PRUDENTIAL PROVISIONS FOR PARTICIPANTS IN THE DERIVATIVES CONTRACTS MARKET

Published in the Official Gazette of the Federation on December 31, 2015.

The National Banking and Securities Commission, based on the provisions of articles 4, fractions II, XXXVI and XXXVIII, 6 and 16, fraction I of the Law of the National Banking and Securities Commission, as well as the Thirty-Ninth of the "Rules to which participants in the derivatives contracts market shall be subject" published in the Official Gazette of the Federation on December 31, 1996, and having previously heard the opinion of the Secretariat of Finance and Public Credit and the Bank of Mexico, and

CONSIDERING

That on May 15, 2014, the "Resolution modifying the Rules to which participants in the derivatives contracts market shall be subject" was published in the Official Gazette of the Federation in order to provide greater transparency and order to the derivatives market, including the establishment of measures to strengthen the regulation of standardized derivatives contracts, as well as a regulatory and control scheme for over-the-counter derivatives contracts;

That the aforementioned modifications resulted from international commitments assumed by Mexico within the framework of the G-20 to, among other things, establish rules so that all over-the-counter derivatives contracts that by their characteristics can be considered as standardized, must be traded on derivatives exchanges or electronic trading platforms, as well as cleared and settled through central counterparties;

That additionally, the aforementioned modifications had the object of foreseeing greater standardization of derivative operations, so it is indispensable to issue new prudential provisions for participants in the derivatives contracts market, in order to have a secondary framework that specifically collects the new principles contained in the aforementioned Rules, and

That on the other hand, it is deemed convenient to establish a series of measures that participants in the derivatives contracts market must implement in order to ensure the continuity of their critical operations in contingency situations that hinder or disable the carrying out of their operations and the provision of their services, as well as incorporating the rules relating to the identification of possible sources of risk of said contingencies, the establishment of viable strategies to respond to them, considering the lessons learned from emergency situations in Mexico and other countries, has resolved to issue the following:

PRUDENTIAL PROVISIONS FOR PARTICIPANTS IN THE DERIVATIVES CONTRACTS MARKET

INDEX

PRELIMINARY PROVISIONS

ON EXCHANGES

ON OPERATORS

ON CLEARING HOUSES

ON CLEARING MEMBERS

GENERAL PROVISIONS

PRELIMINARY PROVISIONS

FIRST. In addition to the definitions contained in the Rules, for the purposes of these Provisions, the following shall be understood in singular or plural:

I. Commission, the National Banking and Securities Commission.

II. Operational Contingency, any event that hinders or disables an Exchange, Clearing House, Operator or Clearing Member from providing the services provided for in the Rules or carrying out the necessary processes for their operation.

III. Provisions, these Provisions.

IV. Independent Members, persons of recognized prestige in financial matters who do not fall under any of the circumstances referred to in the Fourth of these Provisions.

V. Business Continuity Plan, the business recovery plan to ensure the continuity of the provision of services by the Exchange, Clearing House, Operator or Clearing Member referred to in the Fourth, subsection h), second paragraph and Seventeenth, subsection f) item 4 of the Rules, respectively, which include the set of strategies, procedures and actions that allow operational continuity in the provision of services or in the carrying out of processes by Exchanges or Clearing Houses, in the face of Operational Contingencies, or their timely restoration, as well as the mitigation of the effects resulting from said Operational Contingencies.

VI. Rules, the Rules to which participants in the Derivatives Contracts Market shall be subject, published in the Official Gazette of the Federation on December 31, 1996 and their respective modifications or those that replace them.

SECOND. These Provisions aim to establish the prudential regulation to which the operations of Exchanges, Clearing Houses, Operators and Clearing Members in the Derivatives Contracts Market shall be subject.

Likewise, the transmission and routing of orders for the operation of Derivatives Contracts listed on Recognized Foreign Derivatives Markets with which the Exchange has entered into an Agreement in accordance with what is provided in the Rules is regulated, excluding the execution of the operation.

THIRD. Commercial legislation, banking and commercial usages, and the Civil Code for the Federal District and the Federal Code of Civil Procedure shall apply supplementarily to matters not provided for in these Provisions.

FOURTH. Independent Members shall not fall under any of the following circumstances:

I. Serve as relevant executives, employees, or, where applicable, commissioners of Exchanges, Operators, Clearing Houses or Clearing Members or of the legal entities that make up the business group or consortium to which the aforementioned societies belong. The aforementioned limitation shall be applicable to those natural persons who have held such positions during the twelve months immediately preceding the date of appointment.

II. Be natural persons who have significant influence or command power in Exchanges or Operators or in any of the legal entities that make up the business group or consortium to which such societies belong.

III. Be partners who are part of the group of persons that maintains control of Exchanges or Operators.

IV. Be clients, service providers, suppliers, debtors, creditors, partners, directors or employees of a company that is an important client, service provider, supplier, debtor or creditor of Exchanges, Operators, Clearing Houses or Clearing Members.

It is considered for the effect of what is stated in the previous paragraph that a client, service provider or supplier is important when sales to the society or trust represent more than ten percent of the total sales of the client, service provider or supplier, during the twelve months prior to the date of appointment. Likewise, it is considered that a debtor or creditor is important when the amount of the credit is greater than fifteen percent of the assets of the society or trust itself or of the persons cited in the previous paragraph.

V. Have kinship by blood, affinity or civil law up to the fourth degree, as well as spouses, concubines and concubines, of any of the natural persons referred to in fractions I to IV of this provision.

For the purposes of these Provisions, consortium, control, group of persons, business group, significant influence or command power shall be understood as provided in article 2, fractions II, III, IX, X, XI and XX, respectively, of the Securities Market Law.

ON EXCHANGES

FIFTH. Exchanges, in achieving their purpose and in order to promote market competitiveness and price formation, shall issue rules to which Operators, Clearing Members in their capacity as Operators, Floor Operators and other persons intervening in Derivatives Contracts listed on the Exchange itself provided for in the Rules or in these Provisions shall be subject, and shall implement procedures to safeguard the rights of Clients.

SIXTH. The bylaws of Exchanges shall establish, among others, clauses relating to:

I. The rights and obligations of the partners of the Exchange.

II. The integration of the board of directors in which it is provided that:

a) The number of members representing the partners of the Exchange does not exceed fifty percent of the designated directors, the remaining appointments falling on Independent Members.

b) That the appointments of directors fall on persons who meet the requirements referred to in the Seventh and Eighth of these Provisions.

III. The integration of committees in which it is indicated:

a) Their respective functions and responsibilities.

b) That the person designated as responsible before the Exchange for each of the committees must report to the board of directors periodically their activities, or when events or acts of such significance arise that, in their judgment, warrant it.

c) That their members must have knowledge in the function they perform and have not been convicted by a final judgment for a property crime.

d) That their members must abstain from participating in any deliberation or resolution when they have conflicts of interest, including those cases in which disciplinary processes are heard or in the determination of a sanction.

IV. The dismissal from the position of director or committee member for absence from more than two sessions of the board of directors or committee, respectively, without justified cause.

V. The determination of a special quorum, as well as resolutions by the affirmative vote of two-thirds of the total number of directors, when it comes to the application of sanctions considered serious in terms of their internal regulations, including the case of suspension of operations of Operators, Clearing Members and Clients, or the decision on matters of significance for the Exchange and the market in general.

VI. The powers and obligations of the regulatory controller.

SEVENTH. The appointment of directors, committee members, general manager, executives holding positions with the hierarchy immediately below that of the latter, regulatory controller, commissioner and independent external auditor of Exchanges, must fall on persons who demonstrate technical quality, honorability and satisfactory credit history, extensive knowledge and experience in financial or administrative matters, as well as meet at least the requirements provided in the following provision, adjusting for this, where appropriate, to the verification procedure of these, in accordance with what is stated in the Ninth provision.

EIGHTH. The appointment of directors, general manager, executives holding positions with the hierarchy immediately below that of the latter and the regulatory controller, must fall on persons who meet the following requirements:

I. Be residents in national territory in terms of what is provided by the Federal Tax Code;

II. Have provided at least five years of their services in high-level decision-making positions, whose performance requires knowledge and experience in financial and administrative matters;

III. Not fall under any of the following impediments:

a) Have a pending lawsuit with the Exchange in question;

b) Have been convicted by an irrevocable judgment for a property crime, disqualified from exercising commerce or from holding a job, position or commission in public service, or in the Mexican financial system;

c) Have been declared bankrupt or in bankruptcy proceedings, without having been rehabilitated;

d) Perform or exercise inspection, surveillance and regulation functions of the Exchange, and

e) Regarding Independent Members, participate in the capital or equity of Operators, Clearing Members or financial entities that participate in the capital or equity of the latter, hold positions, jobs or commissions in any of them, except in the case that they do so as independent directors in any of the aforementioned financial entities.

IV. Not have conflicts of interest or an interest opposed to that of the Exchange.

Additionally, regarding the regulatory controller, the respective appointment must fall on a person who also has recognized prestige in legal and financial matters and does not participate in the capital or equity of Operators, Clearing Members, Clearing Houses or financial entities that invest in the capital or equity of the latter, nor hold positions, jobs or commissions in any of them, nor be part of the board of directors or technical committee respectively.

The appointment of the commissioner and independent external auditor is subject to what is provided in fractions I, III and IV of this provision.

NINTH. Exchanges must verify that the persons appointed as directors, general manager, executives with the hierarchy immediately below that of the latter and regulatory controller comply, prior to the start of their management, with the requirements stated in the Seventh and Eighth provisions. The Commission may establish the criteria through which the files accrediting compliance with what is stated in this provision must be integrated, as well as for the integration of the supporting documentation relative.

In any case, the persons mentioned in the previous paragraph must declare:

I. That they do not fall under any of the circumstances referred to in subsections III and IV of the Eighth provision, and

II. That they are up to date with their credit obligations of any kind.

The Exchange must inform the Commission of the appointments of directors, general manager, executives with the hierarchy immediately below that of the latter and regulatory controller, within five business days following their appointment, expressly stating that they meet the applicable requirements.

TENTH. The board of directors shall be responsible for:

I. Presenting to the ratification of the shareholders' meeting, its approval regarding the admission requests of new partners of the Exchanges, as well as determining the subscription price of the shares of the Exchange.

II. Authorizing and suspending the registration in the register of Operators and Clearing Members in their capacity as Operators, notifying such situation to the Commission no later than the next business day after the respective agreements are taken.

III. Setting the tariffs, fees or commissions that the Exchange will charge for the services it provides.

IV. Establishing the committees it deems necessary for the best performance of the Exchange's functions, in accordance with what is established in subsection b) of the Fifth of the Rules.

V. Issuing the internal regulations of the Exchange.

VI. Ordering audits of Operators and Clearing Members, the latter only in their capacity as Operators.

VII. Imposing sanctions for violations of the rules issued by the Exchange.

The adoption of measures and the imposition of sanctions referred to in the previous fraction VII may be delegated to the executives and committees of the Exchange, considering in the case of sanctions the nature of the infringement or the amount of conventional penalties.

ELEVENTH. The obligations of the regulatory controller are:

I. To monitor that the Rules, these Provisions, the self-regulation rules issued by the Exchange in which they serve as regulatory controller, as well as the other provisions issued by the Authorities applicable to the market, are observed in the celebration of operations carried out in the Exchange in question.

II. For the case of non-compliance detected in the exercise of their functions, supervise that procedures are established for their resolution.

III. Propose to the board of directors modifications to the self-regulation rules issued by the Exchange, in order to establish, among others, measures to prevent conflicts of interest and avoid the improper use of information.

IV. Report to the Commission monthly on the fulfillment of their obligations, as well as immediately on those conducts or operations that may presumably constitute violations of the Rules and these Provisions and of which they have knowledge in the exercise of their functions.

V. Attend the sessions of the board of directors participating with voice but without vote.

The regulatory controller and the persons under their charge shall not carry out activities of the Exchange whose supervision is entrusted to them.

The regulatory controller will report to the board of directors and will be responsible for the non-compliance of any of its obligations and may be sanctioned in accordance with what is provided in the internal regulations of the Exchange.

TWELFTH. Exchanges must have the following:

I. Derivatives Contracts trading systems listed on the Exchange that allow Operators and Clearing Members in their capacity as Operators equal conditions in access to electronic systems, as well as to information on positions, events carried out and market information in general. These systems must have pre-transactional controls that prevent the registration of erroneous positions.

II. System referred to in the Fifth subsection j) of the Rules, capable of capturing in an orderly and complete manner the information of each transaction, in which the Operator, Clearing Member, date and time of the position and its agreement, price, volume of the transaction, class and type of Derivatives Contract, as well as that generated by operations coming from Global Accounts, can be identified.

III. Monitoring and review systems of the operations carried out daily that allow detecting infringements in the procedures for agreement, receipt of orders and assignment of operations.

IV. Information systems that at the beginning of each session disseminate the closing price of the previous business day, as well as the number of Open Contracts of each Derivatives Contract, real-time information of operations and positions originated in the auction session, identifying the type of Derivatives Contract, maturity date, market price and, where applicable, exercise price, and information on the volume of daily transactions and historical data related to the operation of the different Derivatives Contracts.

V. Mechanisms that allow it to verify the minimum capital that Operators must maintain.

VI. Code of conduct applicable to the personnel of the Exchange, Operators, Clearing Members in their capacity as Operators and Floor Operators.

The personnel of Operators, Clearing Members in their capacity as Operators and the Floor Operators themselves are obliged to demonstrate that they know what is provided in the code of conduct referred to in this fraction.

THIRTEENTH. Exchanges must implement a Business Continuity Plan that considers at least the following:

I. Prior to the development of the Business Continuity Plan, a business impact analysis must be carried out that:

a) Includes all the processes necessary for the provision of services that it provides as an Exchange in terms of the Rules, identifying those considered critical for the continuity of operations.

b) Determines the minimum resources (human, logistical, material, technological infrastructure and any other nature) necessary to maintain and restore services and processes in the event of an Operational Contingency, as well as at the end of it.

c) Elaborate relevant scenarios relating to possible Operational Contingencies, considering, among others, the following events:

i. Natural and environmental disasters.

ii. Infectious diseases.

iii. Cyberattacks or attacks on computer activity.

iv. Sabotage.

v. Terrorism.

vi. Interruptions in energy supply.

vii. Failures or unavailability in technological infrastructure (application functionality, telecommunications, information processing and networks).

viii. Unavailability of human, material or technical resources.

ix. Interruptions occurring in services provided by third parties.

d) Estimate the quantitative and qualitative impacts of Operational Contingencies, based on the scenarios defined for each process and through methodologies authorized by the board of directors of the Exchanges.

e) Define the recovery priority for each of the processes.

f) Determine the recovery time objective (known as RTO, by its initials in English), for each of the processes related to its obligation to provide the facilities, mechanisms and procedures appropriate to celebrate Derivatives Contracts listed on the Exchange, considering the quantitative and qualitative impacts for each scenario provided for in the Business Continuity Plan, in accordance with the methodologies established for this purpose.

The recovery time objective of the processes referred to in the previous paragraph, and which have been classified as critical in terms of subsection a) above, shall not be greater than thirty minutes counted from the time the Exchange in question identifies the Operational Contingency, being obliged to contemplate the provisions within its reach to comply with said recovery time objective.

g) Establish the recovery point objective (known as RPO, by its initials in English), understood as the maximum tolerable data loss for each of the processes, considering that the information of those operations already celebrated cannot be lost in any scenario, and that the status of each operation celebrated at the moment the Operational Contingency occurred must be known in a timely manner.

h) Identify and evaluate risks related to operational processes and data processing and transmission services contracted with third parties, as well as those related to custody and safeguarding of information of the Exchanges or their Clients.

i) Determine risks derived from the geographic location of the main data processing centers and operation of the processes identified as critical in accordance with subsection a) of this fraction, to avoid that the alternative data processing and operation centers are exposed to the same risks as the main ones.

j) Establish alternative sites for information processing, as well as operation, which must allow operating at the moment it is required, and must not be subject to the same risks as the primary site.

II. In the elaboration of the Business Continuity Plan, Exchanges must consider the following:

a) The General Manager shall be responsible for:

i. Preparing the Business Continuity Plan.

ii. Implementing, continuously updating, and disseminating the plan within the Stock Exchanges. To this effect, they must establish a training program responsive to staff participation in the event of an Operational Contingency, as well as in the development of the plan itself.

iii. Designing and implementing a communication policy regarding the verification of Operational Contingencies, which must be part of the Business Continuity Plan. This policy must provide for timely communication with their Clients, members, or the general public, with Clearing Houses, and with recognized foreign derivatives markets with which they have entered into an Agreement, and, where applicable, with participants in recognized foreign derivatives markets provided for in said Agreements, with the different administrative and business units within the Stock Exchanges, as well as with the Commission and other competent authorities depending on the nature of the contingency involved.

iv. Making necessary arrangements to inform the Commission and the Bank of Mexico of any Operational Contingencies that occur in any of their systems or public service channels and result in a suspension of market trading sessions. In all cases, the aforementioned notice must be issued within sixty (60) minutes following the identification of the start of the Operational Contingency, through any means of communication. In the notice referred to in this subsection, at least the date and time of the start of the Operational Contingency, an indication of whether it is ongoing or has concluded, its duration, and a description of the recorded event must be stated. Furthermore, the General Manager must send to the Commission, within a period not exceeding fifteen (15) natural days following the conclusion of the Operational Contingency, a description of said contingency, an analysis of the causes that motivated it, the qualitative and quantitative impact caused, the affected processes, systems, and channels, as well as an indication of the actions to be implemented to minimize the impact or damage in similar subsequent situations.

v. Ensuring that the functioning of the Business Continuity Plan is subjected to effectiveness tests at least once a year and made known to the personnel. Likewise, they must review and, where applicable, update, at least once a year according to what is determined by the Board of Directors or as a result of the effectiveness tests, the Business Continuity Plan.

vi. Informing the Board of Directors and the Commission of the results of the effectiveness tests and the evaluation of the scope of the Business Continuity Plan, as well as its adequate dissemination among relevant areas and the identification, if any, of necessary adjustments for its update and strengthening. Such report must be made at least once a year or earlier if relevant results are detected.

vii. In all cases, for the performance of the responsibilities referred to in this provision, the General Manager may be assisted by the personnel they determine, in which case they must notify the Commission within a period not exceeding five (5) business days from their appointment, maintaining at all times adequate segregation of functions to avoid conflicts of interest.

b) The Business Continuity Plan and its modifications shall be submitted for approval by the Board of Directors.

c) The Stock Exchanges must have a methodology to estimate the quantitative and qualitative impacts of Operational Contingencies, for use in the impact analysis referred to in subsection I, paragraph d) of this provision. Said methodology must be approved by the Board of Directors.

III. In the preparation of the Business Continuity Plan, the Stock Exchanges must incorporate the following strategies:

a) Prevention, which will include at least the determination, based on the business impact analysis, of actions and procedures related to:

i. Reducing the vulnerability of the Stock Exchanges' processes and services against Operational Contingencies.

ii. The availability of human, financial, material, technical, and technological infrastructure resources necessary to act promptly in the face of an Operational Contingency.

iii. The establishment of a testing program for the functioning and sufficiency of the Business Continuity Plan, which contemplates its update at least annually, or earlier if there is a significant change in the technological infrastructure, processes, products and services, or internal organization of the Stock Exchanges, and includes the evaluation of all stages and components of the Business Continuity Plan.

iv. The training program regarding the Business Continuity Plan for involved personnel.

v. A communication policy referred to in subsection II, paragraph a), sub-subsection iii of this provision, which must address all moments of Operational Contingencies, from their occurrence and containment until resolution and evaluation, taking into account the nature of said contingency and the different recipients of communications.

vi. Procedures for recording, attending to, monitoring, and disseminating to relevant personnel the findings, incidents, or observations resulting from tests conducted on the Business Continuity Plan or the execution of the plan itself in the event an Operational Contingency occurred.

b) Contingency, which will include the definition of authorized response actions and procedures to:

i. Identify the nature of Operational Contingencies affecting the Stock Exchanges' processes.

ii. Contain the effects of Operational Contingencies on processes and favor the restoration of operations to required functioning levels, based on what is established in subsections f) and g) of the previous subsection I.

iii. Ensure operational continuity, equal conditions for conducting transactions, equal dissemination of market information, and equal availability for market participants to consult transaction and position information.

c) Restoration, which will include the definition of actions and procedures so that the Stock Exchanges' services and processes return to minimum service levels and eventually to normality, including mechanisms for updating and reconciling information, observing the standards established in subsections f) and g) of the previous subsection I.

d) Evaluation, which will include the collection and analysis of relevant information regarding the development of the Operational Contingency and the actions and procedures followed for its prevention, containment, and restoration, in order to make necessary adjustments to the Business Continuity Plan, if applicable.

When defining the different actions and procedures referred to in this subsection, the Stock Exchanges must always clearly determine the responsible personnel and provide for their replacement or substitution in case the incumbents are unable to carry out what the Business Continuity Plan establishes.

FOURTEENTH.- When contracting third parties to perform an operational process or to administer databases and computer systems necessary for providing services offered as a Stock Exchange under the Rules, the Stock Exchanges must establish the following controls:

I. That the third parties contracted reside in countries whose domestic law provides protection for personal data, safeguarding its confidentiality, or that the countries of residence have signed international agreements with Mexico on this matter or on the exchange of information between supervisory bodies.

II. Maintain in their main offices located in the United Mexican States, at least the documentation and information relating to evaluations, audit results, and performance reports of their suppliers. Likewise, when the Commission requires it, they must provide such documentation in Spanish.

III. Have the approval of the Board of Directors, stating in the respective agreement the following aspects:

a) That contracting the services or commissions referred to in this provision does not jeopardize the proper compliance with the provisions applicable to the Stock Exchange.

b) That the third party's business practices are consistent with those of the Stock Exchange's operation.

c) That there would be no impact on the financial stability or operational continuity of the Stock Exchange due to geographical distance and, where applicable, the language used in providing the service.

FIFTEENTH.- For each service contracted, the Stock Exchanges must keep available to the Commission the following:

I. A report specifying the operational processes or database and computer system administration of the Stock Exchanges that are subject to the services to be contracted, considering the criteria and procedures for selecting the third party, as well as the following aspects:

a) Redundancy schemes or alternative point-to-point telecommunications mechanisms that allow for communication links that minimize the risk of interruption in the telecommunications service.

b) Continuity strategy in the computer services provided to the Stock Exchanges that enable the processing and operation of systems in the event of contingencies, failures, or interruptions in telecommunications or central computer equipment and others involved in the information processing service for transactions or services.

c) Mechanisms to establish and monitor quality in information services, as well as system and application response times.

d) Technical support scheme to solve problems and incidents, independent of, where applicable, differences in time zones and business days.

e) Measures to ensure the encrypted point-to-point transmission of transactions and security elements or controls at each node involved in sending and receiving data.

f) Establishment of the Security Officer's functions regarding the administration and authorization of accesses by the third party. Such accesses must correspond to the need to know the information according to the documented functions of the position. Likewise, the Security Officer must always have records of all personnel having access to information related to the Stock Exchange's operations.

g) Scheme under which the access log to information by authorized third-party personnel will be maintained in an office of the contracting Stock Exchange.

h) Policies and procedures regarding the conduct of internal or external audits on the third party's computing center infrastructure, controls, and operation related to the production environment for the Stock Exchange, at least once every two years to evaluate compliance with what is mentioned in this provision.

i) Access mechanisms to the technological environment, including information, databases, and security configurations, from the Stock Exchange's facilities within national territory.

j) Mechanisms that allow the Stock Exchange to maintain at its facilities detailed records of all transactions and balances current at the daily close of the different services supported by the service contracted with the third party, as well as their accounting records. Such records must be kept in a format that allows their consultation and use even when the contracted service by the third party is not available.

II. The respective service provision contract, or some other document stating the unconditional acceptance by the service provider to:

a) Receive home visits by the Stock Exchange's external auditor, the Commission, or third parties designated by the Commission itself.

b) Accept the conduct of audits by the Stock Exchange, regarding the services subject to said contract, to verify compliance with the provisions applicable to the Stock Exchanges.

c) Deliver, upon request of the Stock Exchange, to the Stock Exchange's own external auditor or a third party designated by it, books, systems, records, manuals, and documents in general related to the provision of the service in question. Likewise, it will allow access to the responsible personnel and their offices and facilities in general related to the provision of the service.

d) Inform the Stock Exchange at least thirty (30) natural days in advance regarding any reform to its corporate purpose or internal organization that could affect the provision of the contracted service.

e) Where applicable, maintain confidentiality regarding information related to services that third parties conclude with Clients, as well as regarding the latter themselves.

SIXTEENTH.- The systems referred to in Fourteenth Provision must comply with the requirements indicated in Sixty-Fifth Provision of these Provisions, as well as meet the following:

I. Contain strict security measures for accessing the database, considering at least the following:

a) User authentication mechanisms that ensure access only to persons expressly authorized for this purpose, including adequate considerations for users with higher privileges derived from their database administration functions.

b) Information encryption mechanisms when transmitted.

c) Robust composition of passwords and access keys, as well as controls in the storage and use of user authentication factors, both internal and external.

d) Control of unattended sessions, as well as simultaneous sessions with the same user identifier.

e) Physical security mechanisms applicable to the infrastructure for storing, processing, and transmitting information.

f) Monitoring mechanisms for accesses to databases.

II. Ensure continuity in the capture and registration of information, as well as its update and backup.

III. Allow detecting the alteration or falsification of transaction records of Operators and Clearing Members.

SEVENTEENTH.- The Stock Exchanges' internal regulations must contain, among others, rules regarding:

I. The requirements and procedures for admitting Stock Exchange members, registering Operators and Clearing Members as Operators in the registry referred to in subsection II of the Tenth Provision of these Provisions, as well as the causes for which said Operators and Clearing Members may be temporarily or permanently suspended in their capacity as Operators.

II. The trading mechanics of Derivative Contracts listed on the Stock Exchange, as well as the terms, conditions, and forms of conducting transactions.

III. Registration and use of information generated and processed by the Stock Exchange and the terms under which it will be provided to the public.

IV. Guidelines to certify the technical capacity of the personnel of Operators and Clearing Members in their capacity as Operators, who intervene in conducted transactions, including any other determined by the Stock Exchange.

V. The circumstances under which the quotation of Derivative Contracts listed on the Stock Exchange will be suspended.

VI. Procedures to resolve conflicts arising from transactions conducted by Operators and Clearing Members in their capacity as Operators with their Clients.

VII. Procedures to present and resolve complaints or reports from market participants regarding the conduct of Derivative Contract transactions listed on the Stock Exchange.

VIII. Guidelines to carry out surveillance and audit programs for Operators and Clearing Members, the latter in their capacity as Operators.

IX. Policies and guidelines for charging tariffs, fees, or commissions for services provided by the Stock Exchange.

EIGHTEENTH.- The Stock Exchanges will supervise the activities of Operators, Clearing Members in their capacity as Operators, and Clients, regarding the conduct of transactions with Derivative Contracts listed on the Stock Exchange.

To carry out the supervision of the activities of Operators, Clearing Members in their capacity as Operators, and Clients, the Stock Exchanges must prepare, in accordance with the guidelines referred to in subsection VIII of the previous provision, through a committee, a continuous and systematic action program with the purpose that the Rules, these Provisions, and self-regulation norms issued by them are properly observed.

For the purposes of the above, permanent review of transactions conducted through the Stock Exchange's operational trading systems, observation of areas where transactions are conducted, audit of records and systems, and analysis of information from Operators, Clearing Members in their capacity as Operators, and Clients must be considered.

NINETEENTH.- The Stock Exchanges must include in their internal regulations the norms regulating the conduct of Operators, Clearing Members in their capacity as Operators, and Floor Traders, which must ensure that the exercise of their activities is carried out honestly and diligently, in order to protect public interests and market integrity, without prejudice to the fact that such norms may also apply to Clients regarding the conduct of transactions with Derivative Contracts listed on the Stock Exchange. To this effect, the Stock Exchange will consider as serious offenses, among others, the acts and omissions indicated below:

I. When Operators receive funds for the application of Contributions, and they use them for purposes other than those established in the Rules.

II. Acting with fraud or bad faith in the negotiation of Derivative Contracts listed on the Stock Exchange.

III. Intentional disclosure of false, inaccurate, or misleading information relative to the Derivative Contract listed on the Stock Exchange that affects its price, as well as the concealment of relevant facts that could influence the cited price.

IV. Performing acts that attempt to manipulate or manipulate the price of any Underlying Asset or any Derivative Contract listed on the Stock Exchange.

V. Improper use of privileged information to conduct Derivative Contracts listed on the Stock Exchange, whose quotation could be influenced by such information, while it has the indicated character, for the benefit of oneself or third parties.

VI. Omission or alteration of records of conducted transactions, as well as the registration of transactions that were not carried out.

VII. Execution of Client orders that were not specifically authorized.

VIII. Failing to appear or behaving falsely before the Board of Directors of the Stock Exchange itself or before any of its committees during an investigation, as well as failing to present the information requested for this purpose.

IX. Allowing transactions to be conducted through the Stock Exchange's electronic trading system by personnel who do not have the corresponding accreditation.

X. Conducting transactions that do not conform to sound market usages and practices.

XI. Executing transactions off-exchange.

XII. Trading for one's own account in which competitive positions are not maintained and equitable treatment is not afforded to Clients.

XIII. Performing any act detrimental to the Stock Exchange and the market in general.

For the purposes of subsection XI of this provision, transactions with Derivative Contracts listed on recognized foreign derivatives markets will not be considered off-exchange transactions, provided that the Stock Exchange has entered into an Agreement, and whose orders are transmitted by Operators or Clearing Members.

TWENTIETH.- The Stock Exchanges must guarantee the right to be heard of the affected party, as well as comply with the essential formalities of any procedure, in the application of sanctions for infringements of their own norms, consigning the form and terms for observance in their internal regulations.

In any case, the sanctions determined must be proportional to the severity of the infraction committed, as provided in the internal regulations.

Exchanges must report to the Commission on the commission of serious infractions of the rules they issue no later than the next business day after the corresponding sanction is notified.

TWENTY-FIRST.- The rules applicable to the registration, use, and disclosure of the information generated and processed by Exchanges must describe, in strict chronological order, all events that occur in the electronic trading system.

TWENTY-SECOND.- Exchanges must send daily to Operators and Clearing Members, in their capacity as Operators, confirmations of Derivatives Contracts executed in the electronic trading system.

TWENTY-THIRD.- Exchanges will adjudicate disputes arising from the contracting of services or operations between Operators or, where applicable, Clearing Members in their capacity as Operators, with their Clients, when in the claims procedure presented by a Client who trades on the Exchange, it is requested that the Exchange act as a conciliator, for which a conciliation meeting will be called.

In the event that no conciliation is reached in the conciliation meeting held for this purpose, or due to the Client's absence who trades on the Exchange, this procedure will be exhausted, and the rights of the parties remain intact to exercise them in the competent courts.

In the conciliation meeting, the parties will be urged to conciliate their interests, and if this is not possible, the Exchange will invite them to voluntarily and by mutual agreement designate one of the arbitrators proposed by the Exchange to resolve their dispute, leaving it to the parties' choice whether the arbitral proceeding is in amicable composition or in strict legal arbitration.

ON OPERATORS

TWENTY-FOURTH.- Operators must request their registration in the register of operators and clearing members of the Exchange, once they have met the requirements established for this purpose by the Exchange's internal regulations.

For the case of Operators who manage Global Accounts and do not have the status of a financial entity, one of the requirements referred to in the preceding paragraph must be the obligation to deliver to the Exchange a manual containing the minimum measures and procedures that such Operators must observe to prevent, detect, and report acts, omissions, or operations that could favor, assist, aid, or cooperate in any manner for the commission of the crime provided for in Article 139 Quater of the Federal Penal Code, or that may fall under the circumstances of Article 400 Bis of the same legal instrument. Such measures and procedures must be appropriate, insofar as applicable, to the general provisions issued in this matter by the Ministry of Finance and Public Credit, directed to stock brokerage houses.

TWENTY-FIFTH.- The Operator may directly execute Derivatives Contracts listed on the Exchange in the Exchange's electronic trading system.

The Operator who executes Operations on behalf of Clients must sign a commercial commission contract with a Clearing Member, stipulating, among other aspects, that they will be a commission agent of the Clearing Member for the purposes of settling Derivatives Contracts listed on the Exchange, without prejudice to including, where applicable, the provisions of the Twenty-Fourth, last paragraph, and the Twenty-Sixth, subsections a) and b) of the Rules.

Additionally, Operators who intend to transmit orders on their own behalf or on behalf of their Clients for the execution of operations with Derivatives Contracts listed on recognized Foreign Derivatives Markets, in terms of the Rules, must comply with the access requirements to the order routing system established by the internal regulations of the Exchange of which they are members.

Operators may perform all necessary acts for the contracting of services required for the execution of orders in recognized Foreign Derivatives Markets.

TWENTY-SIXTH.- Operators must have a system for receiving, recording, and executing orders and assigning buy or sell operations, unless they exclusively perform Operations on their own behalf or act or participate exclusively as Market Makers.

The order receiving, recording, and executing system and operation assignment system must have an operational program for account segregation, which allows clearly identifying orders related to operations on own account, operations on behalf of Clients, as well as registering, immediately, the client's name or account, sequential folio according to receipt, exact date and time of receipt of each order, and the time of sending to the Exchange's electronic trading system, without such data being alterable for any reason or circumstance.

Additionally, Operators must maintain a record of the orders they transmit to execute operations with Derivatives Contracts listed on recognized Foreign Derivatives Markets as provided in the Rules, identifying operations on own account and on behalf of their Clients.

Operators may not manage discretionary accounts, except for Derivatives Contracts listed on the Exchange that have authorization from the Authorities.

TWENTY-SEVENTH.- Operators must have a Business Continuity Plan that allows, upon verification of Operational Contingencies, the continuity in the provision of necessary services performed as an Operator in terms of the Rules, in the execution of their processes, their timely restoration, as well as the mitigation of effects resulting from such contingencies.

Such plan must include:

I. A business impact analysis that contributes to identifying and evaluating the risks to which the Operators' processes are exposed, as well as critical processes, and estimates qualitative and quantitative impacts in the event of Operational Contingencies, considering their external providers.

II. The recovery priority of their processes, according to the impact analysis mentioned in the preceding subsection.

III. Actions and procedures for the Operators' services and processes to return to minimum service levels and eventually to normality, including mechanisms for updating and reconciling information.

IV. Training policies and procedures for involved personnel.

V. The establishment of a testing program for the functionality and sufficiency of the Business Continuity Plan, which contemplates its update at least annually, or sooner if a significant change occurs in the technological infrastructure, processes, products and services, or internal organization of the Operators, and includes the evaluation of all stages and components of the Business Continuity Plan.

VI. A communication policy, which must provide for timely communication with their Clients, with the Exchange, with the different administrative and business units within the Operators, as well as with the Commission and other competent authorities, depending on the nature of the Contingency involved.

TWENTY-EIGHTH.- Operators, when contracting third parties for the execution of an operational process or for the administration of databases and computer systems necessary for the provision of services carried out as an Operator in terms of the Rules, must establish the following controls:

I. That the third parties with whom services are contracted reside in countries whose internal law provides protection for personal data, safeguarding its proper confidentiality, or that the countries of residence have international agreements with Mexico in this matter or for the exchange of information between supervisory bodies.

II. Maintain in their main offices located in the United Mexican States, at least the documentation and information relating to evaluations, audit results, and performance reports of their providers. Furthermore, when the Commission requires it, they must provide such documentation in Spanish.

III. Have the approval of the board of directors, stating in the respective agreement the following aspects:

a) That when contracting services or commissions, the proper compliance with the provisions applicable to the Operator is not put at risk.

b) That the third party's business practices are consistent with the Operator's operating practices.

c) That there would be no impact on the Operator's financial stability or operational continuity, due to geographical distance and, where applicable, the language used in the provision of the service.

TWENTY-NINTH.- Operators, for each service contracted, must maintain the following:

I. Report specifying the operational processes or database administration and computer systems of the Operators that are subject to the services to be contracted, considering the criteria and procedures for selecting the third party, as well as the following aspects:

a) Redundancy schemes or alternative mechanisms in point-to-point telecommunications that allow for communication links that minimize the risk of interruption in the telecommunications service.

b) Continuity strategy in the information services provided to Operators, enabling the processing and operation of systems in the event of contingencies, failures, or interruptions in telecommunications or central computer equipment and others involved in the information processing service for operations or services.

c) Mechanisms to establish and monitor the quality of information services, as well as system and application response times.

d) Technical support scheme, in order to solve problems and incidents, independently, where applicable, of differences in time zones and business days.

e) Measures to ensure the transmission of operations in encrypted point-to-point form and security elements or controls at each node involved in the sending and receiving of data.

f) Establishment of an information security officer and their functions regarding the administration, control, and authorization of accesses by the third party. Such accesses must correspond to the need to know the information according to the documented functions of the position. Furthermore, the information security officer must always have records of all personnel who have access to the information related to the operations performed by the Operator.

g) Scheme by which the access log of information by authorized third-party personnel will be maintained in an office of the contracting Operator.

h) Policies and procedures regarding the conduct of internal or external audits on the infrastructure, controls, and operation of the third party's computer center, related to the production environment for the Operator, at least once every two years in order to evaluate compliance with the provisions of this disposition.

i) Mechanisms for accessing the technological environment, including information, databases, and security configurations, from the Operator's facilities within national territory.

j) Mechanisms that allow the Operator to maintain at their facilities detailed records of all operations and balances current at the daily close of the different services supported by the service contracted with the third party, as well as their accounting records. Such records must be maintained in a format that allows their consultation and use even when the service contracted with the third party is not available.

II. Service provision contract, or another document in which the unconditional acceptance of the service provider is stated for:

a) Receiving home visits by the external auditor determined by the Operator, by the Commission, or by third parties designated by the Commission itself.

b) Accepting the conduct of audits by the Operator, regarding the services subject to such contract, in order to verify compliance with the provisions applicable to Operators.

c) Delivering, at the Operator's request, to the external auditor determined by the Operator or the third party designated by them, books, systems, records, manuals, and documents in general, related to the provision of the service in question. Furthermore, it will allow access to responsible personnel and their offices and facilities in general, related to the provision of the service.

d) Informing the Operator at least thirty natural days in advance, regarding any reform to its corporate purpose or internal organization that could affect the provision of the service subject to the contract.

e) Where applicable, maintaining confidentiality regarding information related to services that third parties conclude with Clients, as well as information regarding the latter.

THIRTIETH.- Operators will transmit to the Exchange's electronic trading system, the positions corresponding to each order registered in their order receiving, recording, and executing system, as received, within the schedule established in the terms and conditions established by the Exchange for each type of Derivatives Contract according to its Underlying Asset or for each type of operation in its internal regulations. In any case, orders must be executed respecting the principles of best price, first trade, equal price, and chronological order.

Operators will perform operation assignment in their systems with strict execution order on the Exchange.

THIRTY-FIRST.- The order receiving, recording, and executing system and operation assignment system must adhere to the requirements set forth in the Sixty-Fifth of these Provisions, and additionally comply with the following:

I. Contain strict security measures for access to the database maintained, considering at least the following:

a) User authentication mechanisms that ensure access only to persons expressly authorized for this purpose, including adequate considerations for users with higher privileges derived from their database administration functions.

b) Information encryption mechanisms when transmitted.

c) Robust composition of passwords and access keys, as well as controls in the storage and use of user authentication factors, both internal and external.

d) Control of unattended sessions, as well as simultaneous sessions with the same user identifier.

e) Physical security mechanisms applicable to the infrastructure for storing, processing, and transmitting information.

f) Monitoring mechanisms for accesses to databases.

II. Ensure continuity in the capture and recording of information, as well as its update and backup.

III. Allow detecting the alteration or falsification of Operators' transaction records.

IV. Have alternative mechanisms in case of interruptions or alterations to its operation.

THIRTY-SECOND.- Operators, themselves or through their Clearing Members, will send Clients a monthly statement reflecting the Derivatives Contracts listed on the Exchange executed through their channel, the commissions accrued, the amount of Contributions delivered to the Clearing Member, specifying the Minimum Initial Contributions, the yield, and, where applicable, return.

Regarding Global Accounts managed by Operators, positions, contributions, yields, and commissions corresponding to each Client must be itemized in the respective statement. Furthermore, the statement must contain a legend that expressly and notably indicates the risks of participating in this type of account and the obligation of Clients to mutualize their contributions in the event of default by other Clients of the account.

Additionally, Operators who transmit orders for the execution of operations with Derivatives Contracts listed on recognized Foreign Derivatives Markets, as provided by the Rules, must add to the statement they send to their Clients the details of operations with such Derivatives Contracts, the commissions, and the amount of resources delivered to such markets in order to fulfill the obligations of the Derivatives Contracts.

THIRTY-THIRD.- Operators must deliver to their Clients, with receipt acknowledgment, the information referred to in the Fifty-Eighth of these Provisions, which will be provided by the Clearing Members, as well as its modifications, which will be incorporated as annexes to the intermediation contracts they conclude.

ON CLEARING HOUSES

THIRTY-FOURTH.- Clearing Houses will issue rules to be observed by Clearing Members in the settlement of Derivatives Contracts, monitor that the terms and conditions agreed upon in the operations are duly and effectively fulfilled, and implement mechanisms and systems that seek to eliminate credit, liquidity, and operational risk, in order to provide security and confidence to the market.

Furthermore, Clearing Houses must establish connection mechanisms with the Exchange and Trading Platforms or Foreign Platforms, as applicable.

Under no circumstances may the Clearing House act as a counterparty to operations with Derivatives Contracts listed on recognized Foreign Derivatives Markets.

THIRTY-FIFTH.- The trust contract of the Clearing Houses must contain, among others, clauses relating to:

I. The criteria for admitting trustors, considering in the case of Clearing Members aspects related to technical capacity, economic solvency, and sufficient technological equipment for the development of their settlement activity according to the Underlying Assets of the Derivatives Contracts they settle. In any case, it must be provided that the fiduciary rights certificates documenting the participation of the trustors must be kept deposited in the Clearing House in order to avoid their circulation or negotiation.

II. The integration of the technical committee, in terms of what is provided in the Eighteenth and Eighteenth Bis of the Rules.

III. The integration of the committees referred to in the Twentieth, subsection o) of the Rules, in which it is stated:

a) Their respective functions and responsibilities.

b) The designation of a responsible person for each committee before the technical committee, who must periodically inform them of their activities, or when events or acts of such significance occur, that in their opinion warrant it.

c) That their members must have knowledge in the function they perform and have not been convicted by a final judgment for a property crime.

d) That their members must abstain from participating in any deliberation or resolution when they have conflicts of interest, including those cases where disciplinary processes are heard or in the determination of a sanction.

IV. The dismissal from the position as a member of the technical committee or any committee for absence from more than two sessions, without justified cause.

V. The determination of a special quorum, as well as resolutions by the affirmative vote of two-thirds of the total members of the technical committee, when it comes to decreeing or lifting interventions to Clearing Members and the application of sanctions considered serious in terms of their internal regulations.

THIRTY-SIXTH.- The obligations of the Clearing House's regulatory controller, in addition to those set forth in the Rules, are the following:

I. For the case of non-compliance detected in the exercise of their functions, supervise that procedures are established for their resolution.

II. Propose to the technical committee modifications to the self-regulation rules issued by the Clearing House, in order to establish, among others, measures to prevent conflicts of interest and avoid the misuse of information.

III. Inform the Commission immediately of irregularities detected within their competence that could be violations of the Rules and these Provisions.

The regulatory controller and the persons under their charge may not perform activities of the Clearing House whose supervision is entrusted to them.

The regulatory controller reports to the technical committee and is responsible for the non-compliance of any of their obligations, and may be sanctioned in accordance with what is provided in the Clearing House's internal regulations.

THIRTY-SEVENTH.- Clearing Houses must have the following:

I. Systems that clear and settle Derivatives Contracts, allowing them to validate the information transmitted by their Clearing Members and the clear segregation of accounts, as well as to value daily at market prices, the positions held by Operators, Clearing Members, and Clients.

II. Monitoring systems that identify the positions and position limits of Operators, Clearing Members, and Clients, even when the latter carry out settlement through two or more Clearing Members.

III. A risk measurement system that allows them, at a minimum, to verify the status of their Clearing Members with respect to minimum equity, Minimum Initial Contributions, Daily Settlements, Maturity Settlements, and Extraordinary Settlements, in order to ensure the sufficiency of available resources to meet the obligations arising from Derivative Contracts.

IV. Mechanisms that ensure the delivery of the Underlying Asset and verify that general warehouses and any entity receiving goods to be physically delivered in order to fulfill Derivative Contracts maintain records describing the quantities, qualities, classification, storage conditions, and required space of the respective Underlying Asset.

V. Mechanisms that allow for the adequate treatment of the positions, funds, and assets of Clearing Members in the event of default.

VI. Systems that provide information to the Exchange, to the Trading Platforms, to the Foreign Platforms, and to the Clearing Members regarding the number and amount of Derivative Contracts, cleared and settled daily, classified by class and type, as well as by the Underlying Asset to which they referred, and that identify the transactions carried out by each Clearing Member.

VII. In the provision of registration and custody services for the information referred to in subsection w) of the Twenty-Second Rules, it must have a system that allows, at a minimum, verifying the date on which the corresponding record was generated, the counterparties in the operation, as well as the main characteristics of the Derivative Contract in question.

THIRTY-EIGHTH.- Clearing Houses must implement a Business Continuity Plan that considers at least the following:

I. Prior to the development of the Business Continuity Plan, they must carry out a business impact analysis that:

a) Includes all processes, identifying those considered critical for the continuity of operations.

b) Determines the minimum resources (human, logistical, material, technological infrastructure, and of any other nature) necessary to maintain and restore services and processes in the event of an Operational Contingency, as well as at its conclusion.

c) Develops relevant scenarios regarding possible Operational Contingencies, considering, among others, the following events:

i. Natural and environmental disasters.

ii. Infectious diseases.

iii. Cyberattacks or attacks on computer activity.

iv. Sabotage.

v. Terrorism.

vi. Interruptions in energy supply.

vii. Failures or unavailability in technological infrastructure (application functionality, telecommunications, information processing, and networks).

viii. Unavailability of human, material, or technical resources.

ix. Interruptions occurring in services provided by third parties.

d) Estimates the quantitative and qualitative impacts of Operational Contingencies, based on the scenarios defined for each process and through methodologies authorized by the technical committee of the Clearing Houses.

e) Defines the recovery priority for each of the processes.

f) Determines the recovery time objective (known as RTO, from its English acronym), for each of the processes related to its obligation to clear and settle Derivative Contracts, as well as to act as the counterparty to Clients regarding the Derivative Contracts brought to them by Clearing Members for clearing and settlement, considering the quantitative and qualitative impacts for each scenario provided for in the Business Continuity Plan, in accordance with the methodologies established for this purpose.

The recovery time objective for the processes referred to in the previous paragraph, and which have been classified as critical in terms of subsection a) above, shall not exceed thirty minutes, counted from the time the Clearing Houses identify an Operational Contingency, being obliged to contemplate the provisions within their reach to meet said recovery time objective.

g) Establish the recovery point objective (known as RPO, from its English acronym), understood as the maximum tolerable data loss for each of the processes, considering that the information of those operations already accepted or novated, as the case may be, cannot be lost in any scenario, and that the status of each transaction at the moment the Operational Contingency occurred must be known in a timely manner.

h) Identify and evaluate risks related to operational processes and data processing and transmission services contracted with third parties, as well as those related to the custody and safeguarding of information of the Clearing Houses or their Clearing Members.

i) Determine risks derived from the geographic location of the main data processing centers and operation of the processes identified as critical in accordance with subsection a) of this section, to avoid that the alternative data processing and operation centers are exposed to the same risks as the main ones.

II. In the preparation of the Business Continuity Plan, Clearing Houses must consider the following:

a) The person responsible for the administration and operation of the Clearing House shall be responsible for:

i. Preparing the Business Continuity Plan.

ii. Its implementation, as well as its continuous updating and dissemination within the Clearing Houses. To this effect, it must establish a training program that responds to the participation of personnel in the event that an Operational Contingency occurs, as well as in the development of the plan itself.

iii. Design and carry out a communication policy regarding the verification of Operational Contingencies, which must be part of the Business Continuity Plan.

This policy must provide for timely communication with its Clients, counterparties, members, or the general public, with derivatives exchanges, other clearing houses with which it has entered into any agreement, and, where applicable, with participants in Recognized Foreign Derivatives Markets that have been provided for in such agreements, with the different administrative and business units within the Clearing Houses, as well as with the Commission and other competent authorities in accordance with the nature of the contingency in question.

iv. Provide for what is necessary to inform the Commission and the Bank of Mexico of any Operational Contingencies that occur in any of its systems that result in the interruption of their operations. In any case, the aforementioned notice must be made within sixty minutes following the identification of the start of the Operational Contingency, through any means of communication. In the notice referred to in this subsection, it must indicate at least the date and time of the start of the Operational Contingency, an indication of whether it continues or has concluded and its duration, as well as a description of the event that occurred. Likewise, the person responsible for the administration and operation of the Clearing House must send to the Commission, within a period not exceeding fifteen calendar days following the conclusion of the Operational Contingency, a description of said Contingency, an analysis of the causes that motivated it, the impact caused in qualitative and quantitative terms, the processes, systems, and channels affected, as well as an indication of the actions that will be implemented to minimize the impact or damage in similar subsequent situations.

v. Ensure that the functioning of the Business Continuity Plan is subjected to effectiveness tests at least once a year and made known to personnel. Likewise, it must review and, where applicable, update, at least once a year in accordance with what is determined for this purpose by its own board of directors or as a result of the effectiveness tests, the Business Continuity Plan.

vi. Inform the technical committee and the Commission of the results of the effectiveness tests and of the evaluation of the scope of the Business Continuity Plan, as well as of its adequate dissemination among the pertinent areas and the identification, where applicable, of the necessary adjustments for its updating and strengthening. Such report must be made at least once a year or earlier if relevant results are detected.

vii. In any case, for the performance of the responsibilities referred to in this provision, the person responsible for the administration and operation of the Clearing House may be assisted by the personnel it determines, in which case it must inform the Commission within a period not exceeding five business days from its designation, maintaining at all times an adequate segregation of functions that avoids conflicts of interest.

b) The Business Continuity Plan and its modifications will be presented for approval by the technical committee.

c) Clearing Houses must have a methodology to estimate the quantitative and qualitative impacts of Operational Contingencies, for its use in the impact analysis referred to in subsection I, subsection d) of this provision. This methodology must be approved by the technical committee.

III. In the preparation of the Business Continuity Plan, Clearing Houses must incorporate the following strategies:

a) Prevention, which will include at least the determination, based on the business impact analysis, of actions and procedures related to:

i. Reducing the vulnerability of the processes and services of the Clearing Houses to Operational Contingencies.

ii. The availability of the human, financial, material, technical, and technological infrastructure resources necessary to act in a timely manner in the event of an Operational Contingency.

iii. The establishment of a testing program for the functioning and sufficiency of the Business Continuity Plan, which contemplates its update at least annually, or earlier, if there is a significant change in the technological infrastructure, processes, products, and services, or internal organization of the Clearing Houses, and which includes the evaluation of all stages and components of the Business Continuity Plan.

iv. The training program regarding the Business Continuity Plan for the personnel involved.

v. A communication policy referred to in subsection II, subsection a), subsubsection iii) of this provision, which must attend to all moments of the Operational Contingencies, from their occurrence and containment to their resolution and evaluation, this in attention to the nature of said contingency and the different recipients of its communications.

vi. Procedures for recording, attending to, following up, and disseminating to relevant personnel the findings, incidents, or observations resulting from the tests carried out on the Business Continuity Plan or the execution of the plan itself in the event that an Operational Contingency has occurred.

b) Contingency, which will include the definition of authorized response actions and procedures for:

i. Identifying the nature of Operational Contingencies that affect the processes of the Clearing Houses.

ii. Containing the effects of Operational Contingencies on processes and favoring the restoration of operations to the required levels of functioning, based on what is established in subsections f) and g) of the previous subsection I.

iii. Ensuring the continuity of operations, equal conditions for the clearing and settlement of operations, equal dissemination of market information, and availability and equality for market participants to consult operation information.

c) Restoration, which will include the definition of actions and procedures so that the services and processes of the Clearing Houses return to minimum service levels and eventually to normality, including mechanisms for updating and reconciling information, observing in this regard the standards established in subsections f) and g) of subsection I above.

d) Evaluation, which will include the collection and analysis of relevant information on the development of the Operational Contingency and the actions and procedures followed for its prevention, containment, and restoration in order to, where applicable, make the necessary adjustments to the Business Continuity Plan.

Clearing Houses, when defining the different actions and procedures referred to in this subsection, must at all times clearly determine the responsible personnel, as well as provide for their replacement or substitution in the event that the holders are unable to carry out what the Business Continuity Plan establishes.

THIRTY-NINTH.- Clearing Houses, when contracting third parties for the performance of an operational process or for the administration of databases and computer systems necessary for the provision of services they carry out as Clearing Houses in terms of the Rules, must establish the following controls:

I. That the third parties with whom they contract reside in countries whose internal law provides protection for the data of persons, safeguarding their due confidentiality, or that the countries of residence have signed international agreements with Mexico in this matter or for the exchange of information between supervisory bodies.

II. Maintain in their main offices located in the United Mexican States, at least the documentation and information related to the evaluations, audit results, and performance reports of their suppliers. Likewise, when the Commission requires it, they must provide such documentation in Spanish.

III. Have the approval of the technical committee, stating in the respective agreement the following aspects:

a) That in contracting the services or commissions, the adequate compliance with the provisions applicable to Clearing Houses is not put at risk.

b) That the business practices of the third party are consistent with those of the operation of the Clearing House.

c) That there would be no impact on the financial stability or operational continuity of the Clearing House, due to the geographic distance and, where applicable, the language that will be used in the provision of the service.

FORTIETH.- Clearing Houses for each service contracted must maintain the following:

I. A report specifying the operational processes or database and computer system administration of the Clearing Houses that are the subject of the services to be contracted, considering the criteria and procedures for selecting the third party, as well as the following aspects:

a) Redundancy schemes or alternate mechanisms in point-to-point telecommunications that allow for communication links that minimize the risk of interruption in the telecommunications service.

b) Continuity strategy in the computer services that provide Clearing Houses with the capacity to process and operate systems in the event of contingency, failures, or interruptions in telecommunications or central computer equipment and others involved in the information processing service of operations or services.

c) Mechanisms to establish and monitor quality in information services, as well as system and application response times.

d) Technical support scheme, in order to solve problems and incidents, independent, where applicable, of differences in time zones and business days.

e) Measures to ensure the transmission of operations in encrypted point-to-point form and security elements or controls in each of the nodes involved in the sending and receiving of data.

f) Establishment of the functions of the security officer regarding the administration, authorization, and control of accesses by the third party. Such accesses must correspond to the need to know the information according to the documented functions of the position. Likewise, the security officer must have at all times the records of all personnel who have access to information related to the operations of the Clearing House.

g) Scheme by which the access log to information by duly authorized personnel will be maintained in an office of the contracting Clearing House.

h) Policies and procedures regarding the performance of internal or external audits on the infrastructure, controls, and operation of the third party's computer center, related to the production environment for the Clearing House, at least once every two years in order to evaluate compliance with what is mentioned in this provision.

i) Mechanisms for access to the technological environment, including information, databases, and security configurations, from the facilities of the Clearing House in national territory.

j) Mechanisms that allow the Clearing House to maintain in its facilities the detailed records of all operations and balances current at the daily close of the different services supported by the service contracted with the third party, as well as its accounting records. Such records must be maintained in a format that allows their consultation and use even when the service contracted by the third party is not available.

II. The respective service provision contract or any other document in which the unconditional acceptance of the person providing the service is stated for:

a) Receiving home visits by the external auditor established by the Clearing House, by the Commission, or by third parties designated by the Commission itself.

b) Accepting the performance of audits by the Clearing House, regarding the services subject to said contract, in order to verify compliance with the provisions applicable to Clearing Houses.

c) Delivering, at the request of the Clearing House, to the external auditor established by the Clearing House or to the third party it designates, books, systems, records, manuals, and documents in general, related to the provision of the service in question. Likewise, it will allow access to the responsible personnel and to their offices and facilities in general, related to the provision of the service.

d) Inform the Clearing House at least thirty calendar days in advance, regarding any reform to its corporate purpose or internal organization that could affect the provision of the service subject to the contract.

e) Where applicable, keep confidentiality regarding information related to the services that third parties enter into with Clients, as well as regarding the latter.

FORTY-FIRST.- The systems referred to in the Thirty-Seventh provision must adhere to the requirements set forth in the Sixty-Fifth of these Provisions, as well as comply with the following:

I. Contain strict security measures for access to these systems, as well as to their databases, considering at least the following:

a) User authentication mechanisms that ensure access only to persons expressly authorized for this purpose, including adequate considerations for users with greater privileges derived from their database administration functions.

b) Information encryption mechanisms when it is transmitted.

c) Robust composition of passwords and access keys, as well as controls in the storage and use of user authentication factors, both internal and external.

d) Control of unattended sessions, as well as simultaneous sessions with the same user identifier. e) Physical security mechanisms applicable to the infrastructure for storage, processing, and transmission of information. f) Surveillance mechanisms for access to databases.

II. Ensure continuity in the capture and recording of information, as well as its update and backup.

III. Allow for the detection of alteration or falsification of operation records settled by Clearing Members.

IV. Have alternative mechanisms in case of alterations or interruption of their operation.

FORTY-SECOND.- The internal regulations of Clearing Houses shall contain, among others, rules relating to:

I. The requirements and procedures for the admission of Clearing Members and Global Account Operators, as well as the causes for which the operations of Clearing Members may be suspended, expressly indicating the treatment that will be given to the Open Contracts of the Clearing Member in question.

II. The mechanisms through which connections with Exchanges and Trading Platforms will be established, as appropriate, and, where applicable, with Foreign Platforms.

III. The obligations and rights that the Clearing House and Clearing Members will have in the clearing and settlement of Derivatives Contracts.

IV. The conditions that operations with Derivatives Contracts traded through Trading Platforms and Foreign Platforms must meet to be novated and for the Clearing House to become the counterparty to them.

V. The operation, coverage, and investment regime of the Compensation Fund and the Contributions Fund and Supplementary Fund, as well as the operational terms and conditions to cover the amounts that must be contributed to said funds in accordance with what is stated in the Rules.

VI. The operational terms and conditions under which Minimum Initial Contributions, Maturity Settlements, and Extraordinary Settlements must be delivered.

VII. The rules that will govern the conduct of Clearing Members and Global Account Operators regarding the settlement of Derivatives Contracts, ensuring that the exercise of their activities is carried out honestly and diligently, in order to protect the interests of Clients, as well as market integrity. Similarly, procedures and sanctions to enforce them must be contemplated.

VIII. The security procedures referred to in Forty-First, Section I of these Provisions.

IX. The guidelines and procedure for determining limit positions per Client or Global Account, for each type of Derivatives Contract, or combination of two or more, including the measures that the Clearing House will adopt in cases where Clearing Members cannot close positions to carry out their early settlement.

X. The procedures implemented in the case of non-compliance with payment obligations arising from requests made by the Clearing House, including the design of the security network for such purposes.

XI. Where applicable, the minimum conditions for the provision of registration and custody services for other natural or legal persons, as well as the minimum requirements to carry out such registration, the terms in which Clients must confirm the information sent, and the obligations of the Clearing House in the handling of said information.

XII. The registration, use, and, where applicable, disclosure of the information generated and processed by the Clearing House.

XIII. The disclosure of the calculation methodologies of the funds that make up the equity of the Clearing House, as well as their administration.

XIV. The guidelines to carry out surveillance and audit programs for Clearing Members and Operators who manage Global Accounts.

XV. The policies and guidelines for the collection of fees, quotas, or commissions for the services provided by the Clearing House.

XVI. The special circumstances under which the Clearing House may demand, at any time during the session, Extraordinary Settlements from Clearing Members regarding their operations with Derivatives Contracts.

XVII. The guidelines to accredit the technical and legal capacity of the personnel of Clearing Members involved in the transactions carried out.

FORTY-THIRD.- Clearing Houses, in order to comply with what is provided in the Seventeenth of the Rules, shall design the rules relating to the security network, which must be included in their internal regulations and contain at least the following:

I. The procedures that must be followed when Clearing Members default, allowing the Clearing House to continue fulfilling its obligations and which contemplate the replenishment of resources once such default occurs. These procedures must provide that defaults are communicated immediately to the Authorities.

II. The priority for applying the resources of each type of Operator who manages Global Accounts or defaulted Clearing Member, also considering whether such Clearing Member settles Derivatives Contracts for its own account, for third parties, or both.

III. General guidelines for the application of the security network by a Clearing Member and Operator who manages Global Accounts when a Client defaults.

IV. Guidelines to carry out audits and tests of the proper operation of the security network, including the participation of Clearing Members or Operators who manage Global Accounts.

Such audits and tests must be carried out at least annually or after significant changes occur in the rules and procedures referred to in this provision to ensure that they are practical and effective. The aforementioned audits and tests may be carried out by an independent external auditor.

FORTY-FOURTH.- Clearing Houses must return excess amounts to the Clearing Member in question, when the amount of Minimum Initial Contributions or Extraordinary Settlements made is greater than what is needed in accordance with what is stated in the internal regulations. This, in accordance with the procedure established for such effect by the Clearing House itself in its internal regulations.

FORTY-FIFTH.- Clearing Houses must guarantee the right to be heard of the affected party, as well as comply with the essential formalities of any procedure, in the application of sanctions for infractions of their own rules, recording for this purpose the form and terms for their observance in their internal regulations.

In all cases, the sanctions determined must be proportional to the gravity of the committed infraction.

Clearing Houses must inform the Authorities about the commission of serious infractions to the rules they issue no later than the next business day after the corresponding sanction is notified.

FORTY-SIXTH.- Clearing Houses will send daily to their Clearing Members the confirmations of the Derivatives Contracts cleared and settled by their account or through them.

Likewise, Clearing Houses will send their Clearing Members a monthly statement reflecting the Derivatives Contracts cleared and settled through their conduct, the Open Contracts they hold, the amount of Contributions, specifying the amount of Minimum Initial Contributions, their yield, and, where applicable, return, as well as the amount of their contributions made to the Compensation Fund.

ON CLEARING MEMBERS

FORTY-SEVENTH.- Clearing Members must obtain their registration in the registry of Clearing Members of the Clearing House where they settle and clear Derivatives Contracts and in the registry of Clearing Members and Operators of the Exchange where they carry out operations.

FORTY-EIGHTH.- Clearing Members who enter into Listed Derivatives Contracts on an Exchange must comply with what is established in the Twenty-Sixth, Thirtieth, and Thirty-First provisions.

Multiple banking institutions or brokerage houses that are settlors of a trust intended to operate as a Clearing Member carrying out operations for their own account and who also act as trustees in Clearing Members carrying out operations for third parties, may use a single order reception and trade allocation system.

Clearing Members may not carry discretionary accounts, except for Listed Derivatives Contracts that have authorization from the Authorities.

FORTY-NINTH.- Clearing Members must have operational and accounting records that allow them to have daily control of the Derivatives Contracts settled, including at minimum the following information:

I. Of Derivatives Contracts settlements that identify the name and account number of the Client, class and type of Derivatives Contract, date and time of settlement, and amount of Contributions.
The settlement records must be kept following the order established for trade allocation.

II. Of Contributions showing the amounts corresponding to Open Contracts, those deposited by Clients, as well as the Excess of Minimum Initial Contributions.

III. Of Daily Settlements, Maturity Settlements, and Extraordinary Settlements, as well as the amounts contributed to the Compensation Fund.

IV. Of positions and limit positions.

Likewise, Clearing Members must evaluate the financial situation of Clients prior to carrying out Derivatives Contracts operations. For these purposes, they must carry out credit studies or analyses regarding Clients, which must be appropriate to the risk profile of said Clients. Additionally, the studies or analyses must be reviewed at least once a year.

FIFTIETH.- Clearing Members must have the following:

I. Policies, procedures, and systems for the comprehensive management of risks to which the Clearing Member is exposed, including credit, liquidity, operational, legal, and business risks.
With respect to liquidity risk, Clearing Members must establish a plan containing, at minimum, procedures to manage and monitor their liquidity needs in various market scenarios.

II. Systems that allow them to value at all times the Open Contracts they hold, as well as validate the Contributions requested by the Clearing House.

III. Systems that allow collecting and returning Contributions, as well as validating that Client accounts do not exceed the limits established by the Clearing House.

IV. Systems to periodically carry out tests with various risk scenarios in order to project results and quantify the impact they would have on the Clearing Member itself. In all cases, Clearing Members must keep a record of the carrying out of such tests.

V. Plans to execute their security network, in accordance with applicable provisions.

The policies, procedures, and plans referred to in this provision must be included in a manual, which must be approved by the technical committee of the Clearing Member.

FIFTY-FIRST.- The systems referred to in the Forty-Eighth to Fiftieth provisions must comply with the requirements set forth in the Sixty-Fifth of these Provisions.

FIFTY-SECOND.- Clearing Members must have a Business Continuity Plan that allows, upon verification of Operational Contingencies, the continuity in the provision of services they carry out as Clearing Members in terms of the Rules, in the realization of their processes, their timely restoration, as well as the mitigation of effects resulting from such contingencies.

Such plan must include:

I. A business impact analysis that contributes to identifying the risks to which the processes of Clearing Members are exposed, as well as critical processes, and estimates qualitative and quantitative impacts in the event of Operational Contingencies, considering their external providers.

II. The recovery priority of their processes, in accordance with the impact analysis mentioned in the previous section.

III. Actions and procedures so that the services and processes of Clearing Members return to minimum service levels and eventually to normality, including mechanisms for updating and reconciling information.

IV. Policies and procedures for training involved personnel.

V. The establishment of a testing program for the functioning and sufficiency of the Business Continuity Plan that contemplates annual update, or earlier if there is a significant change in the technological infrastructure, processes, products and services, or internal organization of Clearing Members, and that evaluates all stages and components of the Business Continuity Plan.

VI. Communication policy, which must provide for timely communication with their Clients, Clearing House, Exchange, Trading Platforms, Foreign Platforms, and, where applicable, with participants of Recognized Foreign Derivatives Markets that have been foreseen in the Agreements that the Exchange has entered into with foreign derivatives exchanges, with the different administrative and business units within Clearing Members, as well as with the Commission and other competent authorities in attention to the nature of the contingency in question.

FIFTY-THIRD.- Clearing Members, in contracting third parties for the performance of an operational process or for the administration of databases and computer systems necessary for the provision of services they carry out as Clearing Members in terms of the Rules, must establish the following controls:

I. That the third parties with whom they contract reside in countries whose internal law provides protection for the data of persons, safeguarding their due confidentiality, or that the countries of residence have signed international agreements with Mexico in this matter or on the exchange of information between supervisory bodies.

II. To keep in their main offices located in the United Mexican States, at least the documentation and information relating to the evaluations, audit results, and performance reports of their providers. Likewise, when the Commission requires it, they must provide such documentation in Spanish.

III. To have the approval of the highest governing body, stating in the respective agreement the following aspects:

a) That by contracting services or commissions, the adequate compliance with the provisions applicable to the Clearing Member is not put at risk.

b) That the business practices of the third party or commissionaire are consistent with the operating practices of the Clearing Member.

c) That there would be no impact on the financial stability or operational continuity of the Clearing Member, due to the geographical distance and, where applicable, the language that will be used in the provision of the service.

FIFTY-FOURTH.- Clearing Members, for each service contracted, must maintain the following:

I. Report specifying the operational processes or database and computer system administration of Clearing Members that are the subject of the services to be contracted, considering the criteria and procedures for selecting the third party, as well as the following aspects:

a) Redundancy schemes or alternative mechanisms in point-to-point telecommunications that allow for communication links that minimize the risk of interruption in the telecommunications service.

b) Continuity strategy in the computer services provided to Clearing Members, giving them the capacity to process and operate systems in case of contingency, failures, or interruptions in telecommunications or central computer equipment and others involved in the service of processing information of operations or services.

c) Mechanisms to establish and monitor quality in information services, as well as response times of systems and applications.

d) Technical support scheme, in order to solve problems and incidents, independently, where applicable, of differences in time zones and business days.

e) Measures to ensure the transmission of operations in encrypted point-to-point form and security elements or controls at each of the nodes involved in the sending and receiving of data.

f) Establishment of functions of the security officer regarding the administration and authorization of accesses by the third party. Such accesses must correspond to the need to know the information according to the documented functions of the position. Likewise, the security officer must have at all times the records of all personnel who have access to information related to the operations carried out by the Clearing Member.

g) Scheme by which the access log to information by authorized third-party personnel will be kept in an office of the contracting Clearing Member.

h) Policies and procedures regarding the carrying out of internal or external audits on the infrastructure, controls, and operation of the third party's computer center, related to the production environment for the Clearing Member, at least once every two years in order to evaluate compliance with what is mentioned in this provision.

i) Mechanisms for access to the technological environment, including information, databases, and security configurations, from the Clearing Member's facilities in national territory.

j) Mechanisms that allow Clearing Members to keep in national territory the detailed records of all balances, operations, and contracts in effect at the daily close of the different services provided by the third party, as well as their accounting records. Such records must be kept in a format that allows their consultation and use at all times.

II. Service provision contract, or some other document in which the unconditional acceptance of the person providing the service is recorded for:

a) Receiving home visits by the external auditor determined by the Clearing Member, by the Commission, or by third parties designated by the Commission itself.

b) Accepting the carrying out of audits by the Clearing Member, regarding the services subject to said contract, in order to verify compliance with the provisions applicable to Clearing Members.

c) Delivering, at the request of the Clearing Member, to the external auditor determined by the Clearing Member or to the third party designated by it, books, systems, records, manuals, and documents in general, related to the provision of the service in question. Likewise, it will allow access to the responsible personnel and their offices and facilities in general, related to the provision of the service.

d) Inform the Clearing Member with at least thirty natural days in advance, regarding any reform to its corporate purpose or internal organization that could affect the provision of the service subject to the contract.

e) Where applicable, keep confidentiality regarding information relating to the services that third parties enter into with Clients, as well as regarding the latter.

FIFTY-FIFTH.- Clearing Members that intend to transmit for their own account or that of their Clients orders for the celebration of operations with Derivatives Contracts listed in exchanges of Recognized Foreign Derivatives Markets, in terms of the Rules, must comply with the access requirements to the order routing system established by the internal regulations of the Exchange of which they are members.

Clearing Members may carry out all necessary acts for the contracting of the services required for the execution of orders in Recognized Foreign Derivatives Markets.

FIFTY-SIXTH.- Liquidating Partners of Derivatives Contracts referring to Financial Underlying Assets must have the services of a credit institution or brokerage house to carry out the delivery of resources and, where applicable, securities, through a transfer system in deposit accounts.

Liquidating Partners shall inform Clients of the manner, place, and schedule in which payments for differences or deliveries of Underlying Assets will be made, as well as any modifications to such terms.

FIFTY-SEVENTH.- Liquidating Partners shall prepare a slip or receipt for each transaction and send Clients daily confirmations of the number of Derivatives Contracts executed and liquidated on their behalf, containing at minimum a brief description of the Derivatives Contract, the agreed price or rate, the Underlying Asset, and whether they correspond to a contract listed on an Exchange or traded through a Trading Platform or External Platform. The same procedure shall be observed with each Client participating in a Global Account.

Furthermore, and if so requested by the Client, the Liquidating Partner may send them only the weighted average price for each client order or the aggregate of transactions executed during the day.

Likewise, Liquidating Partners shall send Clients a monthly statement reflecting the Derivatives Contracts executed, indicating whether they correspond to those listed on an Exchange or traded through a Trading Platform or External Platform, as well as the Derivatives Contracts liquidated; the Open Contracts held, the gains or losses realized during the month; the amount of Contributions received and delivered, specifying the amount of Minimum Initial Contributions, their yield, and, where applicable, return, as well as the fees and commissions charged for account management. For Derivatives Contracts listed on an Exchange, such sending must take into account what is provided in the Thirty-Second Provision.

Regarding Global Accounts managed by Liquidating Partners, positions, contributions, yields, and commissions corresponding to each Client must be itemized in the respective statement. Likewise, the statement must contain a legend expressly and prominently stating the risks of participating in this type of account and the obligation of Clients to mutualize their contributions in case of default by other Clients of the account.

Likewise, Liquidating Partners who transmit orders for the execution of operations with Derivatives Contracts listed on Recognized External Derivatives Markets, in accordance with the Rules, must add to the statement they send to their Clients the details of operations with such Derivatives Contracts, the commissions, and the amount of resources delivered to such markets to fulfill the obligations of the Derivatives Contracts.

FIFTY-EIGHTH.- Liquidating Partners must provide information regarding the class and type of Derivatives Contracts they execute and liquidate, emphasizing explaining to their Clients the inherent risks thereof. Such information shall be incorporated as annexes to the brokerage contracts they sign, and for this purpose, they must deliver them to their Clients with a receipt acknowledgment.

Likewise, Liquidating Partners must provide the Operators acting as their commissionaires with the information referred to, for the purposes of the Thirty-Third Provision of these Provisions.

In the case where Liquidating Partners transmit orders for the execution of operations with Derivatives Contracts listed on Recognized External Derivatives Markets, in accordance with the Rules, they must inform their Clients about the class, type, and other characteristics of the aforementioned Derivatives Contracts, as well as the inherent risks thereof, through the means established in the respective contracts.

FIFTY-NINTH.- Liquidating Partners must establish quantitative and qualitative criteria regarding those positions in Open Contracts that, even while within permitted limits, represent significant risk to the market in case of default, in order to avoid any negative event for said market.

Quantitative criteria shall be understood as those related to resources, assets, funds, and financial position of Clients, and qualitative criteria as those referring to the moral and credit quality of the Clients themselves.

GENERAL PROVISIONS

SIXTIETH.- All acts, Derivatives Contracts, or operations performed by Operators, Liquidating Partners, Clearing Houses, and Exchanges must be recorded in their accounting. The accounting, books, and corresponding documents shall be governed by the general provisions issued by the Commission, and in any case, must be preserved for a period of five years, counted from the date the act, Derivatives Contract, or operation giving rise to them was performed.

SIXTY-FIRST.- The Commission, through general provisions, shall indicate the bases to which the approval of monthly financial statements and the annual balance sheet of Exchanges, Operators, Liquidating Partners, and Clearing Houses will be subject, as well as their publication in terms of what is provided by the Rules.

The Commission may order corrections that in its judgment are fundamental and warrant their publication, who may agree that they be published with the pertinent modifications, and, where applicable, such publication will be made within fifteen days following the agreement.

The annual balance sheet must be audited by an independent external auditor in accordance with what is established in the Rules, who shall be appointed directly by the board of directors or technical committee, as applicable.

If during the practice or as a result of the audit, irregularities affecting the stability or solvency of Operators, Liquidating Partners, Clearing House, or Exchange are found, the auditors are obligated to communicate such situation to the Commission no later than the next business day after they become aware of such situation. The Commission itself, through general provisions, may establish the characteristics and requirements that external auditors must meet, as well as their opinions.

SIXTY-SECOND.- In the brokerage contracts that Liquidating Partners or Operators enter into with Clients for the execution of Derivatives Contracts, the following clauses must be stipulated, among others:

I. The adherence of Clients to the self-regulation rules issued by the Exchange where Derivatives Contracts listed on an Exchange are carried out.

II. The main characteristics and the use of the systems for receiving orders and assigning operations for the purchase and sale of Derivatives Contracts listed on an Exchange.

III. The prohibition to Clients from carrying out indirectly, through their brokerage contracts, operations of other persons, except regarding Global Accounts or brokerage contracts entered into with foreign financial entities that maintain accounts with characteristics equal, analogous, or similar to Global Accounts, provided that in the latter case, authorization from the Exchange is obtained, in accordance with the requirements established in its internal regulations.

IV. The destination of the Contributions delivered by the Client through the Liquidating Partner to the Clearing House in the event of default on the obligations undertaken by the first party in the Derivatives Contracts, including the failure to pay conventional penalties.

V. The conventional penalties applicable to Clients, establishing among others, those resulting from:

a) The breach of the obligation to refrain from executing Derivatives Contracts, for their own benefit or that of third parties, with any class of Underlying Asset, the price of which may be influenced by the use of privileged information, as long as it has the indicated character.

For the purposes of the preceding paragraph, privileged information shall be understood as knowledge of acts, facts, or events capable of influencing the prices of the Underlying Assets subject to the Derivatives Contracts, while such information has not been made known to the public. In any case, scenarios may be stipulated in which it is presumed that a Client may have access to privileged information regarding the Underlying Assets in question, as well as establish time periods during which such Clients must refrain from directly or through intermediaries executing Derivatives Contracts.

b) The execution of manipulation, simulation, or triangulation operations.

c) The execution of Derivatives Contracts that have as their object Underlying Assets, regarding which the Client themselves, in accordance with applicable regulations, cannot operate.

VI. The express authorization of the Client for the execution of operations with Derivatives Contracts listed on Recognized External Derivatives Markets, in accordance with the Rules, through the order routing schemes enabled by the respective Exchange and for the delivery of resources destined to fulfill the obligations undertaken on their behalf.

In any case, the Client must declare that they will be subject to the legislation applicable to the Recognized External Derivatives Market in question and that they are aware of the inherent risks of operating with Derivatives Contracts listed on the exchange of said Market. Likewise, they must declare that they authorize the provision of information to foreign regulatory entities for operations they execute with Derivatives Contracts listed on Recognized External Derivatives Markets in accordance with the Rules.

In the execution of the operations referred to in this fraction, the Clearing House shall in no case be understood to act as the counterparty of operations executed in Recognized External Derivatives Markets.

Likewise, it must be stated in the brokerage contracts that the amount of conventional penalties will be destined to the constitution of a Supplementary Fund of the Clearing House, which would be applied in accordance with the internal regulations of the Clearing House.

The brokerage contracts and the other documentation referred to in the Thirty-Second, Thirty-Third, Fifty-Seventh, and Fifty-Eighth Provisions, as well as any other written communication addressed to Clients, shall be prepared on letterhead paper of the Operator or Liquidating Partner, containing clearly the corporate name or trade name of one or the other, as applicable, and which must be different from that used by the shareholders of the Operator or the natural persons acting in such capacity or the trustors of the Liquidating Partner.

SIXTY-THIRD.- Exchanges and Clearing Houses that provide information consisting of closing prices or liquidation prices to a price provider are obligated to provide it in an identical manner and with the same opportunity, cost, and delivery method to any other price provider that requests it.

SIXTY-FOURTH.- The general manager of Exchanges and Operators, as well as the person responsible for the administration and operation of the Clearing House and Liquidating Partners, must establish the functions of an information security officer, who will enjoy independence from operational, audit, and systems areas, and whose functions will consist, among others, of:

I. Administering and authorizing access to information in correspondence with the need to know such information according to the documented functions of each position.

II. Verifying compliance with security policies.

III. Supporting the coordination of the development of internal controls, policies, and procedures in the matter of information security.

IV. Establishing and updating measures and controls that preserve the security of information generated, received, transmitted, processed, or stored in the computer and telecommunications systems of credit institutions.

V. Establishing necessary preventive and corrective measures to remedy any deficiency detected in the matter of information security.

SIXTY-FIFTH.- The computer systems used by Operators, Liquidating Partners, Clearing Houses, and Exchanges must comply with the following:

I. Perform, at all times, the functions for which they were designed, developed, or acquired.

II. Have their applications and processes duly documented, including their development methodology, as well as, where applicable, records of their changes.

III. Be tested before being implemented, when making changes to them, as well as when applying updates, using quality control mechanisms.

IV. Have the licenses or usage authorizations of the corresponding systems and have been tested before being implemented.

V. Minimize the risk of operational interruption based on backup mechanisms and information recovery procedures, as well as technological infrastructure for its processing.

VI. Maintain audit records, including detailed information of the operation or activity performed by users, database administrators, and operating system administrators, as well as procedures for their periodic review.

VII. Perform tests aimed at detecting vulnerabilities of electronic media, processing, telecommunications, and automated equipment, which prevent unauthorized access and use, including all their technological infrastructure. Such tests will be performed at least once a year or when substantive modifications are made to the technological infrastructure.

VIII. Maintain the confidentiality, integrity, and availability of information generated, stored, and transmitted, observing controls regarding:

a) Access to information, authenticating users and granting permissions according to their profile.

b) Protection of processed, transmitted, and stored information in computer systems, considering, in the case of remote access, information encryption mechanisms.

c) Record of accesses and user activity in audit logs, as well as mechanisms for their periodic review.

d) Version control schemes for applications, ensuring that unauthorized functionality is not found in the computer systems.

TRANSITORY PROVISIONS

FIRST.- These Provisions shall enter into force the day following their publication in the Official Gazette of the Federation, except for what is provided in the following Transitory Articles Second, Third, and Fourth.

SECOND.- Derivatives exchanges, operators, clearing houses, and liquidating partners will have the following timeframes counted from the publication of this instrument in the Official Gazette of the Federation to comply with the provisions indicated below:

I. Six months for the provisions TWELFTH, THIRTY-FOURTH, second paragraph, FIFTY-SIXTH, and FIFTY-NINTH.

Derivatives exchanges will have the timeframe indicated in the preceding paragraph to submit to the Secretariat of Finance and Public Credit, the National Banking and Securities Commission, and the Bank of Mexico the adjustments to their internal regulations to contain the norms provided in the SEVENTEENTH and NINETEENTH provisions of this instrument.

Operators and liquidating partners will have the same timeframe to adjust their order reception and assignment system to what is stated in the TWENTY-SIXTH of these provisions.

Clearing houses will have the mentioned timeframe to adjust their systems referred to in the SEVENTY-THIRD provision of this instrument, as well as to submit to the Secretariat of Finance and Public Credit, the National Banking and Securities Commission, and the Bank of Mexico the adjustments to their internal regulations to provide for the norms referred to in the FORTY-SECOND provision.

Liquidating partners will have the timeframe indicated in the first paragraph of this fraction to adjust the transaction slips and receipts to what is stated in the FIFTY-SEVENTH provision of this instrument.

II. Twelve months for the provisions THIRTEENTH, FOURTEENTH, FIFTEENTH, TWENTY-SEVENTH, TWENTY-EIGHTH, TWENTY-NINTH, THIRTY-EIGHTH, THIRTY-NINTH, FORTIETH, FIFTY-SECOND, FIFTY-THIRD, and FIFTY-FOURTH.

III. Derivatives exchanges and clearing houses will have a maximum timeframe of twelve months for the recovery time objective referred to in fraction I, subsection f) of the THIRTEENTH and fraction I, subsection f) of the THIRTY-EIGHTH, to be no greater than sixty minutes for each of their processes. No later than eighteen months from the publication of this instrument in the Official Gazette of the Federation, they must comply with the recovery time objective of thirty minutes indicated in fraction I, subsection f) of the THIRTEENTH and fraction I, subsection f) of the THIRTY-EIGHTH.

THIRD.- Derivatives exchanges, operators, clearing houses, and liquidating partners must comply with what is provided in the provisions SIXTEENTH, fraction I, subsections b), d), and e), THIRTY-FIRST, fraction I, subsections b), d), and e), and FORTY-FIRST, fraction I, subsections b), d), and e), and SIXTY-FIFTH, fractions V, VI, and VIII, subsection b), within a timeframe of twelve months counted from the publication of these provisions in the Official Gazette of the Federation.

FOURTH.- Upon the entry into force of these Provisions, the "Prudential Provisions to which participants in the market for derivatives contracts listed on an exchange will be subject in their operations," published in the Official Gazette of the Federation on May 26, 1997, and reformed through resolutions published in said Gazette on August 12, 1998, December 31, 2000, August 13 and November 22, 2001, January 4, 2005, and November 23, 2011, are hereby repealed.