Resolution modifying the general provisions applicable to credit institutions — SHCP — MX

DOF: 19/11/2020

RESOLUTION modifying the general provisions applicable to credit institutions

At the margin, a seal with the National Coat of Arms, which reads: United Mexican States.- TREASURY.- Ministry of

Treasury and Public Credit.- National Banking and Securities Commission.

The National Banking and Securities Commission, with the prior agreement of its Board of Directors and based on

what is provided in Article 50 of the Credit Institutions Law; as well as Articles 4, fractions XXXVI and

XXXVIII and 16, fractions I and VI of the National Banking and Securities Commission Law, having received the

prior opinion of the Bank of Mexico, and

CONSIDERING

That in accordance with Article 78 of the General Law for Regulatory Improvement and with the purpose of reducing the

cost of compliance with these provisions, the National Banking and Securities Commission through this

resolution, repeals, among others, the obligations contained in Articles 2 Bis 112, 2 Bis 113, 2

Bis 114 and 2 Bis 114 a., of the General Provisions applicable to credit institutions;

That it is necessary for credit institutions to have a more precise and risk-sensitive method for

the risks to which they are exposed in their operations for the purpose of determining their minimum requirements for

net capital for operational risk, eliminating the other currently valid methods, and at the same time

maintaining the capital framework of the Mexican financial system aligned with the international prudential standards

issued by the Basel Committee on Banking Supervision, and

That it is pertinent to update the types and subtypes

of events in which each

of the indicators contained in Annex 72 titled "Information Security Indicators"

of the General Provisions applicable to credit institutions, has resolved to issue the

following:

RESOLUTION MODIFYING THE GENERAL PROVISIONS

APPLICABLE TO THE

CREDIT INSTITUTIONS

SINGLE.- Articles 2 Bis, second paragraph; 2 Bis 111; 2 Bis 115; 88, first paragraph,

fractions I, sub-paragraphs b) and c), VII and VIII, first paragraph and sub-paragraph a); 207 and 208, fraction II, sub-paragraphs c), d), e), f) and g);

are REFORMED; Articles 1, fraction CIX Bis; 2 Bis 114 b; 208, fraction II, sub-paragraph h); Annex 1-D Bis titled "Minimum Requirements for the Use of the Business Indicator Method in the Calculation of

Capital Requirement for Operational Risk"; Annex 1-O Bis 1 titled "Information Disclosure

Related to the Calculation of the Capital Requirement for Operational Risk" and Annex 36 in the Series "R28

Operational Risk Information", specifically, report A-2815 titled "Assignment of the Business Indicator Method for

Operational Risk"; are ADDED; Articles 1, fractions CVIII, CIX, CXI and

CXII; 2 Bis 112; 2 Bis 113; 2 Bis 114; 2 Bis 114 a; 88, fraction VIII, sub-paragraph c); Annex 1-D "Requirements and

Minimum Criteria for the Use of the Standard Operational Risk Method and Alternative Standard Method"; the

Annex 1-E "Minimum Requirements for the Use of Advanced Methods to Calculate the Capital Requirement

for its Exposure to Operational Risk" and Annex 36 "Regulatory Reports" in the Series "R28

Operational Risk Information", specifically, report A-2814 titled "Assignment of the

standard operational risk method and alternative standard method"; are REPEALED; and Annex 12-A "Requirements for the

Preparation and Updating of the Historical Database Containing the Systematic Record of the Different

Types of Loss Associated with Operational Risk of Institutions"; Annex 72 "Information Security

Indicators" and the index of Annex 36 "Regulatory Reports" of the "General Provisions

Applicable to Credit Institutions", published in the Official Gazette of the Federation on December 2, 2005 and reformed for the last time by resolution published in the said Gazette on August 21, 2020, are SUBSTITUTED, to read as follows:

" ANNEX 1 to ANNEX

1-C . . .

ANNEX 1-D

Repealed.

ANNEX 1-D Bis

Minimum Requirements for the Use of the Business Indicator Method in the Calculation of

Capital Requirement for Operational Risk.

ANNEX 1-E

Repealed.

ANNEX 1-F to ANNEX 1-O Bis . . .

ANNEX 1-O Bis 1

Information Disclosure Related to the Calculation of the Capital Requirement for

Operational Risk.

ANNEX 1-P to ANNEX 12 . . .

ANNEX 12-A

Minimum Requirements for the Preparation and Updating of the Historical Database that

Contains the Systematic Record of the Different Types of Loss Associated with Operational

Risk of Institutions.

ANNEX 12-B to ANNEX 71 . . .

ANNEX 72

Information Security Indicators.

ANNEX 73 . . . "

" Article 1.- . . .

I. to CVII. . . .

CVIII.

Repealed.

CIX.

Repealed.

CIX Bis.

Business Indicator Method: the method for the Calculation of Capital Requirements

for Operational Risk referred to in Article 2 Bis 114 b of these provisions.

CX. . . .

CXI.

Repealed.

CXII.

Repealed.

CXIII. to CXCVII. . .

. "

" Article 2 Bis.- . . .

For such purposes, in the case of credit risk, either of the two approaches may be applied, a Standard Method, to which Section Two of Chapter III of this First Bis Title refers, and another based on internal ratings, the latter of basic or advanced type, the use of which will be subject to what is provided in Section Three of the cited Chapter III. With respect to market and operational risks, Institutions will use the standard methods established in Chapters IV and V of this title, respectively. "

" Article 2 Bis 111.- Institutions, to calculate the capital requirement for their exposure to

Operational Risk, must use the Business Indicator Method.

Article 2 Bis 112.- Repealed.

Article 2 Bis 113.- Repealed.

Article 2 Bis 114.- Repealed.

Article 2 Bis 114 a.- Repealed.

Article 2 Bis 114 b.- To obtain the capital requirement for Operational Risk under the Business Indicator

Method, Institutions must previously determine the following:

The business indicator (BI) will be defined by the following sum:

Where:

Is the interest, lease, and dividend component, which will be calculated in

accordance with the formula indicated in sub-paragraph a) of this fraction.

Is the service component, which will be calculated in accordance with the formula

indicated in sub-paragraph b) of this fraction.

Is the financial component, which will be determined in accordance with the formula

indicated in sub-paragraph c) of this fraction.

For the calculation of the interest, lease, and dividend component (ILDC), Institutions must consider the information corresponding to the 36 months prior to the

date of the capital requirement calculation being performed in accordance with the formula

expressed below. For this effect, month t-1 represents the month immediately prior to

which the capital requirement is being calculated; t-2 refers to the information

corresponding to two months before the month of the cited calculation date, and so

successively until t-36, which will be the information from 36 months before the month of the

referenced calculation.

Where:

Are the Annual Net Income corresponding to period j where j= 1, 2 and

Are the Annual Dividend Income corresponding to period j where

j= 1, 2 and 3.

The variables e

will be the sums of the monthly flows of the concepts from the

comprehensive income statement indicated in Table 1 below, or their

equivalents calculated in accordance with the following formulas:

Table 1. Concepts to be included in Interest Income, Interest Expenses and

Dividend Income

(current pesos)

Concepts

The Interest Income variable will be integrated by:

a.1 Interest on credit portfolio with credit risk stage 1.

a.2 Interest on credit portfolio with credit risk stage 2.

b. Interest on credit portfolio with credit risk stage 3.

c. Interest and yields in favor from investments in financial instruments.

d. Interest and yields in favor in repo operations

e. Interest on cash and cash equivalents.

f. Fees for granting credit

g. Premiums in favor in securities lending operations

h. Premiums for debt placement.

i. Interest and yields in favor from margin accounts

j. Income from hedging operations

k. Gain on valuation

l. Increase due to update of interest income

m. Lease income

n. Credit portfolio recovery

The Interest Expense variable will be composed of the following concepts:

a. Interest on demand deposits

b. Interest on time deposits

c. Interest, transaction costs, and discounts charged for issuance of financial

instruments that qualify as liabilities

d. Interest on interbank loans and from other entities

e. Interest and yields charged in repo operations

f. Premiums charged in securities lending operations

g. Costs and expenses associated with granting credit

h. Expenses from hedging operations

i. Loss on valuation

j. Interest charged associated with the global deposit account with no activity

k. Increase due to update of interest expenses

The Dividend Income variable will be composed of:

a. Dividends from permanent investments

b. Dividends from instruments that qualify as equity financial instruments

Regarding the Productive Assets variable, this must be obtained as the average of

the 36 months of balances at the end of each month reflected in their financial

position statement of the concepts specified in Table 2 of this sub-paragraph, or their

equivalents.

Table 2. Concepts to be included in

Productive Assets of the ILDC

(current pesos)

Concepts

The Productive Assets variable will be the integration of:

a. Cash and cash equivalents

b.1 Credit portfolio with credit risk stage 1

b.2 Credit portfolio with credit risk stage 2

c. Investments in financial instruments

d. Securities lending

e. Financial derivative instruments

The service component (SC) must be calculated considering:

Where:

Are Other Annual Operating Income corresponding to period j

where j= 1, 2 and 3.

Are Other Annual Operating Expenses corresponding to period j where

j= 1, 2 and 3.

Are Annual Fees and Tariffs Charged corresponding to period j

where j= 1, 2 and 3.

Are Annual Fees and Tariffs Paid corresponding to period j

where j= 1, 2 and 3.

For the variables,

referred to, the sums of the monthly flows of the concepts from the comprehensive income statement, or their

equivalents, indicated in Table 3 of this sub-paragraph, corresponding to the 36 months

prior to the month for which the capital requirement is being calculated, must be considered, in accordance with

the following formulas:

Table 3. Concepts to be included in Other Operating Income, Other Operating

Expenses, Fees and Tariffs Charged, and Fees and Tariffs Paid of the

service component (SC)

(current pesos)

Concepts

The Other Operating Income variable will be integrated by:

a. Recoveries

b. Income from credit portfolio acquisition

c. Gain from sale of credit portfolio

d. Income from purchase option in financial leasing operations

e. Income from participation in the sale price of goods in financial leasing

operations

f. Result from sale of adjudicated goods (always if positive)

g. Result from valuation of adjudicated goods (always if positive)

h. Result from sale of properties, furniture, and equipment (always if positive)

i. Interest in favor from loans to officials and employees

j. Result from valuation of benefits to receive in securitization operations

(always if positive)

k. Result from valuation of asset for administration of transferred financial assets

(always if positive)

l. Result from valuation of liability for administration of transferred financial assets

(always if positive)

m. Result from benefits to receive in securitization operations (always if

positive)

n. Other items of operating income (expenses) (always if positive)

ñ. Result from valuation of items not related to the financial margin (always

if positive)

o. Result from monetary position originated by items not related to the financial

margin

p. Increase due to update of other operating income (expenses) (always if

positive)

The Other Operating Expenses variable will be composed of:

a. Expenses from credit portfolio acquisition

b. Loss from sale of credit portfolio

c. Shortfalls

d. Donations

e. Loss from adjudication of goods

f. Result from sale of adjudicated goods (always if negative)

g. Result from valuation of adjudicated goods (always if negative)

h. Loss in custody and administration of goods

i. Loss in trust operations

j. Interest charged in financing for acquisition of assets

k. Result from sale of properties, furniture, and equipment (always if negative)

l. Result from valuation of benefits to receive in securitization operations

(always if negative)

m. Result from valuation of asset for administration of transferred financial assets

(always if negative)

n. Result from valuation of liability for administration of transferred financial assets

(always if negative)

ñ. Result from benefits to receive in securitization operations (always if

negative)

o. Other items of operating income (expenses) (always if negative)

p. Increase due to update of other operating income (expenses) (always if

negative)

q. Result from valuation of items not related to the financial margin (always

if negative)

The Fees and Tariffs Charged variable will be integrated by:

a. Guarantees

b. Letters of credit without refinancing

c. Acceptances on behalf of third parties

d. Purchase and sale of financial instruments

e. Account opening

f. Account management

g. Fiduciary activities

h. Fund transfer

i. Bank drafts

j. Cashier's checks

k. Certified checks

l. Traveler's checks

m. Custody or administration of goods

n. Safe deposit box rental

ñ. Electronic Banking Services

o. Other fees and tariffs charged

p. Credit operations

The Fees and Tariffs Paid variable will be integrated by:

a. Correspondent banks

b. Commission agents

c. Fund transfer

d. Loans received

e. Debt placement

f. Other fees and tariffs paid

For its part, the Financial Component (FC) will be calculated in accordance with the following

formula:

Where:

Is the Annual Purchase and Sale Result corresponding to period j where j= 1, 2 and

3 which will be calculated as the monthly flow of the concepts from the comprehensive income

statement, or their equivalents indicated in the following Table 4, according to

the following formulas:

Table 4. Concepts to be included in Purchase and Sale Result of the financial

component (FC)

(current pesos)

Concepts

The Purchase and Sale Result variable will be integrated by:

a. Result from purchase and sale of financial instruments and financial derivative

instruments

b. Result from purchase and sale of foreign exchange

c. Result from purchase and sale of minted precious metals

d. Result from sale of received collateral

e. Transaction costs

The BI must be calculated before any deduction of reserves, except those specific for

Operational Risk events, and must not include the following concepts:

Income and expenses associated with the marketing or distribution of insurance.

Premiums paid and reimbursements received from acquired insurance or reinsurance policies.

Administration and promotion expenses.

Recovery of administration and promotion expenses

Facility and fixed asset expenses, except when these expenses are the result of events

of loss from Operational Risk.

Depreciation or amortization of tangible and intangible assets, except that depreciation

related to financial leasing assets, which must be considered as financial lease expense.

Provisions or reversal of provisions, except provisions related to loss events

from Operational Risk.

Expenses for reimbursement of share capital.

Impairment of value or reversal of impairment of value (e.g., of financial assets, non-financial

assets, investments in subsidiaries, joint ventures, or associates).

10.

Changes in the merchant credit account recognized in the comprehensive income statement or its

equivalent.

11.

Income tax.

II.

The business indicator component (BIC) must be calculated incrementally as described in the following

Table 5, considering that BI is the result obtained in accordance with fraction I of this article.

Table 5. Calculation of the business indicator component (BIC) based on income

corresponding to each bracket of the BI

Level

BI Level

Marginal Coefficient (a)

Determination of BIC

If BI <

3,500

million Udis

12 %

If 3,500

million Udis < BI <

104,000

million Udis

15 %

III

If BI >

104,000

million Udis

18 %

III.

Once the BIC referred to in the previous fraction is obtained, it will be used to calculate the

Internal Loss Multiplier (ILM) through the following formula:

Where:

The business indicator component obtained in accordance with fraction II of the

present article.

15 times the average of annual Operational Risk losses incurred during the

ten years prior to the calculation of the corresponding capital requirements. The

Institutions, for the determination of such losses, must comply with what is established in

Annexes 1-D Bis and 12-A of these provisions.

For the purpose of calculating the average of annual losses, both

zero losses and those losses that have resulted negative

after having considered recoveries must be considered as zero.

Institutions must request authorization from the Commission to use an ILM less than 1,

provided that the following conditions are met:

An ILM less than 1 has been determined during the 6 months prior to the date on which the

authorization request is submitted if this indicator is calculated with the following

formula:

Where the variables BIC and AL are defined as stated above.

They demonstrate compliance with the requirements indicated in Annexes 1-D Bis and 12-A of these

provisions, for which they must present a letter signed by the general director,

including the result of the last review conducted by an independent third party that complies

with the characteristics established in said annexes, as well as the evidence supporting

said result. This review could not have been conducted with information subsequent to the deadline

indicated in the previous sub-paragraph.

Notwithstanding the foregoing, the Commission may order Institutions to use an ILM for the calculation

of the capital requirement that considers losses from operational events incurred in the

last five years or in a shorter period, if the ILM calculated with the losses recorded in such

periods is greater than 1 and considers them representative of the Operational Risk exposure

of the Institution in question. Likewise, it may order the use of an ILM greater than 1

when it determines non-compliance with the requirements indicated in Annexes 1-D Bis and 12-A of the

present provisions, which, to be corrected or remedied, implies making adjustments to the historical

database of Operational Risk loss events, in which case the ILM for the computation

of capital requirements will be that resulting from considering said adjustments.

The Commission may require additional capital if it has determined non-compliance with the

requirements indicated in Annexes 1-D Bis and 12-A referred to in the previous paragraph, or in the

application of what is contained in Chapter IV of Title Two of these provisions relative to

the

administration of operational risk.

The capital requirement for Operational Risk will be determined by multiplying the BIC and the ILM,

previously calculated in accordance with fractions I, II, and III above.

In the case where Institutions do not have a database of losses from Operational Risk

that has been constituted in accordance with what is established in Annexes 1-D Bis and 12-A, for at least the last

five years, or if they have been in operation for less than five years, their capital requirement for

Operational Risk will be equal to the BIC.

Article 2 Bis 115.- With respect to the variables necessary to determine the business

indicator (BI) established in fraction I of the previous Article 2 Bis 114 b, Institutions that do not have

minimum information for the last 36 months will determine the capital requirement for Operational Risk with the information available at the date of the computation, adjusting the corresponding formulas to the periods of available information. "

" Article 88.- Institutions must disclose to the public at least the information listed in the

fractions of this article, through their Internet page. The information classified as quantitative

must be disclosed quarterly, within the month immediately following its date, unless another method is specified; qualitative information must be updated at least annually,

within the first 90 natural days following the close of each fiscal year:

. . .

The structure and organization of the function for the comprehensive risk management and its control function;

The scope, nature of information and measurement systems and their reporting for each

risk category separately;

d) and e) . . .

II. to VI. . . .

VII.

With respect to operational risk, Institutions must disclose annually at

least the information in accordance with what is established in Annex 1-O Bis 1 of the present

provisions.

VIII.

Information on the market and liquidity risks to which the Institution is exposed at the date of

issuance of financial statements, revealing at least the following quantitative information:

Market Value at Risk.

. . .

Repealed.

IX.

. . .

" Article 207.- Institutions shall provide the Commission, with the frequency established in the following articles, the information attached to these provisions as Annex 36, which is identified with the series and reports listed below:

Series R01 Minimum Catalog

A-0111

Minimum Catalog

Series R03 Investments in securities

E-0304

Allocations

E-0305

Orders

Series R04 Credit Portfolio

Financial Situation

A-0411

Portfolio by credit type, average balance, interest and commissions

A-0417

Credit portfolio rating and preventive estimation for credit risks

A-0419

Movements in preventive estimation for credit risks

A-0420

Movements in portfolio with credit risk stage 3

A-0424

Movements in portfolio with credit risk stages 1 and 2

Commercial Portfolio

Detailed Information (Portfolio Rating Methodology Annexes 18 to 22)

C-0430

New commercial credits held by federal entities and municipalities, financial entities, legal and natural persons with business activity, federal government, federal, state and municipal decentralized agencies, state productive enterprises and credits granted to investment projects or assets with own payment source

C-0431

Tracking of commercial credits held by federal entities and municipalities, financial entities, legal and natural persons with business activity, federal government, federal, state and municipal decentralized agencies, state productive enterprises and credits granted to investment projects or assets with own payment source

C-0432

Discharge of commercial credits held by federal entities and municipalities, financial entities, legal and natural persons with business activity, federal government, federal, state and municipal decentralized agencies, state productive enterprises and credits granted to investment projects or assets with own payment source

C-0433

Reserves of commercial credits held by federal entities and municipalities, financial entities, legal and natural persons with business activity, federal government, federal, state and municipal decentralized agencies and state productive enterprises

C-0434

Severity of Loss of commercial credits held by federal entities and municipalities, financial entities, legal and natural persons with business activity, federal government, federal, state and municipal decentralized agencies and state productive enterprises

C-0435

Probability of Default of commercial credits held by federal entities and municipalities

C-0436

Probability of Default of commercial credits held by financial entities

C-0437

Probability of Default of commercial credits held by legal and natural persons with business activity, federal government, federal, state and municipal decentralized agencies and state productive enterprises with annual net sales or income less than 14 million UDIS, other than federal entities, municipalities and financial entities

C-0438

Probability of Default of commercial credits held by legal and natural persons with business activity, federal government, federal, state and municipal decentralized agencies and state productive enterprises with annual net sales or income greater than or equal to 14 million UDIS, other than federal entities, municipalities and financial entities

C-0439

Rating and provisioning method applicable to commercial credits for investment projects or assets with own payment source (Annex 19)

C-0440

Guarantees of commercial credits

Detailed information on second floor guarantees

C-0447

Tracking of guarantees

Housing Portfolio

H-0491

New housing credits

H-0492

Tracking of housing credits

H-0493

Discharge of housing credits

H-0494

Reserves of housing credits

Series R06 Adjudicated Assets

A-0611

Adjudicated Assets

Series R07 Income Tax and Deferred PTU

A-0711

Income Tax and Deferred PTU

Series R08 Deposits

A-0811

Traditional deposits and interbank and other organism loans

A-0815

Interbank and other organism loans, stratified by terms to maturity

A-0816

Demand deposits and interbank and other organism loans, stratified by amounts

A-0819

Integral deposits stratified by amounts

Series R10 Reclassifications

A-1011

Reclassifications in the statement of financial position

A-1012

Reclassifications in the statement of comprehensive income

Series R12 Consolidation

A-1219

Consolidation of the credit institution's statement of financial position with its subsidiaries

A-1220

Consolidation of the credit institution's statement of comprehensive income with its subsidiaries

B-1230

Disaggregation of permanent investments in shares

Series R13 Financial Statements

A-1311

Statement of changes in equity

A-1316

Statement of cash flows

B-1321

Statement of financial position

B-1322

Statement of comprehensive income

Series R14 Qualitative Information

A-1411

Shareholder integration

A-1412

Directors, employees, retirees, fee-based personnel and branches

Series R15 Service Operations

B-1522

Non-customer users of the institution's electronic media

B-1523

Customer operations for electronic banking services

B-1524

Customers for electronic banking services

Series R16 Risks

A-1611

Repricing gaps

A-1612

Maturity gaps

B-1621

Global portfolio of lawsuits

Series R24 Operational Information

B-2421

Information on operations regarding deposit products

B-2422

Information on operations regarding branches, credit cards and other operational variables

B-2423

Guaranteed holders by IPAB

C-2431

Information on operations with related parties

D-2441

General information on the use of financial services

D-2442

Frequency of use information on financial services

D-2443

Location information of financial services transaction points

E-2450

Number of customers for each product or service by person type

E-2451

Number of operations for each product or service by currency type

E-2452

Number of operations for each product or service by geographic zone

Series R26 Information by Commission Agents

A-2610

New and discharged commission agent administrators

A-2611

New and discharged commission agents

B-2612

New and discharged commission agent modules or establishments

C-2613

Tracking of commission agent operations

Series R27 Claims

A-2701

Claims

Series R28 Operational Risk Information

A-2811

Operational risk loss events

A-2812

Estimation of operational risk levels

A-2813

Update of operational risk loss events

A-2815

Business indicator method allocation for operational risk

Series R29 Account Freezes, Transfers and Unlocks

A-2911

Account freezes, transfers and unlocks

Series R32 Reconciliations

A-3211

Tax accounting reconciliation

Series 34 Leverage Ratio

A-3401

Calculation of the Leverage Ratio

Institutions will require prior authorization from the Commission for the opening of new concepts or levels that are not included in the series corresponding exclusively to the sending of information for new operations authorized for this purpose by the Secretariat, in terms of the relevant legislation, for which they will request said authorization through a free-form letter within fifteen business days following the authorization made by the Secretariat. Likewise, in case that due to changes in applicable regulations it is necessary to establish concepts or levels additional to those provided in these provisions, the Commission will make known to the Institutions the opening of the respective new concepts or levels.

In the two cases provided for in the preceding paragraph, the Commission, through SITI, will notify the Institution of the registration and sending mechanism for the corresponding information. "

" Article 208.-

. . .

a) a b)

. . .

II.

. . .

a) a b)

. . .

The information related to report A-2815 of series R28 shall be provided no later than 15 business days following the close of the month to which the information corresponds.

The information related to series R01; R04, exclusively with respect to reports A-0411, A-0417, A-0419, A-0420 and A-0424, C-0433, C-0434, C-0435, C-0436, C-0437, C-0438, C-0439 and C-0440; R08; R10; R12; R13, only with respect to reports B-1321 and

B-1322, shall be provided no later than the 20th day of the month immediately following the date thereof.

Regardless of electronic submission, reports B-1321 and B-1322 of series R13 shall be sent duly signed by the executives and persons referred to in Article 179 of these provisions to the Commission.

The information related to series R04, exclusively with respect to report C-0447,

R06 and R07 within 25 days of the month immediately following the date thereof.

The information related to series R16, exclusively with respect to reports A-1611

and A-1612, series R24, only reports B-2421, B-2422, C-2431, D-2441 and D-2442, as

well as that corresponding to series R26 shall be sent no later than the last day of the month

immediately following the date thereof.

The information of report B-2423 corresponding to series R24, shall be sent no later than

45 days following the reporting close date.

The information related to series R34 shall be provided no later than the last business day of the

month immediately following the month whose figures are used for the calculation of the leverage

ratio.

III. a IV.

. . .

. .

" TRANSITORY ARTICLES

FIRST.- This Resolution shall enter into force on January 1, 2023, except for what is provided in the following transitory articles.

SECOND.- Credit institutions shall calculate their Operational Risk capital requirement using the Business Indicator Method referred to in article 2 Bis 114 b of this modifying resolution no later than January 1, 2023.

For the purposes of calculating the variable PI referred to in fraction III of article 2 Bis 114 b of this resolution, until the year 2025 it must consider at least the average of the following number of previous years to the calculation of capital requirements depending on the year to which the determination of such capital requirements corresponds:

Year in which the

capital requirement is calculated

Minimum number of previous years used to obtain PI

(average of annual operational risk losses incurred)

8 years

9 years

For the purposes of information for the years established in the table above, credit institutions shall use for the determination of annual losses for Operational Risk incurred during the years 2014 to 2022, those that would have been registered complying with what was established in Annex 12-A, in force in those years.

In the event that institutions do not have information on operational risk losses for the years referred to in the table and the preceding paragraph, their capital requirement for operational risk will be equal to CIN in accordance with the last paragraph of article 2 Bis 114 b of this resolution.

THIRD.- Credit institutions may calculate their Operational Risk capital requirement under the Business Indicator Method from the closing figures of October 2020 and before January 1, 2023, submitting the authorization request to the National Banking and Securities Commission. Such authorization request must include a detailed description of how they meet the requirements referred to in Annexes 1-D Bis and 12-A of the General Provisions applicable to credit institutions substituted or added with this modifying resolution, documentary evidence in electronic files supporting such description, as well as the estimation of the capital requirement for operational risk calculated with the Business Indicator Method for the 6 months prior to the immediately preceding month.

Once the aforementioned authorization request is received, the National Banking and Securities Commission will have 60 business days to resolve the relevant matters, during which it may request additional information, suspending the aforementioned period, while the credit institution delivers the information that has been requested. After the 60 business day period has elapsed without the Commission having pronounced itself, credit institutions may calculate the capital requirement for Operational Risk in terms of the Business Indicator Method.

Credit institutions that obtain authorization from the National Banking and Securities Commission to calculate the capital requirement for Operational Risk under the Business Indicator Method in accordance with what is stated in this transitory article:

I. Shall use for said calculation until December 31, 2021 the following accounts from their financial statements, in substitution of the accounts presented in Tables 1; 2; 3; and 4 of fraction I of article 2 Bis 114 b of this modifying resolution:

Table 1. Concepts to include in Interest Income, Interest Expense and Income from

Dividends

(current pesos)

Concepts

The variable Interest Income will be integrated by:

a. Interest on current credit portfolio

b. Interest on overdue credit portfolio

c. Interest and yields in favor from investments in securities

d. Interest and yields in favor in repo operations

e. Interest on liquidity

f. Commissions for granting credit

g. Premiums in favor in securities lending operations

h. Premiums for debt placement

i. Interest and yields in favor from margin accounts

j. Income from hedging operations

k. Profit from revaluation

l. Increase by updating interest income

m. Rental income

The variable Interest Expense will be composed of the following concepts:

a. Interest on demand deposits

b. Interest on time deposits

c. Interest on issued credit instruments

d. Interest on interbank and other organism loans

e. Interest on subordinated obligations

f. Interest and yields in charge in repo and securities lending operations

g. Premiums in charge

h. Discounts and issuance expenses for debt placement

i. Costs and expenses associated with granting credit

j. Expenses from hedging operations

k. Loss from revaluation

l. Interest in charge associated with the global account referred to in Article 61 of the Credit Institutions Law

m. Increase by updating interest expenses

n. Financial cost for capitalizable leasing

The variable Income from Dividends will be composed of:

a. Dividends from permanent investments

b. Dividends from equity instruments

Table 2. Concepts to include in

CI Productive Assets

(current pesos)

Concepts

The variable Productive Assets will be the integration of:

a. Liquidity

b. Current credit portfolio

c. Investments in securities

d. Net operations with securities and derivatives

Table 3. Concepts to include in Other Operating Income, Other Operating Expenses,

Commissions and Fees Charged, and Commissions and Fees Paid of the services component (CS)

(current pesos)

Concepts

The variable Other Operating Income will be integrated by:

a. Credit portfolio recoveries

b. Recoveries

c. Income from credit portfolio acquisition

d. Profit from credit portfolio cession

e. Income from purchase option in capitalizable leasing operations

f. Income from participation in the sale price of goods in capitalizable leasing operations

g. Result in sale of adjudicated goods (always if positive)

h. Result from valuation of adjudicated goods (always if positive)

i. Result in sale of properties, furniture and equipment (always if positive)

j. Interest in favor from loans to officials and employees

k. Result from valuation of benefits to receive in securitization operations

(always if positive)

l. Result from valuation of asset for administration of transferred financial assets

(always if positive)

m. Result from valuation of liability for administration of transferred financial assets

(always if positive)

n. Result in benefits to receive in securitization operations (always if

positive)

ñ. Other items of operating income (expenses) (always if positive)

o. Profit from revaluation of items not related to the financial margin

p. Result from monetary position originated by items not related to the financial

margin (always if positive)

q. Increase by updating other operating income (expenses) (always if

positive)

The variable Other Operating Expenses will be composed of:

a. Expenses from credit portfolio acquisition

b. Loss from credit portfolio cession

c. Shortfalls

d. Donations

e. Loss from adjudication of goods

f. Result in sale of adjudicated goods (always if negative)

g. Result from valuation of adjudicated goods (always if negative)

h. Loss in custody and administration of goods

i. Loss in trust operations

j. Interest in charge in financing for acquisition of assets

k. Result in sale of properties, furniture and equipment (always if negative)

l. Result from valuation of benefits to receive in securitization operations

(always if negative)

m. Result from valuation of asset for administration of transferred financial assets

(always if negative)

n. Result from valuation of liability for administration of transferred financial assets

(always if negative)

ñ. Result in benefits to receive in securitization operations (always if

negative)

o. Other items of operating income (expenses) (always if negative)

p. Increase by updating other operating income (expenses) (always if

negative)

q. Loss from revaluation of items not related to the financial margin

The variable Commissions and Fees Charged will be integrated by:

a. Guarantees

b. Letters of credit without refinancing

c. Acceptances on behalf of third parties

d. Sale and purchase of securities

e. Account opening

f. Account management

g. Fiduciary activities

h. Fund transfer

i. Bank drafts

j. Cashier's checks

k. Certified checks

l. Traveler's checks

m. Custody or administration of goods

n. Rental of safety deposit boxes

ñ. Electronic Banking Services

o. Other commissions and fees charged (different from those related to credit portfolio)

p. Credit operations

The variable Commissions and Fees Paid will be integrated by:

a. Correspondent banks

b. Commission agents

c. Fund transfer

d. Loans received

e. Debt placement

f. Other commissions and fees paid (different from those related to credit portfolio)

Table 4. Concepts to include in Result from Sale and Purchase of the financial component (CF)

(current pesos)

Concepts

The variable Result from Sale and Purchase will be integrated by:

a. Securities and Derivative Instruments

b. Currencies

c. Metals

d. Result from sale of received collateral

e. Transaction costs

Likewise, regarding the disclosure of the information contained in Section D of Annex 1-D Bis,

institutions must use the information corresponding to the concepts referred to in the tables

above during the period indicated in the first paragraph of this fraction.

II.

For the calculation of PI referred to in fraction III of article 2 Bis 114 b of this modifying

resolution it must consider at least the average of the following number of previous years to the calculation of capital requirements depending on the year to which the determination of

such capital requirements corresponds:

Year in which the capital requirement is calculated

Minimum number of previous years used for

obtaining PI (average of annual losses

by operational risk incurred)

5 years

6 years

7 years

8 years

9 years

For the purposes of information for the years established in the table above, credit institutions

shall use for the determination of annual losses for Operational Risk incurred during the

years 2014 to the date on which they use the business indicator method for the calculation of their capital

requirements for operational risk, those that would have been registered complying with what was established

in Annex 12-A, in force in those years.

Credit institutions that, in terms of this Transitory Article, calculate their capital requirements

for Operational Risk with the Business Indicator Method before January 1, 2023,

will be obliged, from the date on which they have adopted said method, to send to the National Banking

and Securities Commission the regulatory report A-2815 of series R28 contained in Annex 36 as established

in article 207 and 208 of this modifying resolution; said institutions that previously

before the use of the Business Indicator Method for the computation of capital requirements for Operational

Risk, had used the standard or alternative standard method for such effect, will no longer be

obliged to send regulatory report A-2814.

Respectfully,

Mexico City, November 5, 2020.- The President of the National Banking and Securities

Commission, Juan Pablo Graf Noriega .- Rubric.

ANNEX 1-D BIS

MINIMUM REQUIREMENTS FOR THE USE OF THE BUSINESS INDICATOR METHOD IN THE CALCULATION

OF THE CAPITAL REQUIREMENT FOR OPERATIONAL RISK

SECTION A

GENERAL REQUIREMENTS FOR USE OF THE BUSINESS INDICATOR METHOD

Institutions must observe at all times and keep available to the Commission the evidence

of compliance with the following minimum general requirements:

The General Manager must review the Operational Risk management framework at least annually and

have the evidence supporting such review.

II.

Have an operational risk management methodology based on a solid and updated conceptual framework of analysis in accordance with these provisions.

III.

Have an organizational structure and sufficient resources to implement the methodology for operational risk management in the different business lines of the Institutions, as well as in the control and audit areas.

SECTION B

GENERAL CRITERIA FOR DETERMINING THE INTERNAL LOSS MULTIPLIER

Institutions, to determine the Internal Loss Multiplier (ILM), must comply with the requirements established in Annex 12-A of these provisions regarding the identification, collection, and treatment of internal operational loss data.

Likewise, Institutions must carry out an annual review and validation of the specific policies, processes, and procedures for the identification, collection, and treatment of information related to internal losses from Operational Risk, as well as the process for executing the calculation of the capital requirement for Operational Risk, which must be performed by external auditors. This review must be carried out more frequently when Institutions consider it necessary for new activities or changes in their operations.

An internal area will be considered independent when structurally and functionally it does not depend on areas in charge of administering the operational loss event database and the areas in charge of administering the Institution's risk management.

SECTION C

SPECIFIC CRITERIA ON IDENTIFICATION, COLLECTION, AND TREATMENT OF DATA

For the purposes of calculating the Internal Loss Multiplier (ILM), Institutions must adhere to the following definitions:

Gross loss: the loss before any type of recovery.

Net loss: the loss after taking into account the accounting effects of recoveries.

Recovery: an independent event, related to the initial loss event but separated in time, by which the impact of the loss is reduced as a result of receiving economic resources or economic benefits from a third party, such as reimbursements for insurance payments, recoveries of transfers of resources sent to incorrect recipients.

Receivables are not considered as a recovery until payment is received.

II.

For the purposes of calculating the ILM, Institutions must use the amount of net losses, provided that recoveries have been effectively paid and there is evidence of the receipt of payment. Notwithstanding the foregoing, Institutions must identify gross losses, recoveries, separating reimbursements not from insurance and recoveries from insurance for all operational loss events.

III.

In the computation of the gross loss of the historical database of operational loss events, Institutions must include the following concepts:

Records of direct losses, including impairments and write-offs against loss and profit accounts, as well as reductions due to Operational Risk events.

Internal and external costs and expenses incurred as a consequence of the Operational Risk loss event, such as legal fees directly related to the event, costs associated with repair or replacement incurred to restore the situation prior to the Operational Risk event.

Provisions or reserves registered in the comprehensive income statement, or its equivalent, to cover the possible effects of operational losses.

Losses derived from Operational Risk events with a definitive financial impact, but which have not yet been registered in the Institutions' comprehensive income statement, such as contingencies registered in off-balance sheet accounts.

Negative economic impacts registered in an accounting period, resulting from Operational Risk events that affect cash flows or financial statements of previous accounting periods.

IV.

When the Institution intends to exclude from the ILM calculation any Operational Risk loss event from the historical database referred to in Annex 12-A of these provisions, it must request authorization from the Commission duly justified, for which it must take into consideration whether the cause of the loss event could occur in other areas of the Institution's operations.

In the case of legal exposures subject to out-of-court settlement and the discontinuation of business lines or activities, Institutions must demonstrate that there is no similar or residual legal exposure to the aforementioned one, and that the excluded Operational Risk loss events are not relevant to other continuing activities or other products.

Likewise, Institutions may request authorization from the Commission to exclude certain operational loss events that have ceased to be relevant to the risk profile.

For an Operational Risk loss event to be excluded from the corresponding database, said event must meet each of the following conditions:

Represent less than 5% of the Institution's average historical losses over the last 5 years.

Have remained in the Operational Risk loss event database for a minimum period of three years, with the exception of events associated with discontinued activities or Business Units.

Institutions may request authorization from the Commission to exclude operational loss events for the ILM calculation, when as a result of modifications to their general plan of operation referred to in Article 10, fraction IV of the Law, Institutions no longer carry out the activities that gave rise to such operational loss events, for which they must previously demonstrate that there is no residual exposure from said events and that their exclusion is not relevant to their operation under the modified general plan of operation.

SECTION D

ACCOUNTS INTEGRATING THE CALCULATION OF THE BUSINESS INDICATOR

Business Indicator
Component
Concepts from the comprehensive income statement and the statement of financial position Description Account or its equivalent

Interest, lease, and dividend
Interest Income
Interest income from all financial assets and other interest income (includes income from financial and operating leases, and gain on rented assets). a.1 Interest from credit portfolio with credit risk stage 1. a.2 Interest from credit portfolio with credit risk stage 2. b. Interest from credit portfolio with credit risk stage 3.
c. Interest and yields in favor from investments in financial instruments.
d. Interest and yields in favor in repo operations e. Interest on cash and cash equivalents. f. Fees for granting credit g. Premiums in favor in securities lending operations h. Premiums for debt placement.
i. Interest and yields in favor from margin accounts
j. Income from hedging operations k. Gain from valuation
l. Increase from updating interest income
m. Lease income n. Credit portfolio recovery

Interest Expense
Interest expenses on financial liabilities and other interest expenses (including interest expenses on financial and operating leases, losses, depreciation, and impairment of rented assets). a. Interest on demand deposits b. Interest on time deposits
c. Interest, transaction costs, and discounts borne for issuing financial instruments that qualify as liabilities
d. Interest on interbank and other organism loans e. Interest and yields borne in repo operations f. Premiums borne in securities lending operations g. Costs and expenses associated with granting credit h. Expenses from hedging operations
i. Loss from valuation
j. Interest borne associated with the global deposit account with no activity k. Increase from updating interest expenses

Interest-Generating Assets
(Statements of Financial Position Accounts)
Loans, credits, securities income (including government bonds), total annual rented assets. a. Cash and cash equivalents b.1 Credit portfolio with credit risk stage 1 b.2 Credit portfolio with credit risk stage 2
c. Investments in financial instruments
d. Securities lending e. Financial derivative instruments

Dividend Income
Income from dividends on investments in shares and funds not consolidated in the Institution's financial statements, including income from dividends of unconsolidated subsidiaries, associates, and related parties. a. Dividends from permanent investments b. Dividends from instruments that qualify as equity financial instruments

Services
Commission and Fee Income
Income received for advice and services. Includes income received by the Institution as an intermediary for financial services. a. Guarantees b. Letters of credit without refinancing
c. Acceptances on behalf of third parties
d. Purchase and sale of financial instruments e. Account opening f. Account management g. Fiduciary activities h. Fund transfers
i. Bank drafts
j. Cashier's checks k. Certified checks
l. Traveler's checks
m. Custody or administration of assets n. Safe deposit box rental ñ. Electronic Banking Services o. Other commissions and fees charged p. Credit operations

Commission and Fee Expenses
Expenses paid to receive advice and services, including payments for the hiring of third parties offering financial services, but excluding payments for the hiring of third parties offering non-financial services, such as logistics, information technology, and human resources. a. Correspondent banks b. Commission agents
c. Fund transfers
d. Loans received e. Debt placement f. Other commissions and fees paid

Other Operating Income
Income from ordinary banking operations not included in other IN accounts, but of a similar nature (lease operation income should be excluded). a. Recoveries b. Income from credit portfolio acquisition
c. Gain from credit portfolio sale
d. Income from purchase option in financial lease operations e. Income from participation in the sale price of goods in financial lease operations f. Result in sale of adjudicated goods (always if positive) g. Result from valuation of adjudicated goods (always if positive) h. Result in sale of properties, furniture, and equipment (always if positive)
i. Interest in favor from loans to officials and employees
j. Result from valuation of benefits to receive in securitization operations (always if positive) k. Result from valuation of asset for administration of transferred financial assets (always if positive)
l. Result from valuation of liability for administration of transferred financial assets (always if positive)
m. Result in benefits to receive in securitization operations (always if positive) n. Other items from operating income (expenses) (always if positive) ñ. Result from valuation of items not related to the financial margin (always if positive) o. Result from monetary position originated by items not related to the financial margin p. Increase from updating other operating income (expenses) (always if positive)

Other Operating Expenses
Expenses and losses from ordinary operations not included in other IN accounts, but of a similar nature and from operational loss events (operating lease expenses should be excluded). a. Expenses from credit portfolio acquisition b. Loss from credit portfolio sale
c. Shortfalls
d. Donations e. Loss from adjudication of goods f. Result in sale of adjudicated goods (always if negative) g. Result from valuation of adjudicated goods (always if negative) h. Loss in custody and administration of goods
i. Loss in trust operations
j. Interest borne in financing for asset acquisition k. Result in sale of properties, furniture, and equipment (always if negative)
l. Result from valuation of benefits to receive in securitization operations (always if negative)
m. Result from valuation of asset for administration of transferred financial assets (always if negative) n. Result from valuation of liability for administration of transferred financial assets (always if negative) ñ. Result in benefits to receive in securitization operations (always if negative) o. Other items from operating income (expenses) (always if negative) p. Increase from updating other operating income (expenses) (always if negative) q. Result from valuation of items not related to the financial margin (always if negative)

Financial
Net Profit (Loss) on Assets and Liabilities

Net profit/loss on assets and liabilities of derivatives, debt securities, credits, short positions, other assets, and liabilities.
Net profit/loss on hedging accounts
Profit/loss from exchange rate differences.
a. Result from purchase and sale of financial instruments and financial derivatives b. Result from purchase and sale of currencies
c. Result from purchase and sale of minted precious metals
d. Result from sale of received collateral e. Transaction costs

ANNEX 1-O BIS 1

DISCLOSURE OF INFORMATION RELATING TO THE CALCULATION OF THE CAPITAL REQUIREMENT FOR OPERATIONAL RISK

Institutions must disclose the information contained in the following sections:

Minimum capital requirement for operational risk;

II.

Business indicator and subcomponents;

III.

Historical losses.

For the purposes of the information disclosure referred to in this annex, Institutions must proceed as follows:

Figures must be presented in millions of pesos in accordance with Article 176 of these provisions.

The information will correspond to the Institution without consolidated subsidiaries or special purpose entities and at the close of the corresponding fiscal year.

The information contained in sections I to III of this annex must be calculated in the terms set forth in Article 2 Bis 114 b of these provisions.

SECTION I

MINIMUM CAPITAL REQUIREMENT FOR OPERATIONAL RISK

Institutions must disclose the capital requirement for operational risk in accordance with the following format:

Reference
Description a
Business Indicator Component (BIC)
Internal Loss Multiplier (ILM)
Capital Requirement for Operational Risk
Assets Subject to Operational Risk

Definitions

Reference 1: The BIC corresponds to the incremental calculation established in Table 5 of Article 2 Bis 114 b, fraction II of these provisions.

Reference 2: The ILM corresponds to the calculation established in fraction III of Article 2 Bis 114 b of these provisions.

Reference 3: The Capital Requirement for Operational Risk will be determined by multiplying the BIC and the ILM, previously shown in references 1 and 2, respectively. In the event that Institutions do not have an operational loss database that has been constituted in compliance with what is established in Annexes 1-D Bis and 12-A for at least the last five years, or if they have been in operation for less than five years, their capital requirement for Operational Risk will be equal to the BIC.

Reference 4: The Assets Subject to Operational Risk are determined by multiplying the Capital Requirement for Operational Risk, previously shown in reference 3, by 12.5, in accordance with what is established in Article 2 Bis 116 of these provisions.

SECTION II

BUSINESS INDICATOR AND SUBCOMPONENTS

Institutions must disclose the Business Indicator (BI) and its subcomponents, which are used to calculate the Capital Requirement for Operational Risk, in accordance with the following format:

Reference
BI and its subcomponents a b c j=3 j=2 j=1
Interest, Lease, and Dividend Component (ILDC) 1a Interest Income 1b Interest Expense 1c Income-Generating Assets 1d Dividend Income Services Component (SC) 2a Charged Commissions and Fees 2b Paid Commissions and Fees 2c Other Operating Income 2d Other Operating Expenses Financial Component (FC) 3a Result from Purchase and Sale Business Indicator (BI) Business Indicator Component (BIC)

Definitions

Reference 1: The Interest, Lease, and Dividend Component (ILDC) is calculated in accordance with the formula indicated in fraction I, subsection a) of Article 2 Bis 114 b of these provisions. In the formula, the terms are calculated as the average of three years: j=3, j=2, and j=1.

References 1a, 1b, and 1d: Interest Income and Interest Expense and Dividend Income will be the sum of the monthly flows, according to the year being disclosed, of the concepts from the comprehensive income statement indicated in Table 1 of Article 2 Bis 114 b of these provisions, according to the corresponding concept.

Reference 1c: Income-Generating Assets will be the average of the 36 months of the balances at the close of each month reflected in their statement of financial position of the concepts indicated in Table 2 of Article 2 Bis 114 b of these provisions.

Reference 2: Services Component (SC) is calculated in accordance with the formula indicated in fraction I, subsection b) of Article 2 Bis 114 b of these provisions. In the formula, the terms are calculated as the average of three years: j=3, j=2, and j=1.

References 2a, 2b, 2c, 2d: Other Operating Income and Other Operating Expenses, as well as Charged and Paid Commissions and Fees, will be the sum of the monthly flows, according to the year being disclosed, of the concepts from the comprehensive income statement, or their equivalents, indicated in Table 3 of Article 2 Bis 114 b of these provisions, according to the corresponding concept.

Reference 3: Financial Component (FC) is calculated in accordance with the formula indicated in fraction I, subsection c) of Article 2 Bis 114 b of these provisions. In the formula, the terms are calculated as the average of three years: j=3, j=2, and j=1.

Reference 3a: The Result from Purchase and Sale will be the sum of the monthly flows, according to the year being disclosed, of the concepts from the comprehensive income statement, or their equivalents, indicated in Table 4 of Article 2 Bis 114 b of these provisions.

Reference 4: The Business Indicator (BI) is the sum of the three components: ILDC, SC, and FC, in accordance with what is established in fraction I of Article 2 Bis 114 b of these provisions.

Reference 5: The BIC corresponds to the incremental calculation established in Table 5 of Article 2 Bis 114 b, fraction II of these provisions.

Columns: j=3 indicates the end of the annual disclosure period, j=2 indicates the end of the previous year, and so on.

Links between sections: [Section II, reference 5 column "a"] corresponds to [Section I, reference 1, column "a"]

III. HISTORICAL LOSSES

Institutions must disclose the Operational Risk losses incurred during the ten years prior to the calculation of the corresponding capital requirements, classifying them in the year corresponding to their accounting registration date, in accordance with the following format:

Ref
Description a b c d e f g h i j k j=10 j=9 j=8 j=7 j=6 j=5 j=4 j=3 j=2 j=1 10-Year Average A. Losses Total amount of net losses net of recoveries (considering exclusions) Total number of losses Total amount of excluded losses Total number of exclusions Total amount of net losses net of recoveries and exclusions B. Details of the capital calculation for Operational Risk Are losses used to calculate the ILM? (Yes/No) If in reference 11 the answer was "No", is the exclusion due to the failure to have a loss database that has been constituted in compliance with what is established in Annexes 1-D Bis and 12-A of these provisions? (Yes/ No)

Definitions

Reference 1: Disclose the total amount of net losses net of recoveries from Operational Risk loss events, incurred during the ten years prior to the calculation of the corresponding capital requirement, which must comply with what is established in Annexes 1-D Bis and 12-A of these provisions. Excluded losses from the calculation must be included in the total amount of losses disclosed in this reference.

Reference 2: Disclose the total number of Operational Risk losses.

Reference 3: Disclose the total amount of losses that have been excluded from the Operational Risk capital calculation, for each of the ten years prior to the calculation of the corresponding capital requirement.

Reference 4: Disclose the total number of exclusions.

Reference 5: Disclose the total amount of Operational Risk losses net of recoveries and excluded losses.

Reference 11: It must be indicated whether the institution uses Operational Risk losses to calculate the ILM; if an ILM=1 is presented, the answer must be negative.

Reference 12: In the event of answering negatively in reference 11, the institution must indicate if the reason for not using Operational Risk losses to calculate the ILM is due to not complying with what is established in Annexes 1-D Bis and 12-A of these provisions. The request for any multiplier other than the resulting one must be disclosed in reference 2 of section I of this annex, along with a brief explanation.

Columns: For references (a) to (j), j=10 indicates the end of the annual disclosure period, j=9 indicates the

end of the previous year, and so on. Reference (k) reveals the average annual losses, as applicable, incurred during the ten years prior to the calculation of the corresponding capital requirement.

ANNEX 12-A

REQUIREMENTS FOR THE PREPARATION AND UPDATING OF THE HISTORICAL DATABASE THAT CONTAINS THE SYSTEMATIC RECORD OF THE DIFFERENT TYPES OF LOSS ASSOCIATED WITH OPERATIONAL RISK OF INSTITUTIONS

Institutions shall generate a historical database containing the systematic record of the different types of loss and their cost, which must include the economic loss originating from the event, as well as all additional expenses incurred by the Institution as a consequence of said event, in correspondence with its accounting record, which must be carried out globally in the income statements and, specifically, through auxiliary accounts in the accounting.

In case of recoveries, these must be registered separately. Additionally, they must register the amounts of benefits and those cases of credit and market risk failures due to causes attributable to Operational Risk, as well as quasi-losses from Operational Risk.

A quasi-loss shall be understood as those operational risk events that do not lead to a loss, or those operational risk events that generate a loss that is recovered in a short time.

Operational Risk events must be classified into at least one of the different types of Operational Risk indicated in Section II of this Annex 12-A, without this limiting the Institutions from carrying out a more detailed internal classification of losses.

Section I

Considerations for the collection of internal data on loss events from Operational Risk

Institutions, for the identification, collection, and treatment of operational loss data that allows them to generate and maintain a historical database, must:

Have within their objectives, guidelines, and policies for Comprehensive Risk Management specific, documented policies, processes, and procedures for the identification, collection, classification, and accounting record of information related to internal loss events from operational risk.

Historical internal data on loss events from Operational Risk must be comprehensive and include the loss amounts associated with all activities of each business unit and business line within the Institution, including the recognition of such activities at the geographic level. The Institution must map all its internal data on loss events to its processes, its operational risks, and business lines.

Loss events from Operational Risk must be incorporated into a database that guarantees the assignment of both revenues and financial costs.

In the constitution of the Operational Risk loss event database, the Institution must identify simple events, that is, those that generate only one impact on the accounting, as well as multiple events that generate several impacts on the accounting. Additionally, it will identify for each of the events, the business lines and responsible areas both for the management of the events and for the accounting assignment of losses that affect a single or multiple business lines.

The business area or unit in which the loss event occurs must have evidence of the follow-up given to each of the Operational Risk loss events. Such follow-up may be considered concluded if no subsequent events occur during the following 12 months after its occurrence, and in case a subsequent event occurs after this period, it must be considered as a new event.

In the case that subsequent events occur as established in the previous paragraph, they must be followed up together with the event that gave rise to them.

In case of multiple losses caused by a common event, these must be aggregated and associated with the same event. For the purposes of the foregoing, each record can be associated in the database with the same event to identify all its consequences.

For the purposes of this subsection e), recoveries are not considered as subsequent events.

The Operational Risk loss event database must be updated at least quarterly or earlier if the Institution deems it appropriate.

The historical Operational Risk loss event database must include, in addition to the gross amounts of losses, the reference dates of the operational risk events in accordance with the following criteria:

Date of occurrence of the event, when the loss event occurred or began, when available.

ii.

Date of discovery, on which the Institution became aware of the loss event.

iii.

Date of accounting record, on which the loss event was recorded accounting-wise in the statement of comprehensive income of the Institutions, or its equivalent, whether in its character as loss, reserve, or provision for losses.

iv.

Date of Operational Risk tool registration, on which the loss event was registered in the system or tool for its control and management.

Institutions must use the date of the accounting record of the Operational Risk loss event for the integration of the historical database of Operational Risk loss events. In the case of losses associated with legal events, the registration date must be the corresponding to the date on which a legal reserve is constituted charged to the statement of comprehensive income, or its equivalent, for the purpose of covering the estimated probable loss.

Losses caused by a particular Operational Risk event or by several Operational Risk events related over time, but recorded accounting-wise over the course of several years, must be assigned to the years they correspond to in the historical database of Operational Risk loss events, in consistency with their accounting treatment.

Additionally, the Institution must collect information on:

The number of simple event.

ii.

The number of multiple event, if applicable.

iii.

The type of Operational Risk.

iv.

The amount of associated expense.

The amount of recovery with respect to the gross amounts of losses.

vi.

The number of affected business lines.

vii.

The business line with the greatest impact.

viii.

The number of affected processes.

ix.

The process with the greatest impact.

The number of affected products.

xi.

The product with the greatest impact.

xii.

The channel through which the operation or banking transaction was carried out.

xiii.

The cause.

xiv.

Accounting account according to the minimum catalog R01.

xv.

Operational Risk folio from the inventory of operational risks associated with the loss.

xvi.

Associated risk (if it is a legal risk event, technological risk, credit risk, market risk, or if it corresponds to a pure operational risk).

xvii.

Brief description of the Operational Risk loss event.

Additionally, Institutions must identify and register in the historical loss event database, the information corresponding to the recoveries of the gross loss amounts obtained, as well as a description of the determining factors or the causes of the loss event (root cause of the event).

Ensure that in loss events involving a legal process, losses and legal expenses directly attributable to such loss events are identified, but not expenses inherent to the legal operation. Directly attributable expenses are those generated from the loss event, such as fees, per diems, etc.

Losses from Operational Risk that are related to credit risk and that historically have been included to determine the risk-weighted assets for credit risk of the Institutions (for example, failures in collateral management), must not be included in the set of the Operational Risk loss event database; and will continue to receive the treatment of credit risk for the purpose of calculating regulatory capital without being subject to capital requirement for operational risk.

In the case that the losses referred to in the previous paragraph are not considered to determine the risk-weighted assets for credit risk, these must be considered to determine the capital requirement for Operational Risk and consequently be included in the database of loss events for this type of risk.

In the historical database of Operational Risk loss events, the following items must be excluded:

Costs and expenses associated with general maintenance contracts for buildings, furniture, plant and equipment.

ii.

Internal or external expenses intended to improve the business after incurring an event of loss from Operational Risk, as well as any update, improvement, initiative, and strengthening of risk evaluation or management.

iii.

The amount paid for insurance premiums.

Losses from Operational Risk related to market risk must be identified in the Operational Risk loss event database and will be considered as Operational Risk for the purpose of calculating the capital requirement.

Internal loss data must be assigned to one of the categories of types of Operational Risk provided for in Section II of this Annex 12-A.

For the assignment of activities to business lines, Institutions shall observe the following principles:

All banking activities must be assigned among the eight Level 1 business lines indicated in Section III of this annex, in a way that each activity corresponds to a single business line and no activity remains unassigned. Institutions must demonstrate that they have documented criteria and systematic procedures for assignment to the business lines of the accounting structure indicating at least the number and concept of the accounting account and the business line to which each accounting account is assigned, both for revenues and financial costs, as well as for Operational Risk losses associated with the corresponding business line.

In the case of accounts where revenues from more than one business line are recorded, the percentage contributed by each business line must be specified.

ii.

Any banking or non-banking activity that cannot be easily assigned to the framework of the business lines but represents an auxiliary function to an activity, must be assigned to the business line to which it provides support. If the auxiliary activity supports more than one business line, an objective and consistent assignment criterion must be used.

iii.

The assignment of activities to business lines must be consistent with the definitions of business lines used in capital requirement calculations in other categories of risk (i.e., credit risk and market risk). Any deviation from this principle must be justified and documented by the Institutions.

iv.

The process of assigning activities to business lines must be clearly documented, particularly, the definitions of business lines must be clear and detailed so that their assignment can be reproduced by third parties. The documentation must contain the arguments to support any existing exceptions or caveats and must be preserved.

Revenues and costs generated in one line that are attributable to another different business line must be classified in the latter.

vi.

The General Management of the Institutions will be responsible for the assignment policy, which must be submitted for approval by the Board of Directors.

vii.

The assignment process to business lines must be subject to an independent review by an area other than the one that elaborates it, which may be internal or external. For the purpose of determining if an internal area is independent, the provisions of the third paragraph of Section B of Annex 1-D Bis must be considered.

ñ)

Institutions must carry out an annual review and validation by an independent external auditor of the integrity and consistency of the operational loss event database.

Section II

Categories of Operational Risk Types

Internal Fraud: Losses derived from any type of action aimed at defrauding, improperly appropriating assets or circumventing regulations, laws, or corporate policies (excluding diversity/discrimination events) in which at least one internal party to the company is involved. Within this category, there are four classes of loss events which are:

Unauthorized Activities

Improper use of powers and authorities
Undisclosed operations (intentional)
Unauthorized operations (with financial losses)
Erroneous valuation of positions (intentional)

Internal Fraud

Fraud / credit fraud / worthless deposits
Theft / extortion / embezzlement / robbery
Misappropriation of assets
Destructive destruction of assets
Internal Forgery
Use of bounced checks
Smuggling
Misappropriation of accounts, identity, among others
Non-compliance / tax evasion (intentional)
Bribery / corruption
Abuse of insider information (not in favor of the company)

Vulnerability to system security

Breach of security systems
Damage from cyber attacks
Information theft (with financial losses)
Improper use of access keys and/or authorization levels

Identity Theft

Internal forgery / impersonation

External Fraud: Losses derived from any type of action aimed at defrauding, improperly appropriating assets or circumventing legislation, by a third party. In this category, the following classes of loss events are found:

External Fraud

Fraudulent use of checks
Use and/or disclosure of insider information
Industrial espionage
Smuggling

System Security

Breach of security systems
Damage from cyber attacks
Information theft (with financial losses)
Improper use of access keys and/or authorization levels

Bank card fraud

Fraudulent use of credit and debit cards

Robbery or theft

Robbery / theft / robbery / fraud / extortion / bribery

Identity Theft

External forgery / impersonation

Labor Relations and Workplace Safety: Losses derived from actions incompatible with legislation or labor agreements, on hygiene or safety at work, on the payment of claims for personal damages, or on cases related to diversity/discrimination. Within this category, the following classes of loss events are found:

Deficiencies in labor relations management

Issues related to remuneration, social benefits, contract termination, and
human resources
Labor organization

Non-compliance with hygiene and safety at work

Cases related to hygiene and safety standards at work
Worker indemnification

Labor discrimination, defamation, and personal harassment

All types of discrimination
Invasion of privacy, harassment, and/or bullying

Clients, Products, and Business Practices: Losses derived from the involuntary or negligent non-compliance with a professional obligation towards specific clients (including fiduciary and suitability requirements), or from the nature or design of a product. The classes of loss events that are within this category are:

Suitability, information disclosure, and trust

Abuse of trust / non-compliance with guidelines
Suitability aspects / information disclosure
Breach of privacy of retail client information
Privacy breach
Aggressive sales
Account confusion
Abuse of confidential information
Lender liability

Improper or inappropriate business, market, or commercial practices

Restrictive competition practices
Improper commercial / market practices
Market manipulation
Abuse of insider information (in favor of the company)
Unauthorized activities
Money laundering

Defective Products

Product defects
Model errors

Selection, Sponsorship, and Risks

Absence of client research in accordance with guidelines

Deficient client advice

Litigation on results of advisory activities

External Events: Losses derived from damage or harm to material assets as a consequence of natural disasters or other events. Within this category, the following classes of loss events exist:

Natural Disasters

Losses from natural disasters

Provoked Events or Accidents

Losses from external causes (terrorism, vandalism)

Business Disruptions and System Failures: Losses derived from business incidents and system failures. Likewise, in this category, the following classes of loss events are defined:

Hardware

Physical failures in equipment operation

Software

Impact on the integrity and confidentiality of information processed in systems /
materialization of events that deviate from usual parameters

Telecommunications

Impact on service availability / failures in equipment operation /
non-compliance with service levels.

Interruption / energy supply incidents

Interruption or impact on business operation due to energy supply.

Infrastructure damage

Business interruption due to infrastructure damage

Execution, Delivery, and Process Management: Losses derived from errors in the processing of operations or in process management, as well as from relationships with commercial counterparties and suppliers. This category is composed of seven classes of loss events, which are the following:

Receipt, Execution, and Maintenance of Operations

Defective communication
Data entry, maintenance, or download errors
Non-compliance with deadlines or responsibilities
Erroneous execution of models / systems
Accounting error / attribution to wrong entities
Errors in other tasks
Delivery failure
Collateral management failure
Reference data maintenance

Follow-up and Reporting

Non-compliance with reporting obligation
Inaccuracy of external reports (with loss generation)

Deficiencies in the client acceptance process, documentation, and contracting

Absence of authorizations / client rejections
Non-existent / incomplete legal documents
Contract errors (poor design, typographical errors, erroneous clauses, among
others).

Errors in client account management

Unauthorized access to accounts
Incorrect client records (with loss generation)
Loss or damage to client assets due to negligence
e)

Losses derived from non-compliance with Regulations

From tax regulations
From banking regulations - fines
From other norms.

Commercial counterparty failures

Other litigations with counterparties other than clients
Contract errors (poor design, typographical errors, erroneous clauses, among
others).

Distributors and Suppliers / Outsourcing

Outsourcing
Litigations with distributors
Contract errors (poor design, typographical errors, erroneous clauses, among
others).

Section III

Definition of Business Lines

For the purposes of this Annex 12-A, Institutions must divide their activities into eight Level 1 business lines according to the following table:

Level 1

Level 2

Activity Groups

Corporate

Finance

Corporate Finance

Mergers and acquisitions, issuance underwriting, privatizations, securitizations, research services, debt, equity, syndications, initial public offerings, private placements in secondary markets.

Local / Public

Administration Finance

Investment Banking

Consulting Services

Trading and
Sales

Purchases and Sales

Fixed income, equity, currencies, credit, proprietary positions in securities, securities lending, repos and similar operations, financial derivative operations, intermediation and additional services, and debt.

Market Making

Proprietary Positions

Treasury

Retail Banking

Retail client credits and deposits, banking services, trusts, and estates.

Private or Wealth Banking

Credits and deposits of private or wealth banking clients, banking services, trusts, and estates, and investment advice.

Card Services

Corporate / commercial cards, private brand, and retail cards

Commercial Banking

Project financing, real estate, export financing, commercial financing, factoring, financial leasing, loan, guarantees, bills of exchange.

Payment and Settlement 1

External Clients

Payments and collections, fund transfers, compensation and settlement.

Agency

Services

Custody

Custody deposits, certificates of deposit, securities lending operations (client companies).

Corporate Agency

Issuance and payment agents

Corporate Trusts

Asset

Management

Discretionary Fund

Management

Aggregated, segregated, retail, institutional, closed, open, equity participations.

Non-discretionary Fund

Management

Aggregated, segregated, retail, institutional, fixed capital, variable capital

Retail Intermediation /
Retail Brokerage

Operations

Retail Brokerage

Operations

Receipt, registration, execution, and allocation.

1 /

Losses derived from payment and settlement operations related to the activities

own to the Institutions, will be incorporated into the loss history of the affected business line.

ANNEX 36

SERIES R28 OPERATIONAL RISK INFORMATION

The frequency of preparation and presentation must be monthly for report A-2815.

Report

A-2815

Assignment of the Business Indicator Method.

This report requests information regarding the concepts used for the

calculation of the Business Indicator, the accounting accounts according to the report

regulatory R01 A-0111 of the Minimum Catalog, the corresponding balances and their

assignment in the three components that integrate the method.

CAPTURE FORMAT

The Institutions will carry out the sending of the information related to report A-2815 described

above, by using the following capture format:

REQUESTED INFORMATION

REPORT IDENTIFIER SECTION

PERIOD

INSTITUTION KEY

REPORT

COMPONENT ASSIGNMENT SECTION

OF THE ACCOUNTING STRUCTURE

ACCOUNTING REGISTRATION DATE

R01 A-0111 ACCOUNTING CLASSIFICATION

COMPONENT INTEGRATION

COMPONENTS

BALANCE

ANNEX 72

Information security indicators

The Chief Information Security Officer of the Institution, in relation to the information security

indicators referred to in fraction XII of Article 168 Bis 14, of these

dispositions, shall:

Evaluate said indicators, which must comply with the thresholds contained in this annex

for each indicator. In case of defining different thresholds, the reason must be documented, which

must be aligned with the Institution's risk tolerance level.

Define remediation plans for those risks where the evaluation results

yield values that fall within the medium and high risk thresholds established in the

present annex or, if applicable, those defined by the Institution, provided that these are in a high threshold for at least two consecutive periods.

Provide continuous maintenance, whether to add, eliminate or update the key risk and performance indicators of

existing information security, which must always be

aligned with the Institution's strategy and the Master Plan for Information Security of

this.

Measure and evaluate their evolution with the periodicity indicated in the following tables, or earlier in case of

unusual events.

In case that not all assumptions apply, indicate that they are not applicable and explain the reason.

The type, subtype and sub-class of events in which each of the indicators

listed below are classified, have their basis in Section II of Annex 12-A of these

dispositions:

Type

Definition

Sub Type

Event Sub-Class

Examples

I. Internal Fraud

Losses derived

from any type of

action

directed to

defraud, improperly appropriate goods

or, well, bypass

regulations, laws

or corporate policies

(excluding events of

diversity / discrimination) in

which at least one

internal party is

involved in the Institution.

1.1 Unauthorized Activities.

1.1.1 Improper use of powers and authorities

1.1.2 Undisclosed operations (intentional).

1.1.3 Unauthorized operations (with monetary losses).

1.1.4 Erroneous valuation of positions

(intentional).

Undisclosed operations;

unauthorized operations (with

monetary losses); erroneous valuation

of positions, and intentional

omission of regulations.

1.2 Internal Fraud.

1.2.1 Fraud / credit fraud / worthless deposits.

1.2.2 Theft / Extortion / Misappropriation / Robbery.

1.2.3 Improper appropriation of assets.

1.2.4 Destructive destruction of assets.

1.2.5 Internal Forgery.

1.2.6 Use of bounced checks.

1.2.7 Smuggling.

1.2.8 Appropriation of accounts, identity, among others.

1.2.9 Non-compliance / tax evasion (intentional).

1.2.10 Bribery / Corruption.

1.2.11 Abuse of insider information (not in favor of the company).

Robbery; misappropriation; improper

appropriation; destruction of assets;

forgeries; identity theft; and bribes; manipulation of

accounts.

1.3. Vulnerability to the security of the

systems.

1.3.1 Breach of security systems.

1.3.2 Damage from cyber attacks.

1.3.3 Information theft (with monetary losses).

1.3.4 Improper use of access keys and/or levels of

authorization.

Abuse and use of privileged or confidential

information; alteration of

computer applications; theft of

passwords, and prohibited computer access.

1.4. Identity Spoofing

1.4.1 Internal forgery / personality spoofing

Internal forgery and personality spoofing

II. External Fraud

Losses derived

from any type of

action

directed to

defraud, improperly appropriate goods or

bypass the

legislation, by

part of a third party.

2.1 External Fraud.

2.1.1 Fraudulent use of checks.

2.1.2 Use and/or disclosure of privileged information.

2.1.3 Industrial espionage.

2.1.4 Smuggling.

Improper use of stolen,

forged, stolen or blacklisted cards.

2.2 System Security.

2.2.1 Breach of security systems.

2.2.2 Damage from cyber attacks.

2.2.3 Information theft (with monetary losses).

2.2.4 Improper use of access keys and/or levels of

authorization.

Unauthorized computer access;

manipulation of applications

computer; damage from cyber

attacks, and information theft.

2.3 Fraud with bank cards

2.3.1 Fraudulent use of credit and debit cards

Fraudulent use of credit and debit cards

2.4 Assault or robbery

2.4.1 Assault / theft / robbery / fraud / extortion / bribery

Robberies in the Institution's premises,

in internal bags,

cash transports or in postal packages.

2.5 Identity Spoofing

2.5 1

External forgery / personality spoofing

Forged or manipulated documents (checks, transfers, etc.); identity spoofing; improper dispositions; counterfeit coins; deteriorated bills or out of legal tender.

VI. Incidents in the

Business and Failures in the

Systems

Losses derived

from incidents in the

business and from failures

in the systems.

6.1 Systems

6.1.1 Hardware.

6.1.2 Software.

6.1.3 Telecommunications.

6.1.4 Interruption / incidents in the supply.

Interruption / incidents in the

supplies and communication lines;

errors in computer programs;

hardware and software failures;

sabotage; business interruptions;

computer failures and programming of

viruses.

Name

Description

Domain

Type

Sub Type

Event Sub-Class

Indicator Type

Period

Unit of

Measurement

Calculation

Variable X

Variable Y

High Risk

Medium Risk

Low Risk

KRI0001

Incidents

via direct attacks

against internal

systems.

Number of incidents

that have been

originated by attacks

towards the internal systems

of the Institution,

in the established period.

Logical attacks.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Reactive.

Quarterly.

Quantity.

Variable X

Number of

identified incident cases.

More than 1.

Equal to 1.

Equal to 0.

KRI0002

Fraud cases

in Electronic Banking.

Percentage of cases

where fraud is identified,

that has been

originated by attacks

towards the electronic banking systems

of the

Institution, in the period

established.

Logical attacks.

II. External

Fraud

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Reactive.

Monthly.

Percentage.

(X/Y)*100

Number of

electronic banking

fraud cases.

Number of

electronic banking

active users.

More than

.01

Between 0.005 % and

0.01 %.

Less than

0.005 %.

KRI0003

Equipment of the

Technological Infrastructure

from which its

security configuration

is managed.

Percentage of equipment of

Technological Infrastructure within the

platform and/or process of

review of secure configuration standards,

with respect to the total of the Institution's

equipment during the period

established.

Compliance.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Preventive.

Monthly.

Percentage.

(X/Y)*100

Number of

equipment within

the

platform or

process of

review of

secure configuration

standards.

Total number

of equipment.

Less than

85 %.

Between 85 % and

More than 95 %.

KRI0004

Level of

compliance of

secure configuration

of UNIX/Linux servers.

Average percentage of

compliance level of

UNIX/Linux servers

included within the

tool and/or

process of review of secure configuration

standards.

Compliance.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Preventive.

Monthly.

Average

percentage.

Average(X)

% of

compliance

of the secure configuration

standard of each

of the

UNIX/Linux Servers.

Less than

90 %.

Between 90 % and

More than 95 %.

KRI0005

Users with

inadequate roles and profiles.

Percentage of users

with inadequate profiles

within the applications

of the Institution, with

respect to the total of

users in all applications of the

Institution.

Compliance.

I. Internal

Fraud

1.3.

Vulnerability

to the security

of the

systems.

1.3.3 Information theft

(with monetary losses) .

1.3.4 Improper

use of access keys and/or levels of

authorization.

Corrective.

Semi-annual.

Percentage.

(X/Y)*100

Number of

users with

incorrect profiles,

considering

all

applications.

Total number

of users

considering

all

applications.

More than 3

Between 1% and 3 %.

Less than 1 %.

KRI0006

Applications without

roles and profiles.

Percentage of

applications which

do not possess the capacity

for role and permission profiling, or that said

profiles are not

implemented, this with

respect to the total of

applications.

Compliance.

I. Internal

Fraud.

1.3.

Vulnerability

to the security

of the

systems.

1.3.3 Information theft

(with monetary losses) .

1.3.4 Improper use of access keys and/or levels of

authorization

Corrective.

Quarterly.

Percentage.

(X/Y)*100.

Number of

applications

without capacity

for

profiling, or

profiling not

implemented.

Total number

applications.

More than 5

Between 2 % and 5 %.

Less than 2 %.

KRI0007

Information security incidents

general

Total number of

incidents reported

during the established period

regarding security of the

information.

Information.

Applies to:

I. Internal

Fraud

II. External

Fraud

VI.

Incidents

in the

Business and

Failures in the

Systems.

Apply to:

1.3.

Vulnerability

to the security of the systems

2.2 Security

of the

Systems.

6.1 Systems.

Apply to:

1.3.1 Breach of

security systems

1.3.2 Damage from cyber attacks

1.3.3 Information theft

(with monetary losses) .

1.3.4 Improper

use of access keys and/or levels of

authorization.

2.2.1 Breach of

security systems.

2.2.2 Damage from cyber attacks

2.2.3 Information theft

(with monetary losses) .

2.2.4 Improper

use of access keys and/or levels of

authorization.

6.1.1 Hardware.

6.1.2 Software.

6.1.3 Telecommunications.

6.1.4 Interruption /

incidents in the

Supply

Reactive.

Monthly.

Quantity.

Variable X.

Number of

security incidents.

of the information

More than 5.

From 2 to 5.

Less than 2.

KRI0008

Obsolete and/or

outdated technological

platforms

Percentage of

technological platforms

that are on

obsolete versions and/or

without support from the

manufacturer

Infrastructure.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Corrective.

Semi-annual

Percentage.

(X/Y)*10.

Number of

technological platforms

obsolete.

Total of

technological platforms.

More than 5

Between 2 % and 5 %.

Less than 2 %

KRI0009

System failures

related to

ATM network.

Number of system failures related

to the ATM network greater than

10 minutes.

Infrastructure.

VI.

Incidents

in the

Business and

Failures in the

Systems.

6.1 Systems.

6.1.4 Interruption /

incidents in the

Supply.

Reactive.

Monthly.

Quantity.

Variable X.

Number of

system failures.

More than 1.

Equal to 1.

Equal to 0.

KRI0010

Security incidents by

system vulnerabilities

provided by

providers (third parties).

Percentage of security incidents caused

by vulnerabilities in

systems and infrastructure

technological provided by

providers (third parties)

that do not belong to the

institution's payroll,

reported during the

established period, with

respect to the total of

security incidents.

Infrastructure.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

2.2.2 Damage from cyber attacks

2.2.3 Information theft

(with monetary losses) .

2.2.4 Improper

use of access keys and/or levels of

authorization.

Reactive.

Monthly.

Percentage.

(X/Y)*100.

Number of

security incidents

attributed to

vulnerabilities in systems

provided by

providers

(third parties).

Total number

of security

incidents.

More than 5

Between 0.1 % and

Less than 0.1 %.

KRI0011

Pending critical

vulnerabilities to be corrected detected in

ethical hacking tests.

Number of

vulnerabilities in the

information systems

that, according to the

ethical hacking tests,

are classified as

critical, which have

more than one month of

age from their

detection date.

Infrastructure.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Preventive.

Monthly.

Quantity.

Variable X.

Number of critical

vulnerabilities

pending to be corrected with

age of

more than one

month.

More than 2.

Between 1 and 2.

Equal to 0.

KRI0012

Unavailability

of IT systems.

Average percentage of

unavailability time

of the systems against

total time of the established period.

Infrastructure.

VI.

Incidents in the Business

and Failures in

the Systems.

6.1 Systems.

6.1.4 Interruption /

incidents in the

Supply.

Reactive.

Monthly.

Average

Percentage.

Average(X).

Average of

unavailability time

of the IT

systems.

More than

0.5

Between 0.25 % and

0.5 %.

Less than

0.25

KRI0013

Unavailability

of electronic banking.

Percentage of time

unavailability against

total time of the electronic banking system

against the month in

question.

Infrastructure.

VI.

Incidents in the Business

and Failures in

the Systems.

6.1 Systems.

6.1.4 Interruption /

incidents in the

Supply.

Reactive.

Monthly.

Percentage.

(X/Y)*100.

Unavailability time

of electronic banking.

Total time

established

for electronic banking.

More than

0.25 %.

Between 0.15 % and

0.25 %.

Less than

0.15

KRI0014

Critical and high priority incidents

in production environments.

Percentage of incidents

qualified as critical

and high priority in

production environments

with respect to the total of

incidents in production.

Infrastructure.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Reactive.

Monthly.

Percentage.

(X/Y)*100.

Number of

incidents in

production qualified

as critical.

Total number

of incidents

in production.

Greater than or

equal to

0.5

Greater than 0% and

less than 0.5 %.

Equal to 0 %.

KRI0015

Components of the

technological infrastructure

exposed to

internet without

ethical hacking tests and/or

vulnerability analysis.

Percentage of the

components of the

infrastructure

technological of the

organization exposed

towards internet to which

ethical hacking or vulnerability analysis has not been performed,

with

respect to the total of

equipment in more than 3

months.

Infrastructure.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Corrective.

Quarterly.

Percentage.

(X/Y)*100.

Number of

assets exposed to

internet that have not performed

ethical hacking tests or

vulnerability analysis.

Number of

assets exposed to

internet.

More than 3

Between 1 % and 3

Less than 1 %.

KRI0016

Pending critical

vulnerabilities to be corrected detected in the

vulnerability analyses.

Number of

vulnerabilities in the

information systems

that, according to the

vulnerability analyses, are

classified as critical,

which have more

than one month of age

from their date of

detection.

Infrastructure.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Corrective.

Monthly.

Quantity.

Variable X.

Total number of

critical vulnerabilities.

More than 2

Between 1 and 2

Equal to 0

KRI0017

Fraud cases reported by

electronic banking customers.

Percentage of fraud cases reported by the

clients of the electronic banking of the

Institution, considering

the total number of

electronic banking clients in the established period.

Infrastructure.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Reactive.

Monthly.

Percentage.

(X/Y)*100.

Number of fraud cases

reported in

electronic banking.

Number of

electronic banking

clients.

More than

0.005 %

Between 0.003 % and

0.005 %

Less than 0.003

KRI0018

Obsolete Technological

Infrastructure and/or

without support.

Number of equipment and

Technological Infrastructure,

which are in obsolete versions or without support,

compared to all

active IT infrastructure in the established period.

Infrastructure.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Corrective.

Quarterly.

Percentage.

(X/Y)*100.

Number of

equipment and

obsolete infrastructure.

Total number

of active equipment.

More than 5

Between 2 % and 5 %.

Less than 2 %.

KRI0019

Servers without

antimalware solution.

Percentage of servers

without antimalware with respect

to the total of servers.

Malware.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Corrective.

Monthly.

Percentage.

(X/Y)*100.

Number of

servers without

antimalware.

Total number

of servers.

More than 6

Between 3% and 6 %.

Less than 3 %.

KRI0020

Servers with

outdated antimalware

signatures.

Percentage of servers

with antimalware signatures (malware

signatures)

outdated with respect

to the total of servers

with antimalware in each

Institution

Malware.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Corrective.

Monthly.

Percentage.

(X/Y)*100.

Number of

servers with

antimalware signatures

outdated.

Total number

of servers

with

antimalware.

More than 6 %

Between 3% and 6 %

Less than 3 %

KRI0021

Workstations without

antimalware solution

Percentage of

workstations without

antimalware with respect

to the total of equipment

Malware.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Corrective.

Monthly.

Percentage.

(X/Y)*100.

Number of

workstations without

antimalware.

Total number of

workstations.

More than 8

Between 4% and 8 %.

Less than 4 %.

KRI0022

Workstations with

outdated antimalware

signatures.

Percentage of the

workstations that

count with antimalware signatures (malware

signatures)

outdated with

respect to the total of

computing equipment with

antimalware installed.

Malware.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Corrective.

Monthly.

Percentage.

(X/Y)*100.

Number of

workstations with

antimalware signatures

outdated.

Number of

workstations

with

antimalware.

More than 8

Between 4% and 8 %.

Less than 4 %.

KRI0023

Security incidents

attributed to

provider personnel

(third parties).

Percentage of security incidents

related to personnel

of providers (third parties)

that do not belong to the

Institution's payroll,

reported during the

established period, with

respect to the total of

security incidents.

Incidents.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Reactive.

Monthly.

Percentage.

(X/Y)*100.

Number of

security incidents

related to

provider personnel

(third parties).

Number of

total security incidents

of provider personnel

(third parties).

More than 5

Greater than 0 % and

less than 5 %.

Equal to 0 %.

KRI0024

Servers with

obsolete operating system

versions.

Total percentage of

servers with obsolete operating system

versions compared

against total number of

servers.

Software.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Corrective.

Monthly.

Percentage.

(X/Y)*100.

Number of

servers with

obsolete operating system

versions.

Total number

of servers.

More than

Between 5% and 10 %.

Less than 5 %.

KRI0025

Applications in

production with

partial or

deficient compliance of the

security controls.

Percentage of the

applications in

production with

partial or

deficient compliance, with respect to

the established security policies,

in matters of

security, with respect to

the total of applications.

Software.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Corrective.

Quarterly.

Percentage.

(X/Y)*100.

Number of

security controls

deficient in

applications in

production.

Total number

of security controls.

More than 5 %.

Between 2 % and 5 %.

Less than 2 %.

KRI0026

Data base

managers (DBM)

with versions of

technology

obsolete or not

supported.

Percentage of

data base managers (DBM),

which are versions of

obsolete technologies or not supported by the

manufacturer, in

comparison with the total

of data base managers

(DBM) active in the

established period.

Software.

II. External

Fraud.

2.2 Security

of the

Systems.

2.2.1 Breach of

security systems.

Corrective.

Quarterly.

Percentage.

(X/Y)*100.

Number of data

base managers

(DBM) obsolete

or not supported.

Total number

data base managers

(DBM).

More than

Between 5 % and 10 %.

Less than 5 %.

KRI0027

Obsolete or

unsupported applications.

Percentage of

applications within the

Institution, which are

obsolete or

without support from the

manufacturer, in relation to

all active applications during the established period.

Software.

II. External Fraud.

VI. Incidents in Business and System Failures.

2.2 System Security.

6.1 Systems.

2.2.1 Breach of security systems.

6.1.2 Software.

Corrective.

Quarterly.

Percentage.

(X/Y)*100.

Number of obsolete or unsupported applications.

Total active applications.

More than 5%.

Between 2% and 5%.

Less than 2%.

KRI0028

Windows and UNIX/Linux servers without security patch coverage.

Percentage of servers without the most recent security patches in Windows and UNIX/Linux operating systems, with respect to the total of active servers during the established period.

Software.

II. External Fraud.

2.2 System Security.

2.2.1 Breach of security systems.

Corrective.

Monthly.

Percentage.

(X/Y)*100.

Number of servers without the most recent security patches installed.

Total servers.

More than 5%.

Between 2% and 5%.

Less than 2%.

KRI0029

Workstations without security patch coverage.

Percentage of workstations without the most recent security patches, regardless of the operating system, with respect to the total workstations of the institution.

Software.

II. External Fraud.

2.2 System Security.

2.2.1 Breach of security systems.

Corrective.

Monthly.

Percentage.

(X/Y)*100.

Number of workstations without the most recent security patches installed.

Total number of workstations.

More than 3%.

Between 1% and 3%.

Less than 1%.

KRI0030

Database managers (DBM) without security patch coverage.

Percentage of database managers (DBM) without coverage of the most recent security patches, with respect to the total database managers (DBM) during the established period.

Software.

II. External Fraud.

2.2 System Security.

2.2.1 Breach of security systems.

Preventive.

Quarterly.

Percentage.

(X/Y)*100.

Number of database managers (DBM) without security patch coverage.

Total number of database managers (DBM).

More than 5%.

Between 2% and 5%.

Less than 2%.

In the document you are viewing, there may be text, characters, or objects that do not display correctly due to conversion to HTML format, so we recommend always taking the digitized image of the DOF or the PDF file of the edition as a reference. The content, format, and scope of published documents are the strict responsibility of their issuer.

INQUIRY

BY DATE

Sá

INDICATORS

Exchange Rate and Rates as of 08/28/2026

DOLLAR

16.9712 UDIS

8.808812 TIIE 28 DAYS

6.7559% TIIE 91 DAYS

6.7931% TIIE 182 DAYS

6.8474% TIIE DE FONDEO

6.50%