Resolution amending, adding to, and repealing the General Provisions referred to in Article 129 of the Credit Unions Law

DOF: 20/01/2023

RESOLUTION amending, adding to, and repealing the General Provisions referred to in Article 129 of the Credit Unions Law

A seal with the National Emblem is placed at the margin, which reads: United Mexican States.- TREASURY.- Ministry of

Treasury and Public Credit.

RESOLUTION AMENDING, ADDING TO, AND REPEALING THE GENERAL PROVISIONS REFERRED TO

IN ARTICLE 129 OF THE CREDIT UNIONS LAW

ROGELIO EDUARDO RAMÍREZ DE LA O, Secretary of Treasury and Public Credit, based on

the provisions of articles 31, sections VII and XXXII, of the Organic Law of the Federal Public Administration;

129 of the Credit Unions Law, in the exercise of the powers conferred upon me by article 6º,

section XXXIV, of the Internal Regulations of the Ministry of Treasury and Public Credit, and with the

prior opinion of the National Banking and Securities Commission issued via letter number 221/ DGPORPIA-2508781/2022 and 213-2/2513063/37/2022 dated November 24, 2022; and

CONSIDERING

That since the year 2000 Mexico has been a full member of the Financial Action Task Force (FATF),

an intergovernmental body that sets international standards in matters of prevention and combat against

operations with proceeds of illicit origin and terrorist financing;

That on March 22, 2019, the Ministry of Treasury and Public Credit published in the Official Gazette of the

Feder various modifications to the General Provisions referred to in Article 129 of

the Credit Unions Law, with the object of addressing the recommendations of the FATF and establishing a

non-presidential identification regime, thereby granting the possibility to credit unions to carry out

client identification through a real-time online videoconference, as well as the obligation

for those entities to obtain geolocation of their clients; which resulted in a strengthening of the

risk assessment methodology so that such entities evaluate their risks of being used to carry out

operations with proceeds of illicit origin and terrorist financing prior to the use of

new technologies;

That on March 6, 2020, the FATF published the Digital Identification Guide, resulting as a

turning point in the topic of financial technology, showing the benefits of digital identity in matters of

prevention and combat against operations with proceeds of illicit origin and terrorist financing,

presenting financial technology as a more reliable and secure method for financial entities

when carrying out client identification through the use of mechanisms such as

proof of life, the use of biometric elements and authentication factors, among others, which allow the

mitigation of risks of operations with proceeds of illicit origin and terrorist financing;

That on March 11, 2020, the World Health Organization declared the disease caused by the

SARS-CoV2 virus (COVID-19) as a pandemic, making a call to countries to: (i) adopt measures

urgent and aggressive to contain the spread of the virus, (ii) implement an approach based on the

participation of the entire government and society, around a comprehensive strategy directed to prevent

infections, save lives, and minimize their effects, and (iii) find a delicate balance

between the

protection of health, the minimization of social and economic disruptions, and respect for human

rights;

That on March 24, 2020, the Ministry of Health published in the Official Gazette of the Federation the

"Agreement establishing the preventive measures that must be implemented for the mitigation and

control of health risks implied by the disease caused by the SARS-CoV2 virus (COVID-19)", which

establishes in its Article Two, subsection c) "Temporarily suspend the activities of the sectors

public, social, and private that involve physical concentration, transit, or displacement of people starting from

the entry into force of this Agreement and until April 19, 2020";

That on March 31, 2020, the Ministry of Health published in the Official Gazette of the Federation the

"Agreement establishing extraordinary actions to address the health emergency generated

by the SARS-CoV2 virus", which, in its Article One, section I, orders the immediate suspension, from March 30

to April 30, 2020, of non-essential activities, with the purpose of mitigating the dispersion and

transmission of COVID-19 in the community;

That through the "Agreement modifying the similar one establishing extraordinary actions to address the

health emergency generated by the SARS-CoV2 virus, published on March 31,

2020", published on April 21, 2020 in the Official Gazette of the Federation, the Ministry of Health

deemed it necessary to maintain and extend the National Day of Healthy Distance until May 30, 2020,

as well as to ensure the adequate implementation and compliance with health safety measures;

That on May 15, 2020, the Ministry of Health published in the Official Gazette of the Federation the "Agreement

modifying the one establishing a strategy for the reopening of social, educational, and economic activities,

as well as a regional traffic light system to evaluate weekly the epidemiological risk related to the

reopening of activities in each federal entity, as well as establishing extraordinary actions, published on

May 14, 2020" with the objective

of establishing a mechanism involving the public, social, and private sectors to resume

activities under health safety protocols, which guarantee both to their workers, as well as to the public

general that standards reducing risks associated with COVID-19 are being met;

That in this sense and particularly with respect to the financial system, there was a massive closure of

branches of various financial entities, in compliance with the sanitary measures declared by the

Federal Government for the period during which the contingency due to COVID-19 is in effect; which translated

into one of the main challenges to guarantee the continuity of the offering and provision of financial

services to the general public attending to the new normality, without neglecting or undermining the regime

of prevention of operations with proceeds of illicit origin and terrorist financing;

That on April 1, 2020, the FATF issued a statement regarding the health emergency generated

by COVID-19 and measures to combat illicit financing, making a call for (i) countries to explore the appropriate use of simplified identification measures and digital identification to facilitate

financial operations while mitigating risks of operations with proceeds of illicit origin and

terrorist financing, and (ii) regulators, supervisors, and other authorities

involved in the matter, provide the necessary assistance to the private sector regarding how the

regulation in the matter will be applied during the current health crisis;

That, even though since March 2019 Credit Unions have had a non-presidential identification regime, it was not a sufficient measure to address the needs of the general public to celebrate

contracts and, at the same time, mitigate risks in matters of prevention of operations with proceeds of

illicit origin and terrorist financing;

That in this sense and based on the FATF Digital Identification Guide, as well as in compliance with

Recommendations 10 and 15 of said group, it is necessary, just as with other regulated participants

in the matter, to recognize the legal possibility that credit unions can comply with their

obligations in matters of prevention of operations with proceeds of illicit origin and terrorist financing through the use of new technologies, of course with the responsibility of complying with

the applicable norms to the effect so that they have the value that corresponds in law;

That Recommendation 1 of the FATF and its Interpretative Note state that when countries identify

higher risks, they must ensure that their respective regimes of prevention of operations with

proceeds of illicit origin and terrorist financing address them adequately;

That, in this sense, when determining how the risk-based approach must be implemented in an obligated subject, among others, supervisors must review the profiles and risk assessments of operations with

proceeds of illicit origin and terrorist financing that obligated subjects implement, as well as

take into account the result of this review in the exercise of their supervisory powers;

That, based on the foregoing, it is considered necessary that the National Banking and Securities Commission,

as the supervisory authority, know the exposure to risk of operations with proceeds of illicit origin and

terrorist financing of credit unions, through the collection of additional quantitative information that they provide;

That, additionally, in compliance with Recommendation 4 of the FATF and the content of the Mutual Evaluation Report,

issued by said intergovernmental body, in January 2018, it is necessary to strengthen the

legal framework regarding the formation of the List of Blocked Persons, given that our country,

as a member of the FATF, has recognized the formation of shell companies as a generalized technique to carry out operations with proceeds of illicit origin;

in this sense, the condition for inclusion in the List of Blocked Persons is added for those taxpayers referred to in the fourth paragraph of

article 69-B of the Federal Tax Code, the foregoing with the effect of preventing the commission of the crimes of

operations with proceeds of illicit origin and terrorist financing;

That in attention to article 78 of the General Law of Regulatory Improvement and with the purpose of complying with the

requirement of regulatory simplification for the issuance of this Resolution, the savings generated in the "Resolution amending, adding to, and repealing various of the General Provisions

referred to in Article 129 of the Credit Unions Law.", adjudicated by the National Commission for Regulatory Improvement in file CONAMER/22/5449, with an amount of $75,051,600.00

pesos, and

That once the opinion of the National Banking and Securities Commission has been heard, I have deemed it appropriate to issue the following:

RESOLUTION AMENDING, ADDING TO, AND REPEALING THE GENERAL PROVISIONS

REFERRED TO IN ARTICLE 129 OF THE CREDIT UNIONS LAW

SINGLE ARTICLE.- The 2nd, sections VIII and XIII; 4th, section I, subsection b, numeral i.,

second paragraph; 4th Bis, first, second, fourth, and sixth paragraphs; 6th, second paragraph; 7th; 12th; 18th, second

paragraph; 19th, first, fourth, and last paragraphs; 21st; 28th, first paragraph; 33rd, first paragraph; 38th Bis, first and

last paragraphs; 39th, first paragraph, sections I to III; 59th, last paragraph; Annex 2 articles 1, 2, and 4; are

AMENDED; the 2nd, sections XIX Bis and XXIII Bis; 4th Bis, third and seventh paragraphs, renumbering the others

in their order; 18th, third and fourth paragraphs; 19th, fifth paragraph, renumbering the others in their order; 52nd Bis;

60th, first paragraph, section VII; 63rd, first paragraph, section V; Annex 2 Chapter I "Object", Chapter II

"Thresholds for non-presidential identification", Chapter III "Technological Identification Mechanisms",

Chapter IV "Requirements" and Chapter V "Other provisions", renumbering the articles in their order, and are

REPEALED the 4th Bis, first paragraph, section I, subsection a) and third paragraph; Annex 2 article 3, all of them of the

General Provisions referred to in Article 129 of the Credit Unions Law, to remain as follows:

2nd.- ...

I. to VII Bis. ...

VIII. Device, the equipment that allows access to the internet, used to carry out account openings or

celebrate contracts, as well as carry out Operations through internet pages or mobile applications,

among other technological developments, that the Credit Unions themselves make available to their clients to carry

them out.

Devices shall not be considered those that:

a) Are owned by the Credit Unions.

b) Are under the control of the Credit Unions.

c) Are granted under additional controls by the Credit Unions to their Clients so that they can carry out

Operations, or

d) Are installed in the branches of the Credit Unions themselves or in public sites, complying with the

respective regulation so that Clients can carry out Operations.

IX. to XII. ...

XIII. Geolocation, the geographic location of the Device used to carry out non-presidential Operations, which consists of obtaining the geographic coordinates of latitude and longitude through the global positioning system (GPS) in which the Device is located;

In the event that Clients carry out non-presidential Operations from a Device that, due to its

characteristics, cannot provide the geographic coordinates of latitude and longitude through GPS, the

Credit Unions must obtain the geographic coordinates of latitude and longitude based on the matching of

the internet protocol address provided by the Client's Device with a geographic location,

for the approximate obtaining of said coordinates.

The geographic coordinates of latitude and longitude obtained through GPS or based on the

matching of the Internet protocol address must be obtained prior to the Client's consent in terms of the regulations that apply in matters of data protection.

XIV. to XIX. ...

XIX Bis. Technological Identification Mechanism, any of the procedures referred to in

Annex 2, through which Credit Unions carry out the comparison of the valid identification document and the

application of proof of life.

XX. to XXIII. ...

XXIII Bis. Interim Compliance Officer, the person referred to in article 38 Bis of these

provisions;

XXIV. to XXXV. ...

4th.-

...

...

I.

...

a)

...

b) ...

i.

...

For the purposes of what is established in this subsection, the following shall be considered as valid personal identification documents

issued by Mexican authorities: the voter credential, the passport, the professional license, the national military service card, the consular registration certificate, the military identity credential, the affiliation card to the National Institute of Older Adults, the credentials and cards issued by the Mexican Institute of Social Security, by the Institute of Social Security and Services for State Workers, by the Social Security Institute for the Mexican Armed Forces, or by Popular Insurance, the driver's license, the credentials issued by federal, state, and municipal authorities, the identity statements issued by municipal authorities, and the other national identifications that, in their case, are approved by the Commission. Likewise, with respect to natural persons of foreign nationality referred to in this section, in addition to those previously referred to in this paragraph, the passport, passport card, or documentation issued by the National Institute of Migration that accredits their migratory status, as well as the accreditation card issued by the Ministry of Foreign Affairs to diplomatic or consular bodies.

ii. to v. ...

II. to IX. ...

...

...

...

...

...

...

4th Bis. - Credit Unions that opt to celebrate a contract through Devices in a non-presidential manner

with Clients who are natural or legal persons, both of Mexican nationality, in accordance with what is established in

Annex 2 of these Provisions, in addition to the identification data referred to in article 4 of these

Provisions, as applicable, must require and obtain from their Clients the Geolocation of the Device from which they celebrate the contract, as well as:

I.

Regarding Clients who are natural persons who declare to the Credit Union to be of Mexican nationality:

a) Repealed.

b) Consent that may be obtained through Electronic Signature or Advanced Electronic Signature.

Said consent shall serve as proof to legally accredit the celebration of the Operation carried out by the

Credit Union in a non-presidential manner.

c)

...

d) In their case, Standardized Banking Key (CLABE) of an account opened in some financial entity or

Foreign Financial Entity authorized to receive deposits, whose holder coincides with the name referred to in article 4, section I of these Provisions.

e) The statement of the natural person in which they indicate that they act on their own behalf. Said

statement may be established in the Terms and Conditions established to that effect by the Credit Union.

f) The digital version of the valid official personal identification document currently in force from which the data referred to in this Provision originate.

g) The digital version of the proof of address, which may be any of those indicated in article 4,

section I, subsection b), numeral iii., of these Provisions.

Notwithstanding, when the declared address coincides with that of the voter credential of the Client

issued by a Mexican authority, in the event that they have been identified with the same, this will function as the proof of address referred to in this subsection.

II. Regarding Clients who are legal persons of Mexican nationality:

a) Email.

b) In their case, Standardized Banking Key (CLABE) of an account opened in some financial entity or

Foreign Financial Entity authorized to receive deposits, whose holder coincides with the denomination or

trade name referred to in article 4, section II of these Provisions.

c) Consent that may be obtained through Electronic Signature or Advanced Electronic Signature,

of the legal representative. Said consent shall serve as proof to legally accredit the celebration

of the contract carried out with the Credit Union in a non-presidential manner.

d) The information referred to in article 4, section II, subsection c) and section VI of these Provisions.

e) The digital version of the identification documents referred to in article 4, section II, subsection b) of these

Provisions, with the exception of those indicated in numeral ii of the same subsection.

Credit Unions shall not carry out the celebration of the contract in a non-presidential manner when they do not

collect the data related to Geolocation.

Credit Unions shall not be obligated to collect the data related to Geolocation regarding the

societies, dependencies, and entities referred to in Annex 1 of these Provisions,

provided that the aforementioned societies, dependencies, and entities have been classified as Clients with

a Low Risk Grade in terms of article 19 of these Provisions.

Paragraph repealed.

A valid official personal identification document currently in force for the compliance of the

present Provision shall be understood as the voter credential issued by the National Electoral Institute in the country or through the consular offices of the Ministry of Foreign Affairs abroad, the passport, and the consular registration certificate both issued by the Ministry of Foreign Affairs in the country or through its consular offices abroad.

...

The digital version of the valid official personal identification document that Credit Unions collect

for identification purposes must allow its verification in terms of these Provisions.

Additionally, the digital versions of the documents that Credit Unions collect must be preserved

in their Files or Records in accordance with these Provisions. Credit Unions must preserve the

documents in accordance with the official Mexican standard on digitization and preservation of Data Messages applicable or consider an international standard whenever the compliance standard has at least the requirements of the official Mexican standard and does not contravene it.

...

6th.- ...

Regarding contracts celebrated in accordance with article 4 Bis of these Provisions, in substitution of the

interview referred to in the previous paragraph, Credit Unions may establish the Technological Identification Mechanisms referred to in Annex 2 of these Provisions.

...

7th.- Credit Unions must preserve, as part of the identification file of each of their

Clients, the data and documents mentioned in the provisions of this Chapter, the document containing the results of the interview or of the Technological Identification Mechanisms referred to in

article 6 of these Provisions,

as applicable, that of the visits referred to in article 15, in their case, and the

questionnaire provided in article 19 of these Provisions.

12th.- For the carrying out of Operations through electronic, optical, or any other

technology, Credit Unions must previously integrate the Client's identification file in accordance with what is established in these Provisions, establish mechanisms to identify them, as well as develop procedures to prevent the improper use of said means or technologies, which must be contained in their Compliance Manual or some other document or manual prepared by the

Credit Union itself.

18th.-

...

Regarding those Operations carried out in a non-presidential manner, in addition to the elements for

determining the Client's transactional profile indicated in the previous paragraph, the Credit Union must take into account the Geolocation of the Device from which said Operation is carried out.

The Geolocation referred to in the previous paragraph may cover the various Operations carried out by the

Client in the active session within the Internet page or mobile application, among other technological developments, that the Credit Unions themselves make available to their Clients to carry them out.

Credit Unions shall not be obligated to take into account the data related to Geolocation in terms of the

present Provision, regarding the societies, dependencies, and entities referred to in

Annex 1 of these Provisions, provided that the aforementioned societies, dependencies, and entities

have been classified as Clients with a Low Risk Grade in terms of article 19 of these

Provisions,

19th.- The application of the Client knowledge policy must be based on the Risk Grade that

a Client represents; in such a way that, when the Risk Grade is higher, the Credit Union must collect

more information about their predominant economic activity, as well as to carry out stricter supervision of their transactional behavior.

...

...

In the case of the celebration of contracts in a non-presential manner referred to in the 4th Bis of these General Provisions, Credit Unions must consider the Geolocation information of the Device from which the Client carries out the Operation, activity, or service with the respective Credit Union.

Credit Unions will not be obligated to consider Geolocation information under the terms of this Provision, regarding the societies, branches, and entities referred to in Annex 1 of these General Provisions, provided that the aforementioned societies, branches, and entities have been classified as Clients with a Low Risk Grade under the terms of this Provision.

...

...

...

...

To determine the Risk Grade in which Clients should be placed, as well as whether they should be considered Politically Exposed Persons, each Credit Union will establish in the documents indicated in the previous paragraph the criteria conducive to that end, which take into account, among other aspects, the Client's background, their profession, activity, or line of business, the origin and destination of their resources, their place of residence, the Geolocation, the methodology referred to in Chapter II Bis of these General Provisions, and the other circumstances determined by the Credit Union itself.

21st.- Prior to the celebration of contracts with Clients who, due to their characteristics, are classified with a High Risk Grade by the Credit Union, at least one executive or their equivalent who has specific powers to approve the celebration of such contracts, as applicable, must grant the respective approval in writing or in digital or electronic form. Likewise, for the purposes referred to in fractions IV and V of the 38th of these General Provisions, Credit Unions must provide in their Compliance Manual the mechanisms so that their respective Compliance Officers have knowledge of those Clients that are classified with a High Risk Grade by the Credit Unions themselves, as well as the procedures that must be carried out to process the approval indicated in this Provision.

28th.- For each Unusual Operation detected by a Credit Union, it must send the corresponding report to the Secretariat, through the Commission, within three business days following the day on which the session of the Committee that adjudicates it as such concludes. For the purposes of carrying out the aforementioned adjudication, the Credit Union through its Committee will have a period that will not exceed sixty calendar days counted from when the alert is generated through its system, model, process, or by an employee of the Credit Union, whichever occurs first.

...

33rd.- For each Concerning Internal Operation detected by a Credit Union, it must send the corresponding report to the Secretariat, through the Commission, within three business days following the day on which the session of the Committee that adjudicates it as such concludes. For the purposes of carrying out the aforementioned adjudication, the Credit Union through its Committee will have a period that will not exceed sixty calendar days counted from when said Credit Union detects that Operation, through its system, model, process, or by any of its employees, whichever occurs first.

...

...

38th Bis.- The Committee of each Credit Union or its board of directors or general manager may appoint a Credit Union official who will temporarily exercise the functions of Compliance Officer in the fulfillment of its obligations under these General Provisions, for up to ninety calendar days during a calendar year, counted from when the official designated as Compliance Officer leaves, has their appointment revoked, or is unable to perform the aforementioned task.

...

...

The Interim Compliance Officer must perform the functions and obligations indicated in these General Provisions, until the moment the revocation indicated in fraction II of the 39th of these Provisions is reported.

39th.- ...

I. The full name without abbreviations of the official who has been designated as Compliance Officer, as well as the other information provided in the format indicated, within ten business days following the date on which the respective designation was made;

II. The revocation of the designation of the Compliance Officer or Interim Compliance Officer who had been designated under the terms established in both the 38th and the 38th Bis of these General Provisions, as applicable, within ten business days following the date on which it occurred, whether by determination of the Credit Union, rejection of the task, termination of employment, or inability, as well as the other information provided in the format indicated, and

III. The full name without abbreviations of the official who has been designated as Interim Compliance Officer under the terms established in the 38th Bis of these General Provisions, as well as the other information provided in the format indicated, within ten business days following the date on which it occurred.

52nd Bis. - Credit Unions must send to the Commission, within the last ten business days of the month of April of each year, through electronic means and in the official format issued for such effect, quantitative information regarding their operations, channels, type of Clients, type of products and services, as well as the geographic zones where they operate. This information must correspond to the period from January to December of the year prior to that in which it must be sent, or to the period resulting from the date on which the Commission authorized the start of operations of the Credit Union in question to December of the respective year.

59th.- ...

Credit Unions must adopt and implement mechanisms that allow them to identify Clients who are on the List of Blocked Persons, as well as any third party acting on their behalf or for their account, and the Operations they have carried out, are carrying out, or intend to carry out. Such mechanisms must be provided for in the Compliance Manual of the Credit Union itself.

60th.- ...

I. to VI. ...

VII. Those that appear on the list of taxpayers referred to in the fourth paragraph of Article 69-B of the Federal Tax Code.

63rd.- ...

I. to IV. ...

V. They are in the situation referred to in the sixth paragraph of Article 69-B of the Federal Tax Code.

...

Annex 2

...

Chapter I " Object "

Article 1.- This Annex aims to establish the minimum measures and procedures that Credit Unions must observe in order to comply with the 4th Bis of these General Provisions, without prejudice to the fulfillment of the various obligations established therein.

Chapter II " Thresholds for non-presential identification "

Article 2.- Credit Unions must observe the following thresholds by type of Technological Identification Mechanism and product for which they request authorization from the Commission for the purposes of complying with the 4th Bis of these General Provisions:

I. Regarding the Technological Identification Mechanism provided for in Article 4 of this Annex, with respect to Credit Unions, for the purposes of identifying their applicants, in the non-presential celebration of credit contracts granted to natural persons or legal entities, all of Mexican nationality, and which do not have real estate collateral, it must be agreed in the respective contracts that the credit line or amount granted does not exceed the equivalent in national currency to 30,000 Investment Units.

II. Regarding the Technological Identification Mechanism provided for in Article 5 of this Annex, with respect to Credit Unions, for the purposes of identifying their applicants, in the non-presential celebration of credit contracts granted to natural persons or legal entities, all of Mexican nationality, and which do not have real estate collateral, it must be agreed in the respective contracts that the credit line or amount granted does not exceed the equivalent in national currency to 60,000 Investment Units.

Credit Unions must take as the reference value for the Investment Units referred to in this article, that applicable for the last day of the calendar month prior to that in which the contract level calculation is carried out for the granting of the credit in question.

Chapter III " Technological Identification Mechanisms "

Article 3.- Credit Unions may opt for one or both of the Technological Identification Mechanisms indicated in Articles 4 or 5 of this Annex, subject to the thresholds indicated in Article 2 of this Annex.

Without prejudice to the foregoing, additionally, Credit Unions may carry out the Technological Identification Mechanism referred to in Article 5 of this Annex, subject to the thresholds referred to in fraction I of Article 2 of this Annex.

Article 4.- Credit Unions must have technology that allows identifying the applicant through a recording containing image and sound, which must be preserved without edits in its entirety for the entire duration of the account or contract, and once it concludes, for a period of at least ten years from the conclusion of the contractual relationship.

Additionally, during the development of the Technological Identification Mechanism referred to in the previous paragraph, Credit Unions must observe the following:

a) Register the time and date of its realization obtained from a protected time server.

b) Implement it through automated tools that allow its recording and subsequent reproduction.

c) Verify that the quality of the image and sound allows for the full identification of the applicant, according to the parameters established by the Credit Unions themselves for such effect.

d) Require the applicant to show the valid identification document they sent along with the form referred to in fraction III of Article 7 of this Annex, both on the front and back, verifying that it contains the same data and photograph as the valid identification document previously sent.

e) Use specialized technology that allows them to achieve reliable identification of the applicant, ensuring that there is a match between their face and that of the valid identification document previously sent.

f) Perform a liveness test on the applicant.

For the purposes of the foregoing, a liveness test will be understood as technical tests based on algorithms, to measure and analyze the anatomical characteristics or voluntary and involuntary reactions of the applicant, in order to determine if a biometric sample is being captured from a subject alive and present at the point of capture.

Article 5.- Credit Unions must verify the match of the applicant's biometric information, either with the records of the National Electoral Institute, the Secretariat of Foreign Relations, or with those of any other Mexican authority that provides a biometric information verification service.

In the event that the biometric information referred to in the previous paragraph is the applicant's fingerprints, Credit Unions must ensure that the applications or means they have available ensure that the fingerprint is obtained directly from the applicant, that is, a live fingerprint test, avoiding the recording of fingerprints from impressions on any material that intends to simulate another person's fingerprint or images that seek such an end, and have security measures that guarantee that the stored, processed, or sent information through said applications or means is not known or used by unauthorized third parties, as well as authenticate that the fingerprint obtained from the applicant matches, at least, ninety percent with the records of the databases of either the National Electoral Institute, the Secretariat of Foreign Relations, or with those of any other Mexican authority that provides a biometric information verification service.

Additionally, Credit Unions must have technology that allows identifying the applicant through a recording containing image and, where applicable, sound, which must be preserved without edits in its entirety for the entire duration of the account or contract, and once it concludes, for a period of at least ten years from the conclusion of the account opening or contractual relationship, and must observe the requirements referred to in Article 4, second paragraph of this Annex. To comply with item c), it will be necessary to verify the quality of the sound when applicable.

Article 6.- In the event that the National Electoral Institute, the Secretariat of Foreign Relations, or any other Mexican authority that provides a biometric information verification service, cannot respond to the biometric information verification requests referred to in Article 5 of this Annex due to technical or communication failures attributable to the corresponding Mexican authority, Credit Unions may, in the event of having the corresponding authorization, carry out the Technological Identification Mechanism of Article 4 of this Annex 2, subject to the corresponding limits.

In the event that the transactional level exceeds the maximum amount established for the Technological Identification Mechanism referred to in Article 4 of this Annex, the Credit Union must carry out the in-person interview referred to in the 6th of these General Provisions or apply the Technological Identification Mechanism provided for in Article 5 of this Annex, in the event of having the corresponding authorization for the latter, and integrate the Client's identification file with all the information and documentation that corresponds, under the terms provided in the 4th or 4th Bis of these General Provisions, as well as comply with the various obligations established therein. Likewise, Credit Unions must inform their Clients that they will not be able to carry out operations above the limit until the corresponding identification process is concluded.

Chapter IV " Requirements "

Article 7.- Additionally, for the purposes of what is established in this Annex, Credit Unions must:

I. Obtain prior authorization from the Commission.

Authorization referred to in the previous paragraph will not be necessary when Credit Unions adhere to the thresholds referred to in Article 2, fraction I of this Annex and carry out the Technological Identification Mechanism referred to in Article 5 of this Annex. In this case, Credit Unions must inform the Commission in advance of the products and the date on which they will begin to offer them, through the electronic means indicated by the latter.

Likewise, Credit Unions must observe what is established in fractions II to VII of this article, as well as the requirements provided for in Articles 8 and 9 of this Annex.

Credit Unions must conserve all the supporting information and documentation, which must be available to the Commission, at its request, within the timeframe established by the Commission itself.

...

II. Require the applicant to declare whether they are already a Client of the Credit Union. In the event that the declaration is affirmative, the Credit Union must observe what is provided for in fraction IV of this article. Regardless of the applicant's declaration, the Credit Union must complete their identification file according to the product they intend to contract.

III. Require the applicant who has declared not to be a Client of the Credit Union to send a form through the electronic medium established by the Credit Union for such effect, in which must be included, at least, the identification data referred to in the 4th Bis of these General Provisions, as well as the specification of the product intended to be contracted.

The aforementioned form must include a statement indicating that its submission to the Credit Union in question constitutes the applicant's acceptance for their image and, where applicable, their voice, to be recorded in one of the Technological Identification Mechanisms referred to in Chapter III of this Annex. This statement may be made through automated tools that allow its recording and subsequent reproduction.

IV. In the event that the applicant declares being a Client of the Credit Union, it must verify at least the data of full name, Client number, and Unique Population Registry Key (CURP) of the Client, as well as the other data it determines itself in order to corroborate against its own records that, in fact, it is a Client, and in the event that this is the case, the Credit Union must authenticate them with a category 3 authentication factor.

A category 3 authentication factor will be understood as the information contained, received, or generated by electronic means or devices, as well as that obtained by devices generating dynamic one-time passwords. Such means or devices must be provided by the Credit Unions to their Clients, and the information contained, received, or generated by them must meet the following characteristics:

a) Have properties that prevent their duplication or alteration.

b) Be dynamic information that cannot be used more than once.

c) Have a validity that cannot exceed two minutes.

d) Not be known prior to its generation and use by officials, employees, representatives of the Credit Union, or by third parties.

In the event that the verification referred to in the previous paragraph is successful, the Credit Union may proceed to the contracting of the products provided for in Article 2 of this Annex, without the need to carry out what is established in the following fractions V to VIII.

When the verification referred to in this fraction is not successful, the Credit Union must observe the same requirements provided for in this Annex for applicants who declare not to be Clients.

V. If the Credit Union corroborates that the applicant is not its Client, together with the form referred to in fraction III of this article, it must require the applicant to send a color photograph of one of the valid identification documents, referred to in the 4th Bis of these General Provisions, on the front and back and verify the security elements, in order to detect if they present alterations or inconsistencies, for which they must have the necessary technology for this purpose.

Repealed.

Repealed.

...

Repealed.

Regarding the voter credential issued by the National Electoral Institute in the country or through the consular offices of the Secretariat of Foreign Relations abroad, Credit Unions must verify the match of the data listed below, with the records of the Institute itself or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) The Credential Identifier Code (CIC), which is printed on the voter credential or, in its case, the Optical Character Recognition Code (OCR).

b) to d)

...

Credit Unions must verify that the full name, as it appears on the presented voter credential, matches the records of the National Electoral Institute or the National Population Registry or with those of any other Mexican authority that provides a verification service for said identification document.

Regarding the Mexican passport issued by the Secretariat of Foreign Relations in the country or through its consular offices abroad, Credit Unions must verify the match of the data mentioned below with the records of the Secretariat itself or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) The Optical Character Recognition Code (OCR).

b) Full name, as it appears on the Mexican passport.

c) Passport Number.

In the case of the consular enrollment certificate issued by the consular offices of the Secretariat of Foreign Relations abroad, Credit Unions must verify the match of the data mentioned below with the records of the Secretariat itself or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) Full name, as it appears on the consular enrollment certificate.

b) Date of issue and date of expiration.

c) Document Number.

Additionally, Credit Unions must require the applicant to send in digital format the necessary documents to integrate and conserve their identification file under the terms provided in the 4th Bis of these General Provisions.

VI. Inform the applicant of the procedure that will be followed in the corresponding Technological Identification Mechanism provided for in Chapter III of this Annex and what are the accesses to the means for its realization, as well as deliver a one-time code, which will be required from the applicant at the start of the Technological Identification Mechanism in question.

Repealed.

VII. Credit Unions must suspend the contracting process of the applicant when any of the following cases occur:

a) The quality of the image and, where applicable, the sound, do not allow for full identification of the applicant.

b) The applicant does not present the valid identification document previously sent along with the form referred to in fraction III of Article 7 of this Annex, the data obtained from it do not match the records of the National Electoral Institute, the Secretariat of Foreign Relations, the National Population Registry, or with those of any other Mexican authority that provides a biometric information verification service regarding said identification document, or the result of the validation of the security elements of the aforementioned documents, or of the biometric verifications of the applicant's face referred to in Article 5 above, does not reach the effectiveness or level of reliability referred to in fraction VII of Article 9 of this Annex.

c) and d)

...

e) Atypical or risky situations occur, or the Credit Union has doubts about the

authenticity of the valid identification document or of the applicant's identity.

Repealed.

In the event of suspension of the hiring process for the causes mentioned in the above subsections,

Credit Unions must store the information and documentation obtained, for at least 30 calendar days, with the objective that, in case the hiring processes are resumed, it is corroborated that the information is consistent. Additionally, the aforementioned information and documentation must be used by Credit Unions in the controls provided for in these Provisions.

For the case of Clients or applicants who are legal entities, for purposes of identifying their attorneys-in-fact or legal representatives, Credit Unions must observe the same procedures indicated in this article, with the caveat that, for the case of applicants who declare not to be Clients, the sending of the form referred to in fraction III of this article, must be done via signed file with the Advanced Electronic Signature of the legal entity in question.

The technology used for the procedures referred to in this Annex must be approved by the risk manager or their equivalent or, in case they do not have this, by the audit committee, the board of directors or sole administrator of the Credit Union.

Credit Unions may agree during the development of Technological Identification Mechanisms for the conclusion of the contracts referred to in this Annex, the contracting of electronic services referred to in the general provisions referenced in the Law associated with such products, without being able to allow that through the services contracted in accordance with what is established in this article instructions are given to conclude operations charged to other products of the same Client. The aforementioned prohibition will not be applicable when the Client goes to the offices to carry out the contracting of electronic services.

Repealed.

Article 8 .- Credit Unions must have the necessary means for the transmission and safeguarding of the information, data and files generated in the identification procedures referred to in Article 7 of this Annex, which guarantee the integrity of said information, as well as the correct reading of data and the impossibility of its manipulation, as well as its adequate security, conservation and location.

Credit Unions may use technological improvements that help compensate for the clarity of images, when any of the valid identification documents are shown and facial recognition of the applicant is performed, which must be approved by their risk manager or their equivalent or, in case they do not have this, by the audit committee, board of directors or sole administrator.

Chapter V "Other provisions"

Repealed.

Article 9 .- Credit Unions, when requesting the authorization referred to in Article 7, must present the following:

I. Detailed description of the non-presential identification process, as well as of the Technological Infrastructure used in each part of this, specifying the function of each component of said infrastructure, which must be approved by the risk manager or their equivalent or, in case they do not have this, by the audit committee, the board of directors or sole administrator. Likewise, Credit Unions must include all technology providers involved in the Technological Infrastructure and, if applicable, the main applications used for the referred process and their interrelation.

II. Description of the electronic means used so that applicants send, if applicable, the form and documents through a secure channel considering, at least, the type of transmission of the device towards the node that receives the form information, such as hypertext transfer protocol secure (HTTPS) or Transport Layer Security (TLS) version 1.2 or higher.

III. Name of the certification service provider authorized by the Ministry of Economy used for the preservation of the digital version of any of the valid identification documents referred to in 4th Bis of these Provisions, in accordance with the Official Mexican Standard on digitization and preservation of Data Messages applicable or consider an international standard provided that the compliance standard has at least the requirements of said official mexican standard and does not contravene it.

IV. Network diagram showing all components of the Technological Infrastructure that form part of the non-presential identification process, including segregation of communications networks and perimeter security equipment, considering redundancy schemes.

Repealed.

V. Detailed information on whether images of valid identification documents, recordings and biometric information will be kept in service provider facilities or those of the Credit Union itself, describing controls for access management and mechanisms for their storage.

VI. Evidence that the means of verifying the validity of identification documents have the effectiveness approved by the risk manager or their equivalent or, in case they do not have this, by the audit committee, board of directors or sole administrator of Credit Unions.

VII. If applicable, evidence that the systems, tools or mechanisms used for facial identification recognitions or verifications of any other biometric element that are used, have the level of reliability determined by the risk manager or their equivalent or, in case they do not have this, by the audit committee, board of directors or sole administrator.

VIII. If applicable, detailed information on calibration tests for the systems, tools or mechanisms used for facial identification recognitions or verifications of any other biometric element that are used.

These tests must be carried out in accordance with thresholds established by the Credit Union, which must contemplate the results of these tests, and adjustments of the validation engine derived from them. Credit Unions must accompany their authorization request with evidence of all the above.

IX. Image quality standards and, if applicable, sound.

X. If applicable, the technical description of category 3 authentication factors that will be required to corroborate that an applicant is a Client of the Credit Union, in accordance with what is provided in article 7 of this Annex, as well as the characteristics of the one-time code.

XI. Mechanisms through which they will transmit and securely safeguard the information, data and documents generated in the non-presential identification procedure.

XII. Mechanisms used to guarantee the integrity, correct reading, impossibility of manipulation and adequate security, conservation and location of the information, data and documents referred to in this Annex.

XIII. Encryption mechanisms in the communication channels used in the non-presential identification process, indicating the information that will be transmitted through each of said channels.

XIV. Mechanisms used for access management to systems, as well as policies for access management, in which the use of robust passwords is included.

XV. Policies and procedures for information security incident management.

XVI. Mechanisms or tools used for monitoring and blocking hirings that present the situations described in subsection e) of fraction VII of article 7 of this Annex.

XVII. Carry out tests aimed at detecting vulnerabilities and threats, as well as penetration tests on the different components of the Technological Infrastructure used in the process, either own or third-party. The aforementioned penetration tests must be carried out by an independent third party that has personnel who have the technical capacity proven through specialized industry certifications in the subject matter.

Credit Unions must provide the Commission with evidence of the carrying out of the tests referred to in fractions VIII and XVII of this article, before implementing the scheme that has been authorized to them in accordance with article 7 of this Annex.

It shall be the responsibility of Credit Unions that hire third parties to store, process and transmit information in the non-presential hiring process, the supervision of compliance with this article, at least once a year, as well as the obligation to have the evidence supporting it, which they must have available to the Commission at all times.

When Credit Unions intend to modify any of the procedures they have authorized to comply with article 4 or article 5, as applicable, of this Annex, they will require prior authorization from the Commission.

Transitional Provisions

First. - This Resolution will enter into force the day after its publication in the Official Journal of the Federation except for what is provided in the following Transitional Provisions.

Second. - Guidelines, interpretations and criteria issued by the Secretariat or by the Commission, based on what is provided in the Resolution of October 26, 2012 and subsequent Resolutions through which the General Provisions referred to in article 129 of the Credit Unions Law have been added or reformed, will continue to be applicable insofar as they do not conflict with what is established in this Resolution.

Third.- Credit Unions that have obtained the authorization of the Commission to the mechanisms of non-presential identification in terms of Annex 2 of the General Provisions referred to in article 129 of the Credit Unions Law, valid until before the entry into force of this Resolution, will have a term of twelve months, counted from the entry into force of this Resolution, to present to said Commission a new authorization request in compliance with article 7, fraction I of Annex 2 that is reformed with this instrument.

The authorization referred to in the preceding paragraph will remain valid until such time as the Commission resolves on the authorization request that Credit Unions have presented before said Commission in accordance with what is indicated by Annex 2 of the General Provisions referred to in article 129 of the Law of Credit Unions, which are reformed with this Resolution.

Fourth. - Credit Unions must comply with the obligations contained in this Resolution, in the terms and in accordance with the deadlines set forth below:

I. Four months counted from the entry into force of this Resolution to modify the Compliance Manual and present it to the Commission.

II. Nine months counted from the date of entry into force of this Resolution, to modify the methodology referred to in Chapter II Bis of the Provisions.

III. Eighteen months counted from the date of entry into force of this Resolution, to update the automated systems referred to in 42nd of the Provisions.

Fifth.- In the event that Credit Unions update the assumption provided in article 7, fraction I second paragraph of Annex 2 that is reformed with this Resolution, they must inform through the email prevencion.lavado@cnbv.gob.mx, through a free written address addressed to the General Directorates of Prevention of Operations with Illicit Proceeds A and B of the Commission, the situation provided for in said article until the Commission establishes the ideal electronic means for Credit Unions to comply with what is provided in said article.

Sixth. - Credit Unions must begin to send to the Commission the information referred to in 52nd Bis that is added in this Resolution, starting from the date indicated in the resolution that for such effects the Commission issues.

Seventh. - Credit Unions may equate the defined term of Beneficial Owner referred to in these Provisions to references of beneficial owner that are provided for in other legal orders in matters of prevention of operations with illicit proceeds and terrorism financing, as well as in consultation databases managed by competent authorities.

Mexico City, January 4, 2023.- The Secretary of Finance and Public Credit, Rogelio Eduardo Ramírez de la O.- Rubric.

In the document you are viewing there may be text, characters or objects that are not displayed correctly due to conversion to HTML format, therefore we recommend always taking as reference the digitized image of the DOF or the PDF file of the edition. The content, form and scope of published documents are the strict responsibility of their issuer.

INQUIRY

BY DATE

Do Lu Ma Mi Ju Vi Sa INDICATORS Exchange Rate and Rates as of 08/27/2026 DOLLAR 16.9660 UDIS 8.808255 TIIE 28 DAYS 6.7559% TIIE 91 DAYS 6.7931% TIIE 182 DAYS 6.8474% TIIE DE FONDEO 6.50% See more SURVEYS Did you like the new look of the Official Journal of the Federation website? No Yes Official Journal of the Federation Río Amazonas No. 62, Col. Cuauhtémoc, C.P. 06500, Mexico City Tel. (55) 5093-3200, where you can access our menu of services Electronic address: dof.gob.mx 113 LEGAL NOTICE | SOME RIGHTS RESERVED © 2026