Resolution modifying the General Provisions applicable to credit institutions

DOF: 12/10/2020

RESOLUTION modifying the General Provisions applicable to credit institutions

At the margin, a seal with the National Coat of Arms, which reads: United Mexican States.- TREASURY.- Ministry of Finance and Public Credit.- National Banking and Securities Commission.

The National Banking and Securities Commission, based on the provisions of articles 52, penultimate paragraph; 96 Bis, first paragraph and 98, second paragraph of the Credit Institutions Law, as well as 4, sections II, XXXVI and XXXVIII and 16, section I of the National Banking and Securities Commission Law, and

CONSIDERING

That, in accordance with article 78 of the General Law for Regulatory Improvement and with the purpose of reducing the compliance cost of these provisions, the National Banking and Securities Commission, through a resolution published in the Official Gazette of the Federation on December 26, 2017, modified the "General Provisions applicable to credit institutions", with the purpose of flexibly extending the deadline to which multiple banking institutions were subject to establish their capital requirements for operational risk;

That, in order to help prevent, inhibit, mitigate, and if applicable, detect any illicit conduct aimed at identity theft, it is fundamental to strengthen the regulatory framework that credit institutions must observe for the verification of the identity of their clients and applicants in the celebration of contracts for the opening of Level 4 Bank Accounts, as well as for consumer and commercial credits, particularly remotely; to this effect, in addition to extending to legal entities, the regulatory framework strengthens the biometric requirements to be observed in the procedure followed for identity verification and the capture of identification documents, including those from Mexican authority records;

That, in the interest of security and legal certainty for clients and applicants, the approval procedures for non-presential identification mechanisms followed before the National Banking and Securities Commission are reinforced, by providing technical requirements consistent with international standards and the use of diverse identification technologies, which must be observed by both the credit institutions themselves and the service providers that assist them in their work, which in turn strengthens the internal control system of these financial entities, and

That, as a result of what is stated in the second and third paragraphs above, financial inclusion and access to banking services and products will be favored in a simple, fast, and remote manner; has resolved to issue the following:

RESOLUTION MODIFYING THE GENERAL PROVISIONS APPLICABLE TO

CREDIT INSTITUTIONS

SINGLE.- Articles 51 Bis 2; 51 Bis 6; 51 Bis 7, first paragraph; 51 Bis 8; 51 Bis 9 and 51 Bis 10, second paragraph, are REFORMED, and Article 51 Bis 14 is ADDED to the "General Provisions applicable to credit institutions", published in the Official Gazette of the Federation on December 2, 2005 and last modified by Resolution published in said dissemination medium on August 21, 2020, to read as follows:

" Article 51 Bis 2.- Institutions may form a database of biometric information of their clients in accordance with Annex 71 of these provisions, in order to use it for the verification of their identity, in substitution of what is required by Articles 51 Bis, to celebrate contracts for active, passive or service operations, or to request payment means and 51 Bis 1, for the making of cash withdrawals and transfers of resources, except those made against Level 1 and 2 Bank Accounts. The foregoing, provided that the Institutions perform the verification of the coincidence of the client's biometric information with the biometric records of the National Electoral Institute or with those of any other Mexican authority that provides a similar biometric information verification service to that of said institute.

For the purposes of the client identity verification provided for in the preceding paragraph, the Institutions must adhere to the following:

I.

Require the person whose data will be stored in the aforementioned database, their voter credential issued by the National Electoral Institute or identification issued by any other Mexican authority, whose biometric data can be verified with any Mexican authority that provides a biometric information verification service.

II.

First, capture the biometric information of their employees, executives or officials who will be in charge of collecting the clients' data. Once this capture is completed, they will collect their clients'. In both cases, the Institutions must comply with the technical requirements established in Annex 71 of these provisions.

III.

Regarding fingerprints, perform the verification actions indicated in section I of Article 51 Bis 4 of these provisions; or, regarding biometric data other than fingerprints, verify that they coincide with the biometric records in possession of any Mexican authority; in both cases, the Institutions must observe at all times that the requirements of Annex 71 of these provisions are met, at least. Likewise, they must corroborate the existence of the Unique Population Registry Key with the National Population Registry and that the data provided by the client coincides with that of said registry. "

" Article 51 Bis 6.- Institutions, for the purposes of identifying their clients or applicants who are natural persons or legal entities, both of Mexican nationality, in the non-presential celebration of contracts for the opening of Level 4 Bank Accounts, consumer credits for clients or applicants who are natural persons, and commercial credits for clients or applicants who are natural persons with business activity or legal entities, must adhere to what is provided in this Section B.

For the purposes of the contracting referred to in the preceding paragraph, Institutions must verify the coincidence of the client's or applicant's biometric information, as applicable, with the records of the National Electoral Institute or with those of any other Mexican authority that provides a biometric information verification service similar to that of said institute or with those biometric databases that the Institutions themselves have developed in accordance with what is provided in Articles 51 Bis 2 and 51 Bis 3 of these provisions.

In the event that the biometric information referred to in the preceding paragraph is the fingerprints of the client or applicant, the Institutions must ensure that the applications or means at their disposal ensure that the fingerprint is obtained directly from the client or applicant, that is, a live fingerprint test, avoiding the recording of fingerprints originating from impressions on any material intended to simulate the fingerprint of another person or images that seek such an end, and have security measures that guarantee that the stored, processed or sent information through said applications or means is not known or used by unauthorized third parties, as well as authenticate that the fingerprint obtained from the client or applicant presenting the voter credential coincides, at least, by ninety-eight percent with the records of the databases of the Mexican authorities.

For the purposes of what is established in this Section B, Institutions must:

I.

Obtain prior approval from the Commission.

II.

Require the applicant to declare whether they are already a client of the Institution. In the event that the declaration is affirmative, the Institution must observe what is provided in section IV of this article. Regardless of the applicant's declaration, the Institution must complete their file in accordance with the product they intend to contract, as well as, if applicable, observe the file update obligations for identification in terms of what is provided in the 4th of the General Provisions referred to in article 115 of the Credit Institutions Law, issued by the Ministry or those that replace them.

III.

Require the applicant who has declared not to be a client of the Institution, to send a form through the electronic medium established by the Institution for this purpose, in which must be included, at least, the identification data indicated in the 4th and 4th Ter of the General Provisions referred to in article 115 of the Credit Institutions Law, issued by the Ministry or those that replace them, as well as the specification of the product intended to be contracted from those provided in the first paragraph of this article.

The aforementioned form must include a statement indicating that its submission to the Institution in question constitutes the applicant's acceptance for their voice, image, or if applicable, both, to be recorded in the technological mechanisms referred to in section VII of this article. This statement may be made through automated tools that allow its recording and subsequent reproduction.

The acceptance referred to in the preceding paragraph must be obtained in terms of the Federal Law for the Protection of Personal Data in Possession of Private Parties or that which replaces it.

IV.

In the event that the applicant declares to be a client of the Institution, it must verify the data it determines in order to corroborate against its own records that, in fact, it is a client, and if so, the Institution must authenticate them with a Category 3 Authentication Factor and, subsequently, perform the verification referred to in the second paragraph of this article.

In the event that the verification referred to in the preceding paragraph is successful, the Institution may proceed to the contracting of the products provided for in the first paragraph of this article, without the need to carry out what is established in sections V to VIII below.

When the verification referred to in this section is not successful, the Institution must observe what is provided in sections III, V, VI, VII and VIII of this article.

V.

If the Institution corroborates that the applicant is not its client, together with the form referred to in section III of this article, it must require the applicant to send a color photograph of their valid voter credential issued by the National Electoral Institute, on the front and back, and validate the security elements of said credential, in order to detect if said document presents alterations or inconsistencies, for which they must have the necessary technology for this.

Additionally, the Institution must confirm the existence of the Unique Population Registry Key provided by the applicant with the National Population Registry, as well as that the data from this and those sent in the form referred to in section III of this article coincide with each other.

Regarding the voter credential issued by the National Electoral Institute, Institutions must verify the coincidence of the following data, with the records of the institute itself:

a)

The Credential Identifier Code (CIC) which is printed on the voter credential, or in its case, the Optical Character Recognition.

b)

Year of registration.

c)

Voter Key.

d)

Number and year of issuance.

Institutions must verify that the paternal surnames, maternal surnames and name or names, as they appear on the presented voter credential, coincide with the records of the National Electoral Institute or the National Population Registry.

Institutions must require the applicant to send in digital format the necessary documents to integrate and conserve their identification file in terms of what is provided in these provisions, as well as in the 4th and 4th Ter of the General Provisions referred to in article 115 of the Credit Institutions Law, issued by the Ministry or those that replace them.

VI.

Inform the applicant of the procedure that will be followed in the technological mechanisms referred to in section VII of this article and what are the accesses to the means for its realization, as well as deliver a one-time use code, which will be required to the applicant prior to what is established in the aforementioned section.

VII.

Implement technological mechanisms that allow identifying the applicant through a recording, which must be preserved without edits in its total duration for a period of, at least, 10 years. For the purposes of the aforementioned identification, additionally, Institutions must observe the following:

a)

Register the time and date of its realization obtained from a protected time server.

b)

Implement the technological mechanisms referred to in the first paragraph of this section through automated tools that allow their recording and subsequent reproduction. Additionally, Institutions must verify that the quality of the image and, if applicable, the sound allow the full identification of the applicant, according to the parameters established by the Institutions themselves for this effect.

c)

Require the applicant to show their voter credential issued by the National Electoral Institute, both on the front and back side, confirming through automated tools that it contains the same data and photograph of the credential sent along with the form.

d)

Use specialized technology that allows them to achieve reliable identification of the applicant, with the reliability level established in section VII of Article 51 Bis 9 of these provisions, ensuring that there is a coincidence between their face and that of the received voter credential.

e)

Perform a liveness test on the applicant during the implementation of the technological mechanisms referred to in this section. For the purposes of the foregoing, a liveness test will be understood as the technical tests performed by Institutions based on algorithms, to measure and analyze the anatomical characteristics or voluntary and involuntary reactions of the applicant, with the effect of determining if a biometric sample is being captured from a subject alive and present at the capture point.

VIII.

Suspend the contracting process with the applicant when any of the following cases occur:

a)

The image and, if applicable, the quality of the sound, do not allow a full identification of the applicant.

b)

The applicant does not present their voter credential, the data obtained from it does not coincide with the records of the National Electoral Institute, or the result of the validation of the elements of the mentioned credential or of the biometric verifications of the applicant referred to in this article does not reach the effectiveness or reliability level referred to in section VII of Article 51 Bis 9 of these provisions.

c)

The Unique Population Registry Key does not coincide with the information of the National Population Registry.

d)

The one-time use code required to the applicant is not confirmed by them.

e)

Atypical or risky situations arise, or the Institution has doubts about the authenticity of the voter credential or the identity of the applicant.

In the event of suspension of the contracting process for the causes mentioned in the subsections above, Institutions must store the information and documentation obtained, at least, for 30 natural days, with the objective that, in case of resuming contracting processes, it is corroborated that the information is consistent. Additionally, the aforementioned information and documentation must be used by Institutions in their controls to prevent fraud.

For the case of applicants or clients who are legal entities, for the purposes of identifying their attorneys-in-fact or legal representatives, Institutions must observe the same procedures indicated in this article, with the exception that, for the case of applicants, the sending of the form referred to in section III of this article must be made through a file signed with the Advanced or Reliable Electronic Signature of the legal entity in question.

When the National Electoral Institute cannot respond to the biometric information verification requests referred to in this article for causes attributable to said institute, Institutions may effect a communication with the client or applicant through an audiovisual medium, using automated tools that allow their recording and subsequent reproduction, and in accordance with the random dialogue guidelines established by the Institutions themselves. Likewise, the communication must have a duration of, at least, 30 continuous seconds without interruption, as well as be recorded placing the device horizontally, as well as be preserved without edits in its total duration for a minimum period of 10 years.

During the communication referred to in the preceding paragraph, Institutions must also observe the following:

I.

Register the time and date of the realization of the communication.

II.

Verify that the quality of the image and sound allow the full identification of the applicant or client, according to the parameters established by the Institutions themselves for this effect.

III.

Require the applicant or client to show their voter credential issued by the National Electoral Institute, both on the front and back side, confirming through automated tools that it contains the same data and photograph of the credential sent along with the form.

IV.

Use specialized technology that allows them to achieve reliable identification of the applicant or client with the reliability level established in section VII of Article 51 Bis 9 of these provisions, ensuring that there is a coincidence between their face and that of the received voter credential.

V.

Identify, through automated tools, suspicious behavior patterns that could indicate that the applicant or client performing the communication is not the person they claim to be.

VI.

Perform a liveness test on the applicant or client during the communication. A liveness test will be understood as what is established in subsection e) of section VII of the fourth paragraph of this article.

Institutions that adhere to what is established in the sixth paragraph of this article, may only carry out the opening of Level 4 Bank Accounts, in which the sum of the deposits during a calendar month does not exceed the equivalent in national currency to 30,000 UDIs, and in the case of consumer credits for clients or applicants who are natural persons and commercial credits for clients or applicants who are natural persons with business activity or legal entities, these may only be granted up to the equivalent in national currency to 60,000 UDIs.

Article 51 Bis 7.- Institutions must have the necessary means for the transmission and safeguarding of the information, data and files generated in the identification procedures referred to in Article 51 Bis 6 and, if applicable, Article 51 Bis 8 of these provisions, which guarantee the integrity of said information, as well as the correct reading of the data and the impossibility of its manipulation, as well as its adequate security, conservation and location.

. . .

Article 51 Bis 8.- The Commission may approve mechanisms other than those provided in Article 51 Bis 6 of these provisions to identify applicants or clients, as well as to verify identification documents different from those referred to in said article, provided that Institutions comply, at least, with the following:

I.

Include an element of biometric information validation against the records of any Mexican authority with a minimum coincidence of ninety-eight percent, as well as provide for alternative identification mechanisms, in case the biometric validation is not available at that time, being able to use the mechanism provided in the sixth, seventh and eighth paragraphs of Article 51 Bis 6 of these provisions.

II.

Require the applicant or client to present their official identification with photograph issued by any Mexican authority, both on the front and back side.

III.

In the case of applicants, verify the security elements of the official identification with photograph presented for approval, and corroborate the data or information contained in said identification against the records of the authority that issued it considering, at least, the full name and some other key or code included in the identification.

IV.

Corroborate the data of the Unique Population Registry Key with the National Population Registry.

V.

Perform a liveness test, understood as what is established in subsection e) of section VII of the fourth paragraph of Article 51 Bis 6 of these provisions.

Article 51 Bis 9.- Institutions, when requesting the approvals referred to in Articles 51 Bis 6 and, if applicable, 51 Bis 8, must present the following:

I.

Detailed description of the Technological Infrastructure used in each part of the non-presential identification process, specifying the function of each component of said infrastructure. Likewise, Institutions must include all technology providers involved in the Technological Infrastructure and, if applicable, the main applications used for the referred process and their interrelation.

II.

Description of the electronic means used for applicants to send, if applicable, the form and documents through a secure channel considering, at least, the type of transmission of the device to the node that receives the form information, such as Hyper Text Transfer Protocol Secure or Transport Layer Security version 1.2 or higher.

III.

Name of the service provider of certification authorized by the Ministry of Economy

used, if applicable, for the preservation of the digital version of the voter ID issued by the National Electoral Institute or any other official photo identification, in accordance with the Official Mexican Standard on digitization and preservation of data messages applicable.

IV.

Network diagram showing all components of the Technological Infrastructure that form part of the non-presential identification process, including the segregation of communications networks and perimeter security equipment, considering redundancy schemes.

V.

Detailed information on whether images of official identifications, recordings, and biometric information will be maintained at service provider facilities or the Institution's own facilities, describing access management controls and mechanisms for their storage.

VI.

Evidence that the verification means for customer or applicant identification documents have the effectiveness approved by the risk committee of the respective Institution.

VII.

If applicable, evidence that the systems, tools, or mechanisms used for facial identification recognition or the verification of any other biometric element used have the reliability level determined by the risk committee of the respective Institution.

VIII.

If applicable, detailed information on the calibration tests of the systems, tools, or mechanisms used for facial identification recognition or the verification of any other biometric element used. Such tests must be performed in accordance with the thresholds established by the Institution, which must contemplate the results of these tests and the adjustments of the validation engine derived from them. Institutions must accompany their approval application with evidence of all the foregoing.

IX.

If applicable, the image and sound quality standards that will be used to effect the communication referred to in the sixth, seventh, and eighth paragraphs of Article 51 Bis 6 of these provisions.

X.

If applicable, the technical description of the Authentication Factors that will be required to corroborate that an applicant is a customer of the Institution, as provided in Article 51 Bis 6 of these provisions, as well as the characteristics of the one-time code.

XI.

Mechanisms through which they will securely transmit and safeguard the information, data, and documents generated in the non-presential identification procedure.

XII.

Mechanisms used to guarantee the integrity, correct reading, impossibility of manipulation, and adequate security, preservation, and location of the information, data, and documents referred to in this Section B.

XIII.

Encryption mechanisms in the communication channels used in the non-presential identification process, indicating the information that will be transmitted through each of said channels.

XIV.

Mechanisms used for access management to systems, as well as policies for access management, which include the use of robust passwords.

XV.

Policies and procedures for Information Security Incident Management.

XVI.

Mechanisms or tools used for monitoring and blocking contracts that present the situations described in subsection e) of fraction VIII of the fourth paragraph of Article 51 Bis 6 of these provisions.

XVII.

Evidence of having evaluated and incorporated into the methodology referred to in Chapter II Bis of the General Provisions referred to in Article 115 of the Credit Institutions Law, issued by the Secretariat or those that replace them, as well as of the possible risks derived from the launch or use of new technologies, services, countries, or geographic areas and sending or distribution channels with which they will operate.

XVIII.

Draft of the compliance manual indicated in the 64th of the General Provisions referred to in Article 115 of the Credit Institutions Law, issued by the Secretariat or those that replace them, or any other document or manual prepared by the Institutions in which the policies, criteria, measures, and procedures necessary to carry out, at least, the following are developed:

a)

Verify the match in blocked person lists, politically exposed persons lists, and other lists with which the Institutions have.

b)

Determine the initial transactional profile and the risk degree of customers.

c)

Connection with the automated system or systems with which the Institutions have.

XIX.

Conduct tests aimed at detecting vulnerabilities and threats, as well as penetration tests in the different components of the Technological Infrastructure used in the process, whether own or third-party. The mentioned penetration tests must be performed by an independent third party that has personnel with verifiable technical capacity through specialized industry certifications in the matter.

Institutions must provide the Commission with evidence of the performance of the tests referred to in fractions VIII and XIX of this article, before implementing the scheme authorized to them in accordance with Article 51 Bis 6 of these provisions.

It is the responsibility of Institutions that hire third parties to store, process, and transmit information in the non-presential contracting process, to monitor compliance with this article, at least once a year, as well as the obligation to have evidence supporting it, which they must have available to the Commission at all times.

Article 51 Bis 10 .- . . .

For the case of presential contracts referred to in Section A of this section, Institutions must have records of the date and address of the Bank Branch or, if applicable, the commissioner's establishment where each contract was made, including the geo-statistical area key in accordance with the Unique Catalog of State, Municipal, and Local Geo-statistical Area Keys of the National Institute of Statistics and Geography or that which replaces it, as well as the name and key of the official who granted the contract authorization and, if applicable, the manager or person in charge of the Bank Branch where it was authorized.

" Article 51 Bis 14.- The procedures established in Section B are independent of those used in contracts and operations that Institutions carry out with their customers in terms of Chapter X of Title Fifth of these provisions. "

TRANSITORY PROVISIONS

FIRST.- This Resolution will enter into force the day following its publication in the Official Gazette of the Federation, except for what is referred to in the SECOND and THIRD Transitory Articles following.

SECOND.- Credit institutions that have obtained the approval of the National Banking and Securities Commission to non-presential identification mechanisms in terms of Articles 51 Bis 6 and 51 Bis 8 in effect prior to the entry into force of this Resolution, will have a period of nine months, counted from the entry into force of this Resolution, to present to said Commission a new approval application in compliance with Article 51 Bis 6, fraction I, which is amended by this instrument.

The approval referred to in the previous paragraph will remain in effect until the National Banking and Securities Commission resolves on the approval application that credit institutions have presented to said Commission in accordance with what is indicated by Article 51 Bis 6, fraction I, which are amended by this Resolution.

THIRD.- Credit institutions that have opted to implement, on a temporary basis, the administrative facility for compliance with what is provided in Title Second, Chapter II, Second Section Section B, as well as what is indicated in Title Fifth, Chapter XI, Third Section of the General Provisions applicable to credit institutions, contained in letter number P321/2020 of June 11, 2020 issued by the National Banking and Securities Commission, under the FOURTH of the AGREEMENT by which temporary and extraordinary measures are established and some deadlines are suspended for the attention of financial entities and persons subject to supervision of the National Banking and Securities Commission, due to the coronavirus named COVID-19, published in the Official Gazette of the Federation on March 26, 2020, may continue applying it for the period that the National Banking and Securities Commission informs them through a letter counted from the entry into force of this Resolution, to comply with Article 51 Bis 7, as well as to present before said Commission a new approval application in compliance with Articles 51 Bis 6, fourth paragraph, fraction I; 51 Bis 8, and 51 Bis 9, which are amended by this instrument.

The foregoing is without prejudice to the fact that said Commission may modify the aforementioned administrative facilities, by virtue of the entry into force of this Resolution.

Respectfully

Mexico City, October 5, 2020. - The President of the National Banking and Securities Commission, Juan Pablo Graf Noriega. - Rubric.

In the document you are viewing, there may be text, characters, or objects that do not display correctly due to conversion to HTML format, so we recommend always taking the digitized image of the DOF or the PDF file of the edition as a reference. The content, form, and scope of published documents are the strict responsibility of their issuer.

INQUIRY

BY DATE

Do Mo Tu We Th Fr Sa

INDICATORS

Exchange Rate and Rates as of 28/08/2026

DOLLAR
16.9712 UDIS
8.808812 TIIE 28 DAYS
6.7559% TIIE 91 DAYS
6.7931% TIIE 182 DAYS
6.8474% TIIE OVERNIGHT
6.50%

See more

SURVEYS

Did you like the new image of the Official Gazette of the Federation website?

No
Yes

Official Gazette of the Federation

Río Amazonas No. 62, Col. Cuauhtémoc, C.P. 06500, Mexico City Tel. (55) 5093-3200, where you can access our service menu

Electronic address: dof.gob.mx

113

LEGAL NOTICE | SOME RIGHTS RESERVED © 2026