Resolution amending, adding, and repealing General Provisions under Article 226 Bis of the Securities Market Law applicable to Investment Advisors

DOF: 20/01/2023

RESOLUTION amending, adding, and repealing the General Provisions referred to in Article 226 Bis of the Securities Market Law, applicable to Investment Advisors

A seal bearing the National Coat of Arms appears at the margin, which reads: United Mexican States.- TREASURY.- Ministry of

Treasury and Public Credit.

RESOLUTION AMENDING, ADDING, AND REPEALING THE GENERAL PROVISIONS REFERRED TO

IN ARTICLE 226 BIS OF THE SECURITIES MARKET LAW, APPLICABLE TO INVESTMENT

ADVISORS

ROGELIO EDUARDO RAMÍREZ DE LA O, Secretary of Treasury and Public Credit, based on

the provisions of Articles 31, fractions VII and XXXII, of the Organic Law of the Federal Public

Administration; 226 Bis of the Securities Market Law, exercising the powers conferred upon me by

Article

6º, fraction XXXIV, of the Internal Regulations of the Ministry of Treasury and Public Credit, and having received

the prior opinion of the National Banking and Securities Commission issued via letter number 221/ DGPORPIA-2508781/2022 and 213-2/2513063/37/2022 dated November 24, 2022; and

CONSIDERING

That since the year 2000, Mexico has been a full member of the Financial Action Task Force (FATF),

an intergovernmental organization that sets international standards in matters of prevention and combat against

operations with proceeds of illicit origin and financing of terrorism;

That on March 22, 2019, the Ministry of Treasury and Public Credit published in the Official Gazette of the

Federación various modifications to the General Provisions referred to in Article 226 Bis

of the Securities Market Law, applicable to investment advisors, with the objective of addressing the

recommendations of the FATF and establishing a non-presential identification regime, thereby granting

the possibility to investment advisors to carry out client identification through a

real-time online videoconference, as well as the obligation for them to obtain geolocation;

which resulted in a strengthening of the risk assessment methodology so that these entities

evaluate their risks of being used to carry out operations with proceeds of illicit origin and

financing of terrorism prior to the use of new technologies;

That on March 6, 2020, the FATF published the Guide on Digital Identification, resulting as a

watershed in the topic of financial technology, showing the benefits of digital identity in matters of

prevention and combat against operations with proceeds of illicit origin and financing of terrorism,

presenting financial technology as a more reliable and secure method for financial entities

when carrying out client identification through the use of mechanisms such as

life tests, the use of biometric elements and authentication factors, among others, which allow the

mitigation of risks of operations with proceeds of illicit origin and financing of terrorism;

That on March 11, 2020, the World Health Organization declared the disease caused by the

SARS-CoV2 virus (COVID-19) as a pandemic, calling on countries to: (i) adopt urgent

and aggressive measures to contain the spread of the virus, (ii) implement an approach based on the

participation of the entire government and society, around a comprehensive strategy directed to prevent

infections, save lives, and minimize their effects, and (iii) find a delicate balance

between the

protection of health, the minimization of social and economic disruptions, and respect for human

rights;

That on March 24, 2020, the Ministry of Health published in the Official Gazette of the Federation the

"Agreement establishing the preventive measures that must be implemented to mitigate and

control health risks implied by the disease caused by the SARS-CoV2 virus (COVID-19)", which

establishes in its Second Article, subsection c) "Temporarily suspend the activities of the

public, social, and private sectors involving the physical concentration, transit, or displacement of people starting

from the entry into force of this Agreement and until April 19, 2020";

That on March 31, 2020, the Ministry of Health published in the Official Gazette of the Federation the

"Agreement establishing extraordinary actions to address the health emergency generated

by the SARS-CoV2 virus", which, in its First Article, fraction I, orders the immediate suspension, from March 30

to April 30, 2020, of non-essential activities, with the purpose of mitigating the dispersion and

transmission of the COVID-19 virus in the community;

That through the "Agreement modifying the similar one establishing extraordinary actions to address the

health emergency generated by the SARS-CoV2 virus, published on March 31,

2020", published on April 21, 2020 in the Official Gazette of the Federation, the Ministry of Health

deemed it necessary to maintain and extend the National Day of Healthy Distance until May 30, 2020,

as well as to ensure the adequate implementation and compliance with health security measures;

That on May 15, 2020, the Ministry of Health published in the Official Gazette of the Federation the "Agreement

modifying the one establishing a strategy for the reopening of social, educational, and economic

activities, as well as a regional traffic light system to evaluate weekly the epidemiological risk related to the

reopening of activities in each federal entity, as well as establishing extraordinary actions, published on May 14, 2020" with the objective

of establishing a mechanism involving the public, social, and private sectors to resume

activities under health security protocols, which guarantee both to their workers, as well as to the general

public that standards reducing risks associated with COVID-19 are being met;

That in this sense and particularly with respect to the financial system, there was a massive closure of

branches of various financial entities, in compliance with the sanitary measures declared by the

Federal Government for the period during which the contingency due to COVID-19 remains in effect; this translated

into one of the main challenges to guarantee the continuity of the offering and provision of financial

services to the general public, attending to the new normality, without neglecting or undermining the regime of

prevention of operations with proceeds of illicit origin and financing of terrorism;

That on April 1, 2020, the FATF issued a statement regarding the health emergency generated

by COVID-19 and measures to combat illicit financing, calling for (i) countries to explore the appropriate use of simplified identification measures and digital identification to facilitate

financial operations while mitigating risks of operations with proceeds of illicit origin and

financing of terrorism, and (ii) regulators, supervisors, and other authorities

involved in the matter, to provide the necessary assistance to the private sector regarding how the

regulation in this matter will be applied during the current health crisis;

That, although since March 2019 Investment Advisors have had a

non-presential identification regime, it was not a sufficient measure to address the needs of the general public

to enter into contracts and, at the same time, mitigate risks in matters of prevention of operations with proceeds

of illicit origin and financing of terrorism;

That in this sense and based on the FATF Digital Identification Guide, as well as in compliance with

Recommendations 10 and 15 of said group, it is necessary, as with other regulated participants

in the matter, to recognize the legal possibility that Investment Advisors can comply with

their obligations in matters of prevention of operations with proceeds of illicit origin and

financing of terrorism through the use of new technologies, of course with the responsibility

of complying with the applicable norms to the effect so that they have the value that corresponds in law;

That, in accordance with FATF Recommendation 10 which allows the application of simplified measures based on

a risk-based approach, it is considered relevant to foresee simplified identification requirements

for contracts considered low-risk that are offered by investment advisors;

That FATF Recommendation 1 and its Interpretative Note indicate that when countries identify

higher risks, they must ensure that their respective regimes for the prevention of operations with

proceeds of illicit origin and financing of terrorism address them adequately;

That, in this sense, when determining how the risk-based approach must be implemented in an

obligated subject, among others, supervisors must review the profiles and risk assessments of operations with

proceeds of illicit origin and financing of terrorism that obligated subjects implement, as well as

take into account the result of this review in the exercise of their supervisory powers;

That, based on the foregoing, it is considered necessary that the National Banking and Securities Commission,

as the supervisory authority, be aware of the exposure to risk of operations with proceeds of illicit origin and

financing of terrorism of investment advisors, through the collection of additional quantitative information that they provide;

That in attention to Article 78 of the General Law of Regulatory Improvement and with the purpose of complying with the

requirement of regulatory simplification for the issuance of this Resolution, the savings generated in the "Resolution amending, adding, and repealing various of the General Provisions

referred to in Article 226 Bis of the Securities Market Law, applicable to investment

advisors", adjudicated by the National Commission for Regulatory Improvement in file CONAMER /22/ 6124, with an amount of $101,107,044.55 pesos, will be taken;

And after hearing the opinion of the National Banking and Securities Commission, I have deemed it appropriate to issue the following:

RESOLUTION AMENDING, ADDING, AND REPEALING THE GENERAL PROVISIONS

REFERRED TO IN ARTICLE 226 BIS OF THE

SECURITIES MARKET LAW, APPLICABLE TO

INVESTMENT ADVISORS

SINGLE ARTICLE.- The 2nd, fractions VI and XI; 4th, second paragraph, fraction I, subsection b,

numeral i, second paragraph; 4th, penultimate paragraph; 4th Bis first, second, fourth, and sixth paragraphs; 5th,

second paragraph; 6th; 8th Bis; 8th Ter becomes 8th Quáter; 13th, first, fourth, and last paragraphs; 15th;

20th, first

paragraph; 24th first paragraph; Annex 2 articles 1, 2, and 4; are AMENDED; the 2nd, fraction XV Bis; 4th Bis third and

seventh paragraphs, with the rest being renumbered in order; 5th, third and fourth paragraphs; 8th Ter, with the rest

being renumbered in order; 12th, third and fourth paragraphs; 13th, fifth paragraph, with the rest being renumbered in

order; 37th Bis; Annex 2 Chapter I "Object", Chapter II "Thresholds for non-presential identification", Chapter

III "Technological Identification Mechanisms", Chapter IV "Requirements", and Chapter V "Other provisions", with

the articles being renumbered in order; are ADDED; and the 4th Bis, first paragraph, subsection a) and third paragraph;

Annex 2, article 3, all of them of the General Provisions referred to in Article 226 Bis of the

Securities Market Law, applicable to investment advisors, are REPEALED, to remain as follows:

2nd.- ...

I. to V. ...

VI. Device, the equipment that allows access to the internet, used to open accounts or

enter into contracts, as well as to carry out Operations; through internet pages or mobile applications,

among other technological developments, that Investment Advisors themselves make available to their

Clients to carry them out.

Devices that are owned by Investment Advisors, or are under their control, will not be considered Devices.

VII. to X. ...

XI. Geolocation, the geographic location of the Device used to enter into contracts or carry out

non-presential Operations, which consists of obtaining the geographic coordinates of latitude and longitude through the global positioning system (GPS) in which the

Device is located.

In the event that Clients enter into contracts or carry out non-presential Operations from a

Device that, due to its characteristics, cannot provide the geographic coordinates of latitude and

longitude through GPS, Investment Advisors must obtain the geographic coordinates of

latitude and longitude based on matching the Internet Protocol address provided by the

Client's Device with a geographic location, to obtain an approximation of said coordinates.

The geographic coordinates of latitude and longitude obtained through GPS or based on the

matching of the internet protocol address must be obtained with the prior consent of the Client in terms of the regulation applicable in matters of data protection;

XII. to XV.

...

XV Bis. Technological Identification Mechanisms, any of the procedures referred to in

Annex 2, through which Investment Advisors carry out the comparison of the valid identification document and the application of life tests;

XVI. to XXVIII.

...

4th.-

...

...

I.

...

a)

...

b) ...

i.

...

For the purposes of what is provided in this subsection, the following issued by Mexican authorities will be considered as valid personal identification documents: the voter credential, the passport, the professional ID, the national military service card, the consular enrollment certificate, the military identity credential, the card of affiliation to the National Institute of Older Adults, the credentials and cards issued by the Mexican Social Security Institute, by the Institute for Social Security and Services for State Workers, by the Social Security Institute for the Mexican Armed Forces, or by Popular Insurance, the driver's license, the credentials issued by federal, state, and municipal authorities, and the other national identifications that, if applicable, are approved by the Commission. Likewise, regarding natural persons of foreign nationality referred to in this fraction, in addition to those previously referred to in this paragraph, the passport or passport card, or the documentation issued by the National Institute of Migration that accredits their migratory status, as well as the accreditation card issued by the Ministry of Foreign Affairs to diplomatic or consular bodies, will be considered as valid personal identification documents.

ii. to v. ...

II. to VIII. ...

...

...

...

The identification requirements provided in this Provision will be applicable to all types of contracts

entered into by Investment Advisors, including numbered and coded ones; without prejudice to what is provided

in the 8th Ter of these Provisions regarding the integration of simplified files.

...

4th Bis.- Investment Advisors who enter into a contract through Devices in a non-presential manner with

Clients who are natural persons with business activity or legal entities, all

of Mexican nationality, in accordance with Annex 2 of these Provisions, in addition to the identification data,

as applicable, referred to in the 4th of these Provisions, must request and

obtain from their Clients the Geolocation of the Device from which they enter into the contract, as well as:

I. Regarding Clients who are natural persons who declare to the Investment Advisor to be of Mexican

nationality:

a) Repealed.

b) Consent that may be obtained through Electronic Signature or Advanced Electronic Signature.

Such consent will serve as proof to legally accredit the opening of the account, the celebration of the contract

that it carries out with the Investment Advisor in a non-presential manner.

c)

...

d) If applicable, Standardized Banking Key (CLABE) of an account opened in some financial entity

or Foreign Financial Entity authorized to receive deposits whose holder coincides with the name referred to in the 4th,

fraction I, subsection a), numeral i of these Provisions.

e) The statement of the natural person in which it indicates that it acts on its own behalf. Such

statement may be established in the Terms and Conditions to that effect established by the Investment

Advisor.

f) The digital version of the valid official personal identification document currently in force from which the

data referred to in this Provision originate.

g) The digital version of the proof of address, which may be any of those indicated in the 4th,

fraction

I, subsection b), numeral iii., of these Provisions.

However, when the declared address coincides with that of the voter credential of the Client

issued by a Mexican authority, in the event that it has been identified with the same, this will function as the

proof of address referred to in this subsection.

II. Regarding Clients who are legal entities of Mexican nationality:

a) Email.

b) If applicable,

Standardized Banking Key (CLABE) of an account opened in some financial entity

or Foreign Financial Entities authorized to receive deposits, whose holder coincides with the denomination or

trade name referred to in the 4th, fraction II of these Provisions.

c) Consent that may be obtained through Electronic Signature or Advanced Electronic Signature, of the

legal representative. Such consent will serve as proof to legally accredit the celebration of the contract

that it carries out with the Investment Advisor in a non-presential manner.

d) The information referred to in the 4th, fraction II, subsection c) and fraction VI of these Provisions.

e) The digital version of the identification documents referred to in the 4th, fraction II, subsection b) of the

these Provisions, with the exception of those indicated in numeral ii of the same subsection.

Investment Advisors must not carry out the celebration of the contract in a non-presential manner,

when they do not collect the data related to Geolocation.

Investment Advisors will not be obligated to collect the data related to Geolocation

regarding the societies, dependencies, and entities referred to in Annex 1 of these

Provisions, provided that the aforementioned societies, dependencies, and entities have been classified

as Clients with a Low Risk Grade in terms of the 13th

of these Provisions.

Paragraph repealed.

A valid official personal identification document currently in force for the fulfillment of the

present provision will be understood as the voter credential issued by the National Electoral Institute in the country or through the

consular offices of the Ministry of Foreign Affairs abroad, the passport, and the

consular enrollment certificate both issued by the Ministry of Foreign Affairs in the country or through

its consular offices abroad.

...

The digital version of the valid official personal identification document that Investment

Advisors collect for identification purposes must allow its verification in terms of the

these Provisions.

Additionally, the digital versions of the documents that Investment Advisors collect

must be preserved in their Files or Records in accordance with these Provisions. Investment Advisors must preserve documents in accordance with the official Mexican standard on digitalization and preservation of Data Messages applicable or consider an international standard provided that the compliance standard has at least the requirements of the official Mexican standard and does not contravene it.

...

5th.- ...

Regarding contracts entered into in accordance with the 4th Bis of these Provisions, in substitution for the

interview referred to in the previous paragraph, Investment Advisors may establish the Technological

Identification Mechanisms referred to in Annex 2 of these Provisions.

With respect to low-Risk contracts referred to in the 8th Ter of these Provisions, Investment

Advisors may carry out the remote reception or capture of data in substitution for the

interview mentioned in the first paragraph of this provision, provided that the Investment Advisor of

whom it is a matter, verifies the authenticity of the Client's data, for which they must, either directly or through a third party, make a query to the National Population Registry in order to integrate the Unique Key of the Population Registry of the Client and, validate that the data provided remotely by the same, with the exception of the address, coincide with the records existing in the databases of said Registry.

The validation of the identification data referred to in this Provision may be carried out through

procedures different from those indicated in the previous paragraph, with prior authorization of the Commission, with the opinion of the Ministry.

6th.- Investment Advisors must preserve, as part of the identification file of each

of their Clients, the data and documents mentioned in the Provisions of this Chapter, as applicable, the document containing the results of the interview or of the Technological Mechanisms of

identification referred to in the 5th, as applicable, the one regarding the visit referred to in the 9th,

if applicable, and the questionnaire provided in the 13th of these Provisions.

8th Bis.- For the carrying out of Operations through electronic, optical, or any other

technology, Investment Advisors must previously integrate the Client's identification file in accordance with what is established in these Provisions, establish mechanisms to identify

the same, as well as develop procedures to prevent the improper use of said means or technology, which

must be contained in their Compliance Manual or in another document or manual

drafted by the Investment Advisor itself.

8th Ter.- Regarding Clients who are natural persons whose contracts stipulate the carrying out of

Limited Operations up to transactional levels below three thousand Investment Units per Client and per

Investment Advisor, during the course of a calendar month, the Investment Advisor

may integrate the

respective identification files of their Clients, only with the data relating to the full name, without abbreviations, date of birth and address of these, composed of the elements referred to in the 4th of these Provisions. In this case, the data relating to the name and date of birth of the Client must be obtained from a valid identification document indicated in the aforementioned 4th of these Provisions.

Regarding contracts concluded remotely in accordance with what is established in the 5th, third paragraph of these Provisions, Investment Advisers must integrate the identification files of their Clients with the data relating to the full name, without abbreviations, gender, state of birth, date of birth, as well as address of these, composed of the elements referred to in the 4th of these Provisions.

In all cases, the reference value for the corresponding Investment Units shall be that applicable on the last day of the calendar month preceding that in which the calculation of the transaction level in question is carried out.

Likewise, by transaction level shall be understood the sum of all amounts for any Operation. In the event that the established transaction level is exceeded in the first paragraph of this Provision, Investment Advisers must proceed to carry out the in-person interview referred to in the 5th of these Provisions or follow one of the Technological Identification Mechanisms provided for in Annex 2, respectively, of these Provisions and integrate the respective Client's identification file with all the information and documentation that corresponds, in terms of what is provided in the 4th or 4th Bis of these Provisions, as well as comply with the various obligations established in them.

Likewise, Investment Advisers must inform their Clients that they will not be able to carry out Operations above the transaction level until the identification process that corresponds is concluded.

8th Quater. -...

...

...

...

...

12th.- ...

...

The Geolocation referred to in the previous paragraph may cover the various Operations carried out by the Client in the active session within the Internet page or mobile application, among other technological developments, that Investment Advisers make available to their Clients to carry them out.

Investment Advisers will not be obliged to take into account the data relating to Geolocation in terms of this Provision, regarding the societies, dependencies and entities referred to in Annex 1 of these Provisions, provided that the aforementioned societies, dependencies and entities have been classified as Clients with a Low Risk Grade in terms of the 13th of these Provisions.

13th.- The application of the customer knowledge policy must be based on the Risk Grade that a Client represents, such that, when the Risk Grade is higher, the Investment Adviser must collect more information about their predominant economic activity, as well as carry out stricter supervision of the behavior of Clients related to the Operations for which they are provided by Investment Advisers.

...

...

In the case of the celebration of non-presential contracts referred to in the 4th Bis of these Provisions, Investment Advisers must consider the Geolocation information of the Device from which the Client carries out the Operation with the respective Investment Adviser.

Investment Advisers will not be obliged to consider Geolocation information in terms of this Provision, regarding the societies, dependencies and entities referred to in Annex 1 of these Provisions, provided that the aforementioned societies, dependencies and entities have been classified as Clients with a Low Risk Grade in terms of this Provision.

...

...

...

...

To determine the Risk Grade in which Clients should be located, as well as whether they should be considered Politically Exposed Persons, each of the Investment Advisers will establish in their Compliance Manual the criteria conducive to that end, which take into account, among other aspects, the Client's background, their profession, activity or business sector, the origin and destination of their resources, the place of their residence, Geolocation, the methodology referred to in Chapter II Bis of these Provisions and the other circumstances determined by the Investment Adviser itself.

15th.- Prior to the celebration of contracts with Clients who, due to their characteristics, are classified with a High Risk Grade by the Investment Adviser, at least one executive or their equivalent who has specific powers to approve the celebration of such contracts must grant, in writing, in digital or electronic form, the respective approval. Likewise, for the purposes referred to in fractions IV and X of the 30th of these Provisions, Investment Advisers that are legal entities must provide in their Compliance Manual, the mechanisms for their respective Representatives to have knowledge of those Clients that are classified with a High Risk Grade by the Investment Advisers themselves that are legal entities, as well as the procedures that must be carried out to process the approval indicated in this provision.

20th.- For each Unusual Operation detected by an Investment Adviser, it must send to the Secretariat, through the Commission, the corresponding report, within three business days following that in which its Representative dictates it as such. For the purposes of carrying out the aforementioned determination, the Investment Adviser through its Representative will have a period that will not exceed sixty natural days counted from when the alert is generated through its system, model, process or by the employee of the Investment Adviser, whichever occurs first.

...

24th.- For each Concerning Internal Operation detected by an Investment Adviser, it must send to the Secretariat, through the Commission, the corresponding report, within three business days following that in which its Representative dictates it as such. For the purposes of carrying out the aforementioned determination, the Investment Adviser through its Representative will have a period that will not exceed sixty natural days counted from when said Investment Adviser detects that Operation, through its system, model, process or by any employee thereof, whichever occurs first.

...

...

...

...

...

...

37th Bis. - Investment Advisers must send to the Commission, within the last ten business days of the month of April of each year, through electronic means and in the official format issued for such effect, quantitative information about their operations, channels, type of Clients, type of products and services, as well as the geographic zones where they operate. This information must correspond to the period from January to December of the year prior to that in which it must be sent, or to the period resulting from the date on which the Commission grants the registration to operate to the Investment Adviser in question to December of the respective year.

Annex 2

...

Chapter I " Object "

Article 1.- This Annex has the purpose of establishing the minimum measures and procedures that Investment Advisers must observe in order to comply with the 4th Bis of these Provisions, without prejudice to the compliance with the various obligations established in them.

Chapter II " Thresholds for non-presential identification "

Article 2.- Investment Advisers must observe the following thresholds by type of Technological Identification Mechanism and service for which they request authorization from the Commission for the purposes of compliance with the 4th Bis of these Provisions.

Regarding the Technological Identification Mechanism provided for in Article 4 of this Annex, in the non-presential celebration of contracts with applicants who are natural persons, natural persons with business activity or legal entities, all of Mexican nationality, the sum of the Operations must not exceed the equivalent in national currency to 30,000 Investment Units during a calendar month.

Likewise, by transaction level shall be understood the sum of all amounts for any Operation. In the event that the transaction level exceeds the maximum amount established in the previous paragraph, the Investment Adviser must carry out the Technological Identification Mechanism referred to in article 5 of this Annex if it has the corresponding authorization or carry out the in-person interview referred to in the first paragraph of the 5th of these Provisions and integrate the identification file of the respective Client with all the information and documentation that corresponds, in terms of what is provided in the 4th or 4th Bis of these Provisions, as well as comply with the various obligations established in them. Likewise, Investment Advisers must inform their Clients that they will not be able to carry out Operations until the identification process that corresponds is concluded.

Investment Advisers must take as the reference value for the Investment Units referred to in this article, that applicable on the last day of the calendar month preceding that in which the calculation of the transaction level in question is carried out.

Chapter III " Technological Identification Mechanisms "

Article 3.- Investment Advisers may opt for one or both of the Technological Identification Mechanisms indicated in articles 4 or 5 of this Annex subject to the thresholds indicated in article 2 of this Annex.

Without prejudice to the foregoing, additionally Investment Advisers may carry out the Technological Identification Mechanism referred to in article 5 of this Annex subject to the thresholds referred to in the second paragraph of article 2 of this Annex.

Article 4.- Investment Advisers must have technology that allows identifying the applicant through a recording containing image and sound, which must be preserved without edits in its total duration during the entire validity of the contract and, once this concludes, for a period of at least five years from the conclusion of the contractual relationship.

Additionally, during the development of the Technological Identification Mechanism referred to in the previous paragraph, Investment Advisers must observe the following:

a) Register the time and date of its realization obtained from a protected time server.

b) Implement it through automated tools that allow its recording and subsequent reproduction.

c) Verify that the quality of the image and sound allows the full identification of the applicant, according to the parameters established by the Investment Advisers themselves for such effect.

d) Require the applicant to show the valid identification document sent together with the form referred to in fraction III of article 7 of this Annex, both on the front and back, verifying that it contains the same data and photograph as the valid identification document previously sent.

e) Use specialized technology that allows them to achieve reliable identification of the applicant, ensuring that there is a match between their face and that of the valid identification document previously sent.

f) Perform a liveness test on the applicant.

For the purposes of the foregoing, a liveness test shall be understood as technical tests based on algorithms, to measure and analyze the anatomical characteristics or voluntary and involuntary reactions of the applicant, in order to determine if a biometric sample is being captured from a subject with life present at the point of capture.

Article 5.- Investment Advisers must verify the coincidence of the biometric information of the applicant either with the records of the National Electoral Institute, the Secretariat of Foreign Relations or with those of any other Mexican authority that provides a biometric information verification service.

In the event that the biometric information referred to in the previous paragraph is the fingerprints of the applicant, Investment Advisers must ensure that the applications or means they have available ensure that the fingerprint is obtained directly from the applicant, that is, a live fingerprint test, avoiding the registration of fingerprints coming from impressions on any material that intends to simulate the fingerprint of another person or images that pursue such an end, and have security measures that guarantee that the stored, processed or sent information through said applications or means is not known or used by unauthorized third parties, as well as authenticate that the fingerprint obtained from the applicant coincides, at least, in ninety percent with the records of the databases either of the National Electoral Institute, the Secretariat of Foreign Relations or with those of any other Mexican authority that provides a biometric information verification service.

Additionally, Investment Advisers must have technology that allows identifying the applicant through a recording containing image and, if applicable, sound, which must be preserved without edits in its total duration during the entire validity of the account or contract and, once this concludes, for a period of at least five years from the conclusion of the opening of the account or contractual relationship, and must observe the requirements referred to in article 4, second paragraph of this Annex. To comply with item c) it will be necessary to verify the quality of the sound when applicable.

Article 6.- In the event that the National Electoral Institute, the Secretariat of Foreign Relations or any other Mexican authority that provides a biometric information verification service, cannot respond to the requests for biometric information verification referred to in article 5 of this Annex due to technical or communication failures attributable to the corresponding Mexican authority, Investment Advisers may, in case of having the corresponding authorization, carry out the Technological Identification Mechanism of article 4 of this Annex 2, subject to the corresponding limits.

In the event that the transaction level exceeds the maximum amount established for the Technological Identification Mechanism referred to in article 4 of this Annex, the Investment Adviser must carry out the in-person interview referred to in the 5th of these Provisions or apply the Technological Identification Mechanism provided for in article 5 of this Annex, in case of having the corresponding authorization of the latter, and integrate the identification file of the respective Client with all the information and documentation that corresponds, in terms of what is provided in the 4th or 4th Bis of these Provisions, as well as comply with the various obligations established in them.

Likewise, Investment Advisers must inform their Clients that they will not be able to carry out operations above the limit until the identification process that corresponds is concluded.

Chapter IV " Requirements "

Article 7.- Additionally, for the purposes of what is established in this Annex, Investment Advisers must:

I. Obtain prior authorization from the Commission.

The authorization referred to in the previous paragraph will not be necessary when Investment Advisers are subject to the thresholds referred to in the second paragraph of article 2 of this Annex and carry out the Technological Identification Mechanism referred to in article 5 of this Annex. In this case, Investment Advisers must inform the Commission in advance of the services and the date on which they will start offering them, through the electronic means indicated by the latter.

Likewise, Investment Advisers must observe what is established in fractions II to VII of this article, as well as the requirements provided for in articles 8 and 9 of this Annex.

Investment Advisers must conserve all the information and supporting documentation, which must be available to the Commission, at the request of the latter, within the timeframe established by the Commission itself.

For the purposes of this fraction, the Investment Adviser must present the authorization request through a free written document addressed to the Commission, which must resolve in accordance with the timeframes provided for in the applicable financial law.

II. Require the applicant to declare if they are already a Client of the Investment Adviser. In the event that the declaration is affirmative, the Investment Adviser must observe what is provided in fraction IV of this article. Regardless of the applicant's declaration, the Investment Adviser must complete their identification file according to the product they intend to contract.

III. Require the applicant who has declared not to be a Client of the Investment Adviser to send a form through the electronic means established by the Investment Adviser for such effect, in which the identification data referred to in the 4th Bis of these Provisions must be included, as well as the specification of the service intended to be contracted.

The aforementioned form must include a statement indicating that its submission to the Investment Adviser in question constitutes the applicant's acceptance for their image and, if applicable, their voice, to be recorded in one of the Technological Identification Mechanisms referred to in Chapter III of this Annex. This statement may be made through automated tools that allow its recording and subsequent reproduction.

IV. In the event that the applicant declares to be a Client of the Investment Adviser, this must verify at least the data of full name, Client number and Unique Population Registry Key of the Client, as well as the other data that the Investment Adviser itself determines in order to corroborate against its own records that, in fact, it is a Client, and in case that is so, the Investment Adviser must authenticate it with a category 3 authentication factor.

A category 3 authentication factor shall be understood as the information contained, received or generated by electronic means or devices, as well as that obtained by devices generating dynamic passwords of single use. Such means or devices must be provided by Investment Advisers to their Clients and the information contained, received or generated by them must meet the following characteristics:

a) Have properties that prevent their duplication or alteration.

b) Be dynamic information that cannot be used more than once.

c) Have a validity that cannot exceed two minutes.

d) Not be known prior to its generation and use by officials, employees, representatives of the Investment Adviser or by third parties.

In the event that the verification referred to in the first paragraph of this fraction is successful, the Investment Adviser may proceed to the contracting of the services provided for in article 2 of this Annex, without the need to carry out what is established in fractions V to VII below.

When the verification referred to in this fraction is not successful, the Investment Adviser must observe the same requirements provided for in this Annex for applicants who declare not to be Clients.

V. If the Investment Adviser corroborates that the applicant is not their Client, together with the form referred to in fraction III of this article, they must require the applicant to send a color photograph of any of the valid identification documents, referred to in the 4th Bis of these Provisions, on the front and back and verify the security elements, in order to detect if they present alterations or inconsistencies, for which they must have the necessary technology for this.

Repealed.

Repealed.

...

Repealed.

Regarding the voter credential issued by the National Electoral Institute in the country or through the consular offices of the Secretariat of Foreign Relations abroad, Investment Advisers must verify the coincidence of the data listed below, with the records of the Institute itself or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) The Credential Identifier Code (CIC), which is printed on the voter credential or, if applicable, the Optical Character Recognition Code (OCR).

b) to d)

...

Investment Advisers must verify that the full name, as it appears on the presented voter credential, coincides with the records of the National Electoral Institute or the National Population Registry or with those of any other Mexican authority that provides a verification service regarding said identification document.

Regarding the Mexican passport issued by the Secretariat of Foreign Relations in the country or through its consular offices abroad, Investment Advisers must verify the coincidence of the data mentioned below with the records of the Secretariat itself or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) The Optical Character Recognition Code (OCR).

b) Full name, as it appears on the Mexican passport.

c) Passport Number.

In the case of the consular enrollment certificate issued by the consular offices of the Secretariat of Foreign Relations abroad, Investment Advisers must verify the coincidence of the data mentioned below with the records of the Secretariat itself or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) Full name, as it appears in the consular registration certificate.

b) Date of issue and date of expiration.

c) Document number.

Additionally, Investment Advisors must require the applicant to send in digital format the documents necessary to integrate and preserve their identification file in accordance with what is provided in the 4th Bis of these Provisions.

VI. Inform the applicant of the procedure to be followed in the corresponding Technological Identification Mechanism provided for in Chapter III of this Annex and what the access means are for its implementation, as well as deliver a one-time use code, which will be required from the applicant at the start of the respective Technological Identification Mechanism.

Repealed.

VII. Investment Advisors must suspend the hiring process of the applicant when any of the following cases occur:

a) The quality of the image and, if applicable, the sound do not allow for full identification of the applicant.

b) The applicant does not present the valid identification document previously sent along with the form referred to in fraction III of Article 7 of this Annex, the data obtained from this do not match the records of the National Electoral Institute, the Secretariat of Foreign Relations, the National Population Registry or with those of any other Mexican authority that provides a biometric information verification service regarding said identification document, or the result of the validation of the elements of the mentioned documents, or of the biometric verifications of the applicant's face referred to in the previous Article 5, does not reach the effectiveness or level of reliability referred to in fraction VII of Article 9 of this Annex.

c) and d)

...

e) Atypical or risky situations arise, or the Investment Advisor has doubts about the authenticity of the valid identification document or the identity of the applicant.

Repealed.

In the event of suspension of the hiring process for the causes mentioned in the previous subsections, Investment Advisors must store the obtained information and documentation for at least 30 natural days, with the objective that, in case of resuming hiring processes, it is corroborated that the information is consistent. Additionally, the aforementioned information and documentation must be used by Investment Advisors in the controls provided for in these Provisions.

For the case of Clients or applicants who are legal entities, for the purposes of identifying their agents or legal representatives, Investment Advisors must observe the same procedures indicated in this article, with the exception that, for the case of applicants who declare not to be Clients, the sending of the form referred to in fraction III of this article must be done through a file signed with the Advanced Electronic Signature of the legal entity in question.

The technology used for the procedures referred to in this Annex must be approved by the risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors or the sole administrator of the Investment Advisor.

Article 8.- Investment Advisors must have the necessary means for the transmission and safeguarding of the information, data and files generated in the identification procedures referred to in Article 7 of this Annex, which guarantee the integrity of said information, as well as the correct reading of the data, and the impossibility of its manipulation, as well as its adequate security, conservation and location.

Investment Advisors may use technological improvements that help compensate for the clarity of the images, when any of the valid identification documents are shown and the facial recognition of the applicant is performed, which must be approved by their risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors or sole administrator except in the case of Investment Advisors who are natural persons.

Chapter V "Other provisions"

Repealed.

Article 9.- Investment Advisors, when requesting the authorization referred to in Article 7, must present the following:

I. Detailed description of the non-presential identification process, as well as of the Technological Infrastructure used in each part of this, specifying the function of each component of said infrastructure, which must be approved by the risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors or sole administrator, except in the case of Investment Advisors who are natural persons.

Likewise, Investment Advisors must include all technology providers that intervene in the Technological Infrastructure and, if applicable, the main applications used for the referred process and their interrelation.

II. Description of the electronic means used so that applicants send, if applicable, the form and documents through a secure channel considering, at least, the type of transmission of the device to the node that receives the form information, such as the secure hypertext transfer protocol (HTTPS) or the TLS (Transport Layer Security) version 1.2 or higher security protocol.

III. Name of the certification service provider authorized by the Secretariat of Economy used for the conservation of the digital version of any of the valid identification documents referred to in the 4th Bis of these Provisions, in accordance with the Official Mexican Standard on digitalization and conservation of Data Messages applicable or consider an international standard whenever the compliance standard has at least the requirements of said official Mexican standard and does not contravene it.

IV. Network diagram showing all components of the Technological Infrastructure that are part of the non-presential identification process, including the segregation of communication networks and perimeter security equipment, considering redundancy schemes.

Repealed.

V. Detailed information on whether images of valid identification documents, recordings and biometric information will be kept in service provider facilities or of the Investment Advisor itself, describing the controls for access management and mechanisms for their storage.

VI. Evidence that the means of verification of the validity of identification documents have the effectiveness approved by the risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors or sole administrator of the Investment Advisors, except in the case of Investment Advisors who are natural persons.

VII. If applicable, evidence that the systems, tools or mechanisms used for facial identification recognitions or the verifications of any other biometric element that are used, have the level of reliability determined by the risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors or sole administrator of the Investment Advisor, except in the case of Investment Advisors who are natural persons.

VIII. If applicable, detailed information on the calibration tests of the systems, tools or mechanisms used for facial identification recognitions or the verifications of any other biometric element that are used.

These tests must be carried out in accordance with the thresholds established by the Investment Advisor, which must contemplate the results of these tests, and the adjustments of the validation engine derived from them. Investment Advisors must accompany their authorization request with evidence of all the above.

IX. Image quality standards and, if applicable, sound.

X. If applicable, the technical description of category 3 authentication factors that will be required to corroborate that an applicant is a Client of the Investment Advisor, in accordance with what is provided in Article 7 of this Annex, as well as the characteristics of the one-time use code.

XI. Mechanisms through which they will securely transmit and safeguard the information, data and documents generated in the non-presential identification procedure.

XII. Mechanisms used to guarantee the integrity, correct reading, impossibility of manipulation and adequate security, conservation and location of the information, data and documents referred to in this Annex.

XIII. Encryption mechanisms in the communication channels used in the non-presential identification process, indicating the information that will be transmitted through each of said channels.

XIV. Mechanisms used for access management to systems, as well as policies for access management, which include the use of robust passwords.

XV. Policies and procedures for information security incident management.

XVI. Mechanisms or tools used for monitoring and blocking of hirings that present the situations described in subsection e) of fraction VII of Article 7 of this Annex.

XVII. Conduct tests aimed at detecting vulnerabilities and threats, as well as penetration tests on the different components of the Technological Infrastructure used in the process, whether own or third-party. The aforementioned penetration tests must be carried out by an independent third party that has personnel who have the technical capacity proven by specialized industry certifications in the matter.

Investment Advisors must provide the Commission with evidence of the performance of the tests referred to in fractions VIII and XVII of this article, before implementing the scheme that has been authorized to them in accordance with Article 7 of this Annex.

It shall be the responsibility of Investment Advisors who hire third parties to store, process and transmit information in the non-presential hiring process, the supervision of compliance with this article, at least once a year, as well as the obligation to have the evidence that supports it, which they must have available to the Commission at all times.

When Investment Advisors intend to modify any of the procedures that they have authorized to comply with Article 4 or Article 5, as applicable, of this Annex, they will require the prior authorization of the Commission.

Transitory Provisions

First. - This Resolution will enter into force the day after its publication in the Official Gazette of the Federation except for what is provided in the following Transitory Provisions.

Second. - The guidelines, interpretations and criteria issued by the Secretariat or by the Commission, based on what is provided in the Resolution of December 31, 2014 and subsequent Resolutions through which the General Provisions referred to in Article 226 Bis of the Securities Market Law, applicable to investment advisors, have been added or reformed, will continue to be applicable insofar as they do not oppose what is established in this Resolution.

Third.- Investment Advisors, who have obtained the approval of the Commission for the non-presential identification mechanisms in terms of Annex 2 of the General Provisions referred to in Article 226 Bis of the Securities Market Law, applicable to Investment Advisors, in force until before the entry into force of this Resolution, will have a period of twelve months, counted from the entry into force of this Resolution, to present to said Commission a new authorization request in compliance with Article 7, fraction I of Annex 2 that is reformed with this instrument.

The authorization referred to in the previous paragraph will remain valid until such time as the Commission resolves on the authorization request that the Investment Advisors have presented to said Commission in accordance with Annex 2 of the Provisions referred to in Article 226 Bis of the Securities Market Law, applicable to Investment Advisors, which are reformed with this Resolution.

Fourth. - Investment Advisors must comply with the obligations contained in this Resolution, in the terms and in accordance with the deadlines indicated below:

I. Four months counted from the entry into force of this Resolution to modify the Compliance Manual and present it to the Commission.

II. Nine months counted from the date of entry into force of this Resolution, to modify the methodology referred to in Chapter II Bis of the Provisions.

III. Eighteen months counted from the date of entry into force of this Resolution, to update the automated systems referred to in the 27th of the Provisions.

Fifth.- In the event that Investment Advisors update the assumption provided in Article 7, fraction I second paragraph of Annex 2 that is reformed with this Resolution, they must inform through the email prevencion.lavado@cnbv.gob.mx, through a free written document addressed to the General Directions of Prevention of Operations with Resources of Illicit Origin A and B of the Commission, the situation provided for in said article until the Commission establishes the appropriate electronic means so that Investment Advisors comply with what is provided for in said article.

Sixth. - Investment Advisors must begin to send to the Commission the information referred to in the 37th Bis that is added in this Resolution, from the date indicated in the resolution that the Commission issues for such effects.

Seventh. - Investment Advisors may equate the defined term of Beneficial Owner referred to in these Provisions to the references of final beneficiary that are provided for in other legal orders in matters of prevention of operations with resources of illicit origin and financing of terrorism, as well as in the consultation databases in charge of the competent authorities.

Mexico City, January 4, 2023.- The Secretary of Finance and Public Credit, Rogelio Eduardo Ramírez de la O. - Rubric.

In the document you are viewing, there may be text, characters or objects that are not displayed correctly due to conversion to HTML format, so we recommend always taking the digitized image of the DOF or the PDF file of the edition as a reference. The content, form and scope of the published documents are the strict responsibility of their issuer.

CONSULT

BY DATE

Do Lu Ma Mi Ju Vi Sá

INDICATORS

Exchange Rate and Rates as of 08/27/2026

DOLLAR 16.9660 UDIS 8.808255 TIIE 28 DAYS 6.7559% TIIE 91 DAYS 6.7931% TIIE 182 DAYS 6.8474% TIIE DE FONDEO 6.50%

See more

SURVEYS

Did you like the new image of the Official Gazette of the Federation website?

No Yes

Official Gazette of the Federation

Río Amazonas No. 62, Col. Cuauhtémoc, C.P. 06500, Mexico City Tel. (55) 5093-3200, where you can access our service menu

Electronic address: dof.gob.mx

113

LEGAL NOTICE | SOME RIGHTS RESERVED © 2026