Resolution modifying the general provisions applicable to credit institutions

DOF: 29/08/2018

RESOLUTION modifying the general provisions applicable to credit institutions

At the margin, a seal with the National Coat of Arms, which says: United Mexican States.- Ministry of Finance and Public Credit.- National Banking and Securities Commission.

The National Banking and Securities Commission,

based on the provisions of articles 52, last paragraph, and 98, second paragraph of the Credit Institutions Law, as well as 4, fractions II, XXXVI and XXXVIII, and 16, fraction I of the National Banking and Securities Commission Law, and

CONSIDERING

That it is appropriate to make various adjustments to the rules that establish the obligation for credit institutions to verify the identity of their potential clients, with the objective of flexing the verification actions that must be carried out for such purposes in accordance with the characteristics of the potential client;

That it is necessary to make adjustments to Annex 71 of the General Provisions Applicable to Credit Institutions so that, regarding the capture of fingerprints of their clients so that they can be considered biometric data, they are allowed to capture at least six fingerprints, taking into account existing technologies, and

That it is deemed convenient to establish a longer deadline for the entry into force of both the obligation for credit institutions to verify the identity of their clients so that the necessary mechanisms can be implemented for this purpose, and that for credit institutions to pay the amounts corresponding to claims filed by their clients for the celebration of contracts for active, passive, and service operations or the request for means of disposal, unless they are related to Level 1 and 2 Bank Accounts, which have been carried out by persons other than the client themselves pretending to be the client, has resolved to issue the following:

RESOLUTION MODIFYING THE GENERAL PROVISIONS APPLICABLE TO CREDIT INSTITUTIONS

FIRST.- Articles 51 Bis, fraction II and fifth paragraph; 51 Bis 2, fraction III; 51 Bis 4, fraction I, subsection b), second paragraph; 51 Bis 10, first paragraph, and 51 Bis 12, first paragraph are REFORMED; Articles 15 Bis, fourth paragraph; 51 Bis, sixth and seventh paragraphs, and 51 Bis 6, fraction III, fourth paragraph are ADDED; Articles 51 Bis, fifth paragraph, and 51 Bis 6, fraction III, subsection b), are REPEALED, and Annex 71 of the "General Provisions Applicable to Credit Institutions," published in the Official Gazette of the Federation on December 2, 2005, and modified through Resolutions published in the said Official Gazette on March 3 and 28, September 15, December 6 and 8, 2006; January 12, March 23, April 26, and November 5, 2007; March 10, August 22, September 19, October 14, and December 4, 2008; April 27, May 28, June 11, August 12, October 16, November 9, and December 1 and 24, 2009; January 27, February 10, April 9 and 15, May 17, June 28, July 29, August 19, September 9 and 28, October 25, November 26, and December 20, 2010; January 24 and 27, March 4, April 21, July 5, August 3 and 12, September 30, October 5 and 27, and December 28, 2011; June 19, July 5, October 23, November 28, and December 13, 2012; January 31, April 16, May 3, June 3 and 24, July 12, October 2, and December 24, 2013; January 7 and 31, March 26, May 12 and 19, July 3 and 31, September 24, October 30, December 8 and 31, 2014; January 9, February 5, April 30, May 27, June 23, August 27, September 21, October 29, November 9 and 13, December 16 and 31, 2015; April 7 and 28, June 22, July 7 and 29; August 1, September 19 and 28, and December 27, 2016; January 6, April 4 and 27, May 31, June 26, July 4 and 24, August 29, October 6 and 25, December 18, 26 and 27, 2017; January 22, March 14, April 26, May 11, June 26, and July 23, 2018, are SUBSTITUTED, to read as follows:

TITLES FIRST to FIFTH . . .

Annexes 1 to 70

. . .

Annex 71

Technical requirements for the capture of fingerprints and facial identification as biometric data.

" Article 15 Bis.-

. . .

I. to V.

. . .

Institutions that carry out factoring, Discount, or Credit Rights Cession Operations that are celebrated through the platform referred to in this article, and solely with respect to the celebration of these, will not be subject to Section B of the Second Section of Chapter II of Title Two, nor to Chapter X of Title Five of these provisions. "

" Article 51 Bis.-

. . .

II.

Unique Population Registry Key. Institutions must remotely corroborate with the National Population Registry that the data provided matches that of said registry, prior to contracting, of which they will retain evidence. Institutions may not corroborate the Unique Population Registry Key in new contracts made by their clients, provided that said key has been corroborated in previous contracts.

III. and IV.

. . .

Institutions will not be obligated to carry out the verification actions referred to in fraction I of this article, regarding legal representatives or attorneys-in-fact of legal entities. Nor will they have to carry out said verification actions in the contracting of trusts that are constituted by the federal, state, and municipal governments or their parastatal entities, or by individuals who maintain an open Bank Account Level 3 or 4 in their name at the same Institution or another, and which is considered an "Active Account" in terms of Article 207 Bis, fraction II of these provisions, which must be verified prior to contracting.

Development banking institutions will not be obligated to carry out the verification actions indicated in fraction I of this article, when it comes to contracts whose object is to grant the service of access to an automated platform to carry out second-tier operations or execute factoring, Discount, or Credit Rights Cession Operations between financial entities and other persons, natural or legal, or trusts, provided that these have a deposit account previously opened in their name at a national financial entity and this is verified prior to the contracting of the service by the development banking institution in question.

This exception will also apply to credit contracts made by development banking institutions with individuals, provided that the dispersion of the credit resources is carried out exclusively in the deposit account opened in the name of the grantee at a national financial entity, or if it is the administration of securities and the Institutions provide the Internet Banking services referred to in fraction V of article 307 of these provisions with respect to those accounts.

Institutions will also not be obligated to carry out the verification actions provided for in fractions I and II of Article 51 Bis of these provisions, when it comes to the contracting of active, passive, or service operations that, in execution of a mandate, commission, or trust, the employees or fiduciary delegates of the Institutions celebrate with the Institution itself in the name and representation of their principals, clients, or trusts. "

" Article 51 Bis 2.- . . .

I. and II.

. . .

III.

Carry out the verification actions referred to in fraction I of Article 51 Bis 4 of these provisions or verify that the fingerprints of the person match the records of any Mexican authority, provided that these records meet at least the requirements of Annex 71 of these provisions. Likewise, they must corroborate the existence of the Unique Population Registry Key with the National Population Registry and that the data provided by the client matches that of said registry. "

" Article 51 Bis 4.-

. . .

Institutions must provide mechanisms to carry out the contracting and the request for payment means indicated in Article 51 Bis, as well as the carrying out of the operations referred to in Article 51 Bis 1 of these provisions, with those individuals from whom, for any physical impediment, their fingerprint cannot be obtained for purposes of authentication before the National Electoral Institute, which must be recorded in the respective client's file.

. . .

II. to IV.

. . .

. . . "

" Article 51 Bis 6.-

. . .

I. and II.

. . .

III.

. . .

Repealed.

c) to e)

. . .

Institutions must verify that the paternal surnames, maternal surnames, and name(s), as they appear on the presented voter credential, match the records of the National Electoral Institute or the National Population Registry.

IV. to VI.

. . .

. . . "

" Article 51 Bis 10.- Institutions must verify the match of the data or documentation presented by their clients against the information contained in their own records, during the process of formalizing contracts to be celebrated with them to carry out active, passive, or service operations or if they request payment means, except for Level 1 Bank Accounts.

. . . "

" Article 51 Bis 12.- Institutions, as part of their Internal Control System, must keep an electronic record of the reports that their clients make regarding the opening of deposit or savings accounts, except Level 1 Bank Accounts, contracting of credits or any other service that they do not recognize, as well as unsolicited credit cards, whether they are natural or legal persons, in which at least the following is recorded:

I. to VIII.

. . .

. . . "

SECOND.- Articles SECOND; THIRD, first and second paragraphs; FOURTH; FIFTH, and SIXTH TRANSITORY of the "Resolution modifying the general provisions applicable to credit institutions," published in the Official Gazette of the Federation on August 29, 2017, are REFORMED, to read as follows:

" SECOND.- Credit institutions must comply with what is established in articles 51 Bis, 51 Bis 1, and 51 Bis 4 that are added by this Resolution, starting from March 31, 2020, provided that, no later than December 14, 2018, they present to the National Banking and Securities Commission for its approval, a work plan in which they specify the actions they will follow to develop the mechanisms referred to in articles 51 Bis 3 and 51 Bis 5 that are added by this instrument, which serves to verify the biometric identity of persons who contract or carry out operations with them.

To resolve what corresponds, the plan must include the obligation for credit institutions to verify the biometric identity of their clients starting from March 31, 2020, and the Commission will have ten business days from the presentation of the aforementioned work plan; if there is no manifestation regarding this by said Commission, the response must be understood as positive.

To this effect, the aforementioned plan must describe the concrete activities that credit institutions must develop, as well as the dates of realization of each of them.

If the option indicated in the first paragraph of this article is not exercised, or if the corresponding approval is not obtained, credit institutions must comply with articles 51 Bis, 51 Bis 1, and 51 Bis 4 cited above starting from January 1, 2019.

THIRD.- From the entry into force of this instrument and until such time as credit institutions comply with the articles indicated in the previous SECOND Transitory article or verify the biometric identity of persons who contract or carry out operations with them in terms of the approvals referred to in articles 51 Bis 3 and 51 Bis 5 of this instrument, they will be obligated to announce or offer to the general public in a notable and reliable manner that, in case their clients file claims for the acts referred to in article 51 Bis that is added by this Resolution to the "General Provisions Applicable to Credit Institutions," which are carried out by third parties pretending to be the client in question, they commit to assume the risks and, therefore, the amounts of said claims, when the circumstances of the next paragraph are met. For the purposes of the foregoing, the respective amounts will be paid, no later than twenty days after the claim is presented, and the corresponding clarifications will be made before the credit information societies, as well as the cancellation of the bank account or credit in question.

In any case, to process the claims provided for in the previous paragraph, credit institutions may only require the official identification and the Unique Population Registry Key of the claimant, and within the twenty-day period cited, they must rule in favor of the claimant if the data and copies of identification documents that, in their case, must be integrated in accordance with applicable regulations are not in the file, or if said data or documents present inconsistencies with those presented by the claimant from which it is clear that they are different persons. This is without prejudice to the judicial actions that the credit institution or the client in question may initiate, in their case.

. . .

FOURTH.- Credit institutions will be obligated to carry out the notifications referred to in article 51 Bis 11 that is added by this Resolution, starting from when they obtain the data referred to in article 51 Bis, fraction III that is added by this instrument to the "General Provisions Applicable to Credit Institutions," in contracts that are made after January 1, 2019.

Credit institutions that have an approved work plan in terms of the previous SECOND transitory article, will be obligated to carry out the notifications indicated in the preceding paragraph, starting from when they obtain the data referred to in article 51 Bis, fraction III that is added by this instrument to the "General Provisions Applicable to Credit Institutions," in contracts that are made after March 31, 2020.

FIFTH.- Credit institutions will have the following deadlines, starting from the publication in the Official Gazette of the Federation of this Resolution, to comply with the articles of the "General Provisions Applicable to Credit Institutions" as follows:

Nine months, to comply with what is provided by articles 51 Bis 10 and 51 Bis 12.

II.

Twenty-four months, to comply with the reforms to articles 141, fraction IV; 154, fraction III, subsection c); 156, fraction VI, subsection h); 160, fraction XIII; 164, fraction IX, and 286.

In case credit institutions that have an approved work plan in terms of the previous SECOND transitory article, what is provided in the previous paragraph will be applicable starting from March 31, 2020.

The annual report and valuation that the audit committee and the internal audit area of credit institutions must carry out, respectively, regarding articles 156, fraction VI, subsection h), and 160, fraction XIII that are added by this Resolution, must be carried out for the first occasion once a year has passed since the entry into force of these provisions, and will contain information regarding the immediately preceding calendar year.

SIXTH.- Annexes 2 to 5 that are substituted by this Resolution will enter into force twenty-four months following the date of their publication, so credit institutions must continue integrating their clients' files in terms of what is provided by the ones in force prior to the entry into force of this instrument during said period and will not be obligated to keep them updated in accordance with the terms of this Resolution, until the moment when the client themselves contracts new deposit accounts, credits, or services.

In case credit institutions have an approved work plan in terms of the previous SECOND transitory article, what is provided in the previous paragraph will enter into force on March 31, 2020, so credit institutions must continue integrating their clients' files in terms of what is provided by Annexes 2 to 5 of the "General Provisions Applicable to Credit Institutions" in force prior to the entry into force of this instrument during said period and will not be obligated to keep them updated in accordance with the terms of this Resolution, until the moment when the client themselves contracts new deposit accounts, credits, or services. "

TRANSITORY

SOLE.- This Resolution will enter into force the day following its publication.

Respectfully,

Mexico City, August 24, 2018.- The President of the National Banking and Securities Commission, José Bernardo González Rosas.- Signature.

ANNEX 71

TECHNICAL REQUIREMENTS FOR THE CAPTURE OF FINGERPRINTS AND FACIAL IDENTIFICATION AS BIOMETRIC DATA

I. Fingerprint Capture

The fingerprint records made by Institutions will consist of an image capture of the papillary ridges of the fingers on a contrast surface by pressure, from which the biometric data are obtained. This capture must consider controls that ensure that they are obtained directly from the person, avoiding the recording of fingerprints coming from impressions on any material that intends to simulate the fingerprint of another person (live fingerprint test).

The process of the first capture of fingerprints must consist of registering, first, the ten fingerprints of the employees, executives, and officials of the Institutions who will be in charge of registering the fingerprints of the clients. Second, the aforementioned employees, executives, and officials will proceed to capture at least six fingerprints of the Institution's clients. For this, Institutions must be assisted by the person or persons responsible for Internal Control functions to verify what is provided in this paragraph.

The fingerprint capture process must prevent an employee, executive, or official of the Institution from registering their own fingerprints in substitution of the client's. Institutions must at all times guarantee the integrity of the stored or transmitted biometric information, as well as the conservation, availability, and impossibility of manipulation of such information. For the purposes of what is provided in this paragraph, Institutions must adhere at least to the following:

Logically and physically segregate the infrastructure in which the databases of biometric information are maintained, including the segmentation of the different networks involved.

Securely configure the equipment, according to the type of infrastructure element, ports, services, permissions, access lists, manufacturer updates, and factory configuration.

Establish access controls and identification and authentication mechanisms for all and each of the users of the technological infrastructure, which allow them to be recognized unequivocally and ensure access only to persons expressly authorized for this purpose. Both mechanisms must include specific controls for those users with greater privileges, derived from their functions, such as database and operating system administration, including audit logs on all accesses.

Have encryption mechanisms for information when it is transmitted or stored.

Carry out tests aimed at detecting vulnerabilities and threats, as well as penetration in the different elements of the technological infrastructure in order to implement defense mechanisms that prevent unauthorized access and use of information.

Implement controls for the conservation of information, including those regarding the integrity of the stored information, which allow identifying any change to the original data, as well as secure conservation and deletion that avoid at all times that they can be known by unauthorized third parties.

Designate a person to serve as the information security officer in the Institution, who will enjoy independence with respect to operational, audit, and systems areas, who must approve the definition of the security mechanisms mentioned in this annex and in the provisions, as well as verify their compliance. Institutions may designate for these functions the person referred to in Annex 52 of the Provisions.

Institutions must use fingerprint readers of at least two fingers per reading (dual devices) for the procedure of the first capture of fingerprints for the integration of their databases.

For the fingerprint capture process, the minimum image requirements are as follows:

Scanner Resolution (dots per inch)
Depth (pixels)
Minimum Dynamic Range (gray levels)
500
8 bits
200

Platform operation parameters (software and hardware) for fingerprint capture

The applications and devices used in the fingerprint capture process on a contrast surface by pressure, in order to integrate a database with such information, must consider at least the following requirements:

PARAMETER
DECISION
OBSERVATION

First fingerprint capture
Captured Image
Type of capture
M
Flat live.
Number of fingers
M
10 for employees, executives, and officials.
6 for clients as a minimum.

The foregoing, subject to the exception established in this annex.

Finger Position
MP
Fingers must be placed in the center of the platter with respect to its horizon and parallel to the capture surface.

Capture Angle
MP
Fingers must be placed at 90° with a rotation of ±10° with respect to the platter horizon.

Movement during Capture
MP
Avoid sliding of the prints on the platter at the moment of capture, to avoid smudged images.

Visualization
MP
The operator must observe capture information in real time.

Segmentation
MP
Proven by NIST in the test called "Slap Seg II test".

Sequence
M
Validate that fingerprints of each finger are not repeated during the same capture process.

Deduplication
M
Validate that the fingerprints of the Institution's clients or employees are not previously registered in the database with the information of another client or employee of the Institution.

Devices
Dual
M
EFTS certified annex F FAP 45.

Decadactylar (4-4-2)
M
EFTS certified annex F FAP 60.

Sequence review.

Image
M
Generates RAW.
Preview of the taken image.

Information to be obtained from the device M The serial number is mandatory.
Optionally, the device must have firmware version, manufacturer, and model.

Operation
Assisted
M
Yes. Hierarchical fingerprint capture and at least one operator fingerprint must be recorded, which must be registered biometrically in the Institution.

Analysis of quality parameters
M
In accordance with NFIQ.

Cleaning
MP
Clean the platter before each fingerprint capture for optical readers.

Lighting
MP
For optical devices, avoid light sources on the capture device.

Recapture
M
In case of not obtaining the minimum quality parameters, at least 3 attempts per fingerprint.

Transmission
Compression of images of 500 dots per inch (ppi, by its English acronym) M Single compression starting from RAW image. WSQ maximum 10:1.

Decision: M->Mandatory O->Optional MP->Best practice

In the event that the applications, processes, parameters, or devices used in fingerprint capture do not comply with the requirements of this annex, the Institutions must submit them to the approval of the Commission. Notwithstanding the foregoing, regarding the capture of fingerprints of the Institutions' clients, in no case may it be less than six fingerprints, except for the exception provided for in this annex.

Exception to fingerprint capture

In the event that clients, employees, executives, and officials of the Institutions are permanently unable to imprint their fingerprints on the respective readers, it must be specified that it is not possible to capture the fingerprint image due to amputations, grafts, malformation, permanent injury, prosthesis, disease, among others.

In any case, the largest possible number of fingerprints must be captured, making the corresponding annotations in the file.

Authentication using the Institution's own fingerprint database

For the process by which fingerprint reading is performed for authentication (1-to-1 matching) of already registered clients, and its use as Authentication Factor Category 4, if applicable, the image capture requirements are as follows:

Scanner Resolution (dots per inch)	Depth (pixels)	Minimum Dynamic Range (gray levels)
300	4 bits	12
500	8 bits	80

PARAMETER	DECISION	OBSERVATION
Authentication Captured Image
Number of fingers	O	1 to 4 depending on the type of reader.
Any finger	O	Yes. The sample against all user records.
Recapture	O	Yes. A minimum of three attempts is suggested.
Devices
Mobile	M	EFTS certified annex F or PIV FAP 30.
Dual	M	EFTS certified annex F FAP 45.
Decadactylar (4-4-2)	M	EFTS certified annex F FAP 60.
Unidactylar	O	PIV is recommended.
Transmission
Format	O	One of the following: Proprietary Format, RAW Format, compressed image with ANSI INCITS 378 or ISO/IEC 19794-2 standards.

Decision: M->Mandatory O->Optional MP->Best practice

II. Operational guidelines for facial recognition

In the event that Institutions determine to obtain any facial recognition element from their clients, the applications and devices used in the facial element capture process must consider at least the following requirements:

PARAMETER	DECISION	OBSERVATION
Facial Image Capture
Captured Image	M	2D Full Frontal, 24 bits color, minimum distance between eyes 90 pixels.
Digital and photographic requirements	M	Standard ISO 19794-5 sections 7.3, 7.4, 8.3, and 8.4.
Posture	M	Must allow a rotation of at least ±5° frontal in any direction (up, down, left, right).
Expression	M	Neutral facial expression. Smiles, winks, etc., must be avoided.
Gaze at the camera lens (with the exception of physical impediments).
Lighting	M	Balanced and distributed in each part of the face. To achieve natural skin tones and avoid red eyes.
Depth of Field	M	The central pose of the complete face will be in focus from the crown to the chin and from the nose to the ears.
Lenses	M	The use of frames of any type will not be allowed.
Accessories	M	Only medical accessories are allowed (no hats, nor accessories that cover the face).
Impediments for taking the photo	M	Closed eyes.
Hair covering eyes or forehead.
Elements obstructing the forehead.
Facial Hair	M	It is allowed.
Background	O	A uniform light-colored background that contrasts with the face and hair will be used; pale gray or white is recommended.
Operation	M	Controlled lighting environment.
Assisted	M	Yes.
Segmentation and feature extraction
	M	Crop according to ICAO standard. Automatic feature extraction by software.
Quality review
	M	Automatic by software; the ICAO standard for image quality must be evaluated.
Authentication
Image Capture	O	Same as in facial image capture.
Number of Images	O	One full frontal.

Decision: M->Mandatory O->Optional MP->Best practice

The facial element capture process must prevent an employee, executive, or official of the Institution from registering their own characteristics in substitution of the client's. For these purposes, prior to the start of client information capture, Institutions must ensure that the data of their employees, executives, and officials have been previously captured. For this purpose, Institutions must assist themselves with the person or persons responsible for Internal Audit functions to verify what is provided for in this paragraph.

III. GLOSSARY

ANSI: American National Standards Institute, of the United States of America.

Authentication: The Process by which the User's identity is verified with the biometric data of fingerprints or face that the Institutions have previously obtained. This process implies searches for stored patterns of a single individual (1-to-1).

Deduplication: The specialized data compression technique used to avoid duplicate copies of these.

EFTS (by its English acronym Electronic Fingerprint Transmission Specifications): The specifications for the transmission of biometric information of the Federal Bureau of Investigation of the United States of America (FBI).

FAP (by its English acronym FingerPrint Acquisition Profile): It is a subdivision of the categories applied to devices for fingerprint acquisition based on dimensions, number of fingers to be captured simultaneously, image quality. When accompanied by a number (30, 45, 60) this indicates the capture area in inches (45=1.6 x 1.5; 60=3.2 x 3.0, etc.).

ICAO: The standard for passports issued by the International Civil Aviation Organisation.

INCITS (by its English acronym InterNational Committee for Information Technology Standards): The central forum of the United States of America, dedicated to the creation of standards for technological innovation.

ISO/IEC: The standard for information security published by the International Organization for Standardization and the International Electrotechnical Commission.

NFIQ: NIST Fingerprint Image Quality. The fingerprint image quality standards defined by NIST.

NIST: National Institute of Standards and Technology.

PIV: The standard defined by NIST for 1-to-1 fingerprint verification (comparison of one fingerprint against a record).

Platter: The capture surface of the fingerprint capture device.

RAW: The format of the raw (unprocessed) image capture of a fingerprint.

Segmentation: The process by which the fingerprint image of each finger is individualized, based on a compressed image with WSQ or a single RAW image obtained from the reader, to obtain up to four independent images, one for each finger.

Slap Seg II Test: The test that evaluates the precision with which the algorithm segments images in multi-finger captures.

WSQ (by its English acronym Wavelet Scalar Quantization): The standard created by the FBI that defines the format for the compression of fingerprint images.

In the document you are viewing, there may be text, characters, or objects that do not display correctly due to conversion to HTML format, so we recommend always taking the digitized image of the DOF or the PDF file of the edition as a reference. The content, form, and scope of published documents are the strict responsibility of their issuer.

CONSULT

BY DATE

Do Lu Ma Mi Ju Vi Sá

INDICATORS

Exchange Rate and Rates as of 29/08/2026
UDIS 8.809369
See more

SURVEYS

Did you like the new image of the Federal Official Gazette website?
No Yes

Federal Official Gazette
Río Amazonas No. 62, Col. Cuauhtémoc, C.P. 06500, Mexico City Tel. (55) 5093-3200, where you can access our service menu Electronic address: dof.gob.mx

113

Lineage: Amended

Timeline

Similar documents from other regulators