Resolution amending, adding to, and repealing various General Provisions under Articles 71 and 72 of the Law for Regulating the Activities of Savings and Loan Cooperative Societies

DOF: 09/09/2021

RESOLUTION amending, adding to, and repealing various of the General Provisions referred to in Articles 71 and 72 of the Law for Regulating the Activities of Savings and Loan Cooperative Societies

A seal bearing the National Coat of Arms appears on the margin, which reads: United Mexican States.- FINANCE.- Secretariat of

Finance and Public Credit.

RESOLUTION AMENDING, ADDING TO, AND REPEALING VARIOUS OF THE GENERAL PROVISIONS REFERRED TO IN ARTICLES 71 AND 72 OF THE LAW FOR REGULATING THE ACTIVITIES OF SAVINGS AND LOAN COOPERATIVE SOCIETIES

ROGELIO EDUARDO RAMÍREZ DE LA O, Secretary of Finance and Public Credit, based on

the provisions of Articles 31, fractions VII and XXXII, of the Organic Law of the Federal Public Administration;

71 and 72 of the Law for Regulating the Activities of Savings and Loan Cooperative Societies, in the exercise of the powers conferred upon me by Article 6, fraction XXXIV, of the Internal Regulations of the Secretariat of Finance and Public Credit, and having received the prior opinion of the National Banking and Securities Commission issued via letter number VSPP-220/10030526/2021 dated July 29,

2021; and

CONSIDERING

That since the year 2000, Mexico has been a full member of the Financial Action Task Force (FATF),

an intergovernmental body that sets international standards in matters of prevention and combat against

operations with proceeds of illicit origin and terrorist financing.

That on March 21, 2019, the Secretariat of Finance and Public Credit published in the Official Journal of the

Federate various modifications to the General Provisions referred to in Articles 71

and 72 of the Law for Regulating the Activities of Savings and Loan Cooperative Societies, with the

objective of addressing the recommendations of the FATF and establishing a non-presential identification regime,

thereby granting the possibility for savings and loan cooperative societies with levels of

operation I to IV, to carry out client identification through a real-time

videoconference and online, which resulted in a strengthening of the risk assessment methodology so that said

societies evaluate their risks of being used to carry out operations with proceeds of illicit

origin and terrorist financing prior to the use of new technologies.

That on March 6, 2020, the FATF published the Digital Identification Guide, resulting as a

culmination in the topic of financial technology, showing the benefits of digital identity in matters of

prevention and combat against operations with proceeds of illicit origin and terrorist financing,

presenting financial technology as a more reliable and secure method for financial entities

when carrying out client identification through the use of mechanisms such as

proof of life, the use of biometric elements and authentication factors, among others, which allow the

mitigation of risks of operations with proceeds of illicit origin and terrorist financing.

That on March 11, 2020, the World Health Organization declared the disease caused by the virus

SARS-CoV2 (COVID-19) as a pandemic, calling on countries to: (i) adopt measures

urgent and aggressive to contain the spread of the virus, (ii) implement an approach based on the

participation of the entire government and society, around a comprehensive strategy aimed at preventing

infections, saving lives, and minimizing its effects, and (iii) find a delicate balance between the

protection of health, the minimization of social and economic disruptions, and respect for human

rights.

That on March 24, 2020, the Secretariat of Health published in the Official Journal of the Federation the

"Agreement establishing the preventive measures that must be implemented for the mitigation and

control of health risks implied by the disease caused by the SARS-CoV2 virus (COVID-19)", which

establishes in its Article Two, subsection c) "Temporarily suspend the activities of the sectors

public, social, and private that involve the physical concentration, transit, or displacement of people starting

from the entry into force of this Agreement and until April 19, 2020".

That on March 31, 2020, the Secretariat of Health published in the Official Journal of the Federation the

"Agreement establishing extraordinary actions to address the health emergency generated

by the SARS-CoV2 virus", which, in its Article One, fraction I, orders the immediate suspension, from March 30

to April 30, 2020, of non-essential activities, with the aim of mitigating the dispersion and

transmission of the SARS-CoV2 virus in the community.

That through the "Agreement modifying the similar one establishing extraordinary actions to address the

health emergency generated by the SARS-CoV2 virus, published on March 31

2020", published on April 21, 2020 in the Official Journal of the Federation, the Secretariat of Health

deemed it necessary to maintain and extend the National Day of Healthy Distance until May 30, 2020,

as well as to ensure the adequate implementation and compliance with health security measures.

That on May 15, 2020, the Secretariat of Health published in the Official Journal of the Federation the "Agreement

modifying the one establishing a strategy for the reopening of social, educational, and economic activities,

as well as a regional traffic light system to evaluate weekly the epidemiological risk related to the reopening of activities in each federal entity,

as well as establishing extraordinary actions, published on May 14, 2020" with the objective

of establishing a mechanism involving the public, social, and private sectors to resume

activities under health security protocols, which guarantee both to their workers, as well as to the general

public that standards are being met that reduce risks associated with SARS-CoV2.

That in this sense and particularly with respect to the financial system, there was a massive closure of

branches of various financial entities, in compliance with the health measures declared by the

Federal Government for the period during which the contingency due to COVID-19 is in effect; which translated

into one of the main challenges to guarantee the continuity of the offering and provision of financial

services to the general public, attending to the new normality, without neglecting or undermining the regime of

prevention of operations with proceeds of illicit origin and terrorist financing.

That on April 1, 2020, the FATF issued a statement regarding the health emergency generated

by COVID-19 and measures to combat illicit financing, calling for (i) countries to explore the appropriate use of simplified identification measures and digital identification to facilitate

financial operations while mitigating risks of operations with proceeds of illicit

origin and terrorist financing, and (ii) regulators, supervisors, and other authorities

involved in the matter, provide the necessary assistance to the private sector regarding how the

regulation in the matter will be applied during the current health crisis.

That, even though savings and loan cooperative societies currently have since March

2019 a non-presential identification regime, it was not sufficient to address the needs of the

general public to enter into contracts and, at the same time, mitigate risks in matters of prevention of

operations with proceeds of illicit origin and terrorist financing.

That in this sense and based on the FATF Digital Identification Guide, as well as in compliance with

Recommendations 10 and 15 of said group, it is necessary, as with other participants

regulated in the matter, to recognize the legal possibility that savings and loan cooperative societies

may comply with their obligations in matters of prevention of operations with proceeds of illicit

origin and terrorist financing through the use of new technologies, of course with the

responsibility of complying with the applicable regulations to that effect so that they have the value that in

law corresponds.

That, additionally, in accordance with FATF Recommendation 4 and the content of the Mutual Evaluation Report,

issued by said intergovernmental body, in January 2018, it is necessary to strengthen the

legal framework regarding the composition of the Blocked Persons List given that our country,

as a member of the FATF, has recognized the formation of ghost companies as a generalized technique

to carry out operations with proceeds of illicit origin, in this sense, the condition is added for

inclusion in the Blocked Persons List to those taxpayers referred to in the fourth paragraph of

Article 69-B of the Federal Tax Code, the above in order to prevent the commission of the crimes of

operations with proceeds of illicit origin and terrorist financing.

That in attention to Article 78 of the General Law of Regulatory Improvement and with the purpose of complying with the

requirement of regulatory simplification for the issuance of this Resolution, the savings generated in the "Resolution amending, adding to, and repealing various of the General Provisions

referred to in Articles 71 and 72 of the Law for Regulating the Activities of Savings and Loan

Cooperative Societies", determined by the National Commission for Regulatory Improvement in the

file CONAMER/21/3461, with an amount of $193,851,471.42 pesos.

RESOLUTION AMENDING, ADDING TO, AND REPEALING VARIOUS OF THE GENERAL PROVISIONS REFERRED TO IN ARTICLES 71 AND 72 OF THE LAW FOR REGULATING THE ACTIVITIES OF SAVINGS AND LOAN COOPERATIVE SOCIETIES

ARTICLE ONLY.- The 2nd, fractions X and XV; 4th Bis first, second, fourth, and sixth

paragraphs; 7th, second, fourth, and fifth paragraphs; 8th; 13th, third paragraph; 16th; 25th; second paragraph; 26th, fourth and

last paragraphs; 28th; 39th first paragraph; 41st, first paragraph; 46th, first paragraph; 51st Bis, first and last

paragraph; 52nd first paragraph, fractions I to III; 73rd, second paragraph; Annex 2 articles 1, 2, and 4; are AMENDED; the 2nd, fractions XXI Bis and XXV Bis; 4th Bis third and sixth paragraphs, with the rest being renumbered in order; 13th,

fourth and fifth paragraphs, with the rest being renumbered in order; 14th fifth, sixth, and seventh paragraphs; 25th third

and fourth paragraphs; 26th fifth paragraph, with the rest being renumbered in order; 39th, last paragraph; 74th first

paragraph, fraction VII; 77th first paragraph, fraction V; Annex 2 Chapter I " Object ", Chapter II " Thresholds for non-presential identification ", Chapter III " Technological Identification Mechanisms ", Chapter IV

" Requirements " and Chapter V " Other provisions ", with the articles being renumbered in order, and are REPEALED the 4th Bis third paragraph; 17th Bis; Annex 2 article 3, all of them of the General Provisions referred to in

Articles 71 and 72 of the law for regulating the activities of savings and loan cooperative societies, to remain as follows:

2nd.-

...

I. to IX. ...

X. Device, the equipment that allows access to the worldwide network called Internet, used for

entering into contracts or carrying out Operations through internet pages or mobile applications, among other

technological developments, which the Societies themselves make available to their Clients to carry them

out.

Devices shall not be considered those that:

a) Are owned by the Societies.

b) Are under the control of the Societies.

c) Are provided under additional controls by the Societies to their Clients so that they can carry out

Operations, or

d) Are installed in the branches of the Societies themselves or in public sites, complying

with the respective regulation so that Clients can enter into contracts or carry out Operations;

XI. to XIV. ...

XV.

Geolocation, the geographic location of the Device used to enter into contracts or carry out

Non-presential Operations, which consists of obtaining the geographic coordinates of latitude and longitude through the global positioning system (GPS) in which the Device is located.

In the event that Clients enter into contracts or carry out Non-presential Operations from a

Device that, due to its characteristics, cannot provide the geographic coordinates of latitude and

longitude through GPS, the Societies must obtain the geographic coordinates of latitude and longitude

based on matching the Internet protocol address provided by the Client's Device with a

geographic location, for the approximate obtaining of said coordinates.

The geographic coordinates of latitude and longitude obtained through GPS or based on the

matching of the Internet protocol address must be obtained prior to the Client's consent in terms of the regulation that in matters of data protection is applicable;

XVI. to XXI. ...

XXI. Bis. Technological Identification Mechanism, to

any of the procedures referred to in

Annex 2, through which the Societies carry out the comparison of the valid identification document and

the application of proof of life;

XXII. to XXV. ...

XXV. Bis. Interim Compliance Officer, to the person referred to in Article 51 Bis of these

Provisions;

XXVI. to XXXVIII. ...

4th Bis.- The Societies that receive contributions to their social capital, open an account or

enter into a contract through Devices in a non-presential manner to individual or corporate Clients,

both of Mexican nationality, in accordance with what is established in Annex 2 of these Provisions,

in addition to the identification data referred to in Article 4 of these Provisions, as applicable,

must require and obtain from their Clients the Geolocation of the Device from which they carry out

the contribution to capital, open the account, or enter into the contract, as well as:

I. Regarding individual Clients who declare to the Society to be of Mexican nationality:

a) Repealed.

b) Consent that may be obtained through Electronic Signature or Advanced Electronic Signature.

Such consent shall serve as proof to legally establish the celebration of the contract carried out with the

Society in a non-presential manner.

c) ...

d) In its case, Standardized Banking Key (CLABE) of an account opened in any financial entity

or Foreign Financial Entity authorized to receive deposits, whose holder coincides with the name referred to in

Article 4 of these Provisions.

e) The declaration of the individual stating that they act on their own behalf. Such

declaration may be established in the Terms and Conditions established to that effect by the Society.

f) The digital version of the valid official personal identification document currently in force from which the

data referred to in this provision originate.

g) The digital version of the proof of address, which may be any of those indicated in subsection b),

numeral iii. of fraction I of Article 4 of these Provisions.

However, when the declared address coincides with that of the voter credential of the Client

issued by a Mexican authority, in case they have been identified with it, this will function as the

proof of address referred to in this subsection.

II. Regarding Clients that are legal entities of Mexican nationality:

a) Email.

b) In its case, Standardized Banking Key (CLABE) of an account opened in any financial entity

or Foreign Financial Entities authorized to receive deposits, whose holder coincides with the

designation or corporate name referred to in Article 4, fraction II of these Provisions.

c) Consent that may be obtained through Electronic Signature or Advanced Electronic Signature, of the

legal representative. Such consent shall serve as proof to legally establish the contributions to their

social capital, the opening of the account, or the celebration of the contract carried out with the Society in a non-

presential manner.

d) The information referred to in Article 4, fraction II, subsection c) and fraction VI of these Provisions.

e) The digital version of the identification documents referred to in Article 4, fraction II, subsection b) of the

present Provisions, with the exception of those indicated in numeral ii of the same subsection.

The Societies shall not carry out the receipt of contributions to their capital, or carry out the

opening of the account or the celebration of the contract in a non-presential manner, when they do not collect the data related to

Geolocation.

The Societies shall not be obligated to collect the data related to Geolocation regarding the

societies, dependencies, and entities referred to in Annex 1 of these Provisions,

provided that the aforementioned societies, dependencies, and entities have been classified as Clients with

a Low Risk Degree in terms of Article 26 of these Provisions.

Paragraph repealed.

It shall be understood as a valid official personal identification document currently in force for the compliance of the

present Provision, the voter credential issued by the National Electoral Institute in the country or through

the consular offices of the Secretariat of Foreign Relations abroad, the passport, and the

consular registration certificate.

...

The digital version of the valid official personal identification document currently in force that the Societies

collect for identification purposes must allow its verification in terms of these

Provisions.

Additionally, the digital versions of the documents that the Societies collect must

be preserved in their Files or Records in accordance with these Provisions. The Societies must

preserve the documents in accordance with the official Mexican standard on digitalization and preservation of

Data Messages applicable or consider an international standard whenever the standard of

compliance has at least the requirements of the official Mexican standard and does not contravene it.

...

7th- ...

Regarding contributions to social capital, accounts opened, or contracts entered into

in accordance with Article 4 Bis of these Provisions, in substitution of the interview referred to in the previous paragraph, the Societies will establish the Technological Identification Mechanisms referred to in Annex 2

of these Provisions.

...

With respect to the accounts referred to in Article 14 of these Provisions, the Societies may carry out

the remote receipt or capture of the data, in substitution of the interview mentioned in the first paragraph of this provision, provided that the Society in question verifies the authenticity of the Client's data, for which they must adhere to the following procedure:

I. and II. ...

...

The validation of the identification data referred to in this Provision may be carried out through

procedures different from those indicated in the previous paragraph, prior authorization of the Commission,

with the opinion of the Secretariat.

8th.- The Societies must preserve, as part of the identification file of each of their

Clients, the data and documents mentioned in the provisions of this Chapter, in its case, the document containing the results of the interview or of the Technological Identification Mechanisms referred to in

Article 7, as applicable, the one regarding visits referred to in Article 22, in its case, and the questionnaire

provided for in Article 26 of these Provisions.

13th- ...

...

In the event that the transactional level of any of the products or services referred to in the

first paragraph of this Provision exceeds the maximum amount established by the Society for them to

be considered as Low Risk, said Society must proceed to carry out the in-person interview or

apply any of the Technological Identification Mechanisms referred to in Article 7 and Annex 2,

respectively, of these Provisions and integrate the identification file of the respective Client

with all the information and documentation that corresponds, in terms of what is provided in

Article 4 or 4 Bis of these Provisions, as well as comply with the various obligations established in

the same.

Likewise, the Societies must inform their clients that they cannot carry out Operations above

the limit until the identification process that corresponds is concluded.

To determine the transactional level referred to in this provision, the Societies shall not be

obliged to consider the amounts related to interest generated or any other bonus that said

Societies grant for the use or management of the respective account that, if any, are made in the period

in question.

...

14th- ...

...

...

...

In the event that the transactional level of any of the products or services referred to in the

first paragraph of this Provision exceeds the maximum amount established by the Society for them to

be considered as Low Risk, said Society must proceed to carry out the in-person interview or

apply any of the Technological Identification Mechanisms referred to in Article 7 and Annex 2,

respectively, of these Provisions and integrate the identification file of the respective Client

with all the information and documentation that corresponds, in terms of what is provided in

Article 4 or 4 Bis of these, as well as comply with the various obligations established in the same.

Likewise, the Societies must inform their clients that they cannot carry out operations above

the limit until the identification process that corresponds is concluded.

To determine the transactional level referred to in this provision, the Societies shall not be

obliged to consider the amounts related to interest generated or any other bonus that said

Societies grant for the use or management of the respective account that, if any, are made in the period

in question.

16th.- For the carrying out of Operations through electronic, optical, or any other

technology, the Societies must previously integrate the Client's identification file in accordance with what is established in these Provisions, establish mechanisms to identify the same, as well

as develop procedures to prevent the improper use of said means or technologies, which

shall be contained in their Compliance Manual or in some other document or manual prepared by the Society itself.

17th Bis.- Repealed.

25th.- ...

Regarding those Operations carried out in a non-presential manner, in addition to the elements for determining the Client's transactional profile indicated in the preceding paragraph, the Society must take into account the Geolocation of the Device from which said Operation is carried out.

The Geolocation referred to in the preceding paragraph may cover the various Operations that the Client carries out in the active session within the Internet page or mobile application, among other technological developments, that the Societies themselves make available to their Clients to carry them out.

Societies will not be obligated to take into account the data relating to Geolocation under the terms of this Provision, regarding the societies, dependencies, and entities referred to in Annex 1 of these Provisions, provided that said societies, dependencies, and entities have been classified as Clients with a Low Risk Degree under the terms of the 26th of these Provisions.

26th.-

...

...

...

In the case of capital contributions, account opening, or contract celebration in a non-presential manner referred to in the 4th Bis of these Provisions, Societies must consider the Geolocation information of the Device from which the Client carries out the Operation, activity, or service with the respective Society.

Societies will not be obligated to consider Geolocation information under the terms of this Provision, regarding the societies, dependencies, and entities referred to in Annex 1 of these Provisions, provided that said societies, dependencies, and entities have been classified as Clients with a Low Risk Degree under the terms of this Provision.

...

...

...

...

To determine the Risk Degree in which Clients should be located, as well as whether they should be considered Politically Exposed Persons, each Society will establish in its Compliance Manual the criteria conducive to that end, which take into account, among other aspects, the Client's background, profession, activity or business sector, the origin and destination of their resources, place of residence, Geolocation, the methodology referred to in Chapter II Bis of these Provisions, and other circumstances determined by the Society itself.

28th.- Prior to opening accounts or celebrating contracts with Clients who, due to their characteristics, are classified by the Society with a High Risk Degree, at least one executive or equivalent who has specific powers to approve the opening or celebration of said accounts or contracts, as applicable, must grant written approval, digitally or electronically. Likewise, for the purposes referred to in fractions IV and V of the 51st of these Provisions, Societies must provide in their Compliance Manual the mechanisms for their respective Compliance Officers to have knowledge of those Clients who are classified with a High Risk Degree by the Societies themselves, as well as the procedures that must be carried out to process the approval indicated in this Provision.

39th.- Societies must monthly send to the Secretariat, through the Commission, no later than within fifteen business days following the last business day of the immediately preceding month, a report for each international fund transfer that, individually, any of their Clients or Users has received or sent during said month, for an amount equal to or greater than one thousand United States dollars or its equivalent in national currency or in the foreign currency in which it is carried out.

...

...

For purposes of calculating the amount of the Operations in its equivalent in national currency, the exchange rate to settle obligations denominated in foreign currency payable in the Mexican Republic, published by the Bank of Mexico in the Official Gazette of the Federation, on the business day immediately preceding the date on which the Operation is carried out, will be considered.

41st.- For each Unusual Operation detected by a Society, it must send to the Secretariat, through the Commission, the corresponding report, within three business days following the day on which the session of the Committee that rules on it as such concludes. For purposes of carrying out the ruling in question, the Society, through its Committee, will have a period that will not exceed sixty calendar days counted from when the alert is generated through its system, model, process, or by the Society's employee, whichever occurs first.

...

46th.- For each Internally Concerning Operation detected by a Society, it must send to the Secretariat, through the Commission, the corresponding report, within three business days following the day on which the session of the Committee that rules on it as such concludes. For purposes of carrying out the ruling in question, the Society, through its Committee, will have a period that will not exceed sixty calendar days counted from when said Society detects that Operation, through its system, model, process, or any employee thereof, whichever occurs first.

...

...

...

51st Bis.- The Committee of each Society or its board of directors or general manager may appoint a Society official who will temporarily exercise the functions of Compliance Officer in the fulfillment of its obligations under these Provisions, for up to ninety calendar days during a calendar year, counted from when the official designated as Compliance Officer leaves, has their appointment revoked, or is unable to perform the assignment in question.

...

...

The Interim Compliance Officer must perform the functions and obligations indicated in these Provisions, until the moment the revocation indicated in fraction II of the 52nd of these Provisions is reported.

52nd.-

...

I. The full name and surname without abbreviations of the official who has been designated as Compliance Officer, as well as the other information provided for in the format indicated, within ten business days following the date on which the corresponding appointment has been made;

II. The revocation of the appointment of the Compliance Officer or Interim Compliance Officer who has been designated under the terms established in both the 51st and the 51st Bis of these Provisions, as applicable, within ten business days following the date on which it has occurred, whether by determination of the Society, rejection of the assignment, termination of employment, or impossibility, as well as the other information provided for in the format indicated, and

III. The full name and surname without abbreviations of the official who has been designated as Compliance Officer under the terms established in the 51st Bis of these Provisions, as well as the other information provided for in the format indicated, within ten business days following the date on which it has occurred.

73rd.- ...

Societies must adopt and implement mechanisms that allow identifying Clients or Users who are on the List of Blocked Persons, as well as any third party acting on their behalf or for their account, and the Operations they have carried out, are carrying out, or intend to carry out. Such mechanisms must be provided for in the Compliance Manual of the Society itself.

74th.- ...

I. to VI. ...

VII. Those that appear on the list of taxpayers referred to in the fourth paragraph of Article 69-B of the Federal Tax Code.

77th.- ...

I. to IV. ...

V. They are in the situation referred to in the sixth paragraph of Article 69-B of the Federal Tax Code.

...

Annex 2

...

Chapter I " Object "

Article 1.- This Annex aims to establish the minimum measures and procedures that Societies must observe in order to comply with the 4th Bis of these Provisions, without prejudice to compliance with the various obligations established therein.

Chapter II " Thresholds for non-presential identification "

Article 2.- Societies must observe the following thresholds by type of Technological Identification Mechanism and product on which they request authorization from the Commission for purposes of complying with the 4th Bis of these Provisions:

I. Regarding the Technological Identification Mechanism provided for in Article 4 of this Annex, for the realization or contracting of:

a) Capital contributions and deposit account opening offered by Societies to applicants who are natural persons, natural persons with business activity, or legal entities, all of Mexican nationality, it must be agreed in the respective contracts that the sum of deposits over the course of a calendar month does not exceed the equivalent in national currency to 30,000 Investment Units.

In the event that the transactional level exceeds the maximum amount established in the preceding paragraph, the Society must carry out the Technological Identification Mechanism provided for in Article 5 of this Annex if it has the corresponding authorization or carry out the in-person interview referred to in the 7th of these Provisions and integrate the Client's identification file with all the corresponding information and documentation, under the terms provided in the 4th or 4th Bis of these Provisions, as well as comply with the various obligations established therein. Likewise, Societies must inform their clients that they cannot carry out operations above the limit until the corresponding identification process is concluded.

To determine the transactional level referred to in this provision, Societies will not be obligated to consider amounts related to interest generated or any other bonus that said Societies grant for the use or management of the respective account, if any, carried out during the period in question.

b) Consumer credits offered by Societies to natural person applicants, as well as commercial credits granted to natural persons with business activity and legal entities, all of Mexican nationality, in both cases, it must be agreed in the respective contracts that the credit line or amount granted does not exceed the equivalent in national currency to 60,000 Investment Units.

II. Regarding the Technological Identification Mechanism provided for in Article 5 of this Annex:

a) Capital contributions and deposit account opening offered by Societies to applicants who are natural persons, natural persons with business activity, or legal entities, all of Mexican nationality, it must be agreed in the respective contracts that the sum of deposits over the course of a calendar month does not exceed the equivalent in national currency to 60,000 Investment Units.

In the event that the transactional level exceeds the maximum amount established in the preceding paragraph, the Society must carry out the in-person interview referred to in the first paragraph of the 7th of these Provisions and integrate the Client's identification file with all the corresponding information and documentation, under the terms provided in the 4th of these Provisions, as well as comply with the various obligations established therein. Likewise, Societies must inform their clients that they cannot carry out operations above the limit until the corresponding identification process is concluded.

To determine the transactional level referred to in this provision, Societies are not obligated to consider amounts related to interest generated or any other bonus that said Societies grant for the use or management of the respective account, if any, carried out during the period in question.

b) Consumer credits offered by Societies to natural person applicants, as well as commercial credits granted to natural persons with business activity and legal entities, all of Mexican nationality, in both cases, it must be agreed in the respective contracts that the credit line or amount granted does not exceed the equivalent in national currency to 100,000 Investment Units.

Societies must take as a reference value for the Investment Units referred to in this article, that applicable for the last day of the calendar month preceding that in which the contract computation for the granting of the credit in question is carried out.

Chapter III " Technological Identification Mechanisms "

Article 3.- Societies may opt for one or both of the Technological Identification Mechanisms indicated in Articles 4 or 5, subject to the thresholds indicated in Article 2 of this Annex.

Without prejudice to the foregoing, additionally, Societies may carry out the Technological Identification Mechanism referred to in Article 5 of this Annex subject to the thresholds referred to in fraction I of Article 2 of this Annex.

Article 4.- Societies must have technology that allows identifying the applicant through a recording containing image and sound, which must be preserved without edits in its total duration throughout the validity of the account or contract and, once it concludes, for a period of at least ten years from the conclusion of the account opening or contractual relationship.

Additionally, during the development of the Technological Identification Mechanism referred to in the preceding paragraph, Societies must observe the following:

a) Register the time and date of its realization obtained from a protected time server.

b) Implement it through automated tools that allow its recording and subsequent reproduction.

c) Verify that the quality of the image and sound allows full identification of the applicant, according to the parameters established by the Societies themselves for this purpose.

d) Require the applicant to show the valid identification document sent along with the form referred to in fraction III of Article 7 of this Annex, both the front and back, verifying that it contains the same data and photograph as the valid identification document previously sent.

e) Use specialized technology that allows them to achieve reliable identification of the applicant, ensuring that there is a match between their face and that of the valid identification document previously sent.

f) Perform a liveness test on the applicant.

For the purposes of the foregoing, a liveness test is understood as technical tests based on algorithms, to measure and analyze the anatomical characteristics or voluntary and involuntary reactions of the applicant, in order to determine if a biometric sample is being captured from a subject with life present at the point of capture.

Article 5.- Societies must verify the match of the applicant's biometric information either with the records of the National Electoral Institute, the Secretariat of Foreign Relations, or with those of any other Mexican authority that provides a biometric information verification service.

In the event that the biometric information referred to in the preceding paragraph is the applicant's fingerprints, Societies must ensure that the applications or means they have available ensure that the fingerprint is obtained directly from the applicant, that is, a live fingerprint test, avoiding the recording of fingerprints from impressions on any material intended to simulate another person's fingerprint or images pursuing such an end, and have security measures that guarantee that the stored, processed, or sent information through said applications or means is not known or used by unauthorized third parties, as well as authenticate that the fingerprint obtained from the applicant coincides, at least, ninety percent with the records of the databases of either the National Electoral Institute, the Secretariat of Foreign Relations, or with those of any other Mexican authority that provides a biometric information verification service.

Additionally, Societies must have technology that allows identifying the applicant through a recording containing image and, if applicable, sound, which must be preserved without edits in its total duration throughout the validity of the account or contract and, once it concludes, for a period of at least ten years from the conclusion of the account opening or contractual relationship, and must observe the requirements referred to in Article 4, second paragraph of this Annex. To comply with item c), it will be necessary to verify the quality of the sound when applicable.

Article 6.- In the event that the National Electoral Institute, the Secretariat of Foreign Relations, or any other Mexican authority that provides a biometric information verification service, cannot respond to requests for biometric information verification referred to in Article 5 of this Annex due to technical or communication failures attributable to the corresponding Mexican authority, Societies may, if they have the corresponding authorization, carry out the Technological Identification Mechanism of Article 4 of this Annex 2, subject to the corresponding limits.

In the event that the transactional level exceeds the maximum amount established for the Technological Identification Mechanism referred to in Article 4 of this Annex, the Society must carry out the in-person interview referred to in the 7th of these Provisions or apply the Technological Identification Mechanism provided for in Article 5 of this Annex, if it has the corresponding authorization for the latter, and integrate the Client's identification file with all the corresponding information and documentation, under the terms provided in the 4th or 4th Bis of these Provisions, as well as comply with the various obligations established therein. Likewise, Societies must inform their clients that they cannot carry out operations above the limit until the corresponding identification process is concluded.

Chapter IV " Requirements "

Article 7.- Additionally, for purposes of what is established in this Annex, Societies must:

I.

Obtain prior authorization from the Commission.

Authorization referred to in the preceding paragraph will not be necessary when Societies comply with the thresholds referred to in Article 2, fraction I of this Annex and carry out the Technological Identification Mechanism referred to in Article 5 of this Annex. In this case, Societies must inform the Commission in advance of the products and the date on which they will begin offering them, through the electronic means indicated by the latter.

Likewise, Societies must observe what is established in fractions II to VII of this article, as well as the requirements provided for in Articles 8 and 9 of this Annex.

Societies must conserve all the supporting information and documentation, which must be available to the Commission, upon its request, within the timeframe established by the Commission itself.

II. Require the applicant to declare whether they are already a Client of the Society. In the event that the declaration is affirmative, the Society must observe what is provided for in fraction IV of this article. Regardless of the applicant's declaration, the Society must complete their identification file according to the product they intend to contract.

III. Require the applicant who has declared not to be a Client of the Society to send a form through the electronic medium established by the Society for this purpose, in which must be included, at least, the identification data referred to in the 4th Bis of these Provisions, as well as the specification of the product intended to be contracted from those provided for in Article 2 of this Annex.

The aforementioned form must include a statement indicating that its submission to the Society in question constitutes the applicant's acceptance for their image and, if applicable, their voice to be recorded in one of the Technological Identification Mechanisms referred to in Chapter III of this Annex.

This statement may be made through automated tools that allow its recording and subsequent reproduction.

IV. In the event that the applicant declares being a Client of the Society, it must verify at least the data of full name, Client number, and Unique Population Registry Key of the Client, as well as other data it determines itself in order to corroborate against its own records that, indeed, it is a Client, and if so, the Society must authenticate them with a category 3 authentication factor according to the General Provisions applicable to the activities of savings and loan cooperative societies.

In the event that the verification referred to in the preceding paragraph of this fraction is successful, the Society may proceed to the contracting of the products provided for in Article 2 of this Annex, without the need to carry out what is established in fractions V to VIII below.

When the verification referred to in this fraction is not successful, the Society must observe the same requirements provided for in this Annex for applicants who declare not to be Clients.

V. If the Society corroborates that the applicant is not its Client, together with the form referred to in fraction III of this article, it must require the applicant to send a color photograph of one of the valid identification documents, referred to in the 4th Bis of these Provisions, front and back, and verify the security elements in order to detect if they present alterations or inconsistencies, for which they must have the necessary technology for this purpose.

Repealed.

Repealed.

...

Repealed.

In the case of the voter credential issued by the National Electoral Institute in the country or through the consular offices of the Secretariat of Foreign Relations abroad, the Societies must verify the coincidence of the data listed below with the records of said Institute or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) The Credential Identifier Code (CIC), which is printed on the voter credential or, in its case, the Optical Character Recognition Code (OCR).

b) to d) ...

The Societies must verify that the paternal and maternal surnames and name or names, as they appear on the submitted voter credential, match the records of the National Electoral Institute or the National Population Registry or with those of any other Mexican authority that provides a verification service for said identification document.

In the case of the Mexican passport issued by the Secretariat of Foreign Relations in the country or through its consular offices abroad, the Societies must verify the coincidence of the data mentioned below with the records of said Secretariat or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) The Optical Character Recognition Code (OCR).

b) Paternal and maternal surnames and name(s), as they appear on the Mexican passport.

c) Passport Number.

In the case of the consular enrollment certificate issued by the consular offices of the Secretariat of Foreign Relations abroad, the Societies must verify the coincidence of the data mentioned below with the records of said Secretariat or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) Paternal and maternal surnames and name(s), as they appear on the consular enrollment certificate.

b) Date of issue and date of expiration.

c) Document Number.

Additionally, the Societies must require the applicant to send in digital format the necessary documents to integrate and maintain their identification file in accordance with what is provided in 4th Bis of these Provisions.

VI. Inform the applicant of the procedure to be followed in the corresponding Technological Identification Mechanism provided for in Chapter III of this Annex and what are the access points to the media for its realization, as well as deliver a one-time use code, which will be required from the applicant at the start of the Technological Identification Mechanism in question.

Repealed.

VII. The Societies must suspend the contracting process of the applicant when any of the following cases occur:

a) The quality of the image and, in its case, the quality of sound, do not allow for full identification of the applicant.

b) The applicant does not present the valid identification document previously sent along with the form referred to in fraction III of article 7 of this Annex, the data obtained from this do not match the records of the National Electoral Institute, the Secretariat of Foreign Relations, the National Population Registry or with those of any other Mexican authority that provides a biometric information verification service regarding said identification document or, the result of the validation of the security elements of the mentioned documents or of the biometric verifications of the applicant's face referred to in the previous article 5, do not reach the effectiveness or level of reliability referred to in fraction VII of article 9 of this Annex.

c) and d) ...

e) Atypical or risky situations arise, or the Society has doubts about the authenticity of the valid identification document or the identity of the applicant.

Repealed.

In the event of suspension of the contracting process for the causes mentioned in the previous subsections, the Societies must store the information and documentation obtained, for at least 30 natural days, with the objective that, in case of resuming the contracting processes, it is corroborated that the information is consistent. Additionally, the aforementioned information and documentation must be used by the Societies in the controls provided for in these Provisions.

For the case of Clients or applicants who are legal entities, for the purposes of identifying their attorneys or legal representatives, the Societies must observe the same procedures indicated in this article, with the exception that, for the case of applicants who declare not to be Clients, the sending of the form referred to in fraction III of this article must be made through a file signed with the Advanced Electronic Signature of the legal entity in question.

...

The Societies may agree during the development of the Technological Identification Mechanism for the celebration of deposit account contracts referred to in this Annex, the contracting of electronic services associated with such accounts, without being able to allow that through the services contracted in accordance with what is established in this article, the celebration of operations charged to other accounts of the same Client is instructed. The aforementioned prohibition will not be applicable when the Client goes to the Offices to carry out the contracting of electronic services.

Repealed.

Repealed.

Repealed.

Article 8.- The Societies must have the necessary means for the transmission and safeguarding of the information, data, and files generated in the identification procedures referred to in Article 7 of this Annex, which guarantee the integrity of said information, as well as the correct reading of the data, and the impossibility of its manipulation, as well as its adequate security, conservation, and location.

The Societies may use technological improvements that help compensate for the clarity of images, when any of the valid identification documents are shown and the facial recognition of the applicant is performed, which must be approved by their risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors, or sole administrator.

Chapter V "Other Provisions"

Repealed.

Article 9.- The Societies, when requesting the authorization referred to in article 7, must present the following:

I. Detailed description of the non-presential identification process, as well as the Technological Infrastructure used in each part of this, specifying the function of each component of said infrastructure which must be approved by the risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors, or sole administrator.

Likewise, the Societies must include all technology providers involved in the Technological Infrastructure and, in its case, the main applications used for the referred process and their interrelation.

II. Description of the electronic means used for applicants to send, in their case, the form and documents through a secure channel considering, at least, the type of transmission of the device to the node that receives the form information, such as Hyper Text Transfer Protocol Secure, or Transport Layer Security version 1.2 or higher.

III. Name of the certification provider authorized by the Secretariat of Economy used for the conservation of the digital version of any of the valid identification documents referred to in 4th Bis of these Provisions, in accordance with the Official Mexican Standard on digitalization and conservation of Data Messages applicable or consider an international standard whenever the compliance standard has at least the requirements of the Mexican official standard and does not contravene it.

IV. Network diagram showing all components of the Technological Infrastructure that form part of the non-presential identification process, including the segregation of communication networks and perimeter security equipment, considering redundancy schemes.

Repealed.

V. Detailed information on whether the images of valid identification documents, recordings, and biometric information will be kept in service provider facilities or the Society's own facilities, describing the controls for access management and mechanisms for their storage.

VI. Evidence that the means of verification of the validity of identification documents have the effectiveness approved by the risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors, or sole administrator of the Societies.

VII. In its case, evidence that the systems, tools, or mechanisms used for facial identification recognitions or the verifications of any other biometric element that are used have the level of reliability determined by the risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors, or sole administrator of the Society.

VIII. In its case, detailed information on the calibration tests of the systems, tools, or mechanisms used for facial identification recognitions or the verifications of any other biometric element that are used.

These tests must be carried out in accordance with the thresholds established by the Society, which must contemplate the results of these tests, and the adjustments of the validation engine derived from them.

The Societies must accompany their authorization request with evidence of all the above.

IX. The quality standards of the image and, in its case, of sound.

X. In its case, the technical description of the category 3 authentication factors that will be required to corroborate that an applicant is a Client of the Society, in accordance with what is provided in article 7 of this Annex, as well as the characteristics of the one-time use code.

XI. Mechanisms through which they will transmit and securely safeguard the information, data, and documents generated in the non-presential identification procedure.

XII. Mechanisms used to guarantee the integrity, correct reading, impossibility of manipulation, and adequate security, conservation, and location of the information, data, and documents referred to in this Annex.

XIII. Encryption mechanisms in the communication channels used in the non-presential identification process, indicating the information that will be transmitted through each of said channels.

XIV. Mechanisms used for access management to the systems, as well as policies for access management, in which the use of robust passwords is included.

XV. Policies and procedures for information security incident management.

XVI. Mechanisms or tools used for monitoring and blocking contracts that present the situations described in subsection e) of fraction VII of article 7 of this Annex.

XVII. Carry out tests aimed at detecting vulnerabilities and threats, as well as penetration tests on the different components of the Technological Infrastructure used in the process, whether own or third-party. The aforementioned penetration tests must be carried out by an independent third party that has personnel who have the technical capacity proven by specialized industry certifications in the matter.

The Societies must provide the Commission with evidence of the performance of the tests referred to in fractions VIII and XVII of this article, before implementing the scheme that has been authorized to them in accordance with article 7 of this Annex.

It will be the responsibility of the Societies that hire third parties to store, process, and transmit information in the non-presential contracting process, the monitoring of compliance with this article, at least once a year, as well as the obligation to have the evidence that supports it, which they must have available to the Commission at all times.

When the Societies intend to modify any of the procedures they have authorized to comply with article 4 or article 5, as applicable, of this Annex, they will require prior authorization from the Commission.

Transitory Provisions

First.- This Resolution will enter into force the day after its publication in the Official Gazette of the Federation except for what is provided in the following Transitory Provisions.

Second.- The guidelines, interpretations, and criteria issued by the Secretariat or by the Commission, based on what is provided in the Resolution of December 31, 2014, and subsequent Resolutions through which the General Provisions referred to in Articles 71 and 72 of the Law for Regulating the Activities of Savings and Loan Cooperative Societies have been added or reformed, will remain applicable insofar as they do not oppose what is established in this Resolution.

Third.- The Societies must comply with the obligations contained in this Resolution, in the terms and in accordance with the deadlines indicated below:

I. Four months counted from the entry into force of this Resolution to modify the Compliance Manual and present it to the Commission.

II. Nine months counted from the date of entry into force of this Resolution, to modify the methodology referred to in Chapter II Bis of the Provisions.

III. Eighteen months counted from the date of entry into force of this Resolution, to update the automated systems referred to in 55th of the Provisions.

Fourth.- In the event that the Societies update the assumption provided in article 7, fraction I second paragraph of Annex 2 that is reformed with this Resolution, they must inform through the email prevencion.lavado@cnbv.gob.mx, through a free written document to the General Directorates of Prevention of Operations with Resources of Illicit Origin A and B of the Commission, the situation provided for in said article while the Commission establishes the ideal electronic means for the Societies to comply with what is provided for in said article.

Fifth.- Those references of ultimate beneficiary that are provided for in other normative frameworks, guidelines, or guides issued by the competent authorities in matters of prevention of operations with resources of illicit origin and financing of terrorism other than these Provisions, as well as in the public consultation databases in charge of the competent authorities, the Societies may equate it to the defined term of Real Owner referred to in these Provisions.

Mexico City, August 25, 2021.- The Secretary of Finance and Public Credit, Rogelio Eduardo Ramírez de la O.- Signature.

In the document you are viewing, there may be text, characters, or objects that do not display correctly due to conversion to HTML format, so we recommend always taking the digitized image of the DOF or the PDF file of the edition as a reference. The content, form, and scope of published documents are the strict responsibility of their issuer.

INQUIRY

BY DATE

Do Mo Tu We Th Fr Sa

INDICATORS

Exchange Rate and Rates as of 28/08/2026

DOLLAR 16.9712 UDIS 8.808812 TIIE 28 DAYS 6.7559% TIIE 91 DAYS 6.7931% TIIE 182 DAYS 6.8474% TIIE OVERNIGHT 6.50%

See more

SURVEYS

Did you like the new image of the Official Gazette of the Federation website?

No Yes

Official Gazette of the Federation

Río Amazonas No. 62, Col. Cuauhtémoc, C.P. 06500, Mexico City Tel. (55) 5093-3200, where you can access our menu of services

Electronic address: dof.gob.mx

113

LEGAL NOTICE | SOME RIGHTS RESERVED © 2026