Resolution reforming, adding, and repealing general provisions applicable to money transmitters under Articles 95 Bis and 81-A Bis of the General Law of Credit Auxiliary Organizations and Activities

DOF: 05/04/2023

RESOLUTION that reforms, adds, and repeals various general provisions referred to in Article 95 Bis of the General Law of Credit Auxiliary Organizations and Activities, applicable to money transmitters referred to in Article 81-A Bis of the same legislation.

A seal with the National Coat of Arms, which reads: United Mexican States.- TREASURY.- Ministry of

Treasury and Public Credit.

RESOLUTION THAT REFORMS, ADDS, AND REPEALS VARIOUS GENERAL PROVISIONS REFERRED TO IN ARTICLE 95 BIS OF THE GENERAL LAW OF CREDIT AUXILIARY ORGANIZATIONS AND ACTIVITIES, APPLICABLE TO MONEY TRANSMITTERS REFERRED TO IN ARTICLE 81-A BIS OF THE SAME LEGISLATION

ROGELIO EDUARDO RAMÍREZ DE LA O, Secretary of Treasury and Public Credit, based on

the provisions of articles 31, fractions VII and XXXII, of the Organic Law of the Federal Public Administration;

95 Bis and 81-A Bis of the General Law of Credit Auxiliary Organizations and Activities, in

exercise of the powers conferred upon me by article 6, fraction XXXIV, of the Internal Regulations of the

Ministry of Treasury and Public Credit, and with the prior opinion of the National Banking and Securities Commission

issued via letter number VSPP/220-2811662/2022 dated January 16, 2023; and

CONSIDERING

That since the year 2000, Mexico has been a full member of the Financial Action Task Force (FATF),

an intergovernmental body that sets international standards in matters of prevention and combat against

operations with proceeds of illicit origin and financing of terrorism;

That on March 20, 2019, the Ministry of Treasury and Public Credit published in the Official Gazette of the

Federations various modifications to the General Provisions referred to in Article 95 Bis

of the General Law of Credit Auxiliary Organizations and Activities, applicable to money transmitters

referred to in Article 81-A Bis of the same legislation, with the object of addressing the

recommendations of the FATF and establishing a non-presidential identification regime, thereby granting

the possibility to money transmitters to carry out the identification of the user through a

real-time videoconference and online; which resulted in a strengthening of the methodology of

risk assessment so that these entities evaluate their risks of being used to carry out

operations with proceeds of illicit origin and financing of terrorism prior to the use of new technologies;

That on March 6, 2020, the FATF published the Digital Identification Guide, resulting as a watershed in the topic of financial technology, showing the benefits of digital identity in matters of prevention and combat against operations with proceeds of illicit origin and financing of terrorism, presenting financial technology as a more reliable and secure method for financial entities when carrying out the identification of their customers through the use of mechanisms such as proof of life, the use of biometric elements and authentication factors, among others, which allow the mitigation of risks of operations with proceeds of illicit origin and financing of terrorism;

That on March 11, 2020, the World Health Organization declared the disease caused by the virus SARS-CoV2 (COVID-19) as a pandemic, calling on countries to: (i) adopt measures urgent and aggressive to contain the spread of the virus, (ii) implement an approach based on the participation of the entire government and society, around a comprehensive strategy aimed at preventing infections, saving lives, and minimizing their effects, and (iii) find a delicate balance between the protection of health, the minimization of social and economic disruptions, and respect for human rights;

That on March 24, 2020, the Ministry of Health published in the Official Gazette of the Federation the "Agreement establishing the preventive measures that must be implemented to mitigate and control health risks implied by the disease caused by the SARS-CoV2 virus (COVID-19)", which establishes in its second article, subsection c) "Temporarily suspend the activities of the public, social and private sectors that involve the physical concentration, transit or displacement of people starting from the entry into force of this Agreement and until April 19, 2020";

That on March 31, 2020, the Ministry of Health published in the Official Gazette of the Federation the "Agreement establishing extraordinary actions to address the health emergency generated by the SARS-CoV2 virus", which, in its first article, fraction I, orders the immediate suspension, from March 30 to April 30, 2020, of non-essential activities, with the purpose of mitigating the dispersion and transmission of the SARS-CoV2 virus in the community;

That through the "Agreement modifying the similar one establishing extraordinary actions to address the health emergency generated by the SARS-CoV2 virus, published on March 31 of 2020", published on April 21, 2020 in the Official Gazette of the Federation, the Ministry of Health resolved it necessary to maintain and extend the National Day of Healthy Distance until May 30, 2020, as well as ensure the adequate implementation and compliance with health security measures;

That on May 15, 2020, the Ministry of Health published in the Official Gazette of the Federation the "Agreement modifying the one establishing a strategy for the reopening of social, educational, and economic activities, as well as a regional traffic light system to evaluate weekly the epidemiological risk related to the reopening of activities in each federal entity, as well as establishing extraordinary actions, published on May 14, 2020" with the objective of establishing a mechanism that involves the public, social, and private sectors to resume activities under health security protocols, which guarantee both to their workers, as well as to the general public that standards are being met that reduce risks associated with SARS-CoV2;

That in this sense and particularly with respect to the financial system, there was a massive closure of branches of various financial entities, in compliance with the health measures declared by the Federal Government for the period during which the contingency due to COVID-19 is in effect; which translated into one of the main challenges to guarantee the continuity of the offering and the provision of financial services to the general public attending to the new normality, without neglecting or undermining the regime of prevention of operations with proceeds of illicit origin and financing of terrorism;

That on April 1, 2020, the FATF issued a statement regarding the health emergency generated by COVID-19 and measures to combat illicit financing, making a call for (i) countries to explore the appropriate use of simplified identification measures and digital identification to facilitate financial operations while mitigating risks of operations with proceeds of illicit origin and financing of terrorism, and (ii) regulators, supervisors, and other authorities involved in the matter, provide the necessary assistance to the private sector regarding how the regulation in the matter will be applied during the current health crisis;

That, although since March 2019 money transmitters have had a regime of non-presidential identification, it was not a sufficient measure to address the needs of the general public to carry out operations and, at the same time, mitigate risks in matters of prevention of operations with proceeds of illicit origin and financing of terrorism;

That in this sense and based on the FATF Digital Identification Guide, as well as in compliance with Recommendations 10 and 15 of said Group, it is necessary, as with other participants regulated in the matter, to recognize the legal possibility that money transmitters can comply with their obligations in matters of prevention of operations with proceeds of illicit origin and financing of terrorism through the use of new technologies, of course with the responsibility that they comply with the applicable norms to the effect so that they have the value that in law corresponds;

That Recommendation 1 and its Interpretative Note of the FATF state that when countries identify higher risks, they must ensure that their respective regimes of prevention of operations with proceeds of illicit origin and financing of terrorism address them adequately;

That, in this sense, when determining how the risk-based approach must be implemented in a subject obliged, among others, supervisors must review the profiles and evaluations of risks of operations with proceeds of illicit origin and financing of terrorism that obliged subjects implement, as well as take into account the result of this review in the exercise of their supervisory powers;

That, based on the foregoing, it is considered necessary that the National Banking and Securities Commission, as the supervisory authority, know the exposure to risks of operations with proceeds of illicit origin and financing of terrorism of money transmitters, through the collection of additional quantitative information that they provide;

That, additionally, in compliance with Recommendation 4 of the FATF and the content of the Mutual Evaluation Report, issued by said intergovernmental body, in January 2018, it is necessary to strengthen the legal framework regarding the formation of the List of Blocked Persons, given that our country, as a member of the FATF, has recognized the formation of shell companies as a generalized technique to carry out operations with proceeds of illicit origin and financing of terrorism; in this sense, the condition of inclusion to the List of Blocked Persons is added for those taxpayers referred to in the fourth paragraph of
Article 69-B of the Federal Tax Code, the above to prevent the commission of the crimes of
operations with proceeds of illicit origin and financing of terrorism;

That in attention to Article 78 of the General Law of Regulatory Improvement and with the purpose of complying with the requirement of regulatory simplification for the issuance of this Resolution, the savings generated in the "Resolution that reforms, adds, and repeals various general provisions referred to in Article 95 Bis of the General Law of Credit Auxiliary Organizations and Activities, applicable to money transmitters referred to in Article 81-A Bis of the same legislation.", dictated by the National Commission for Regulatory Improvement in file CONAMER/23/0762, with an amount of $44,261,200 pesos, and

That once the opinion of the National Banking and Securities Commission has been heard, I have deemed it appropriate to issue the following:

RESOLUTION THAT REFORMS, ADDS, AND REPEALS VARIOUS GENERAL PROVISIONS REFERRED TO IN ARTICLE 95 BIS OF THE GENERAL LAW OF CREDIT AUXILIARY ORGANIZATIONS AND ACTIVITIES, APPLICABLE TO MONEY TRANSMITTERS REFERRED TO IN ARTICLE 81-A BIS OF THE SAME LEGISLATION

SINGLE ARTICLE.- The 2nd, fractions VIII and XIII; 4th, fraction IV, subsection A, sub-subsection b), numeral i., second paragraph; 4th Bis, first, second, fourth, and sixth paragraphs; 8th; 15th, second paragraph; 16th, first, fourth, and last paragraphs; 18th; 24th, first paragraph; 26th, first paragraph; 31st, first paragraph; 36th Bis, first and last paragraphs; 37th, first paragraph, fractions I to III; 60th, last paragraph; Annex 2 articles 1, 2, and 4; is ADDED the 2nd, fractions XIX Bis and XXIII Bis; 4th Bis, third and seventh paragraphs, shifting the others in their order; 12th, fourth paragraph, shifting the others in their order; 15th, third and fourth paragraphs; 16th, fifth paragraph, shifting the others in their order; 24th, last paragraph; 52nd Bis; 61st, first paragraph, fraction VII; 64th, first paragraph, fraction V; Annex 2 Chapter I "Object", Chapter II "Thresholds for non-presidential identification", Chapter III "Technological Identification Mechanisms", Chapter IV "Requirements", and Chapter V "Other provisions", shifting the articles in their order, and is REPEALED the 4th Bis, first paragraph, subsection a) and third paragraph; Annex 2 article 3, all of them of the General Provisions referred to in
Article 95 Bis of the General Law of Credit Auxiliary Organizations and Activities, applicable to
money transmitters referred to in Article 81-A Bis of the same legislation, to remain as follows:

2nd.-

...

I. to VII. ...

VIII. Device, the equipment that allows access to the Internet, which can be used to carry out
Operations, through websites or mobile applications among other technological developments that the Money Transmitters themselves make available to their Users to carry them out.

Devices that are property of the Money Transmitters, or are under their control, are not considered Devices.

IX. to XII. ...

XIII.

Geolocation, the geographic location of the Device used to carry out non-presidential Operations which consists of obtaining the geographic coordinates of latitude and longitude through the global positioning system (GPS by its acronym in English) in which the Device is located;

In the case where Users carry out non-presidential Operations from a Device that by its characteristics cannot provide the geographic coordinates of latitude and longitude through GPS, the Money Transmitters must obtain the geographic coordinates of latitude and longitude based on the matching of the Internet protocol address provided by the User's Device with a geographic location, for the approximate obtaining of said coordinates.

The geographic coordinates of latitude and longitude obtained through GPS or based on the matching of the Internet protocol address must be obtained prior to the consent of the User in terms of the regulations that in matters of data protection are applicable.

XIV. to XIX. ...

XIX Bis. Technological Identification Mechanism, to any of the procedures referred to in
Annex 2, through which Money Transmitters carry out the comparison of the valid identification document and the application of proof of life;

XX. to XXIII. ...

XXIII. Bis. Interim Compliance Officer, to the person referred to in the 36th Bis of these
Provisions;

XXIV. to XXXIX. ...

4th.-

...

I. to III.

...

IV.

...

A.

...

a)

...

b) ...

i.

...

For the purposes of what is provided in this subsection, the following will be considered as valid personal identification documents issued by Mexican authorities: the voter credential, the passport, the professional license, the national military service card, the consular registration certificate, the military identity credential, the affiliation card to the National Institute of Older Adults, the credentials and cards issued by the Mexican Institute of Social Security, by the Institute of Security and Social Services for State Workers, by the Institute of Social Security for the Mexican Armed Forces, or by Popular Insurance, the driver's license, the credentials issued by federal, state, and municipal authorities as long as they contain a photograph and signature, as well as other national identifications that, in their case, the Commission approves. Likewise, with respect to natural persons of foreign nationality referred to in this subsection A, in addition to those previously referred to in this paragraph, the passport or passport card, or the documentation issued by the National Institute of Migration that accredits their migratory status, as well as the accreditation card issued by the Ministry of Foreign Affairs to diplomatic or consular bodies will be considered as valid personal identification documents.

ii. to v. ...

B. to F. ...

...

...

...

...

...

...

...

4th Bis.- Money Transmitters that carry out Operations through Devices in a non-presidential manner with natural persons, natural persons with business activity, or legal entities, all of Mexican nationality, must collect prior to their celebration, the data and documents to integrate the user identification file, in accordance with Annex 2 of these Provisions, for which, in addition to the data and identification documents referred to in fractions I and IV of the 4th of these Provisions, as applicable, they must require and obtain from their Users, the Geolocation of the Device from which they celebrate the Operation, as well as:

I. Regarding Users who are natural persons who declare to the Money Transmitter to be of Mexican nationality:

a) Repealed

b) Consent that may be obtained through Electronic Signature or Advanced Electronic Signature.
Said consent will serve as proof to legally accredit the celebration of the Operation carried out with the Money Transmitter in a non-presidential manner.

c)

...

d) In the event that the resources come from a checking account, the Standardized Banking Key (CLABE) of an account opened in any financial entity or Foreign Financial Entity authorized to receive deposits, whose holder coincides with the name of the User.

e) The manifestation of the natural person in which they indicate that they act on their own behalf. Said manifestation may be established in the Terms and Conditions to that effect established by the Money Transmitter.

f) The digital version of the valid official personal identification document from which the data referred to in this Provision originate.

g) The digital version of the proof of address which may be any of those indicated in the 4th, fraction IV subsection A., sub-subsection b), numeral iii. of these Provisions.

Notwithstanding, when the declared address coincides with that of the voter credential of the User issued by a Mexican authority, in the event that they have been identified with the same, this will function as the proof of address referred to in this subsection.

II. Regarding Users who are legal entities of Mexican nationality:

a) Email.

b) In their case, Standardized Banking Key (CLABE) of an account opened in any financial entity or Foreign Financial Entity authorized to receive deposits, whose holder coincides with the denomination or trade name of the User.

c) Consent that may be obtained through Electronic Signature or Advanced Electronic Signature, of the legal representative. Said consent will serve as proof to legally accredit the celebration of the Operation carried out with the Money Transmitter in a non-presidential manner.

d) The information referred to in the 4th, fraction IV, subsection B, sub-subsection c) and subsection E of these Provisions.

e) The digital version of the identification documents referred to in the 4th, fraction IV subsection B, sub-subsection b) of these Provisions, with the exception of those indicated in numeral ii of the same subsection.

Money Transmitters shall not carry out Operations in a non-presidential manner when they do not collect the data related to Geolocation.

Repealed paragraph.

Money Transmitters shall not be obliged to collect the data related to Geolocation regarding the societies, dependencies, and entities referred to in Annex 1 of these Provisions, provided that the aforementioned societies, dependencies, and entities have been classified as Users with a Low Risk Degree in terms of the 16th of these Provisions.

A valid official personal identification document for the compliance of the present Provision will be the voter credential issued by the National Electoral Institute in the country or through the consular offices of the Ministry of Foreign Affairs abroad, the passport, and the consular registration certificate both issued by the Ministry of Foreign Affairs in the country or through its consular offices abroad.

...

The digital version of the valid official personal identification document that Money Transmitters collect for identification purposes must allow its verification in terms of these Provisions.

Additionally, the digital versions of the documents that Money Transmitters collect must be kept in their Files or Records in accordance with these Provisions. Money Transmitters must keep the documents in accordance with the official Mexican standard on digitalization and conservation of Data Messages applicable or consider an international standard whenever the compliance standard has at least the requirements of the official Mexican standard and does not contravene the same.

...

8th.- For the carrying out of Operations through electronic, optical, or any other technology, Money Transmitters must previously integrate the user identification file in accordance with what is established in these Provisions, establish mechanisms to identify the same, as well as develop procedures to prevent the improper use of said means or technologies, the which must be contained in their Compliance Manual or in another document or manual prepared by the Money Transmitter itself.

12th.- ...

...

...

In the case of Users whose identification file is integrated in terms of the 4th Bis and
Annex 2 of these Provisions and who have not carried out Operations with the Money Transmitter
in a period greater than one hundred eighty natural days, regardless of their Risk Degree, the Money Transmitters must confirm that the respective identification file is properly integrated and, if applicable, must carry out the update of the same in terms of the present Provisions, once said User intends to carry out Operations again with the Money Transmitter in question.

...

15th.-

...

Regarding Operations carried out in a non-presidential manner, in addition to the elements to determine the transactional profile of the User indicated in the previous paragraph, the Money Transmitter must take into account the Geolocation of the Device from which said Operation is carried out.

---

The Geolocation referred to in the preceding paragraph may cover the various Operations carried out by the User in the active session within the Internet page or mobile application, among other technological developments, that the Money Transmitters themselves make available to their Users to carry them out.

Money Transmitters will not be obligated to take into account the data related to Geolocation in terms of this Provision, regarding the societies, dependencies, and entities referred to in Annex 1 of these Provisions, provided that the aforementioned societies, dependencies, and entities have been classified as Users with a Low Risk Grade in terms of the 16th of these Provisions.

16th.- The application of the user knowledge policy must be based on the Risk Grade that Users represent, such that, when the Risk Grade is higher, Money Transmitters must collect more information about their predominant economic activity, as well as carry out stricter supervision of their transactional behavior.

...

...

In the case of the celebration of Operations carried out in a non-presential manner referred to in the 4th Bis of these Provisions, Money Transmitters must consider the Geolocation information of the Device from which the User carries out the Operation, activity, or service with the respective Money Transmitter.

Money Transmitters will not be obligated to consider Geolocation information in terms of this Provision, regarding the societies, dependencies, and entities referred to in Annex 1 of these Provisions, provided that the aforementioned societies, dependencies, and entities have been classified as Users with a Low Risk Grade in terms of this Provision.

...

...

To determine the Risk Grade in which Users should be located, as well as whether they should be considered Politically Exposed Persons, each of the Money Transmitters will establish in its Compliance Manual the criteria conducive to that end, which take into account, among other aspects, the User's background, profession, activity, or business sector, the origin and destination of their resources, the place of their residence, Geolocation, the methodology referred to in Chapter II Bis of these Provisions, and the other circumstances determined by the Money Transmitter.

18th.- Prior to the celebration of Operations with Users who, due to their characteristics, are classified with a High Risk Grade by the Money Transmitter, at least one executive, or their equivalent who has specific powers to approve the celebration of said Operations, must grant the respective approval in writing, in digital or electronic form. Likewise, for the purposes referred to in fractions IV and V of the 36th of these Provisions, Money Transmitters must provide in their Compliance Manual the mechanisms so that their respective Compliance Officers have knowledge of those Users who are classified with a High Risk Grade by the Money Transmitters themselves, as well as the procedures that must be carried out to process the approval indicated in this Provision.

24th.- Money Transmitters must send monthly to the Secretariat, through the Commission, no later than within fifteen business days following the last business day of the immediately preceding month, a report for each international fund transfer that, individually, any of their Users has received or sent during said month, for an amount equal to or greater than one thousand United States dollars or its equivalent in national currency or in the foreign currency in which it is carried out.

...

...

For the purposes of calculating the amount of the Operations in its equivalent in national currency, the exchange rate to settle obligations denominated in foreign currency payable in the Mexican Republic, published by the Bank of Mexico in the Official Gazette of the Federation, on the banking business day immediately preceding the date on which the Operation is carried out, will be considered.

26th.- For each Unusual Operation detected by a Money Transmitter, this must send to the Secretariat, through the Commission, the corresponding report, within three business days following the day on which the Committee session that adjudicates it as such concludes. For the purposes of carrying out the adjudication in question, the Money Transmitter through its Committee will have a period that will not exceed sixty natural days counted from when the alert is generated through its system, model, process, or by the employee of the Money Transmitter, whichever occurs first.

...

31st.- For each Concerning Internal Operation detected by a Money Transmitter, this must send to the Secretariat through the Commission, the corresponding report, within three business days following the day on which the Committee session that adjudicates it as such concludes. For the purposes of carrying out the adjudication in question, the Money Transmitter through its Committee will have a period that will not exceed sixty natural days counted from when said Money Transmitter detects that Operation, through its system, model, process, or by any employee thereof, whichever occurs first.

...

...

36th Bis.- The Committee of each Money Transmitter or its board of directors or managers, or sole administrator, as applicable, or general manager, may appoint a Money Transmitter official who will temporarily exercise the functions of Compliance Officer, in compliance with its obligations in accordance with these Provisions, for up to ninety natural days during a calendar year, counted from when the official designated as Compliance Officer leaves, has their appointment revoked, or is unable to perform the assignment in question.

...

...

The Interim Compliance Officer must perform the functions and obligations indicated in these Provisions, until the moment when the revocation indicated in fraction II of the 37th of these Provisions is reported.

37th.-

I. The full name without abbreviations of the official who has been designated as Compliance Officer, as well as the other information provided for in the format indicated, within ten business days following the date on which the corresponding designation has been made;

II. The revocation of the designation of the Compliance Officer or Interim Compliance Officer who has been designated in terms of what is established in both the 36th and 36th Bis of these Provisions, as applicable, within ten business days following the date on which it has occurred, whether by determination of the Money Transmitter, rejection of the assignment, termination of employment, or impossibility, as well as the other information provided for in the format indicated, and

III. The full name without abbreviations of the official who has been designated as Compliance Officer in terms of what is established in the 36th Bis of these Provisions, as well as the other information provided for in the format indicated, within ten business days following the date on which it has occurred.

52nd Bis. - Money Transmitters must send to the Commission, within the last ten business days of the month of April of each year, through electronic means and in the official format issued for such effect, quantitative information about their Operations, channels, type of Users, type of products and services, as well as the geographic zones where they operate. This information must correspond to the period from January to December of the year prior to that in which it must be sent, or to the period resulting from the date on which the Commission grants the registration to operate as a Money Transmitter to December of the respective year.

60th.- ...

Money Transmitters must adopt and implement mechanisms that allow identifying Users who are within the List of Blocked Persons, as well as any third party acting on behalf or for the account of the same, and those Operations that they have carried out, carry out, or intend to carry out. These mechanisms must be provided for in the Money Transmitter's Compliance Manual.

61st.-

...

I. to VI. ...

VII. Those that appear on the list of taxpayers referred to in the fourth paragraph of article 69-B of the Federal Tax Code.

64th.-

...

I. to IV. ...

V. They are in the situation referred to in the sixth paragraph of article 69-B of the Federal Tax Code.

...

Annex 2

...

Chapter I " Object

Article 1.- This Annex aims to establish the minimum measures and procedures that Money Transmitters must observe in order to comply with the 4th Bis of these Provisions, without prejudice to the compliance with the various obligations established therein.

Chapter II " Thresholds for non-presential identification "

Article 2.- Money Transmitters must observe the following thresholds by type of Technological Identification Mechanism on which they request authorization from the Commission for the purposes of compliance with the 4th Bis of these Provisions:

I. Regarding the Technological Identification Mechanism provided for in article 4 of this Annex, in the non-presential celebration of Operations with applicants who are natural persons, natural persons with business activity, or legal entities, all of Mexican nationality, they must not exceed the equivalent in national currency to five thousand United States dollars in the course of a calendar month.

II. Regarding the Technological Identification Mechanism provided for in article 5 of this Annex, in the non-presential celebration of Operations with applicants who are natural persons, natural persons with business activity, or legal entities, all of Mexican nationality, they must not exceed the equivalent in national currency to seven thousand United States dollars in the course of a calendar month.

To determine the amount in United States dollars of the Operations indicated in the first paragraph of this article, the exchange rate to settle obligations denominated in foreign currency payable in the Mexican Republic, published by the Bank of Mexico in the Official Gazette of the Federation, on the banking business day immediately preceding the date on which the Operation is carried out, must be used.

Chapter III " Technological Identification Mechanisms "

Article 3.- Money Transmitters may opt for one or both of the Technological Identification Mechanisms indicated in articles 4 or 5 subject to the thresholds indicated in article 2 of this Annex.

Without prejudice to the foregoing, additionally, Money Transmitters may carry out the Technological Identification Mechanism referred to in article 5 of this Annex subject to the threshold referred to in fraction I of article 2 of this Annex.

Article 4.- Money Transmitters must have technology that allows identifying the applicant through a recording containing image and sound, which must be preserved without edits in its total duration from when the Operation is carried out, for a period of no less than ten years.

Additionally, during the development of the Technological Identification Mechanism referred to in the preceding paragraph, Money Transmitters must observe the following:

a) Register the time and date of its realization obtained from a protected time server.

b) Implement it through automated tools that allow its recording and subsequent reproduction.

c) Verify that the quality of the image and sound allows full identification of the applicant, according to the parameters established by the Money Transmitters themselves for such effect.

d) Require the applicant to show the valid identification document sent along with the form referred to in fraction III of article 7 of this Annex, both on the front and back, verifying that it contains the same data and photograph as the valid identification document previously sent.

e) Use specialized technology that allows them to achieve reliable identification of the applicant, ensuring that there is a match between their face and that of the valid identification document previously sent.

f) Perform a liveness test on the applicant during the implementation of the Technological Identification Mechanisms.

For the purposes of the foregoing, a liveness test will be understood as technical tests based on algorithms, to measure and analyze the anatomical characteristics or voluntary and involuntary reactions of the applicant, in order to determine if a biometric sample is being captured from a subject alive and present at the capture point.

Article 5.- Money Transmitters must verify the match of the applicant's biometric information either with the records of the National Electoral Institute, the Secretariat of Foreign Relations, or with those of any other Mexican authority that provides a biometric information verification service.

In the event that the biometric information referred to in the preceding paragraph is the applicant's fingerprints, Money Transmitters must ensure that the applications or means they have available ensure that the fingerprint is obtained directly from the applicant, that is, a live fingerprint test, avoiding the registration of fingerprints coming from impressions on any material that intends to simulate the fingerprint of another person or images that pursue such an end, and have security measures that guarantee that the stored, processed, or sent information through said applications or means is not known or used by unauthorized third parties, as well as authenticate that the fingerprint obtained from the applicant coincides, at least, by ninety percent with the records of the databases either of the National Electoral Institute, the Secretariat of Foreign Relations, or with those of any other Mexican authority that provides a biometric information verification service.

Additionally, Money Transmitters must have technology that allows identifying the applicant through a recording containing image and, if applicable, sound, which must be preserved without edits in its total duration from when the Operation is carried out, for a period of no less than ten years, and must observe the requirements referred to in article 4, second paragraph of this Annex.

To comply with item c) of said article, it will be necessary to verify the quality of the sound when applicable.

Article 6.- In the event that the National Electoral Institute, the Secretariat of Foreign Relations, or any other Mexican authority that provides a biometric information verification service, cannot respond to the biometric information verification requests referred to in article 5 of this Annex due to technical or communication failures attributable to the corresponding Mexican authority, Money Transmitters may, in the event of having the corresponding authorization, carry out the Technological Identification Mechanism of article 4 of this Annex 2, subject to the corresponding limits.

In the event of not having such authorization, Money Transmitters must observe what is provided for in the 7th of these Provisions.

Chapter IV " Requirements "

Article 7.- Additionally, for the purposes of what is established in this Annex, Money Transmitters must:

I. Obtain prior authorization from the Commission.

Authorization referred to in the preceding paragraph will not be necessary when Money Transmitters are subject to the threshold referred to in article 2, fraction I of this Annex and carry out the Technological Identification Mechanism referred to in article 5 of this Annex. In this case, Money Transmitters must inform the Commission in advance of the date on which they will begin offering the carrying out of non-presential Operations, through the electronic means indicated by the latter.

Likewise, Money Transmitters must observe what is established in fractions II to VII of this article, as well as the requirements provided for in articles 8 and 9 of this Annex.

Money Transmitters must conserve all the information and supporting documentation, which must be available to the Commission, at the request of the latter, within the term established by the Commission itself.

For the purposes of this fraction, the Money Transmitter must present the authorization request through a free-form letter addressed to the Commission, which must resolve in accordance with the terms provided for in the applicable financial law.

II. In the event that the Money Transmitter confirms that the applicant is a User previously identified by it, said Money Transmitter must observe what is provided for in fraction IV of this article. Independently of the foregoing, the Money Transmitter must complete its identification file in terms of the 4th Bis and Annex 2 of these Provisions to carry out the respective Operation.

III. Require the applicant, who has not updated the situation provided for in fraction II of this article, to send a form through the electronic means established by the Money Transmitter for such effect, in which the identification data referred to in the 4th Bis of these Provisions must be included, as well as the specification of the Operation intended to be carried out.

The aforementioned form must include a declaration stating that its submission to the Money Transmitter in question constitutes the applicant's acceptance for their image and, if applicable, their voice, to be recorded in one of the Technological Identification Mechanisms referred to in Chapter III of this Annex. Such declaration may be made through automated tools that allow its recording and subsequent reproduction.

IV. In the case of Users previously identified by the Money Transmitter in question, the latter must verify at least the following:

a) Full name

b) Phone number

c) Unique Population Registry Key (CURP)

d) Additional data determined by the Money Transmitter itself

The foregoing, with the purpose that the Money Transmitter corroborates against its own records that, in effect, it is a User with an identification file in terms of the 4th Bis and Annex 2 of these Provisions.

If the aforementioned verification is successful, the Money Transmitter must authenticate the User, at least, with a category 3 authentication factor.

A category 3 authentication factor will be understood as the information contained, received, or generated by electronic means or devices, as well as that obtained by dynamic single-use password generator devices. Such means or devices must be provided by Money Transmitters to their Users, and the information contained, received, or generated by them must meet the following characteristics:

a) Have properties that prevent duplication or alteration.

b) Be dynamic information that cannot be used more than once.

c) Have a validity that cannot exceed two minutes.

d) Not be known prior to its generation and use by officials, employees, representatives of the Money Transmitter, or third parties.

In the event that the authentication referred to in the preceding paragraph is successful, the Money Transmitter may proceed to carry out Operations in terms of this Annex, as applicable, without the need to carry out what is established in fractions V to VII below.

When the verification and authentication referred to in this fraction are not successful, the Money Transmitter must observe the same requirements provided for in this Annex for applicants who have not been previously identified as Users.

V. If the Money Transmitter corroborates that the applicant is not a User previously identified in terms of the previous fraction, together with the form referred to in fraction III of this article, it must require the applicant to send a color photograph of any of the valid identification documents, referred to in the 4th Bis of these Provisions, on the front and back and verify the security elements, in order to detect if they present alterations or inconsistencies, for which they must have the necessary technology for this.

Repealed.

Repealed.

...

Repealed.

Regarding the voter credential issued by the National Electoral Institute in the country or through the consular offices of the Secretariat of Foreign Relations abroad, Money Transmitters must verify the match of the data listed below, with the records of the Institute itself or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) The Credential Identifier Code (CIC), which is printed on the voter credential or, if applicable, the Optical Character Recognition Code (OCR).

b) to d) ...

Money Transmitters must verify that the paternal surname, maternal surname, and name or names, as they appear on the presented voter credential, match the records of the National Electoral Institute or the National Population Registry or with those of any other Mexican authority that provides a verification service for said identification document.

Regarding the Mexican passport issued by the Secretariat of Foreign Relations in the country or through its consular offices abroad, Money Transmitters must verify the match of the data mentioned below with the records of the Secretariat itself or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) The Optical Character Recognition Code (OCR)

b) Paternal and maternal surnames and name(s), as they appear on the Mexican passport

c) Passport Number

In the case of the consular enrollment certificate issued by the consular offices of the Ministry of Foreign Affairs abroad, Money Transmitters must verify the coincidence of the following data with the records of said Ministry or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) Paternal and maternal surnames and name(s), as they appear in the consular enrollment certificate

b) Date of issue and expiration date

c) Document number

Additionally, Money Transmitters must require the applicant to send in digital format the necessary documents to integrate and maintain their identification file in accordance with what is provided in 4th Bis of these Provisions.

VI. They must inform the applicant of the procedure to be followed in the development of the real-time communication, what the access means are for its implementation, as well as deliver a one-time use code, which will be required from the applicant at the start of the Technological Identification Mechanism in question.

Repealed.

VII. Money Transmitters must suspend the identification process of the applicant when any of the following cases occur:

a) The quality of the image and, if applicable, the sound, do not allow for full identification of the applicant.

b) The applicant does not present the valid identification document previously sent along with the form referred to in fraction III of Article 7 of this Annex, the data obtained from this do not coincide with the records of the National Electoral Institute, the Ministry of Foreign Affairs, the National Population Registry or with those of any other Mexican authority that provides a verification service of biometric information regarding said identification document or, the result of the validation of the security elements of the aforementioned documents, or of the biometric verifications of the applicant's face referred to in Article 5 above, do not reach the effectiveness or level of reliability referred to in fraction VII of Article 9 of this Annex.

c) and d) ...

e) Atypical or risky situations arise, or the Money Transmitter has doubts about the authenticity of the valid identification document or the identity of the applicant.

Repealed.

In the event of suspension of the non-presential identification process, for the causes mentioned in the above subsections, Money Transmitters must store the information and documentation obtained for at least 30 natural days, with the objective that, in case of resuming the processes of celebration of Operations, it is corroborated that the information is consistent. Additionally, the aforementioned information and documentation must be used by Money Transmitters in the controls provided for in these Provisions.

For the case of Users or applicants who are legal entities, for the purposes of identifying their attorneys or legal representatives, Money Transmitters must observe the same procedures indicated in this article, with the exception that, for the case of applicants who are not Users with an identification file with the Money Transmitter in terms of these Provisions, the sending of the form referred to in fraction III of this article must be done through a file signed with the Advanced Electronic Signature of the legal entity in question.

Repealed.

The technology used for the procedures referred to in this Annex must be approved by the risk manager or their equivalent or, in case of not having this, by the audit committee, management board, board of directors or sole administrator of the Money Transmitter.

Article 8.- Money Transmitters must have the necessary means for the transmission and safeguarding of the information, data and files generated in the identification procedures referred to in Article 7 of this Annex, which guarantee the integrity of said information, as well as the correct reading of the data and the impossibility of its manipulation, as well as its adequate security, conservation and location.

Money Transmitters may use technological improvements that help compensate for the clarity of the images, when any of the valid identification documents are shown and the facial recognition of the applicant is performed, which must be approved by their risk manager or their equivalent or, in case of not having this, by the audit committee, management board, board of directors or sole administrator.

Chapter V "Other provisions"

Repealed.

Article 9.- Money Transmitters, when requesting the authorization referred to in Article 7, must present the following:

I. Detailed description of the non-presential identification process, as well as of the Technological Infrastructure used in each part of this, specifying the function of each component of said infrastructure, which must be approved by the risk manager or their equivalent or, in case of not having this, by the audit committee, management board, board of directors or sole administrator.

Likewise, Money Transmitters must include all technology providers that intervene in the Technological Infrastructure and, if applicable, the main applications used for said process and their interrelation.

II. Description of the electronic means used so that applicants send, if applicable, the form and documents through a secure channel considering, at least, the type of transmission of the device to the node that receives the form information, such as hypertext transfer protocol secure (HTTPS by its acronym in English), or the TLS security protocol (Transport Layer Security by its name in English) version 1.2 or higher.

III. Name of the service provider authorized by the Ministry of Economy used for the conservation of the digital version of any of the valid identification documents referred to in 4th Bis of these Provisions, in accordance with the official Mexican standard on digitalization and conservation of Data Messages applicable or consider an international standard whenever the compliance standard has at least the requirements of the official Mexican standard and does not contravene it.

IV. Network diagram showing all components of the Technological Infrastructure that are part of the non-presential identification process, including the segregation of communication networks and perimeter security equipment, considering redundancy schemes.

Repealed.

V. Detailed information on whether images of valid identification documents, recordings and biometric information will be kept in service provider facilities or of the Money Transmitter itself, describing the controls for access management and mechanisms for their storage.

VI. Evidence that the means of verification of the validity of identification documents have the effectiveness approved by the risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors or sole administrator of the Money Transmitters.

VII. If applicable,

evidence that the systems, tools or mechanisms used for facial identification recognitions or the verifications of any other biometric element that are used, have the level of reliability determined by the risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors or sole administrator.

VIII. If applicable, detailed information on the calibration tests of the systems, tools or mechanisms used for facial identification recognitions or the verifications of any other biometric element that are used.

These tests must be carried out in accordance with the thresholds established by the Money Transmitter, which must contemplate the results of these tests, and the adjustments of the validation engine derived from them. Money Transmitters must accompany their authorization request with evidence of all the above.

IX. Image quality standards and, if applicable, sound.

X. If applicable, the technical description of the category 3 authentication factors that will be required to corroborate that the applicant is a User who already has an identification file with the Money Transmitter in accordance with what is provided in article 7 of this Annex, as well as the characteristics of the one-time use code.

XI. Mechanisms through which they will transmit and securely safeguard the information, data and documents generated in the non-presential identification procedure.

XII. Mechanisms used to guarantee the integrity, correct reading, impossibility of manipulation and adequate security, conservation and location of the information, data and documents referred to in this Annex.

XIII. Encryption mechanisms in the communication channels used in the non-presential identification process, indicating the information that will be transmitted by each of said channels.

XIV. Mechanisms used for access management to systems, as well as policies for access management, which include the use of robust passwords.

XV. Policies and procedures for information security incident management.

XVI. Mechanisms or tools used for monitoring and blocking non-presential identification processes that present the situations described in subsection e) of fraction VII of article 7 of this Annex.

XVII. Carry out tests aimed at detecting vulnerabilities and threats, as well as penetration tests on the different components of the Technological Infrastructure used in the process, whether own or third-party. The aforementioned penetration tests must be carried out by an independent third party that has personnel who have the technical capacity proven by specialized industry certifications in the matter.

Money Transmitters must provide the Commission with evidence of the carrying out of the tests referred to in fractions VIII and XVII of this article, before implementing the scheme that has been authorized to them in accordance with article 7 of this Annex.

It is the responsibility of Money Transmitters who hire third parties to store, process and transmit information in the non-presential identification process, the monitoring of compliance with this article, at least once a year, as well as the obligation to have the evidence that supports it, which they must have available to the Commission at all times.

When Money Transmitters intend to modify any of the procedures that they have authorized to comply with article 4 or article 5, as applicable, of this Annex, they will require prior authorization from the Commission.

Transitory Provisions

First. - This Resolution will enter into force the day after its publication in the Official Gazette of the Federation except for what is provided in the following Transitory Provisions.

Second. - The guidelines, interpretations and criteria issued by the Ministry or by the Commission, based on what is provided in the Resolution of April 10, 2012 and subsequent Resolutions through which the General Provisions referred to in article 95 Bis of the General Law of Organizations and Auxiliary Credit Activities, applicable to money transmitters referred to in article 81-A Bis of the same legislation, have been added or reformed, will continue to be applicable insofar as they do not oppose what is established in this Resolution.

Third.- Money Transmitters, who have obtained the approval of the Commission for the non-presential identification mechanisms in terms of Annex 2 of the General Provisions referred to in article 95 Bis of the General Law of Organizations and Auxiliary Credit Activities, applicable to money transmitters referred to in article 81-A Bis of the same legislation, valid until before the entry into force of this Resolution, will have a period of twelve months, counted from the entry into force of this Resolution, to present to said Commission a new request for authorization in accordance with article 7, fraction I of Annex 2 that is reformed with this instrument.

The authorization referred to in the previous paragraph will remain valid until the Commission resolves on the authorization request that the Money Transmitters have presented to said Commission in accordance with what is indicated by Annex 2 of the General Provisions referred to in article 95 Bis of the General Law of Organizations and Auxiliary Credit Activities, applicable to money transmitters referred to in article 81-A Bis of the same legislation, which are reformed with this Resolution.

Fourth. - Money Transmitters must comply with the obligations contained in this Resolution, in the terms and in accordance with the deadlines indicated below:

I. Four months counted from the entry into force of this Resolution to modify the Compliance Manual and present it to the Commission.

II. Nine months counted from the date of entry into force of this Resolution, to modify the methodology referred to in Chapter II Bis of the Provisions.

III. Eighteen months counted from the date of entry into force of this Resolution, to update the automated systems referred to in 40th of the Provisions.

Fifth.- In the event that Money Transmitters update the assumption provided in article 7, fraction I second paragraph of Annex 2 that is reformed with this Resolution, they must inform through the email prevencion.lavado@cnbv.gob.mx, through a free written document addressed to the General Directions of Prevention of Operations with Illicit Proceeds A and B of the Commission, the situation provided for in said article while the Commission establishes the ideal electronic means so that Money Transmitters comply with what is provided for in said article.

Sixth. - Money Transmitters must begin to send to the Commission the information referred to in 52nd Bis that is added in this Resolution, from the date indicated in the resolution that the Commission issues for such effects.

Seventh. - Money Transmitters may equate the defined term of Ultimate Beneficial Owner referred to in these Provisions to the references of final beneficiary that are provided for in other legal orders in matters of prevention of operations with illicit proceeds and financing of terrorism, as well as in the consultation databases in charge of the competent authorities.

Mexico City, March 24, 2023.- The Secretary of Finance and Public Credit, Rogelio Eduardo Ramírez de la O .- Rubric.

In the document you are viewing, there may be text, characters or objects that do not display correctly due to conversion to HTML format, so we recommend always taking the digitized image of the DOF or the PDF file of the edition as a reference. The content, form and scope of the published documents are the strict responsibility of their issuer.

INQUIRY

BY DATE

Do
Lu
Ma
Mi
Ju
Vi
Sá
INDICATORS

Exchange Rate and Rates as of 27/08/2026

DOLLAR
16.9660 UDIS

8.808255 TIIE 28 DAYS

6.7559% TIIE 91 DAYS

6.7931% TIIE 182 DAYS

6.8474% TIIE DE FONDEO

6.50%

See more

SURVEYS

Did you like the new image of the Official Gazette of the Federation website?

No

Yes

Official Gazette of the Federation

Río Amazonas No. 62, Col. Cuauhtémoc, C.P. 06500, Mexico City Tel. (55) 5093-3200, where you can access our service menu

Electronic address: dof.gob.mx

111

LEGAL NOTICE | SOME RIGHTS RESERVED © 2026