Operating Companies or well, the means that

define the Administrators themselves, prior express authorization of the Commission, shall make available

to the Workers the Mobile Registration request, which shall contain at least the following information:

I. ...

II. ...

...

...

When the Administrators directly or through Support Companies or through Financial Technology Companies facilitate the Registration or Mobile Registration process on electronic devices that are not

property of the Worker, they shall record at the moment of carrying out the Mobile Registration process, a video that

contains the manifestation of the Worker in which he expresses his consent for the Registration or Mobile Registration and confirms his personal and contact data, in accordance with the characteristics established in the

Manual of Transactional Procedures, said video shall be stored by the Administrators.

Likewise, the Administrators shall keep said videos available to the Commission and implement the

necessary security measures to guarantee that the data and information that is generated is not manipulable. The models that facilitate the Registration or the Mobile Registration through Support Companies or

through Financial Technology Companies, must be authorized by the Commission. "

" Article 149 bis B. ...

I. a III. ...

...

...

...

...

The Administrators may use the Web Portal and the Mobile Application developed, administered and

operated by the Operating Companies or well, the means that define the Administrators themselves, prior

express authorization of the Commission, to make available to the Workers who register in

terms of what is established in this article, the account statement referred to in article 265 of

these general provisions. "

" Article 149 bis D. The Administrators and the Operating Companies, through the Web Portal or the

Mobile Application, or well the means that define the Administrators themselves, prior express authorization of the

Commission, where applicable, shall form the Mobile File of the Worker, which shall contain the

following data and elements:

I. a II. ...

III.

A photograph or a video of the Worker, that complies with the characteristics provided in the

Manual of Transactional Procedures, in accordance with the following:

i.

In case of being through the Mobile Application:

A digital photograph of the Worker; for the registration of minors who do not contribute to

any of the Social Security Institutes, the digital photograph will not be a mandatory requirement.

ii.

In case of being through Web Portal, or well the means that define the own

Administrators:

A video of the Worker confirming that it is his will to register in the Administrator of his

election, according to what is indicated in article 149 bis; for the registration of minors who do not

contribute to any of the Social Security Institutes, the video will not be a mandatory

requirement.

The Administrators, prior request, may consult through the Operating Companies, the video with

the will of the Worker referred to in this article. The registration, custody, administration and update

in the National SAR Database, of the consultation that the Administrators or the Commission carry out to the

Operating Companies of the referred video must operate in a centralized manner and under standards that

guarantee the quality of the images, security, integrity and confidentiality of the information of the

same, that for this purpose are established in the Manual of Transactional Procedures.

..."

" Article 150. ...

I. a II. ...

III. Folio of the Registration Request or the folio that replaces it and that is generated by the Operating Companies and the Administrators, through the Web Portal or the Mobile Application.

IV. a IX. ...

..."

" Article 160. ...

I. a VI. ...

VII. That the cell phone number entered by the Worker in the Registration Request, where applicable, that is

associated with the Web Portal or the Mobile Application, does not belong to the cell phone of another Worker

registered in the National SAR Database for at least a period of four months;

..."

" Article 161. ...

The Administrators shall inform the Workers of the result of the Registration of their

Individual Account, in accordance with what is provided in Section II, of Chapter VI, of Title Sixth, as well as of the

accounts of minors that they have registered, if applicable. "

" Article 168. ...

I. ...

II. Ensure that the Worker enters his full name, Biometric Signature and Digital Handwritten Signature, or where applicable the SAR Electronic Signature with which he manifests that he knows its content and that

it is his will to carry out the procedure, in the following documents:

a. a d. ...

...

III a IV. ...

IV bis. ...

a. ...

b. Through the validation of the Worker using the Web Portal or the Mobile Application

developed, administered and operated by the Operating Companies in accordance with what is

established in the Authentication Factors category 3 referred to in Annex B, of these

general provisions;

c. ...

d. Repealed.

i. Repealed.

ii. Repealed.

iii. Repealed.

V. a VIII. ..."

" Article 170. The Receiving Administrators, through their Retirement Advisors, shall verify

that the information registered in the Identification File of the Worker and of the minors that

he wishes to transfer, if applicable corresponds with the information provided by the Worker and this is

found duly registered or updated.

When any of the data referred to in numeral I, subsections a, b, c, d and e of article 210 following,

registered in the Identification File of the Worker or of the minors that he wishes to transfer,

do not correspond with the data of the same, the Receiving Administrators may not continue with the

Transfer procedure, until the Worker modifies or updates the data that correspond before the

Administrator that operates his Individual Account.

...

The Receiving Administrators, through their Retirement Advisors, shall verify if the

Worker requires modifying or updating the information contained in his Identification File of the

Worker or of the minor that he was transferring, and where applicable, carry out the modifications

corresponding, in accordance with what is provided in article 216 following.

When the Receiving Administrators carry out the update or modification of the information to

which article 216 following refers, the Operating Companies shall update the information of the

Workers that had been modified or updated, and that of their minors that they had registered,

where applicable, no later than the same day that they carry out the certification of the Transfer. "

" Article 173. ...

I. a II. ...

III. Folio of the Transfer Request that is generated by the Operating Companies through the

Web Portal or the Mobile Application that these develop, administer and operate or the Mobile Application;

IV.

Repealed.

V. a XI. ...

...

...

The Administrators shall privilege the use of the SAR Electronic Signature in the Transfer Requests, through the Electronic Means, being able, where applicable, to make use of the Biometric Signature of the

Worker or the Digital Handwritten Signature of the Worker. "

" Article 176. The Receiving Administrators shall ensure that the Net Yield Documents

and the Transfer Requests that they make available to the Workers comply with the requirements

provided in article 173, and in Annexes " A " , " C " and " E " of these general provisions,

are valid, personalized, as well as that the fields for the Workers and the Retirement Advisors to enter their Biometric Signature and their Digital Handwritten Signature, or where applicable the SAR Electronic Signature, the latter exclusively for the Workers, are found within the same document and in

sight of the Worker.

..."

" Article 186. The Transferring Administrators may contact the Workers who request the

Transfer of their Individual Account, in order to solely verify if it was the will of the Worker to request the

Transfer of their Individual Account or that of their registered minors, if applicable, to another

Administrator.

...

I.

Request the Worker to present the corresponding claim and sign the same, either

with his autograph signature, Biometric Signature or Digital Handwritten Signature, or where applicable the SAR

Electronic Signature, in accordance with what is established in Annex " H " ;

II a III. ...

The Retirement Advisors shall be prohibited from carrying out the actions referred to in this

article. "

" Article 189. The Operating Companies shall certify the information and elements contained in the

Transfer Requests that they receive, as well as validate the existence of the Identification File of the

Worker, of his registered minors, if applicable, and of the Retirement Advisor, prior confrontation

that they make of the same with the information contained in the National SAR Database, and shall

be responsible for the certification processes being carried out in accordance with what is provided in the Law, its

Regulation, these general provisions and the Manual of Transactional Procedures,

considering at least the following:

I. That there is an Identification File of the Worker, of his registered minors, of

if applicable, or, well, that it had been formed, in accordance with what is provided in these

general provisions;

II. a III ...

IV. Repealed.

V. a X. ...

XI. That the cell phone number registered by the Worker in the Transfer Request or, where applicable,

associated with the Web Portal developed, administered and operated by the Operating Companies or the

Mobile Application, does not belong to the cell phone of another Worker registered in the National SAR Database

in a period of four months;

XII. a XIV. ...

...

Repealed.

..."

" Article 191. ...

The Transferring Administrators shall be responsible for the veracity of the information that they send to the

Operating Companies, as well as for the balances of the Individual Accounts that they transfer, in case the

Transferring Administrator for some reason does not transfer all the resources, must carry out the

transfer of the same in the following immediate cycle of the transfer operational calendar.

In the case of Complementary Transfers, the Transferring Administrator, within a period not greater than

twenty business days after the date of receipt of resources, regardless of the origin of the Transfer,

shall transfer the resources to the Administrator that manages the account, through the Operating Companies.

In the case of Complementary Transfers of the Service Provider, in accordance with the determined

operational calendars, it must transfer the resources to the Administrator that manages the account, through

the Operating Companies.

... . "

" SECTION VI

TRANSFER THROUGH REMOTE OPERATION DEVICES. "

" Article 192 bis.- The Worker may directly request the Transfer of his Individual Account, through the Equipment and automated or telecommunication systems. The procedure of said request must

be personal.

The Administrators shall be prohibited from using their Retirement Advisors, their officials or third parties

of any nature, to carry out or manage for, or on behalf of the Worker, the request to carry

out the Transfer of their Individual Account through the remote operation computer application

implemented in the Equipment and automated or telecommunication systems referred to in this section or

well, to carry out any act that affects the personal processing of the same.

The Transferring Administrators shall make available a video or infographic through the

Operating Companies, so that the Worker can receive additional guidance on the benefits that

that Administrator provides.

For these effects, the Administrators shall notify the Commission annually on the first business

day of the month of November, the content of the videos or infographics that they will use as guidance to the holders

of the accounts that will be transferred.

The Commission, prior analysis of the content of the videos or infographics may give its no objection within a maximum period of

thirty business days, counted from the receipt of the request for no objection so that the

Administrators can make use of the same.

In case the content of the videos or infographics that they will use as guidance to the holders

of the accounts that will be transferred is modified, the Administrators shall request from the Commission the no

objection. The Commission shall have a maximum period of thirty business days, counted from the receipt

of the request to resolve the conduct. "

" Article 192 bis A.- The Administrators through the Mobile Application, the Equipment and systems

automated or telecommunication that operate the Operating Companies in terms of these

general provisions, shall make available to the Workers the Mobile Transfer request, which shall contain at least the following information:

I. a VI. ...

...

The Mobile Application, the Equipment and automated or telecommunication systems shall only show

those Administrators that have the Mobile Transfer request service enabled by the

Operating Companies. "

" Article 192 bis D.- The Administrators shall act as Transferring when the Worker, through

the Mobile Application, the Equipment and automated or telecommunication systems, in terms of what is provided

in these general provisions, requests the Transfer of his Individual Account to another

Administrator. "

" Article 192 bis E.- The Administrators shall act as Receiving when, through the Mobile Application

, the Equipment and automated or telecommunication systems, in terms of what is provided in these

general provisions, receive the request of the Worker to manage his Individual Account.

Only those that have the Mobile Application,

equipment or automated or telecommunication systems, in terms of what is provided in these

general provisions, may act as Receiving Administrators. "

" Article 192 bis F.-

...

I. That the Workers have the Identification File of the Worker with biometric enrollment

and that they use the SAR Electronic Signature;

II. a V. ..."

" Article 192 bis H.- The Receiving Administrators shall attend to the Mobile Transfer requests

that they receive through the Mobile Application, Equipment and automated or telecommunication systems operated

by the Operating Companies.

..."

" Article 192 bis K.- The Operating Companies shall enable the means through the Mobile Application, Equipment and automated or telecommunication systems, in which the Worker can carry out the

cancellation of the Mobile Transfer request, requesting the reason for cancellation.

..."

" Article 192 bis L.- The Transferring Administrators, during the period referred to in the article

previous, may provide the Workers, with information that helps them in the decision making

regarding their Individual Account, either through the same Mobile Application, equipment or systems

automated or telecommunication.

..."

" Article 192 bis M.- The Transfers that are processed through the Mobile Application, equipment or

automated or telecommunication systems,

shall be managed within the maximum period established in the

article 167 of these general provisions. "

" Article 193. When in the Registration and Transfer processes errors are detected, incorrect operations, inconsistencies or irregularities, derived from the verification processes of the

Administrators or as a result of the clarification referred to in Section II of Chapter III of Title

Sixth of these general provisions, as well as derived from the complaints presented by

the Workers or by Undue Registrations or Transfers that the Commission detects in exercise of its

supervisory powers; the Administrators shall make the return of the total balance of the

transferred Individual Account, as well as compensate the corresponding amount for concept of commissions charged

during the time that the Individual Account had been managed by said Administrator and the amount

of the yields that it would have obtained if its resources had been invested in the Investment Company that

had granted the net yields of commission highest during said time, in accordance with the

methodology established in Annex O of these general provisions.

...

..."

" Article 198. ... .

...

I. ...

I bis. The Mobile File of the Worker;

II. a V. ...

...

a. and b. ...

...

..."

" Article 208 bis. The Administrators, before they begin the management of the services referred to in the

article 209 of these general provisions, shall consult the information of the

Electronic Files of the Workers, registered in the National SAR Database, through the

use of the Biometric Signature of the Worker and of the Retirement Advisor, through the computer systems that

for such effects establish the Operating Companies, in accordance with the specifications provided in

the guidelines referred to in article 200 previous, of these general provisions. "

" Article 208 ter. The Administrators shall use the information contained in the Electronic Files of the Worker, to pre-fill the Service Requests referred to in article 209, and

identify the Workers, as well as update only the images, documents and data

in accordance with the periods provided in these provisions with the purpose of not requiring

documentation that is valid at the time of the consultation to the Workers.

The Administrators through the Operating Companies shall use mechanisms that guarantee the

integrity, security and confidentiality to pre- fill the information for the Services provided in the

article 209 and 234 of these general provisions."

Administrators must ensure that the information contained in the Electronic File of the query made to the Operating Company is not stored nor available on any device or electronic medium different from the National SAR Database.

Audit logs must be made available to the Commission to verify the correct management of the information of the consulted Electronic File, as well as the actions that were taken for the adequate update when this is processed."

Article 209. ...

I. to VI. ...

VII. Total disposition of resources;

VII bis. Partial disposition of resources;

VIII. Return of resources derived from a Partial Withdrawal due to Unemployment;

IX. Scheduled Withdrawal or Guaranteed Pension Contract, referred to in the general provisions applicable to scheduled withdrawals issued by the Commission, or

X.

Selection of transfer or permanence of resources of the sub-accounts that make up their Individual Account, among the Investment Companies operated by the Administrator in which they are registered."

Article 210. Administrators, through the Pension Advisor, must form the Worker Identification File, through the use of the Electronic Means that the Administrators define for such effect, in said formation the Administrators must use the verification models that allow certifying the authenticity of the information and personal identification.

The Worker Identification File must contain the following data and elements that are provided to them by the Workers:

I. to IV. ...

V. The Biometric Enrollment of the Worker;

VI. The Biometric Signature and the Digital Handwritten Signature of the Pension Advisor who manages the procedure, as well as those of the Worker and where applicable the SAR Electronic Signature of the latter; and,

VII. CURP Certificate, document issued by RENAPO and whose delivery and authenticity must be effected and verified by the Administrator.

..."

Article 210 bis.- For the purposes of carrying out any of the in-person services referred to in the previous article 209, Workers may carry them out through a proxy, tutor or curator or Beneficiary, in accordance with the services that result applicable in these general provisions.

I. Repealed.

II. Repealed.

When Workers choose to carry out procedures of sections I, IV, V, VI, VII, IX and X, referred to in article 209 through a proxy, the powers of this must be recorded, through a power of attorney granted before a certifying officer. The instruments that are granted abroad, must be presented legalized or apostilled and translated, where applicable, by an expert.

The deposit of the resources referred to in sections VI and VII will be made in a CLABE account either of national or foreign origin in the name of the holder of the Individual Account.

For the Proxy to manage the services corresponding to sections I, IV, V, VI, VII, IX and X of the previous article 209 on behalf of the Worker, the Administrators must verify that the proxy integrates the Electronic File of the Worker and records their Digital Handwritten Signature, likewise, they must verify that this does not have a status of Active Pension Advisor in the information system provided for in the general provisions that implement article 36, fourth paragraph of the Law.

For the tutor or curator, where applicable, to be able to manage the services provided for in sections I, IV, V, VI, VII, IX and X of the previous article 209 on behalf of the Worker, the Administrators must verify that the tutor or curator integrates the Electronic File of the Worker and records their Digital Handwritten Signature, likewise, they must verify that these do not have a status of Active Pension Advisor in the information system, provided for in the general provisions that implement article 36, fourth paragraph of the Law.

The Pension Advisor with active status, may only act as proxy, tutor or curator when acting in representation of their spouse or of the person with whom they have a concubinage relationship, as well as with those with whom they have a civil or consanguineous kinship relationship within the second degree.

...

I. and II. ...

...

Repealed."

Article 210 quater. Administrators must privilege at all times the strictly personal management of any procedure related to the Individual Account of the Workers, and for the case in which they carry out the processing referred to in the previous article 210 bis, they must implement the use of electronic models that allow them to authenticate the identity of the proxy, tutor, curator or Beneficiary, always provided that the latter is of legal age, who presents themselves to manage the services provided for in the previous article 209, using a category 3 or higher authentication factor in accordance with the provisions in article 140 bis and Annex B Authentication Factors of these general provisions.

Repealed.

Repealed.

Repealed.

Repealed.

Repealed.

Repealed.

Repealed.

Repealed.

Repealed.

Repealed."

Article 211. ...

Administrators must ensure that Workers record their Biometric Signature and their Digital Handwritten Signature, or where applicable the SAR Electronic Signature in the Worker Identification File, through the Electronic Means that the Administrators make available to them, once said File is duly completed.

..."

Article 229. Administrators must receive, attend, guide and resolve the queries, requests and complaints of the Workers, Pensioners or their Beneficiaries, related to the administration and operation of their Individual Accounts, through the means that the Administrator has made available to them.

In cases where a specific deadline is not established, Administrators must inform every fifteen calendar days to the Workers, Pensioners or Beneficiaries the status of the requested procedure and, at the appropriate time, the result of the same, using the means and mechanisms available to contact and inform.

Administrators, according to the systems that they have established for such effect, in terms of the previous article 6, must keep a record and follow-up of the queries, requests and complaints that have been requested by the Workers, Pensioners and Beneficiaries, and assign a Complaint or Service Folio, which must be provided at the time of presenting their query, request or complaints. Administrators must use said Folio to follow up and inform the Workers, Pensioners or Beneficiaries the status of the procedure and the result of the same, in accordance with the deadlines that are established in these general provisions to carry out the requested processes or procedures.

Repealed."

Article 231. ...

The Commission will make known to the general public, to the Administrators and to the Operating Companies, through the publication on its Web Page, https://www.gob.mx/consar, the following:

I. Repealed.

II.

...

..."

Article 232 . Administrators must provide for the form of compensating the Workers, Pensioners and/or Beneficiaries for non-compliance with the provision of services or operational errors in the administration of the Individual Accounts, in terms of article 18 of the Law; when the Workers, Pensioners and/or Beneficiaries, where applicable, have requested from the Administrators some service related to the administration of their Individual Account, and those procedures related to the rights of the Workers, provided for in the Law, the Social Security Laws, the Regulation and the general provisions issued by the Commission, and these have not been resolved within the deadlines established in these general provisions, for cause attributable to the Administrator and, some charge has been generated for the provision of the Individual Accounts administration service, according to article 37 of the Law.

...

..."

Article 234. Administrators must attend, determine and resolve the clarifications for the following cases:

I.

When the Worker states that they did not grant their consent to carry out the Registration or Transfer of their Individual Account;

II.

When the Electronic Files of the Workers present any inconsistency;

III.

When the Biometric Enrollment of a Worker or Pension Advisor is rejected by the Operating Company due to the identification of a possible duplicate or due to operational error;

IV.

When the Biometric Signature of a Worker or Pension Advisor does not match their Biometric Enrollment, due to the identification of changes in the quality of the fingerprints that make up the Biometric Enrollment, as well as in the enrollment images, and

V.

When the Mobile File of the Worker presents any inconsistency.

Regarding sections I and II of this article, the involved Administrators must resolve the cases that arise for clarification in a maximum period of eight business days counted from when the case for clarification was notified.

Regarding sections III, IV and V the Administrators must send the particular cases to the Operating Company for its resolution, on the next business day from when the validation response of the Biometric Elements contained in the Identification File of the Worker or of the Pension Advisor was received from the Operating Company, or well the validation response of the Biometric Signature of the Worker or of the Mobile File, as applicable; in accordance with the criteria and guidelines that for such effects are established in the Transactional Procedures Manual.

Administrators in coordination with the Operating Company, must resolve the clarification in a period no greater than three business days from the notification to the Operating Company for its resolution.

The Administrator must send the respective notification in the period indicated above on the status of the clarification request according to the means that the Worker has designated either via telephone, via email or via postal mail with certified mail.

From the above, the Administrators and the Operating Companies must keep available to the Commission the documentation stipulated in the Transactional Procedures Manual, as part of the evidence that supports the actions carried out in each of the clarifications."

Article 240 . Operating Companies must inform and notify monthly the Individual Accounts to the Administrators that present zero balance so that in coordination with these they reconcile data and information for the application of the corresponding zero balance attribute and safeguard in their databases and in the National SAR Database said account attribute.

...

..."

Article 242 bis. In the case of judicial resolutions in which it is ordered that the Worker contributing to ISSSTE changes from the Individual Accounts regime to the regime established in the Tenth Transitional Article of the ISSSTE Law, or vice versa, the Administrators, in coordination with the Operating Company, must carry out the change of regime, as well as the return of the resources that corresponds in accordance with what is established in the Transactional Procedures Manual."

Article 243 Ter A. Whoever exercises parental authority or the tutor of a minor registered in an Administrator, may request through the means made available to them, that the account of the minor, be transferred to the same Administrator to which the Worker is transferred.

Whoever exercises parental authority or the tutor, may at least, consult through the Web Portal or the Mobile Application, the balance of the accounts of the minors that they have registered."

Article 243 Ter B. The transfer of a minor's account to another Administrator, will be subject to the procedure established in the Transactional Procedures Manual and to the deadlines of the Individual Account Transfer process of their tutor."

SECTION VIII OF SELF-LINKING THROUGH THE MOBILE APPLICATION AND WEB PORTAL"

Article 243 quater. Administrators or Operating Companies, through the Web Portal and the Mobile Application may make available to Workers the Self-Linking, which must contain at least the following information:

I. ..."

Article 243 quinquies . Administrators or Operating Companies, through the Web Portal or the Mobile Application, must form the Mobile File of the Worker, which must contain the following data and elements:

I. to II. ...

III. A photograph or a video of the Worker, that comply with the characteristics provided for in the Transactional Procedures Manual, in accordance with the following:

i.

In case of being through the Mobile Application:

-A digital photograph of the Worker.

ii.

In case of being through Web Portal:

-A video of the Worker confirming that it is their will to connect with the Administrator that operates the Individual Account.

..."

Article 243 septies. ...

Administrators may use the Web Portal and the Mobile Application to make available to Workers the account statement referred to in article 265 of these general provisions."

SECTION IX OF THE NIP"

Article 243 octies . Administrators will be responsible for managing the issuance of the NIP before the Operating Companies, prior request of the Worker who must be identified and authenticated, in accordance with what is established in the Transactional Procedures Manual."

Article 243 nonies . Operating Companies will provide Administrators with the results of the following validations:

a.

That the Worker's cell phone number is not associated with another Worker.

b.

That the Worker has an Electronic File with permanent status."

Article 243 decies. Operating Companies will send Online and Real Time, a temporary key to the cell phone or to the email that the Worker has registered with the Administrator, provided that they comply with the validations of the previous article. Otherwise, the generation of the NIP will not proceed for the Worker who has requested it and must notify it Online and Real Time to the Administrator so that, in turn, it informs the Worker.

The temporary key will have a validity of 15 business days from its generation. After this period, the Operating Companies will disable the temporary key and will inform Online and Real Time to the Worker, through message to the cell phone or email that they have registered, that they must process a new temporary key with the Administrator."

Article 243 undecies . The Administrator must inform the Worker, that the temporary key that will be generated for them has a validity of 15 business days for security reasons and that in said period, they must enter the Mobile Application or well, the Web Portal in order to generate the NIP."

Article 248. Administrators must attend through personalized attention in branches or the means defined by the Administrators themselves, prior express authorization of the Commission, the requests for transfer or permanence of the resources of their Individual Account from one Investment Company to another.

For this effect, Administrators must make available to Workers, information on the requirements, deadlines and possible risks about the characteristics of the transfer to be carried out.

Administrators must attend all requests, no later than the third business day after the date on which said request for transfer or permanence of the resources was received through the branches or the means defined by the Administrators themselves, prior express authorization of the Commission in accordance with article 337 bis of these provisions.

Administrators must keep evidence, documentary support of the requests for the transfer or permanence of the resources."

Article 249. Administrators must execute and invest the resources of the Workers in the Investment Companies chosen by them, no later than the fourth business day after having received from the Workers the requests."

Article 258 . In order to keep the National SAR Database purified and updated, it will be the responsibility of the Operating Companies and the Administrators to carry out in coordination with the Social Security Institutes, either through the celebration of collaboration agreements or any other mechanism that is provided, the procedures that are necessary for the unification and separation of Individual Accounts, in accordance with the guidelines and validation criteria that the Commission establishes, which must be incorporated in the Transactional Procedures Manual.

...

...

The procedures established in this section must be carried out in a maximum period of thirty business days, counted from the day on which the corresponding request is presented before the Administrator to unify or separate an Individual Account, in terms of the following article.

In the case of information that between the involved Administrators must be exchanged for the clarification, confrontation and resolution of information, these will have a period of three business days for their resolution, counted from having received the clarification notification by any of the involved Administrators or the Operating Companies.

The period of thirty days referred to in this article will be interrupted when the Institutes require carrying out some operation regarding the Individual Accounts; said interruption together with the resumption of the corresponding procedure will be informed by the Administrators to the applicants within the period of three business days after the date on which any of these assumptions is updated."

Article 265. The account statement is the physical or digital document that the Administrators and the Service Providers must issue and send periodically to each of the Workers whether registered, assigned or pending assignment, to the domicile or email address or through electronic means that for such effects have been indicated by the Workers in accordance with articles 149 bis b, 192 bis, 209 and 243 septies of these general provisions.

The account statements must be sent within the twenty business days following the cut-off date referred to in article 47 of the Regulation, without prejudice to them being available to the same in any of the branches of the Administrator, Mobile Application, Web Portal or on their Web Pages.

In case that the Worker has so requested, the account statement must be sent or notified through electronic means for its consultation and download that for such effect has been indicated before the Administrator, prior authorization of the Commission, in accordance with the provisions of article 337 bis of these general provisions. In case that the Worker requests the Administrator to receive their account statement only by email or other electronic means, it will not be necessary that this be sent to the Worker's domicile.

Administrators must generate the policies of the issuance and sending of the account statements and establish them in their Policies and Procedures Manual, to ensure conservation in auditable logs that allow verifying, at least, the place, date and time of the transaction and as well as that information that serves as evidence for the determination of compliance with the non-face-to-face procedure.

Said logs must be kept available to the Commission at all times, for their supervision."

Article 266. The Commission will notify the Administrators and Service Providers the formats to prepare the account statements of the Workers, as well as the information that said formats must contain.

...

...

...

Administrators must obtain from the Web Page of the Commission, https://www.gob.mx/consar, the information of the Net Performance Indicator for Transfers updated to the sending period that corresponds, so that the same is presented in the account statement that is sent quadrimestrally to the Worker.

..."

Article 269. ...

...

...

...

Likewise, Administrators must provide Workers with means of consultation of their account statement and of the balance of their Individual Account, through Electronic Means, Web Portal, Mobile Application or of their Web Page, establishing the security required to guarantee the confidentiality of the information."

Article 271. When an Individual Account is identified with the attribute of "pensioned account" and the disposition and/or transfer of corresponding resources is carried out, Administrators must issue and send to the domicile or email account of the pensioned Worker that they have provided for such effect, or well make it available through Electronic Means, Web Portal, Mobile Application or of their Web Page, a final account statement, within the ten business days following the closing of the month in which the disposition and/or transfer has been carried out.

...

Repealed.

..."

Article 272. Repealed."

Article 274. Workers may at any time request an account statement, carry out queries on the balance of the Individual Account, request certifications of the balance of the sub-accounts or carry out corrections to the information contained in the account statement, the detail of movements of their Individual Account, request the last quadrimestral account statement issued, as well as request general information or clarifications related to their Individual Accounts.

Administrators must make available to Workers, in all their offices or branches and, where applicable, through Electronic Means, the format through which these may request from the Administrator a quadrimestral account statement of their Individual Account, general information or clarifications related to their Individual Account and deliver an acknowledgment of receipt to the Worker.

Administrators must deliver the documents, information or clarifications on the Individual Accounts referred to in this article, in a maximum period of five business days counted from the day on which the Worker requests the document, information or corresponding clarification, being able to the

Administrators deliver them at the time of the request, either at their branches, send them to the email address, make them available to the Worker on their Website, or by the means that for such effect the Administrator has available prior authorization of the Worker, or else, at the domicile of the Worker that the latter has provided for such effect.

... .

... .

... . "

" Article 274 bis. The Operating Companies must provide the Administrators with the service, through which, using the Mobile Application and the Web Portal, they can notify the Worker about the reception of the account statement, the contributions, dispositions and withdrawals made to the Individual Account of the Worker, as well as the result of the services requested by the Worker to the Administrator, in the same way, let them deliver messages about the importance of making Voluntary Savings, information about the requirements, deadlines and others related to the Retirement Savings Systems. In the same way the service must allow incorporating interactive applications to boost Voluntary Savings. Said notifications and messages must be adapted to the formats that for such effect the Commission notifies them . "

" Article 274 ter. The Operating Companies must provide the Administrators with the service, through which, using the Mobile Application and the Web Portal, they can send invitations to the Worker to make Voluntary Savings, carry out the Registration of their Individual Account when it concerns Non-Affiliated Workers. They must also provide balance consultation services of the Individual Account, update or modification of the Worker's personal data and interactive applications designed by the Administrators. "

" Article 274 quater. The Operating Companies must adapt the services referred to in Articles 274 bis and 274 ter according to the guidelines that the Administrators and the Operating Companies must follow for the use and operation of the Mobile Application and the Web Portal, established in Annex B section III of these general provisions. "

" Article 277. ... I. and II. ... The Administrators must issue and send a summary of movements according to the format that for such effect the Commission determines, to the domicile or to the email of the Workers, or else make it available through Electronic Means, Web Portal, Mobile Application or their Website, according to corresponds, in the same period in which the certificate referred to in section I above is delivered, as follows: a and b. ... The document issued by the Administrators to inform the opening of the Individual Account must contain current information on the Net Performance Indicator for Transfers of the different Administrators. For this effect, the Administrators must use the information available on the Website of the Commission, https://www.gob.mx/consar. "

" Article 337 bis. The Administrators may present before the Commission for its authorization, the models, projects or initiatives that, through innovation and the use of technology, stimulate Voluntary Savings, the registration of Individual Accounts, the expansion of service coverage, or any other mechanism that facilitates access to them and to the exercise of the rights of the Workers related with their Individual Account, that the Administrators must provide them, in which they may have the participation of companies, Support Companies, Non-Governmental Organizations (NGOs), entities governmental, international organisms or natural persons with business activity. For the purposes of the above the Administrators must send to the Commission their request for authorization, where it describes its specifications based on the structure described in article 140 quater, including, the authentication factor that is intended to be used, which may not be less than an Authentication factor category 3, described in Annex B of these general provisions. ... The Commission, prior analysis of the operational viability, technical and security of the information and of personal data and information referred to in article 140 quater, may authorize the models, projects or initiatives, within a maximum period of thirty business days, counted from the reception of the request for authorization with the complete documentation. ... ... ... ... The Administrators must ensure that the functioning and operation of the models, projects or initiatives, that are authorized to them in terms of this article, are subject to the regulations in force in the Retirement Savings Systems. When there are modifications or additions in these provisions, the Administrators must present to the Commission their models with the update sixty business days after said additions or modifications. The previously authorized models will not have an impact on the effective date. In case the Administrators do not carry out the update referred to in the previous paragraph, the models, projects or initiatives that had been authorized to them, may no longer be used. "

" Article 337 ter. The Operating Companies must implement in the Web Portal the service of generation of payment references for the deposit of Voluntary Savings contributions, in accordance with the following characteristics: I. and II. ... III. The service must validate the information received and where applicable generate the payment reference that covers the deposit or deposits that were requested by the Worker. IV. and V. ... ..."

" Article 342 . The Operating Companies must send to the Administrators, Online and Real Time, the Voluntary Savings requests that the Workers have made through the Portal or Mobile Application, as well as the status of the same. The Administrators must formalize with multiple banking institutions a collaboration agreement that allows the Workers to make the direct debit of their contributions charged to a bank account or through the service channels that this offers. For the purposes of the provisions in the first paragraph of this article, the Operating Companies must enable the Mobile Application and the Web Portal developed, administered and operated by the Operating Companies so that the Workers can make a Voluntary Savings request online for the deposit of Voluntary Savings contributions to the Administrator that operates their Individual Account charged to a bank account. The Operating Companies must enable the Mobile Application and the Web Portal developed, administered and operated by the Operating Companies so that the Workers can locate the commercial networks where they can make Voluntary Contributions and generate a bar code associated with their CURP. "

" Article 343. It is repealed. "

" Article 386. The Administrators must provide due attention to the Workers, Pensioners and Beneficiaries to carry out the procedures whose purpose is the disposition or transfer of the resources that they administer in the Individual Accounts. The Administrators will be responsible for the veracity of the balances and consistency in the information they provide to the Social Security and Housing Institutes. The Administrators or the Operating Companies must compensate the Workers, Pensioners and Beneficiaries the damages caused, when the information they provide to the Social Security Institutes contains errors or inconsistencies attributable to each of these that impact negatively the balance of the Individual Account, or else when they stop providing them due attention or omit carrying out the disposition or transfer of resources processes referred to in this chapter. The above, without prejudice to the sanctions that result applicable, according to the provisions in the Law. "

" Article 387. The Administrators must cooperate with the Social Security Institutes in the pension procedures and partial withdrawals of the Individual Account that the Workers and the Beneficiaries carry out, according to the procedures and mechanisms that are established in the collaboration agreements or any other instrument that for such effect is celebrated with the Social Security Institutes. The Administrators must receive and validate the information of the Workers and of the Beneficiaries that have the right to it according to the Social Security Laws establish, in order to manage the pension procedures, the delivery of resources that in terms of the legal provisions can be made and of partial withdrawals of the Individual Account before the corresponding Social Security Institute, using the tools and computer systems that for such effect they provide or in their case determine said Institutes. During the management of the pension procedures and partial withdrawals of the Individual Account, the Administrators must request the corresponding information for the resource disposition procedure; including the CLABE of the bank account in the name of the Worker or, in its case, of the Beneficiary in which, in its case, the resources to which they are entitled must be deposited. The Administrators, in the management of the pension procedures and partial withdrawals of the Individual Account that they carry out in accordance with the provisions of this article, may not intervene in the attributes of the Social Security Institutes for the issuance and granting of the pensions and rights for partial withdrawals of the Individual Account; therefore, said Administrators must give account solely of the acts they carry out regarding the pension procedures and partial withdrawals of the Individual Account. The Administrators in terms of the legal provisions, must deliver in a single exhibition to the Beneficiaries expressly designated by the Worker in the fund administration contracts for retirement or in the formats that the Administrators make available to the Worker for the update of the designated beneficiaries, the resources of the Individual Account that correspond, when these do not have another specific purpose. The above will only be applicable to the resources contributed in terms of the Social Security Law and to the Beneficiaries designated in terms of the second paragraph of article 193 of that law, and according to the pension regime that corresponds to them. When the Individual Account still has resources whose purpose is specific, but there are no Legal Beneficiaries, the Administrator in question may deliver them to the Beneficiaries designated in terms of the second paragraph of article 193 of the Social Security Law, provided there is a resolution issued by a competent authority that resolves on the non-existence of Legal Beneficiaries in terms of the applicable regulations. The Administrators must operate the resources coming from the Individual Accounts whose destination is the payment to Workers, Pensioners or Beneficiaries by reason of a resource disposition, in accounts that do not generate interest for the permanence of the balance for the Administrator or third parties. In case interest is generated, these must be integrated into the Individual Account of the Workers. The Administrators, for those Individual Accounts that present balance and have made a resource disposition request derived from a right associated in the DATA MART must carry out the liquidation of the resources in accordance with the rights matrix or the instrument that each one of the Social Security Institutes determines and deposit them in the bank account that provided the Worker, Pensioner or Beneficiary in the referred resource disposition request. "

" Article 387 bis. For the procedures of resource disposition by assistance for marriage expenses, Partial Withdrawal for Unemployment and those of resource disposition referred to in article 406 of these general provisions, the Operating Companies and the Administrators through the Web Portal and the Mobile Application, must coordinate to keep enabled a calendar so that the Worker generates an appointment with the characteristics that establish the General Provisions regarding service to the users of the Retirement Savings Systems, being subject to the following: a) The Operating Companies must make available to the Workers and their Beneficiaries as the case may be, through the Web Portal and the Mobile Application , the service of request of resource disposition according to the established in article 9 of these provisions of general character, as well as provide information to the Worker on the Web Portal and the Mobile Application regarding the service in question and the necessary requirements to be able to continue with the procedure, specifying the documentation that, in its case, must be presented before the Administrator; b) The Operating Companies must notify the Administrators the information of the appointments generated for the resource disposition no later than the next business day of having been created in the Web Portal or Mobile Application, according to the information exchange criteria provided for in the Transactional Procedures Manual; c) The Administrators, in coordination with the Operating Companies, must carry out the corresponding validations to confirm that the Worker can carry out the procedure, as well as to verify the veracity of the balances and consistency in the information they provide to the Social Security Institutes; the above based on the information that is in the file of the Worker, as well as with that complementary that they obtain from the Operating Companies; In any case, the Worker, in accordance with the established in article 210 bis of these provisions, may go to any office, branch or Specialized Unit of the Administrator in question, to request the resource disposition by assistance for marriage expenses, Partial Withdrawal for Unemployment and those of resource disposition referred to in article 406 of these provisions of general character, for which the Administrators must support the Worker or their Beneficiaries to carry out the request, according to the guidelines that for such effect the Operating Company establishes in the Transactional Procedures Manual. "

" Article 387 ter. The Administrators must cooperate with the Social Security Institutes in the procedures that, in accordance with articles 302 of the Social Security Law and 251 of the Law of the Institute of Security and Social Services for State Workers and 37 of the Law of the Institute of the National Fund of Housing for Workers, they carry out, according to the procedures and mechanisms that are established in the collaboration agreements or any other instrument, that for such effect is celebrated with the Social Security Institutes. The Administrators, must give account of the acts they carry out regarding the movements of disposition and reimbursement that are made in the Individual Account, regarding the management of the procedures that the Social Security Institutes or the Workers, Pensioners or their Beneficiaries carry out, of conformity with the provisions of this article, according to the established in the Manual of Transactional Procedures. "

" Article 397. The Administrators, must classify the Individual Accounts with pension attribute and identify the Pension Regime and, in its case, the Pension Modality that corresponds to each Worker, Pensioner or to their Beneficiaries. The Administrators must send the corresponding information to the Operating Companies the same day in which they carry out the classification referred to in the previous paragraph. The Operating Companies, the same day in which they receive the information, must register and update in the National SAR Database the Pension Regime and the Pension Modality that corresponds to each Worker, Pensioner or to their Beneficiaries. ... ..."

" Article 406. The Workers, Pensioners or their Beneficiaries, in their case, that have the right to dispose of the resources of one or more of the subaccounts of the Individual Account may: I. Go to any branch of the Administrator that operates the Individual Account in question or, in its case, to INFONAVIT, to request the withdrawal of the corresponding resources, mediante the presentation of the request format that the Administrator or INFONAVIT make available to them; or else, treating itself of resource disposition of the housing subaccount, through the Electronic Means that INFONAVIT makes available to them, or II. Request directly to the Administrator, through the corresponding Social Security Institute, or of the dependencies of the Federal Government that the Secretariat determines, that the resources are transferred in the CLABE account in the name of the Worker or, in its case, of the Beneficiary. When it treats of information provided by the Social Security Institutes or the dependencies of the Federal Government that the Secretariat determines, the responsibility of the Administrator is limited to transfer the corresponding resources, prior confirmation that the holder of the CLABE account provided, corresponds with that of the Individual Account or, in its case, of the Beneficiary, in terms of the information that they provide them the Social Security Institutes or the dependencies of the Federal Government that the Secretariat determines. The Administrators will make available exclusively to the Worker, the Mobile Application, the Portal Web or any other non-presential electronic means that the Administrators make available to the Worker in accordance with article 337 bis of these provisions, included the SAR Electronic Signature, so that, through these, can request remotely the disposition of the resources of one or more subaccounts of the Individual Account, when thus corresponds to it in accordance with the applicable legal provisions. The Administrators, will be responsible for verifying the identity of the holder that requests the disposition of resources of the Individual Accounts. The non-presential electronic means that the Administrator employs for the effects referred to in the previous paragraph must have the authentication factor category 3 or superior in terms of Annex B of these provisions, in addition to having the authorization of the Commission. The remote request of disposition of the resources of one or more subaccounts of the Individual Account that the Worker makes through the Mobile Application, the Web Portal or any other non-presential electronic means that the Administrators make available to the Worker in accordance with the article 337 bis of these provisions, must be subject to the established in the Social Security Laws and to the rights matrix or the instrument that each one of the Social Security Institutes determines, according corresponds to the type of withdrawal in question. The procedure of the remote request of disposition of the resources of one or more subaccounts of the Individual Account that the Worker makes through the Mobile Application, the Web Portal or any other non-presential electronic means that the Administrators make available to the Worker in accordance with the article 337 bis of these provisions, will contain the same requirements that refer the articles relative to resource disposition of these general provisions. The Administrators or, in its case, the Social Security Institutes and the dependencies of the Federal Government that the Secretariat determines, will be responsible for verifying the identity of the Holder or Beneficiary that requests the disposition of resources of the Individual Accounts, as well as verifying that the Worker or Beneficiary is holder of the CLABE account in which the resources will be deposited. "

" Article 406 bis. The resources of the Retirement Insurance and of the housing subaccount 92, accumulated in the Individual Account during the pension regime of the Social Security Law 73, as well as those corresponding to the Voluntary Savings Subaccount and to the Housing Subaccount referred to the Law of the ISSSTE in force until December 31, 2007 according to corresponds, must be deposited by the Administrators in the CLABE account provided by the Social Security Institutes or of the dependencies of the Federal Government that the Secretariat determines, provided it is confirmed previously that the holder of the CLABE account in which the resources will be deposited, corresponds with that of the Individual Account or, in its case, of the Beneficiary, without being necessary the direct request of this, the use of means electronics and its Biometric Signature, provided the following requirements are met: I. to VI. ..."

" Article 406 ter. ... a). to e). ... ... ... I. ... II. ... i . to iii. ... iv. They must conserve the evidence of the contact with the record of the recordings of the telephone calls made to contact and confirm the will of the Worker. ... ... ... ..."

" Article 407. The Administrators that receive a request for resource disposition must verify the same day of its reception that the Individual Account in question complies with the requirements for the withdrawal of the resources determined by the applicable legal provisions, in the same way they must confirm that the holder of the CLABE account provided, corresponds with that of the Individual Account, or in its case, the Beneficiary, prior to remit the request to the Operating Companies. Likewise, for the procedure of return of resources of the housing subaccount, the Administrators must provide the Worker a document of conformity of return of balance of the housing subaccount, in which they indicate the data of identification of the Worker and the amount of the resources to return, so that the Worker signs it in case of being in agreement. The Administrators will be responsible for verifying that the data that are recorded in said document correspond to those of the Worker and coincide with the data of the documents presented. ..."

" Article 410. The Administrators, for all the assumptions established by the Social Security Laws, only must transfer an amount less or equal, according to the case, to the Constitutive Amount of the Associated Subaccounts. In the same way they must, deposit in the CLABE account provided by the Social Security Institutes or of the dependencies of the Federal Government that the Secretariat determines or the housing institutes,

provided that it is previously confirmed that the holder of the CLABE account where the resources will be deposited corresponds to that of the Individual Account or, as the case may be, the Beneficiary, the retirement and housing resources that had been requested by the Worker or, as the case may be, the Beneficiary, through the Social Security Institutes or the dependencies of the Federal Government that the Secretariat or the housing institutes determine.

When the deposit of resources cannot be carried out due to causes attributable to the CLABE account data, bank rejections or of any kind, the Administrators must contact the Worker, Pensioner or Beneficiary so that they correct the situation and be able to make the corresponding deposit. In this case, if after thirty calendar days the deposit of resources has not been able to be made, the Administrator must reinvest the resources in the origin sub-accounts within a maximum period of three business days thereafter."

" Article 413. The Administrators, for the case of dispositions, must carry out the delivery of the amount that make up the balance of the Associated Sub-accounts and make available to the Worker, no later than the third business day after the deadline established for sending the resource disposition requests to the Operating Company, the resources that by law they are entitled to receive, as well as in their case request from the housing institutes the deposit of the corresponding housing resources with the CLABE account that for this purpose the Worker has indicated.

When the deposit of resources cannot be carried out due to causes attributable to the CLABE account data or bank rejections, the Administrators must contact the Worker, Pensioner or Beneficiary so that they correct the situation and be able to make the corresponding deposit. In this case, if after thirty calendar days the deposit of resources has not been able to be made, the Administrator must reinvest the resources in the origin sub-accounts within a maximum period of three business days thereafter."

" Article 419. If the Worker, in accordance with the provisions of article 210 bis of these provisions, decides to go to an Administrator, they must present the documentation accompanying the disposition request in original, so that the Administrators carry out the corresponding digitization and it is kept in the Worker's file and in their case, the appointment generated through the Web Portal for the disposition of resources for marriage expense assistance or Partial Retirement due to Unemployment.

If the request for disposition of resources for marriage expense assistance for Workers affiliated with the IMSS, as well as in the case of Partial Retirement due to Unemployment, is presented by Electronic Means, there must be an electronic certificate that accredits the presentation of the request and the deposit in favor of the Worker in the CLABE account that the Worker had designated for this purpose, and of which the Administrator must verify previously, that it corresponds to the Holder of the Individual Account. Said certificates must be kept available to the Commission.

When the deposit of resources cannot be carried out due to causes attributable to the CLABE account data or bank rejections, the Administrators must contact the Worker, Pensioner or Beneficiary so that they correct the situation and be able to make the corresponding deposit.

In this case, if after thirty calendar days the deposit of resources has not been able to be made, the Administrator must reinvest the resources in the origin sub-accounts within a maximum period of three business days thereafter."

" Article 423. ...

I. to III. ...

IV. In their case, the data of the Worker's CLABE account in which the deposit of resources must be made, and

V. The Biometric Signature for in-person requests. For the case of non-in-person ones, the Biometric Signature or, as the case may be, the SAR Electronic Signature.

...

Additionally, the Administrators must obtain from the Worker for in-person requests, the Unique Service Key corresponding to the appointment for the resource disposition request that the Worker has obtained through the Web Portal or the Mobile Application or else, the Unique Service Key requested by the Administrator to attend to the Worker, based on the guidelines, criteria and characteristics that for this purpose the Operating Companies determine in the Transactional Procedures Manual."

" Article 424. ...

I. That the Worker has made the request for Partial Retirement due to Unemployment or marriage assistance, in accordance with the provisions of article 9 and 419 of these general provisions.

II. to V. ...

VI. ...

a. Ensure that the request for Partial Retirement due to Unemployment or marriage assistance that is presented through the Web Portal, the Mobile Application or any other non-in-person Electronic Means to the Workers adheres to the guidelines that the Commission determines for this effect.

b. ...

VII. ...

The Request for Partial Retirement due to Unemployment or marriage assistance, may be carried out through the Mobile Application, the Web Portal or any other non-in-person electronic means that the Administrator makes available to the Worker, prior authorization from the Commission, in accordance with the provisions of article 337 bis of these general provisions.

Repealed.

Repealed."

" Article 429. ...

...

In the case of Workers who opted for the benefit provided for in article 191 section II of the Social Security Law, the Administrators must settle and make available to the Workers the corresponding resources, once the Worker requests the corresponding payment, either in person, through the Mobile Application, or the Web Portal, in accordance with the provisions of the previous article 427, according to the instructions that for this purpose they had indicated in the Partial Retirement due to Unemployment request.

...

..."

" Article 437. ...

I.

That the Worker has an Identification File and in their case for the request that is made through the Web Portal or Mobile Application, the Worker must have the Mobile File;

II.

Ensure that the Worker states in the Voluntary Savings disposition request:

a. That they know its content;

b. The CLABE account data for the deposit, and

c. That it is their will to carry out the procedure, for which they must record their full name, their Biometric Signature and Digital Handwritten Signature or in their case, the SAR Electronic Signature according to the means through which the service procedure is requested.

III. Repealed.

IV. ...

The non-in-person mechanisms that the Administrators implement in their case to effect the withdrawal of resources from the Individual Account, in accordance with the specifications established in article 337 bis of these general provisions.

Repealed.

i. Repealed.

ii. Repealed.

iii. Repealed.

iv. Repealed.

v. Repealed.

Repealed.

Repealed.

Repealed.

Repealed.

Repealed.

..."

" Article 439. The Administrators must make available the requested resources no later than the fifth business day following counted from the disposition request of the corresponding Voluntary Savings sub-account, provided that it is admissible, in accordance with the provisions of the Policies and Procedures Manual, and must inform the Worker, by one of the contact means that the holder has designated for this effect on the same day that they are available.

When the deposit of resources cannot be carried out due to causes attributable to the CLABE account data or bank rejections, the Administrators must contact the Worker, Pensioner or Beneficiary so that they correct the situation and be able to make the corresponding deposit. In this case, if after thirty calendar days the deposit of resources has not been able to be made, the Administrator must reinvest the resources in the origin sub-accounts within a maximum period of three business days thereafter."

" Article 471. The Authorized Users of the Commission must sign the Digital Documents where the administrative acts referred to in the previous article 22 are recorded, through the Enveloping option established in the User Manual of the WebSecBM System of the Bank of Mexico, referred to in Annex " N " of these general provisions. In the case of administrative acts with joint signatures in terms of article 28 of the Internal Regulations of the Commission, the Enveloping may be carried out indistinctly by any of the officials who sign the administrative act.

...

...

In the case of administrative acts with joint signatures in terms of the Internal Regulations of the Commission, the respective Digital Document must contain the Digital Seals of all the officials who sign it."

" ANNEX B

AUTHENTICATION FACTORS

...

I. ...

II. Authentication factor category 2: It is composed of information that only the Worker knows, such as passwords, which they enter through an Electronic Means. The Authentication Factors that are used must comply with the following characteristics:

a. to c. ...

The Administrators must allow the Worker to change their passwords and any other static authentication information, when the latter so requires.

For the operation of the Web Portal, the Operating Companies must implement the use of Authentication Factor category 2, to guarantee access to the services that are specified in these general provisions and in the Transactional Procedures Manual;

III. ...

IV. ...

V. Authentication factor category 5: It is composed of the Biometric Signature and Digitized Handwritten Signature, or in their case the SAR Electronic Signature of the Worker, in their case, which must contemplate the following elements:

a) That the Biometric Signature and Digitized Handwritten Signature, or in their case the SAR Electronic Signature is collected Online and in Real Time.

b) ...

...

...

... .

VI. Authentication factor category 6: It is composed of the Personal Identification Number (PIN) of the Worker and a dynamic password that they enter through an Electronic Means.

..."

ANNEX D

CATALOGS OF INFORMATION AND PERSONAL IDENTIFICATION IN THE RETIREMENT SAVINGS SYSTEMS

...

SECTION B

CATALOG OF PROOF OF ADDRESS

...

I. to V. ...

The Administrators must adhere to the technical criteria and quality standards that for this effect the Operating Companies determine taking as a basis the National Postal Code Catalog published by the Mexican Postal Service on a weekly basis, so that the data of the addresses and proofs are registered in the National SAR Database in an integral manner and keeping relation with them.

The Operating Companies must establish the technical criteria and quality standards for the conformation, modification or update of the data and of the proof of address taking as a basis the National Postal Code Catalog published by the Mexican Postal Service on a weekly basis.

SECTION C

CATALOG OF OCCUPATION

The Administrators must take as a basis the " Mexican Classification of Occupations (CMO) " published by the National Institute of Statistics and Geography and Informatics, as well as the updates to it that the Commission establishes for statistical purposes. The update or modification to said catalog must be considered in the updates or modifications that the Administrators make to the formats they use.

SECTION D

CATALOG OF ECONOMIC ACTIVITIES

The Administrators must take as a basis the " Classification of Economic Activities of the National Employment Survey (CAE-ENE) " published by the National Institute of Statistics and Geography and Informatics, as well as the updates to it that the Commission establishes for statistical purposes. The update or modification to said catalog must be considered in the updates or modifications that the Administrators make to the formats they use.

SECTION E

CATALOG OF LEVEL OF STUDIES

The Administrators must take as a basis the " Career Coding Catalog " published by the National Institute of Statistics and Geography and Informatics, as well as the updates to it that the Commission establishes for statistical purposes. The update or modification to said catalog must be considered in the updates or modifications that the Administrators make to the formats they use.

SECTION F

CHARACTERISTICS OF THE PHOTOGRAPH

...

I. and II. ...

The Administrators must ensure that the photographs of the Workers do not have an age greater than five years and comply with the following criteria:

I. to VII. ...

...

...

In the case of the Mobile File, the Operating Companies must establish the characteristics and define the technical criteria and quality standards for the conformation of the photograph of the Mobile File, in accordance with the characteristics of the photograph provided for in the Transactional Procedures Manual, as well as provide the Administrators with the information to determine the identity of the holder, based on the official identification and inform if it complies with the ages provided for in this annex.

ANNEX L

CONTACT OF WORKERS AND PENSIONERS THROUGH TELEPHONE CALLS OR HOME VISITS

A. When the Administrators attempt to contact the Workers or Pensioners through telephone calls, these must observe the following:

I. Ensure that the telephone number to contact the Worker or Pensioner, whether fixed and/or cellular, is not in any of the following assumptions:

a. to e. ...

For the case of the Registration and Transfer processes, when the telephone number to contact the Worker or Pensioner, recorded in the respective request is in any of the previous assumptions, the Administrator may not continue with the management of Registration or Transfer of the Individual Account.

II. If it is the Worker or Pensioner who answers the call, they must authenticate the identity of the Worker and confirm that the Registration or Transfer Request was the will of the Worker.

If the will of the Worker or Pensioner is not confirmed, the Administrator may not continue with the management of the Registration or Transfer of the Individual Account.

III. If another person different from the Worker or Pensioner answers the call, the Administrator must:

a) Confirm if they know the Worker or Pensioner who requested the Registration or Transfer, and

b). ...

IV. ...

The Administrators must follow best practices regarding methods to contact Workers and Pensioners.

B. When the Administrators attempt to contact the Workers or Pensioners through home visits, these must observe the following:

I. Ensure that the address to contact the Worker or Pensioner is not in any of the following assumptions:

a.

and b. ...

...

...

II. If the Worker or Pensioner is the one who answers at the address, they must authenticate the identity of the Worker or Pensioner and confirm that the Registration or Transfer Request was the will of the Worker.

If the will of the Worker or Pensioner is not confirmed, the Administrator may not continue with the management of the Registration or Transfer of the Individual Account;

III. If another person different from the Worker or Pensioner answers at the address, the Administrator must:

a) Confirm if they know the Worker or Pensioner who requested the Registration or Transfer, and

b). ...

IV. ...

..."

TRANSITORY ARTICLES

FIRST ARTICLE. These modifications and additions to the General Provisions on matters of operations of the Retirement Savings Systems, shall enter into force on the business day following their publication in the Official Gazette of the Federation, with the exception of the following:

I.

Shall enter into force at 30 business days from their publication in the Official Gazette of the Federation:

a.

The modifications, additions and repealing effects as corresponds to articles 1, sections XXVIII bis, LXI ter, CVII ter; 8, section V; 9, with the exception of its subsections f) and g); 14; 23 ter; 62 bis; 62 ter; 140 ter, 140 quater; 149 bis; 149 bis B; 149 bis D; 150; 173 section IV; 243 quinquies, first paragraph, section III, subsection ii; 243 octies, 243 nonies; 248; 258 first paragraph; 265 second, third and fourth paragraphs; 269; 274 bis; 274 ter; 274 quater; 277 second paragraph; 337 bis; 337 ter, first paragraph; 342; 343; 424, subsection a of section VI, as well as the second, third and fourth paragraphs; 429; 437, second, third with its subsections i to v, fourth, fifth, sixth, seventh and eighth paragraphs and Annex D, section B second and third paragraphs.

II.

Shall enter into force at 60 calendar days from their publication in the Official Gazette of the Federation:

a.

The modifications, additions and repealing effects as corresponds to 145 bis; 146; 173 section III; 191 second and third paragraphs; 210, first paragraph; 210 bis, 387; and 439, first paragraph.

III.

Shall enter into force at 60 business days from their publication in the Official Gazette of the Federation:

b.

The modifications, additions and repealing effects as corresponds to articles 1 section LXXI; 132; 140 bis; 168; 189; 266; 271; 272, and 274.

IV.

Shall enter into force at 120 business days from their publication in the Official Gazette of the Federation:

a.

The modifications, additions and repealing effects as corresponds to articles 1 sections XXXIV bis, LXVI bis, LXXIII, CI bis; 9, subsections f) and g); 9 bis; 15 bis; 117 bis; 120; 160 section VII; 173 last paragraph; 176; 192 bis F section I, 210 sections VI and VII; 240; 242 bis; 243 Ter A, last paragraph; 243 decies; 243 undecies; 258 fourth and fifth paragraphs; 406, section II and sixth paragraph; 406 bis first paragraph; 407; 410, first and second paragraphs; 413, first paragraph; 419 first and second paragraph; 423, sections IV and V and 437, sections I and II subsections a, b and c.

V.

Shall enter into force at 180 business days from their publication in the Official Gazette of the Federation:

a.

The modifications, additions and repealing effects as corresponds of articles 1 sections LX and CLX Ter; 170; 186; 191 fourth paragraph, 198; 208 bis; 208 ter; 211; 234 third, fourth, fifth and sixth paragraphs; 243 Ter A. first paragraph 249; 387 bis, first paragraph and subsection b); 406, second, third, fourth and fifth paragraphs; 410, third paragraph; 413, second paragraph; 419, last paragraph, 423, last paragraph; 439, second paragraph and Annex B section VI.

VI.

Regarding the modifications and additions to article 192 bis, the Administrators must notify the Commission for the first time of the videos or infographics referred to in that article on the first business day of November 2023.

SECOND ARTICLE. The authentication models that had been authorized in terms of articles 23 ter, 62 bis; 140 bis; 210 quater and 337 bis prior to the entry into force of articles 140 bis, 140 ter, 140 quater and 337 bis of these modifications and additions, shall be in force during the period for which they were authorized, and must be renewed in their time in accordance with the provisions of these modifications and additions of the general provisions on matters of operations of retirement savings systems.

For the case of authentication models whose validity ends between the date of publication of these modifications and additions and the entry into force of articles 140 bis, 140 ter, 140 quater and 337 bis, they may continue operating provided that the Administrators request the renewal of the model in the new terms during that period, and must present an operational transition program from the previous model to the model that is authorized.

Regarding electronic and authentication models different from those referred to in the previous paragraphs and those authorized in accordance with article 437 in its part that is repealed, the Administrators must present a transition program and request its renewal in the terms of these modifications and additions within a period of 30 business days counted from their publication in the Official Gazette of the Federation, otherwise, they must cease operating at the end of that period. The future operation of the Administrators' models that present their renewal request in the terms of this paragraph, will be subject to the authorization that may be granted to them.

THIRD ARTICLE. With the entry into force of these modifications and additions, all those provisions that contravene these are abrogated.

Mexico City, July 28, 2023 .- The President of the National Commission of the Retirement Savings System, Mtro. Julio César Cervantes Parra .- Signature.

In the document you are viewing there may be text, characters or objects that are not displayed correctly due to the conversion to HTML format, so we recommend always taking as reference the digitized image of the DOF or the PDF file of the edition. The content, form and scope of the published documents, are strict responsibility of their issuer.