Resolution reforming, adding, and repealing various General Provisions under Article 212 of the Securities Market Law — SHCP — MX

DOF: 09/09/2021

RESOLUTION reforming, adding, and repealing various of the General Provisions referred to in Article 212 of the Securities Market Law

At the margin, a seal with the National Coat of Arms, which reads: United Mexican States.- TREASURY.- Ministry of

Finance and Public Credit.

RESOLUTION REFORMING, ADDING, AND REPEALING VARIOUS OF THE GENERAL PROVISIONS REFERRED TO IN ARTICLE 212 OF THE SECURITIES MARKET LAW

ROGELIO EDUARDO RAMÍREZ DE LA O, Secretary of Finance and Public Credit, based on

the provisions of Articles 31, fractions VII and XXXII, of the Organic Law of the Federal Public Administration;

212 of the Securities Market Law, in the exercise of the powers conferred upon me by Article 6º,

fraction XXXIV, of the Internal Regulations of the Ministry of Finance and Public Credit, and with the

prior opinion of the National Banking and Securities Commission issued via letter number

VSPP-220/ 10030526/2021 dated July 29, 2021; and

CONSIDERING

That since the year 2000 Mexico has been a full member of the Financial Action Task Force (FATF),

an intergovernmental organization that sets international standards in the matter of prevention and combat against

operations with proceeds of illicit origin and financing of terrorism.

That on July 22, 2019, the Ministry of Finance and Public Credit published in the Official Gazette of the

Federación various modifications to the General Provisions referred to in Article 212 of

the Securities Market Law, with the object of addressing the recommendations of the FATF and establishing a

remote identification regime, thereby granting the possibility to brokerage houses to carry out

client identification through a real-time online videoconference, as well as the obligation

of brokerage houses to obtain geolocation of their clients, defined as the geographic

coordinates of latitude and longitude where the device through which their clients conduct

operations is located; which resulted in a strengthening of the risk assessment methodology so that such

brokerage houses evaluate their risks of being used to carry out operations with proceeds of

illicit origin and financing of terrorism prior to the use of new technologies.

That on March 6, 2020, the FATF published the Guide on Digital Identification, resulting as a

turning point in the topic of financial technology, showing the benefits of digital identity in the matter of

prevention and combat against operations with proceeds of illicit origin and financing of terrorism,

presenting financial technology as a more reliable and secure method for financial

entities when carrying out client identification through the use of mechanisms such as

liveness tests, the use of biometric elements and authentication factors, among others, which allow the

mitigation of risks of operations with proceeds of illicit origin and financing of terrorism.

That on March 11, 2020, the World Health Organization declared the disease caused by the

SARS-CoV2 virus (COVID-19) as a pandemic, calling on countries to: (i) adopt urgent

and aggressive measures to contain the spread of the virus, (ii) implement an approach based on

government-wide and whole-of-society participation, around a comprehensive strategy aimed at preventing

infections, saving lives, and minimizing their effects, and (iii) find a delicate balance between

health protection, minimizing social and economic disruptions, and respect for human

rights.

That on March 24, 2020, the Ministry of Health published in the Official Gazette of the Federation the

"Agreement establishing preventive measures that must be implemented to mitigate and

control health risks implied by the disease caused by the SARS-CoV2 virus (COVID-19)", which

establishes in its Second Article, subsection c) "Temporarily suspend activities of the

public, social, and private sectors involving the physical concentration, transit, or displacement of people starting

from the entry into force of this Agreement and until April 19, 2020".

That on March 31, 2020, the Ministry of Health published in the Official Gazette of the Federation the

"Agreement establishing extraordinary actions to address the health emergency generated

by the SARS-CoV2 virus", which, in its First Article, fraction I, orders the immediate suspension, from March 30

to April 30, 2020, of non-essential activities, with the aim of mitigating the dispersion and

transmission of the SARS-CoV2 virus in the community.

That through the "Agreement modifying the similar one establishing extraordinary actions to address the

health emergency generated by the SARS-CoV2 virus, published on March 31

of 2020", published on April 21, 2020 in the Official Gazette of the Federation, the Ministry of Health

deemed it necessary to maintain and extend the National Day for Healthy Distancing until May 30, 2020,

as well as to ensure the adequate implementation and compliance with health security measures.

That on May 15, 2020, the Ministry of Health published in the Official Gazette of the Federation the "Agreement

modifying the one establishing a strategy for the reopening of social, educational, and economic

activities, as well as a regional traffic light system to evaluate weekly the epidemiological risk related to the reopening of activities in each federal entity, as well as establishing extraordinary actions, published on May 14, 2020" with the objective

of establishing a mechanism involving the public, social, and private sectors to resume

activities under health security protocols, which guarantee both to their workers, as well as to the general

public that standards reducing risks associated with SARS-CoV2 are being met.

That in this sense and particularly with respect to the financial system, there was a massive closure of

branches of various financial entities, in compliance with health measures declared by the

Federal Government for the period during which the COVID-19 contingency is in effect; which translated

into one of the main challenges to guarantee the continuity of the offering and provision of financial

services to the general public attending to the new normality, without neglecting or undermining the regime of

prevention of operations with proceeds of illicit origin and financing of terrorism.

That on April 1, 2020, the FATF issued a statement regarding the health emergency generated

by COVID-19 and measures to combat illicit financing, calling for (i) countries to explore the appropriate use of simplified identification measures and digital identification to facilitate

financial operations while mitigating risks of operations with proceeds of

illicit origin and financing of terrorism, and (ii) regulators, supervisors, and other authorities

involved in the matter, provide the necessary assistance to the private sector regarding how the

regulation in the matter will be applied during the current health crisis.

That, even though currently brokerage houses have had since July 2019 a regime of

remote identification, it was not sufficient to address the needs of the general public to

celebrate contracts and, at the same time, mitigate risks in the matter of prevention of operations with proceeds of

illicit origin and financing of terrorism.

That in this sense and based on the FATF Digital Identification Guide, as well as in compliance with

Recommendations 10 and 15 of said group, it is necessary, as with other regulated participants

in the matter, first, to recognize the legal possibility that brokerage houses can

comply with their obligations in the matter of prevention of operations with proceeds of

illicit origin and financing of terrorism through the use of new technologies, of course with the responsibility

of complying with the applicable norms to that effect so that they have the value that in law corresponds.

That in addition to the above and to provide legal certainty to brokerage houses in the compliance

with the obligation to obtain geolocation in remote operations, provided for in the Resolution

reforming, adding, and repealing various of the General Provisions referred to in Article

212 of the Securities Market Law, published in the Official Gazette of the Federation on July 22, 2019

(Resolution 2019), its scope and definition are clarified and a new deadline is established to comply with the

obtaining of geographic latitude and longitude coordinates when these are based on

matching the Internet Protocol address of the device from which clients conduct

remote operations with brokerage houses, leaving without effect the deadline provided for in fraction IV of

the Third Transitory Provision of Resolution 2019 for this particular case.

That, in compliance with FATF Recommendation 10 which allows the application of simplified measures based on

a risk-based approach, it is considered relevant to increase the transactional level for

simplified identification contracts considered low risk that brokerage houses offer.

That, additionally, in compliance with FATF Recommendation 4 and the content of the Mutual Evaluation

Report, issued by said intergovernmental organization, in January 2018, it is necessary to strengthen the

legal framework regarding the formation of the Blocked Persons List, given that our country

as a member of the FATF, has recognized the formation of shell companies as a generalized technique

to carry out operations with proceeds of illicit origin; in this sense, the condition for

inclusion in the Blocked Persons List is added for those taxpayers referred to in the fourth paragraph of

Article 69-B of the Federal Tax Code, the above to prevent the commission of the crimes of

operations with proceeds of illicit origin and financing of terrorism.

That in attention to Article 78 of the General Law on Regulatory Improvement and with the purpose of complying with the

requirement of regulatory simplification for the issuance of this Resolution, the savings generated

in the "Resolution reforming, adding, and repealing various of the General Provisions

referred to in Article 212 of the Securities Market Law", audited by the

National Commission for Regulatory Improvement in file CONAMER/21/3585, with an amount of $127,169,844.38

pesos, will be taken.

RESOLUTION REFORMING, ADDING, AND REPEALING VARIOUS OF THE GENERAL PROVISIONS REFERRED TO IN ARTICLE 212 OF THE SECURITIES MARKET LAW

SINGLE ARTICLE.- The 2nd, fractions X, XV, and XXXV; 4th Ter first, fourth, and sixth

paragraphs; 6th second paragraph; 7th; 12th, first and fourth paragraphs; 13th; 22nd, second paragraph; 23rd, fourth and last

paragraphs; 25th; 36th first paragraph; 38th first paragraph; 43rd first paragraph; 48th Bis first and last paragraphs; 49th

first paragraph fractions I to III; 69th second paragraph; Annex 2 articles 1, 2, and 4; are REFORMED; the 2nd

fractions XXI Bis and XXV Bis; 4th, fraction IX, second paragraph; 4th Ter third and sixth paragraphs, shifting the

rest in their order; 6th fifth and sixth paragraphs; 12th, second, fifth, and sixth paragraphs, shifting the rest

in their order; 22nd third and fourth paragraphs; 23rd fifth paragraph, shifting the rest in their order, 36th last

paragraph; 70th first paragraph fraction VII; 73rd first fraction V; Annex 2 Chapter I "Object", Chapter II

"Thresholds for Remote Identification", Chapter III "Technological Identification Mechanisms",

Chapter IV "Requirements" and Chapter V "Other Provisions", shifting the articles in their order, and are

REPEALED the 4th Ter third paragraph; 12th, second paragraph; 14th Bis; Annex 2 article 3; all of them of the

General Provisions referred to in Article 212 of the Securities Market Law, to remain as follows:

2nd.- ...

I. to IX. Bis. ...

Device, the equipment that allows access to the worldwide network called Internet, used to

celebrate contracts or conduct Operations through Internet pages or mobile applications, among other technological developments, that the Brokerage Houses themselves make available to their Clients to carry them out.

Devices shall not be considered those that:

a) Are owned by the Brokerage Houses.

b) Are under the control of the Brokerage Houses.

c) Are provided under additional controls by the Brokerage Houses to their Clients so that they can conduct Operations, or

d) Are installed in the offices, branches, agencies, or subsidiaries of the Brokerage Houses themselves or in public places, complying with the respective regulation so that Clients can celebrate contracts or conduct Operations;

XI. to XIV.

...

XV. Geolocation, the geographic location of the Device used to celebrate contracts or conduct

Remote Operations, which consists of obtaining the geographic coordinates of latitude and longitude through the global positioning system (GPS) in which the Device is located.

In the event that Clients celebrate contracts or conduct Remote Operations from a

Device that, due to its characteristics, cannot provide the geographic coordinates of latitude and longitude through GPS, Brokerage Houses must obtain the geographic coordinates of latitude and longitude based on matching the Internet Protocol address provided by the Client's Device with a geographic location, for the approximate obtaining of said coordinates.

The geographic coordinates of latitude and longitude obtained through GPS or based on the

matching of the Internet Protocol address must be obtained prior to the Client's consent in terms of the regulation that in the matter of data protection is applicable;

XVI. to XXI. ...

XXI Bis. Technological Identification Mechanism, any of the procedures referred to in

Annex 2, through which Brokerage Houses carry out the comparison of the valid identification document and the application of liveness tests;

XXII. to XXV. ...

XXV. Bis. Interim Compliance Officer, the

person

referred to in Article 48th Bis of these

Provisions;

XXVI. to XXXIV. ...

XXXV. Obligated Subjects, the entities or societies subject to the obligations referred to in

Articles 115 of the Credit Institutions Law, 71 and 72 of the Law to Regulate the Activities of Savings and Loan Cooperative Societies, and 124 of the Savings and Popular Credit Law;

XXXVI. ...

XXXVII. ...

...

4th.-

...

I to VIII.

...

IX. ...

In the cases referred to in Article 12th of these Provisions, Brokerage Houses may collect

the data of the Beneficiaries referred to in the previous paragraph, after the

contracts are celebrated, through the means determined by the Brokerage Houses themselves; such means must be

included in the Compliance Manual of the respective Brokerage House.

X. ...

...

4th Ter.- Brokerage Houses that celebrate a contract through Devices in a remote manner with

Clients who are natural or legal persons, both of Mexican nationality, according to what is established in

Annex 2 of these Provisions, in addition to the identification data referred to in Article 4th of the

present Provisions, as applicable, must request and obtain from their Clients the Geolocation of the

Device from which they celebrate the contract, as well as:

I. Regarding Clients who are natural persons who declare to the Brokerage House to be of Mexican nationality:

a) Repealed.

b) Consent that may be obtained through Electronic Signature or Advanced Electronic Signature.

Such consent serves as proof to legally establish the celebration of the contract conducted with the

Brokerage House in a remote manner.

c) ...

d) Standardized Banking Key (CLABE) of an account opened in any financial entity or Foreign

Financial Entity authorized to receive deposits, whose holder coincides with the name referred to in

Article 4th, fraction I of these Provisions.

e) The declaration of the natural person stating that they act on their own behalf. Such

declaration may be established in the Terms and Conditions established to that effect by the Brokerage

House.

f) The digital version of the valid official personal identification document from which the

data referred to in this Provision originate.

g) The digital version of the proof of address, which may be any of those indicated in subsection b),

numeral iii. of fraction I of Article 4th of these Provisions.

However, when the declared address coincides with that of the Client's voter ID card

issued by a Mexican authority, in case they were identified with the same, this will function

as the proof of address referred to in this subsection.

II. Regarding Clients who are legal persons of Mexican nationality:

a) Email address.

b) Standardized Banking Key (CLABE) of an account opened in any financial entity or Foreign

Financial Entity authorized to receive deposits, whose holder coincides with the denomination or corporate

name referred to in Article 4th, fraction II of these Provisions.

c) Consent that may be obtained through

the

Electronic Signature or Advanced Electronic Signature, of the

legal representative. Such consent serves as proof to legally establish the celebration of the

contract conducted with the Brokerage House in a remote manner.

d) The information referred to in Article 4th, fraction II, subsection c) and fraction VII of these Provisions.

e) The digital version of the identification documents referred to in Article 4th, fraction II, subsection b) of the

present Provisions, with the exception of those indicated in numeral ii of the same subsection.

...

Brokerage Houses will not be obligated to collect the data related to Geolocation regarding the

societies, dependencies, and entities referred to in Annex 1 of these Provisions,

provided that the aforementioned societies, dependencies, and entities had been classified as Clients with

a Low Risk Grade in terms of Article 23rd of these Provisions.

Paragraph repealed.

A valid official personal identification document for the purposes of compliance with the

present Provision shall be understood to be the voter ID card issued by the National Electoral Institute in the country or through

the consular offices of the Ministry of Foreign Affairs abroad, the passport, and the

consular registration certificate.

...

The digital version of the valid official personal identification document that Brokerage Houses collect for identification purposes must allow its verification in terms of these

Provisions.

Additionally, the digital versions of the documents that Brokerage Houses collect must be

preserved in their Files or Records in accordance with these Provisions. Brokerage Houses

must preserve documents in accordance with the Mexican official standard on digitalization and

preservation of Data Messages applicable or consider an international standard whenever the compliance standard has at least the requirements of the Mexican official standard and does not contravene it.

...

6th.-

...

Regarding contracts celebrated in accordance with Article 4th Ter of these Provisions, in substitution of the

interview referred to in the previous paragraph, Brokerage Houses may establish the Mechanisms

Technological Identification referred to in Annex 2 of these Provisions.

...

With respect to low Risk contracts referred to in Article 12th of these Provisions, Brokerage Houses

may carry out the remote reception or capture of data, in substitution of the interview

mentioned in the first paragraph of this provision, provided that the Brokerage House in question

verifies the authenticity of the Client's data, for which they must, either directly or through a

third party, conduct a consultation to the National Population Registry in order to integrate the Unique Key of the Population Registry of the Client and, validate that the data provided remotely by the same, with

the exception of the address, coincide with the records existing in the databases of said Registry.

The validation of the identification data referred to in this Provision may be carried out

through procedures different from those indicated in the previous paragraph, with prior authorization of the Commission, with the opinion of the Ministry.

7th.- Brokerage Houses must preserve, as part of the identification file of each of their

Clients, the data and documents mentioned in the Provisions of this Chapter, as applicable, the document containing the results of the interview or of the Technological Identification Mechanisms referred to in

Articles 6th and 13th, as applicable, that of the visit referred to in Article 19th, as applicable, and the

questionnaire provided for in Article 23rd of these Provisions.

12th.- For the case of contracts in which it is agreed that the conduct of Operations is limited to

transactional levels below three thousand Investment Units per Client and per Brokerage House,

over the course of a calendar month, Brokerage Houses will be obligated to integrate the respective

identification files of their Clients, only with the data related to the full name, without

abbreviations, date of birth, and address of these, composed of the elements referred to in Article 4th of

the present Provisions.

Regarding contracts celebrated remotely in terms of what is established in Article 6th, fifth paragraph

of the Provisions, Brokerage Houses must integrate the identification files of their

Clients with the data related to the full name, without abbreviations, gender, state of

birth, date of birth, as well as address of these, composed of the elements referred to in

Article

4th of these Provisions.

Repealed.

...

In the event that the transactional level established in the first paragraph of this

Provision is exceeded, Brokerage Houses must proceed to

carry out the in-person interview or apply one of the

Technological Identification Mechanisms referred to in the 6th and Annex 2, respectively, of these Provisions and to integrate the respective Client's identification file with all the information and documentation that corresponds, in terms of what is provided in the 4th or 4th Ter of these Provisions, as well as to comply with the various obligations established therein.

Likewise, Brokerage Houses must inform their Clients that they will not be able to carry out Operations above the limit until the corresponding identification process is completed.

To determine the transactional level referred to in this provision, Brokerage Houses will not be obliged to consider amounts related to generated interest or any other bonus, including those amounts related to the Client's property rights, which such Brokerage Houses grant for the use or management of the respective account, if any, carried out in the period in question.

13th.- For the carrying out of Operations through electronic, optical, or any other technology means, Brokerage Houses must previously integrate the Client's identification file in accordance with what is established in these Provisions, establish mechanisms to identify them, as well as develop procedures to prevent the improper use of such means or technologies, which must be contained in their Compliance Manual or in another document or manual prepared by the Brokerage House itself.

14th Bis.- Repealed.

22nd.- ...

Regarding those Operations carried out in a non-presential manner, in addition to the elements to determine the Client's transactional profile indicated in the previous paragraph, the Brokerage House must take into account the Geolocation of the Device from which said Operation is carried out.

The Geolocation referred to in the previous paragraph may cover the various Operations that the Client carries out in the active session within the Internet page or mobile application, among other technological developments, that the Brokerage Houses themselves make available to their Clients to carry them out.

Brokerage Houses will not be obliged to take into account the data related to Geolocation in terms of this Provision, regarding the societies, dependencies, and entities referred to in Annex 1 of these Provisions, provided that said societies, dependencies, and entities have been classified as Clients with a Low Risk Grade in terms of the 23rd of these Provisions.

23rd.- ...

...

In the case of the celebration of contracts in a non-presential manner referred to in the 4th Ter of these Provisions, Brokerage Houses must consider the Geolocation information, of the Device from which the Client carries out the Operation, activity, or service with the respective Brokerage House.

Brokerage Houses will not be obliged to consider Geolocation information in terms of this Provision, regarding the societies, dependencies, and entities referred to in Annex 1 of these Provisions, provided that said societies, dependencies, and entities have been classified as Clients with a Low Risk Grade in terms of this Provision.

...

To determine the Risk Grade in which Clients should be located, as well as whether they should be considered Politically Exposed Persons, each Brokerage House will establish in its Compliance Manual the criteria conducive to that end, which take into account, among other aspects, the Client's background, their profession, activity, or business sector, the origin and destination of their resources, their place of residence, Geolocation, the methodology referred to in Chapter II Bis of these Provisions, and the other circumstances determined by the Brokerage House itself.

25th.- Prior to the celebration of contracts with Clients who, due to their characteristics, are classified by the Brokerage House with a High Risk Grade, at least one executive or equivalent who has specific powers to approve the celebration of said contracts must grant written approval, in digital or electronic form. Likewise, for the purposes referred to in fractions IV and V of the 48th of these Provisions, Brokerage Houses must provide in their Compliance Manual the mechanisms for their respective Compliance Officers to have knowledge of those Clients that are classified with a High Risk Grade by the Brokerage Houses themselves, as well as the procedures that must be carried out to process the approval indicated in this Provision.

36th.- Brokerage Houses must send monthly to the Secretariat, through the Commission, no later than within fifteen business days following the last business day of the immediately preceding month, a report for each international transfer of funds that, individually, any of their Clients or Users has received or sent during said month, for an amount equal to or greater than one thousand United States dollars or its equivalent in national currency or in the foreign currency in which it is carried out.

...

For purposes of calculating the amount of the Operations in its equivalent in national currency, the exchange rate to settle obligations denominated in foreign currency payable in the Mexican Republic, published by the Bank of Mexico in the Official Gazette of the Federation, on the business day immediately preceding the date on which the Operation is carried out, will be considered.

38th.- For each Unusual Operation detected by a Brokerage House, it must send to the Secretariat, through the Commission, the corresponding report, within three business days following the day on which the session of the Committee that adjudges it as such concludes. For purposes of carrying out the adjudication in question, the Brokerage House through its Committee will have a period that will not exceed sixty calendar days counted from when the alert is generated through its system, model, process, or by the Brokerage House employee, whichever occurs first.

...

43rd.- For each Concerning Internal Operation detected by a Brokerage House, it must send to the Secretariat, through the Commission, the corresponding report, within three business days following the day on which the session of the Committee that adjudges it as such concludes. For purposes of carrying out the adjudication in question, the Brokerage House through its Committee will have a period that will not exceed sixty calendar days counted from when said Brokerage House detects that Operation, through its system, model, process, or by any employee thereof, whichever occurs first.

...

48th Bis.- The Committee of each Brokerage House or its board of directors or general manager may appoint a Brokerage House official who will temporarily exercise the functions of Compliance Officer in the fulfillment of its obligations under these Provisions, for up to ninety calendar days during a calendar year, counted from when the official designated as Compliance Officer leaves, has their appointment revoked, or is unable to perform the appointment in question.

...

The Interim Compliance Officer must perform the functions and obligations indicated in these Provisions, until the moment when the revocation indicated in fraction II of the 49th of these Provisions is reported.

49th.- ...

I. The full name and surname without abbreviations of the official who has been designated as Compliance Officer, as well as the other information provided in the format indicated, within ten business days following the date on which the corresponding designation was made;

II. The revocation of the designation of the Compliance Officer, or Interim Compliance Officer who has been designated in terms of what is established in both the 48th, as well as the 48th Bis of these Provisions, as applicable, within ten business days following the date on which it occurred, whether by determination of the Brokerage House, rejection of the appointment, termination of employment, or impossibility, as well as the other information provided in the format indicated, and

III. The full name and surname without abbreviations of the official who has been designated as Compliance Officer in terms of what is established in the 48th Bis of these Provisions, as well as the other information provided in the format indicated, within ten business days following the date on which it occurred.

69th.-

...

Brokerage Houses must adopt and implement mechanisms that allow identifying Clients or Users who are within the List of Blocked Persons, as well as any third party acting on behalf or for the account of the same, and those Operations that they have carried out, are carrying out, or intend to carry out. Such mechanisms must be provided for in the Compliance Manual of the Brokerage House itself.

70th.- ...

I. to VI. ...

VII. Those that appear on the list of taxpayers referred to in the fourth paragraph of article 69-B of the Federal Tax Code.

73rd.-

...

I. to IV.

...

V. They are in the situation referred to in the sixth paragraph of article 69-B of the Federal Tax Code.

...

ANNEX 2

...

Chapter I " Object "

Article 1.- This Annex has the purpose of establishing the minimum measures and procedures that Brokerage Houses must observe in order to comply with the 4th Ter of these Provisions, without prejudice to the compliance with the various obligations established therein.

Chapter II " Thresholds for non-presential identification "

Article 2.- Regarding the Technological Identification Mechanism provided for in article 4 of this Annex, in the celebration of contracts with applicants who are natural persons, natural persons with business activity, or legal entities, all of Mexican nationality, whose resources come from a deposit account opened in a financial entity authorized for that purpose, the sum of the Operations must not exceed the equivalent in national currency to 30,000 Investment Units during a calendar month.

In the event that the transactional level exceeds the maximum amount established in the previous paragraph, the Brokerage House must carry out the Technological Identification Mechanism referred to in article 5 of this Annex if it has the corresponding authorization or carry out the in-person interview referred to in the first paragraph of the 6th of these Provisions and integrate the respective Client's identification file with all the information and documentation that corresponds, in terms of what is provided in the 4th or 4th Ter of these Provisions, as well as to comply with the various obligations established therein. Likewise, Brokerage Houses must inform their Clients that they will not be able to carry out operations until the identification process is completed.

Brokerage Houses must take as the reference value for the Investment Units referred to in this article, that applicable for the last day of the calendar month preceding that in which the calculation of the transactional level in question is carried out.

Chapter III " Technological Identification Mechanisms "

Article 3.- Brokerage Houses may opt for one or both of the Technological Identification Mechanisms indicated in articles 4 or 5 subject to the thresholds indicated in article 2 of this Annex.

Without prejudice to the foregoing, additionally, Brokerage Houses may carry out the Technological Identification Mechanism referred to in article 5 of this Annex subject to the threshold referred to in the first paragraph of article 2 of this Annex.

Article 4.- Brokerage Houses must have technology that allows identifying the applicant through a recording containing image and sound, which must be preserved without edits in its total duration throughout the validity of the contract and, once it concludes, for a period of at least ten years, from the conclusion of the contractual relationship.

Additionally, during the development of the Technological Identification Mechanism referred to in the previous paragraph, Brokerage Houses must observe the following:

a) Register the time and date of its realization obtained from a protected time server.

b) Implement it through automated tools that allow its recording and subsequent reproduction.

c) Verify that the quality of the image and sound allows for the full identification of the applicant, according to the parameters established by the Brokerage Houses themselves for that effect.

d) Require the applicant to show the valid identification document they sent along with the form referred to in fraction III of article 7 of this Annex, both the front and back, verifying that it contains the same data and photograph as the valid identification document previously sent.

e) Use specialized technology that allows them to achieve reliable identification of the applicant, ensuring that there is a match between their face and that of the valid identification document previously sent.

f) Perform a liveness test on the applicant.

For the purposes of the foregoing, a liveness test will be understood as technical tests based on algorithms, to measure and analyze the anatomical characteristics or voluntary and involuntary reactions of the applicant, in order to determine if a biometric sample is being captured from a subject with life present at the capture point.

Article 5.- Brokerage Houses must verify the coincidence of the applicant's biometric information, with the records of the National Electoral Institute, the Secretariat of Foreign Relations, or with those of any other Mexican authority that provides a biometric information verification service.

In the event that the biometric information referred to in the previous paragraph is the applicant's fingerprints, Brokerage Houses must ensure that the applications or means they have available ensure that the fingerprint is obtained directly from the applicant, that is, a live fingerprint test, avoiding the recording of fingerprints from impressions on any material that intends to simulate another person's fingerprint or images that seek such an end, and have security measures that guarantee that the stored, processed, or sent information through said applications or means is not known or used by unauthorized third parties, as well as authenticate that the fingerprint obtained from the applicant coincides, at least, by ninety percent with the records of the databases of either the National Electoral Institute, the Secretariat of Foreign Relations, or with those of any other Mexican authority that provides a biometric information verification service.

Additionally, Brokerage Houses must have technology that allows identifying the applicant through a recording containing image and, if applicable, sound, which must be preserved without edits in its total duration throughout the validity of the contract and, once it concludes, for a period of at least ten years from the conclusion of the contractual relationship, and must observe the requirements referred to in article 4, second paragraph of this Annex. To comply with item c), it will be necessary to verify the quality of the sound when applicable.

Article 6.- In the event that the National Electoral Institute, the Secretariat of Foreign Relations, or any other Mexican authority that provides a biometric information verification service, cannot respond to the biometric information verification requests referred to in article 5 of this Annex due to technical or communication failures attributable to the corresponding Mexican authority, Brokerage Houses may, if they have the corresponding authorization, carry out the Technological Identification Mechanism of article 4 of this Annex 2, subject to the corresponding limits.

In the event that the transactional level exceeds the maximum amount established for the Technological Identification Mechanism referred to in article 4 of this Annex, the Brokerage House must carry out the in-person interview referred to in the 6th of these Provisions or apply the Technological Identification Mechanism provided for in article 5 of this Annex, if it has the corresponding authorization for the latter, and integrate the respective Client's identification file with all the information and documentation that corresponds, in terms of what is provided in the 4th or 4th Ter of these Provisions, as well as to comply with the various obligations established therein.

Likewise, Brokerage Houses must inform their clients that they will not be able to carry out operations until the identification process is completed.

Chapter IV " Requirements "

Article 7.- Additionally, for purposes of what is established in this Annex, Brokerage Houses must:

I. Obtain prior authorization from the Commission.

Authorization referred to in the previous paragraph will not be necessary when Brokerage Houses adhere to the thresholds referred to in the first paragraph of article 2 of this Annex and carry out the Technological Identification Mechanism referred to in article 5 of this Annex. In this case, Brokerage Houses must inform the Commission in advance of the products and the date on which they will start offering them, through the electronic means indicated by the latter.

Likewise, Brokerage Houses must observe what is established in fractions II to VII of this article, as well as the requirements provided for in articles 8 and 9 of this Annex.

Brokerage Houses must conserve all the information and supporting documentation, which must be available to the Commission, at its request, within the timeframe established by the Commission itself.

II. Require the applicant to declare if they are already a Client of the Brokerage House. In the event that the declaration is affirmative, the Brokerage House must observe what is provided in fraction IV of this article. Regardless of the applicant's declaration, the Brokerage House must complete their identification file according to the product they intend to contract.

III. Require the applicant who has declared not to be a Client of the Brokerage House to send a form through the electronic means established by the Brokerage House for that effect, in which the identification data referred to in the 4th Ter of these Provisions must be included, as well as the specification of the product intended to be contracted.

The mentioned form must include a statement indicating that its submission to the Brokerage House in question constitutes the applicant's acceptance for their image and, if applicable, their voice to be recorded in one of the Technological Identification Mechanisms referred to in Chapter III of this Annex.

Such statement may be made through automated tools that allow its recording and subsequent reproduction.

IV. In
the event that the applicant declares being a Client of the Brokerage House, it must verify at least the data of full name, Client number, and Unique Population Registry Key of the Client, as well as the other data it determines itself in order to corroborate against its own records that, in fact, it is a Client, and in the event that this is the case, the Brokerage House must authenticate them with a category 3 authentication factor.

A category 3 authentication factor will be understood as the information contained, received, or generated by electronic means or devices, as well as that obtained by dynamic single-use password generator devices. Such means or devices must be provided by the Brokerage Houses to their Clients and the information contained, received, or generated by them must meet the following characteristics:

a) Have properties that prevent duplication or alteration.

b) Be dynamic information that cannot be used more than once.

c) Have a validity that cannot exceed two minutes.

d) Not be known prior to its generation and use by the Brokerage House's officials, employees, representatives, or brokers, or by third parties.

In the event that the verification referred to in the first paragraph of this fraction is successful, the Brokerage House may proceed to the contracting of the products provided for in article 2 of this Annex, without the need to carry out what is established in the following fractions V to VIII.

When the verification referred to in this fraction is not successful, the Brokerage House must observe the same requirements provided for in this Annex for applicants who declare not being Clients.

V. If the Brokerage House corroborates that the applicant is not its Client, together with the form referred to in fraction III of this article, it must require the applicant to send a color photograph of one of the valid identification documents referred to in the 4th Ter of these Provisions, front and back, and verify the security elements, in order to detect if they present alterations or inconsistencies, for which they must have the necessary technology for this.

Repealed.

...

Repealed.

Regarding the voter credential issued by the National Electoral Institute in the country or through the consular offices of the Secretariat of Foreign Relations abroad, Brokerage Houses must verify the coincidence of the data listed below, with the records of the Institute itself or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) The Credential Identifier Code (CIC), which is printed on the voting credential or, in its case, the Optical Character Recognition Code (OCR).

b) to d) ...

Brokerage Houses must verify that the paternal and maternal surnames and name or names, as they appear on the presented voting credential, match the records of the National Electoral Institute or the National Population Registry or those of any other Mexican authority that provides a verification service for said identification document.

Regarding the Mexican passport issued by the Secretariat of Foreign Affairs in the country or through its consular offices abroad, Brokerage Houses must verify the match of the following data with the records of said Secretariat or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) The Optical Character Recognition Code OCR. b) Paternal and maternal surnames and name(s), as they appear on the Mexican passport. c) Passport Number.

In the case of the consular enrollment certificate issued by the consular offices of the Secretariat of Foreign Affairs abroad, Brokerage Houses must verify the match of the following data with the records of said Secretariat or with those of any other Mexican authority that provides a verification service regarding said identification document:

a) Paternal and maternal surnames and name(s), as they appear on the consular enrollment certificate. b) Date of issue and date of expiration. c) Document Number.

Additionally, Brokerage Houses must require the applicant to send in digital format the necessary documents to integrate and maintain their identification file in accordance with what is provided in the 4th Ter of these Provisions.

VI. Inform the applicant of the procedure to be followed in the corresponding Technological Identification Mechanism provided for in Chapter III of this Annex and what the access means are for its implementation, as well as deliver a one-time code, which will be required from the applicant at the beginning of the Technological Identification Mechanism in question.

Repealed.

VII. Brokerage Houses must suspend the applicant's onboarding process when any of the following cases occur:

a) The quality of the image and, in its case, the sound, do not allow for full identification of the applicant.

b) The applicant does not present the valid identification document previously sent along with the form referred to in fraction III of article 7 of this Annex, the data obtained from this do not match the records of the National Electoral Institute, the Secretariat of Foreign Affairs, the National Population Registry or those of any other Mexican authority that provides a biometric information verification service regarding said identification document or the result of the validation of the security elements of the aforementioned documents, or of the biometric verifications of the applicant's face referred to in the previous article 5, do not reach the effectiveness or level of reliability referred to in fraction VII of article 9 of this Annex.

c) and d) ...

e) Atypical or risky situations arise, or the Entity has doubts about the authenticity of the valid identification document or the identity of the applicant.

Repealed.

In the event of suspension of the onboarding process for the causes mentioned in the above subsections, Brokerage Houses must store the obtained information and documentation for at least 30 natural days, with the objective that, in case of resuming onboarding processes, it is corroborated that the information is consistent. Additionally, the aforementioned information and documentation must be used by Brokerage Houses in the controls provided for in these Provisions.

For the case of Clients or applicants who are legal entities, for the purposes of identifying their attorneys or legal representatives, Brokerage Houses must observe the same procedures indicated in this article, with the exception that, for the case of applicants who declare not to be Clients, the sending of the form referred to in fraction III of this article must be done via file signed with the Advanced Electronic Signature of the legal entity in question.

The technology used for the procedures referred to in this Annex must be approved by the risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors or sole administrator of the Brokerage House.

Brokerage Houses may agree during the development of the Technological Identification Mechanism for the celebration of the contracts referred to in this Annex, the contracting of electronic services associated with such products, without allowing that through the services contracted in accordance with what is established in this article, the celebration of operations charged to other products of the same Client is instructed. The aforementioned prohibition will not be applicable when the Client goes to the offices to carry out the contracting of electronic services.

Repealed.

Article 8.- Brokerage Houses must have the necessary means for the transmission and safeguarding of the information, data, and files generated in the identification procedures referred to in article 7 of this Annex, which guarantee the integrity of said information, as well as the correct reading of the data and the impossibility of its manipulation, as well as its adequate security, conservation, and location.

Brokerage Houses may use technological improvements that help compensate for the clarity of the images, when any of the valid identification documents are shown and the facial recognition of the applicant is performed, which must be approved by their risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors or sole administrator.

Chapter V "Other Provisions"

Repealed.

Article 9.- Brokerage Houses, when requesting the authorization referred to in Article 7, must present the following:

I. Detailed description of the non-presidential identification process, as well as the Technological Infrastructure used in each part of this, specifying the function of each component of said infrastructure, which must be approved by the risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors or sole administrator.

Likewise, Brokerage Houses must include all technology providers involved in the Technological Infrastructure and, in its case, the main applications used for the referred process and their interrelation.

II. Description of the electronic means used so that applicants send, in their case, the form and documents through a secure channel considering, at least, the type of transmission of the device to the node that receives the form information, such as Hyper Text Transfer Protocol Secure, or Transport Layer Security version 1.2 or higher.

III. Name of the certification service provider authorized by the Secretariat of Economy used for the conservation of the digital version of any of the valid identification documents, referred to in the 4th Ter of these Provisions in accordance with the Official Mexican Standard on digitalization and conservation of Data Messages applicable or consider an international standard whenever the compliance standard has at least the requirements of the Mexican official standard and does not contravene it.

IV. Network diagram showing all components of the Technological Infrastructure that are part of the non-presidential identification process, including the segregation of communication networks and perimeter security equipment, considering redundancy schemes.

Repealed.

V. Detailed information on whether images of valid identification documents, recordings, and biometric information will be kept in service provider facilities or of the Brokerage House itself, describing the controls for access management and mechanisms for their storage.

VI. Evidence that the means of verification of the validity of identification documents have the effectiveness approved by the risk manager or their equivalent or, in case of not having this, by the audit committee or board of directors of the Brokerage Houses.

VII. In its case, evidence that the systems, tools, or mechanisms used for facial identification recognitions or the verifications of any other biometric element that are used, have the level of reliability determined by the risk manager or their equivalent or, in case of not having this, by the audit committee or board of directors of the Brokerage House.

VIII. In its case, detailed information on the calibration tests of the systems, tools, or mechanisms used for facial identification recognitions or the verifications of any other biometric element that are used.

These tests must be carried out in accordance with the thresholds established by the Brokerage House, which must contemplate the results of these tests, and the adjustments of the validation engine derived from them. Brokerage Houses must accompany their authorization request with evidence of all the above.

IX. Image quality standards and, in its case, sound.

X. In its case, the technical description of category 3 authentication factors that will be required to corroborate that an applicant is a Client of the Brokerage House, in accordance with what is provided in Article 7 of this Annex, as well as the characteristics of the one-time code.

XI. Mechanisms through which they will transmit and securely safeguard the information, data, and documents generated in the non-presidential identification procedure.

XII. Mechanisms used to guarantee the integrity, correct reading, impossibility of manipulation, and adequate security, conservation, and location of the information, data, and documents referred to in this Annex.

XIII. Encryption mechanisms in the communication channels used in the non-presidential identification process, indicating the information that will be transmitted through each of said channels.

XIV. Mechanisms used for access management to systems, as well as policies for access management, which include the use of robust passwords.

XV. Policies and procedures for information security incident management.

XVI. Mechanisms or tools used for monitoring and blocking onboarding that present the situations described in subsection e) of fraction VII of article 7 of this Annex.

XVII. Carry out tests aimed at detecting vulnerabilities and threats, as well as penetration tests on the different components of the Technological Infrastructure used in the process, whether own or third-party. The aforementioned penetration tests must be carried out by an independent third party that has personnel who have the technical capacity proven by specialized industry certifications in the matter.

Brokerage Houses must provide the Commission with evidence of the carrying out of the tests referred to in fractions VIII and XVII of this Article, before implementing the scheme that has been authorized to them in accordance with article 7 of this Annex.

It will be the responsibility of Brokerage Houses that hire third parties to store, process, and transmit information in the non-presidential onboarding process, the monitoring of compliance with this article, at least once a year, as well as the obligation to have the evidence that supports it, which they must have available to the Commission at all times.

When Brokerage Houses intend to modify any of the procedures they have authorized to comply with article 4 or article 5, as applicable, of this Annex, they will require prior authorization from the Commission.

Article 10.- The procedures established in articles 4 or 5 of this Annex are independent of those used in the onboarding and operations that Brokerage Houses carry out with their Clients in terms of Chapter II of Title Fifth of the General Provisions applicable to Brokerage Houses issued by the Commission or those that replace them.

TRANSITIONAL PROVISIONS

First.- This Resolution will enter into force the day after its publication in the Official Gazette of the Federation except for what is provided in the following Transitional Provisions.

Second.- The guidelines, interpretations, and criteria issued by the Secretariat or by the Commission, based on what is established in the Resolution of September 9, 2010, and subsequent Resolutions through which the General Provisions referred to in article 212 of the Securities Market Law have been added or amended, will continue to be applicable insofar as they do not oppose what is established in this Resolution.

Third.- Brokerage Houses that have obtained the approval of the National Banking and Securities Commission for non-presidential identification mechanisms in terms of Annex 2 of the General Provisions referred to in article 212 of the Securities Market Law, in force until before the entry into force of this Resolution, will have a period of twelve months, counted from the entry into force of this Resolution, to present to said Commission a new request for approval in accordance with article 7, fraction I of Annex 2 that is amended with this instrument.

The authorization referred to in the previous paragraph will remain in force until such time as the Commission resolves on the authorization request that Brokerage Houses have presented to said Commission in accordance with Annex 2 of the General Provisions referred to in article 212 of the Securities Market Law that are amended with this Resolution.

Fourth.- Brokerage Houses that have opted to implement, on a temporary basis, the administrative facility contained in letter number P322/2020 of June 15, 2020, issued by the National Banking and Securities Commission, under the FOURTH of the AGREEMENT by which temporary and extraordinary measures are established and some deadlines are suspended for the attention of financial entities and persons subject to supervision of the Commission, due to the coronavirus named COVID-19, published in the Official Gazette of the Federation on March 26, 2020, may continue to apply it for the period that the Commission informs them through letter. This, without prejudice to the fact that said Commission may modify the aforementioned administrative facilities, by virtue of the entry into force of this Resolution.

Fifth.- Brokerage Houses must comply with the obligations contained in this Resolution, in the terms and in accordance with the deadlines indicated below:

I. Four months counted from the entry into force of this Resolution to modify the Compliance Manual and present it to the Commission.

II. Nine months counted from the date of entry into force of this Resolution, to modify the methodology referred to in Chapter II Bis of the Provisions.

III. Eighteen months counted from the date of entry into force of this Resolution, to update the automated systems referred to in the 52nd of the Provisions.

IV. Six months counted from the date of entry into force of this Resolution, to obtain the geographic coordinates of latitude and longitude based on the matching of the Internet protocol address provided by the Client's Device with a geographic location, for the approximate obtaining of said coordinates, in case that Clients carry out Non-presidential Operations from a Device that, due to its characteristics, cannot provide the geographic coordinates of latitude and longitude through the global positioning system (GPS).

Sixth.- In the event that Brokerage Houses update the assumption provided in article 7, fraction I second paragraph of Annex 2 that is amended with this Resolution, they must inform through the email prevencion.lavado@cnbv.gob.mx, through a free written document addressed to the General Directions of Prevention of Operations with Resources of Illicit Origin A and B of the Commission, the situation provided for in said article as long as the Commission establishes the ideal electronic means so that Brokerage Houses comply with what is provided for in said article.

Seventh.- Those references of ultimate beneficiary that are provided for in other regulatory frameworks, guidelines, or guides issued by competent authorities in matters of prevention of operations with resources of illicit origin and financing of terrorism other than these Provisions, as well as in public consultation databases under the responsibility of competent authorities, Brokerage Houses may equate it to the defined term of Beneficial Owner referred to in these Provisions.

Mexico City, August 25, 2021.- The Secretary of Finance and Public Credit, Rogelio Eduardo Ramírez de la O. - Rubric.

In the document you are viewing, there may be text, characters, or objects that do not display correctly due to conversion to HTML format, so we recommend always taking the digitized image of the DOF or the PDF file of the edition as a reference. The content, form, and scope of published documents are the strict responsibility of their issuer.

CONSULT

BY DATE

Do Mo Tu We Th Fr Sa

INDICATORS

Exchange Rate and Rates as of 28/08/2026

DOLLAR
16.9712 UDIS
8.808812 TIIE 28 DAYS
6.7559% TIIE 91 DAYS
6.7931% TIIE 182 DAYS
6.8474% TIIE DE FONDEO
6.50%

SURVEYS

Did you like the new image of the Official Gazette of the Federation website?

No
Yes

Official Gazette of the Federation
Río Amazonas No. 62, Col. Cuauhtémoc, C.P. 06500, Mexico City Tel. (55) 5093-3200, where you can access our service menu Electronic address: dof.gob.mx

113

Lineage: No known changes