Resolution reforming, adding, and repealing various General Provisions under Article 115 of the Credit Institutions Law

DOF: 28/08/2024

RESOLUTION reforming, adding, and repealing various of the General Provisions referred to in Article 115 of the Credit Institutions Law

A seal with the National Emblem appears at the margin, which reads: United Mexican States.- TREASURY.- Secretariat of Finance and Public Credit.

RESOLUTION REFORMING, ADDING, AND REPEALING VARIOUS OF THE GENERAL PROVISIONS REFERRED TO IN ARTICLE 115 OF THE CREDIT INSTITUTIONS LAW

ROGELIO EDUARDO RAMÍREZ DE LA O, Secretary of Finance and Public Credit, based on the provisions of Articles 31, fractions VII and XXXII, of the Organic Law of the Federal Public Administration, and 115 and 115 Bis of the Credit Institutions Law, in exercise of the powers conferred upon me by Article 6, fraction XXXIV, of the Internal Regulations of the Secretariat of Finance and Public Credit, and with the prior opinion of the National Banking and Securities Commission issued via letter number VSPP/220-79925/2024 dated April 24, 2024;

AND CONSIDERING

That, since the year 2000, Mexico has been a full member of the Financial Action Task Force (FATF), an intergovernmental body that sets international standards in matters of prevention and combat against operations with resources of illicit origin and terrorist financing.

That on March 22, 2019, the Secretariat of Finance and Public Credit published in the Official Gazette of the Federation various modifications to the General Provisions referred to in Article 115 of the Credit Institutions Law, with the objective of addressing the recommendations of the FATF and recognizing, among other things, the legal possibility for credit institutions to comply with their obligations in matters of prevention of operations with resources of illicit origin and terrorist financing through the use of new technologies, thereby granting credit institutions the possibility to carry out Client identification through a real-time online videoconference; which resulted in a strengthening of the risk assessment methodology so that such entities evaluate their risks of being used to carry out operations with resources of illicit origin and terrorist financing prior to the use of new technologies.

That on March 6, 2020, the FATF published the Guide on Digital Identification, becoming a watershed in the topic of financial technology, exposing the benefits of using identification systems in matters of prevention and combat against operations with resources of illicit origin and terrorist financing, presenting financial technology as a more reliable and secure method for financial entities when carrying out the identification of their Clients through the use of mechanisms such as proof of life, the use of biometric elements and authentication factors, among others, which allow the mitigation of risks of operations with resources of illicit origin and terrorist financing.

That on April 1, 2020, the FATF issued a communication regarding the health emergency generated by COVID-19 and measures to combat illicit financing, calling for: (i) countries to explore the appropriate use of simplified identification measures and digital identification to facilitate financial operations while mitigating risks of operations with resources of illicit origin and terrorist financing, and (ii) regulators, supervisors, and other authorities involved in the matter to provide the necessary assistance to the private sector regarding how the regulation in the matter will be applied during the current health crisis.

That, even though since March 2019 credit institutions have had a non-presidential identification regime, it was not a sufficient measure to address the needs of the general public to open accounts or enter into contracts and, in turn, mitigate risks in matters of prevention of operations with resources of illicit origin and terrorist financing.

That, in this sense and based on the FATF Guide on Digital Identification, as well as in compliance with Recommendations 10 and 15 of said group, it is necessary, as with other regulated participants in the matter, to recognize the legal possibility for credit institutions to comply with their obligations in matters of prevention of operations with resources of illicit origin and terrorist financing through the use of new technologies, with the responsibility that they comply with the applicable norms to the effect so that they have the value that corresponds in law.

That in accordance with FATF Recommendation 1, financial institutions must identify, evaluate, and take actions to mitigate risks in matters of prevention of operations with resources of illicit origin and terrorist financing through mechanisms of knowledge of Clients and Users that are appropriate to the risk they represent in operations, which implies that institutions carry out the application of a Risk-Based Approach, in relation to their operations.

That, one of the most effective mechanisms for the regulatory framework in matters of prevention and combat of operations with resources of illicit origin and terrorist financing, consists in the implementation of identification and knowledge policies of Clients and Users by credit institutions, since they are essential elements to mitigate the risk that such institutions are used for the commission of the aforementioned illicit acts.

That, small and medium-sized enterprises (SMEs) play a relevant and essential role both in the economic and labor activity of the country, contributing around 52% of Mexico's Gross Domestic Product and generating around 72% of employment in the country.

That, to fulfill their objectives, SMEs require simplified identification mechanisms in the Mexican Banking System to carry out operations and strengthen their participation in the economic life of the country.

That, in this sense and with a risk-based approach, new simplified identification requirements are established, delimited by a threshold, to the effect of promoting the economic activity of SMEs through the use of new technologies, while mitigating risks of operations with resources of illicit origin and terrorist financing.

That on March 3, 2022, the resolution that reforms and modifies the General Provisions referred to in Article 115 of the Credit Institutions Law was published in the Official Gazette of the Federation, so that, among other things, credit institutions can obtain the identification data of refugees in Mexico and repatriated Mexican persons, from the official document issued by the National Institute of Migration that accredits the entry or regular stay of refugees, without it being necessary to additionally present the passport or passport card and from the Unique Key of Temporary Population Registry referred to in the Normative Instruction for the Assignment of the Unique Key of Population Registry; the foregoing, without prejudice to the compliance with the other obligations in matters of prevention of operations with resources of illicit origin and terrorist financing that these Provisions provide.

That, derived from the foregoing and with the purpose of following up on the actions of financial inclusion for foreign natural person refugees and to guarantee the international protection of natural persons of Mexican nationality residing abroad, as well as taking into account the application of a risk-based approach, new simplified identification requirements are established under an operational threshold, with the possibility of identifying the holders of said accounts remotely, likewise the validity of the consular enrollment is recognized as an identification document, while mitigating risks of operations with resources of illicit origin and terrorist financing.

That, with a view to strengthening the cooperation that has been developed between the Mexican and foreign financial systems, as well as facilitating and promoting the exchange of information between Mexican and foreign Entities, some areas of opportunity and best practices were identified that could be incorporated into the Mexican regulatory framework.

That, recognizing that the implementation of preventive measures, as well as the development and adoption of best practices and standards, improve the effectiveness of regimes against illicit resource operations and terrorist financing, and contribute to stability and confidence in our financial system to face new challenges and cross-border threats.

That FATF Recommendation 1 and its Interpretative Note state that when countries identify higher risks, they must ensure that their respective regimes for the prevention of operations with resources of illicit origin and terrorist financing address them adequately.

That, in this sense, in determining how the risk-based approach must be implemented in an obligated subject, among other things, supervisors must review the profiles and risk assessments of operations with resources of illicit origin and terrorist financing that obligated subjects implement, as well as take into account the result of this review in the exercise of their supervisory powers.

That, based on the foregoing, it is considered necessary that the National Banking and Securities Commission, as the supervisory authority, know the exposure to the risk of operations with resources of illicit origin and terrorist financing of credit institutions, through the collection of additional quantitative information that these provide.

That in November 2023, the update of the National Risk Assessment was issued in which it was reiterated that although within national territory there have been no cases of terrorism, no type of transactionality that could give rise to an investigation related to said crime has been detected, nor has the existence of terrorist combatants been identified, there are certain factors that open the possibility that Mexico be used as a financial platform for international terrorism, such as its geographical position and the porosity of the borders.

That it is necessary to improve and update the understanding of terrorist financing risks, in light of the dynamic way in which risks are changing in different regions of the world.

That, for all the foregoing, it is necessary to modify structural aspects of the regime for the prevention of operations with resources of illicit origin and terrorist financing applicable to credit institutions, such as those related to their Compliance Manual, the risk assessment methodology referred to in Chapter II Bis, the model of classification by degree of risk of their Clients and Users, automated systems, and training, in order to make visible the approach of preventing terrorist financing.

That in attention to Article 78 of the General Law of Regulatory Improvement and with the purpose of complying with the requirement of regulatory simplification for the issuance of the present Resolution, the savings generated in the "Resolution that reforms, adds, and repeals various of the General Provisions referred to in Article 115 of the Credit Institutions Law", dictated by the National Commission for Regulatory Improvement in file CONAMER/24/3013, with an amount of $642,666,433.60, will be taken.

RESOLUTION REFORMING, ADDING, AND REPEALING VARIOUS OF THE GENERAL PROVISIONS REFERRED TO IN ARTICLE 115 OF THE CREDIT INSTITUTIONS LAW

ARTICLE FIRST.- The 2nd, fractions IV, second paragraph, X, first paragraph, XVI, first paragraph, and XXXIV, first paragraph; the 4th, second paragraph, fractions I, subsections a), numeral i. and b), numerals i. first and second paragraphs and iii. second paragraph, II, subsections a), numeral x., IV, first paragraph, subsection b), numeral i., third paragraph, V, first paragraph, subsection a), numeral i. and second paragraph, numeral 3, VI, second and sixth paragraphs, VII, VIII, first paragraph, and IX, subsection a), numeral vii. second paragraph, as well as sixth paragraph; the 4th Ter, first paragraph, fractions I, first paragraph, subsections b) and e), and II, subsections c) and e), as well as fifth and seventh paragraphs; the 6th, fraction III; the 7th, second, third, fifth, fractions I and II, and eighth paragraphs; the 8th; the 11th, second paragraph; the 14th, first and third paragraphs; the 14th Bis, first paragraph fractions I, first paragraph, and II, first and second paragraphs; 14th Bis 2, second paragraph, subsection a), numeral i; the 14th Ter; the 15th; the 15th Bis, first and second paragraphs; the 18th, eighth paragraph; the 24th, second paragraph; the 25th, first paragraph; the 25th Bis, fourth paragraph; the 27th; the 28th, first paragraph; the 30th, first and second paragraphs; the 33rd; the 34th, third paragraph; the 35th, first paragraph; the 37th, first paragraph; the 38th, first paragraph fractions IV, IX, and X, subsection b); the 41st, first paragraph; the 42nd, first paragraph; the 44th, first paragraph; the 47th, third paragraph, fraction XI; the 47th Bis, first and fourth paragraphs; the 48th, first paragraph, fractions I, II and III; the 49th, fraction I; the 51st, fractions III, IV, IX, X, XI and XII; the 60th, first paragraph; the 64th, first paragraph; Annex 1 and; Annex 3; are REFORMED; the 2nd, fractions X, second paragraph, XVI, second and third paragraphs, XXVI Bis, and XXXIV subsections a) and b); the 4th, second paragraph fractions IV Bis, VI, fourth and fifth paragraphs, rearranging the rest in their order, as well as tenth paragraph; the 4th Ter, fraction I, subsection g), as well as third, eighth and ninth paragraphs, rearranging the rest in their order; the 6th Bis; the 7th, fifth paragraph, fractions III and IV, as well as sixth, seventh paragraphs, rearranging the rest in their order; the 14th, fourth and fifth paragraphs, rearranging the rest in their order; the 14th Bis, fractions I, third paragraph, rearranging the rest in their order, III, second and third paragraphs, IV, as well as second, third, fourth, fifth, sixth, eighth and ninth paragraphs, rearranging the rest in their order; the 14th Bis 2, seventh and ninth paragraphs, rearranging the rest in their order; the 14th Bis 3; the 21st, fifth paragraph; the 21st -2, second paragraph; the 24th, third and fourth paragraphs; the 25th, second paragraph; the 25th Bis, fifth and seventh paragraphs, rearranging the rest in their order; the 25th Quáter, second paragraph, rearranging the rest in their order; the 30th, second paragraph, fractions I and II, as well as third paragraph; the 33rd Bis, fourth paragraph; the 35th, second and fifth paragraphs, rearranging the rest in their order; the 38th, first paragraph, fractions X, subsection c), XVI and XVII; the 47th, fifth paragraph, rearranging the rest in their order; the 49th, subsections a), b) and c) of fraction I; the 51st, fraction XIII and second paragraph; the 60th, fourth paragraph; the 60th Bis; the 64th, fourth paragraph, rearranging the rest in their order; and are REPEALED the 4th, second paragraph, fraction II, subsection b), numeral iv., second paragraph; the 4th Ter, fractions I, subsections a) and d), II, subsection b), III, IV, V, VI and VII, as well as fourth paragraph; the 14th Bis, fraction II, fourth paragraph; the 16th Bis; all of them of the General Provisions referred to in Article 115 of the Credit Institutions Law, to remain as follows:

2nd.- ...

I. to III. ...

IV. Client.

...

a) and b) ...

Natural persons who accredit to the Entities that they are subject to the tax regime applicable to natural persons with business activity in the terms of sections I and IV of Chapter II of Title IV of the Income Tax Law, shall be considered as legal persons for the purposes of what is established in these Provisions, except for what refers to the integration of their file, which must be carried out in terms of what is established in fraction I of the 4th and, when applicable, of the 4th Ter, 14th, 14th Bis and 14th Ter of these Provisions and, in which, the Entities must additionally require the Federal Taxpayer Registry key (with homoclave) and, if applicable, tax identification number and/or equivalent of said natural persons, as well as the country or countries that assigned them.

V. to IX. ...

X. Device, the equipment that allows access to the worldwide network called Internet, used to open accounts, enter into contracts or carry out Operations through Internet pages or mobile applications, among other technological developments, that the Entities themselves make available to their Clients to carry them out.

Devices shall not be considered those that:

a) Are owned by the Entities; b) Are under the control of the Entities; c) Are granted under additional controls by the Entities to their Clients so that they can carry out Operations, or d) Are installed in the branches of the Entities themselves or in public sites, complying with the respective regulation so that Clients can enter into contracts or carry out Operations;

XI. to XV. ...

XVI. Geolocation, the geographical location of the Device used to open accounts, enter into contracts or carry out non-presential Operations, which consists of obtaining the geographical coordinates of latitude and longitude through the global positioning system (GPS) in which the Device is located.

In the event that Clients open accounts, enter into contracts or carry out non-presential Operations from a Device that, due to its characteristics, cannot provide the geographical coordinates of latitude and longitude through GPS, the Entities must obtain the geographical coordinates of latitude and longitude based on the matching of the Internet protocol address provided by the Client's Device with a geographical location, for the approximate obtaining of said coordinates.

The geographical coordinates of latitude and longitude obtained through GPS or based on the matching of the Internet protocol address must be obtained prior to the Client's consent in terms of the regulation in matters of personal data protection that is applicable;

XVII. to XXVI. ...

XXVI. Bis. Interim Compliance Officer, the person referred to in the 47th Bis of these Provisions;

XXVII. to XXXIII. ...

XXXIV. Risk, the probability that Entities may be used by their Clients or Users to carry out acts or Operations:

a) Through which the circumstance provided for in Article 139 Quáter of the Federal Penal Code could be updated, or b) Through which the circumstance provided for in Article 400 Bis of the Federal Penal Code could be updated;

XXXV. to XXXVIII. ...

4th.- ...

...

I. ...

a) ...

i. First surname, second surname in case of having it, and name or names, all without abbreviations.

ii. ...

iii. ...

iv. ...

v. ...

vi. ...

vii. ...

viii. ...

ix. ...

x. ...

xi. ...

xii. ...

...

b) ...

i. Personal identification, which must be, in all cases, an original official document issued by a competent authority, valid on the date of its presentation, containing the photograph, signature, code or distinctive official digital seal in case of being an electronic identification and, if applicable, the domicile of the Client.

For the purposes of what is provided for in this subsection, the following documents issued by Mexican authorities shall be considered as valid personal identification documents:

the voter credential issued by the National Electoral Institute in the country or through the consular offices of the Secretariat of Foreign Relations abroad, the passport, the professional card,

the

military

service

card,

the

consular

enrollment

certificate,

the

military

identity

card,

the

affiliation

card

for

the

National

Institute

of

Senior

Citizens,

the

credentials

and

cards

issued

by

the

Mexican

Institute

of

Social

Security,

by

the

Institute

of

Security

and

Social

Services

for

State

Workers

or

by

the

Social

Security

Institute

for

the

Mexican

Armed

Forces,

the

driving

license,

the

credentials

issued

by

federal,

state,

and

municipal

authorities

and

the

other

national

identifications

that,

in

their

case,

are

approved

by

the

Commission.

Likewise,

regarding

natural

persons

of

foreign

nationality

referred

to

in

this

fraction,

in

addition

to

those

previously

mentioned

in

this

paragraph,

the

passport

or

passport

card,

or

the

documentation

issued

by

the

National

Institute

of

Migration

that

accredits

their

migratory

status,

as

well

as

the

accreditation

card

issued

by

the

Secretariat

of

Foreign

Relations

to

diplomatic

or

consular

corps

shall

be

considered

valid

documents

of

personal

identification.

ii.

...

...

iii.

...

Notwithstanding,

when

the

address

stated

in

the

contract

concluded

by

the

Client

with

the

Entity

coincides

with

that

on

the

voter

credential

of

the

Client

issued

by

the

National

Electoral

Institute

in

the

country

or

through

the

consular

offices

of

the

Secretariat

of

Foreign

Relations

abroad,

or

the

consular

enrollment

certificate

of

the

Client

issued

by

the

Secretariat

of

Foreign

Relations,

in

the

case

that

they

have

identified

themselves

with

any

of

these,

they

shall

function

as

the

proof

of

address

referred

to

in

the

previous

paragraph.

iv. ...

...

v. ...

II.

...

a)

...

i. ...

ii. ...

iii. ...

iv.

...

v.

...

vi.

...

vii.

...

viii.

...

ix.

...

x.

First

surname,

second

surname

if

available,

and

name

or

names,

all

without

abbreviations,

of

the

administrator

or

administrators,

director,

general

manager,

or

legal

representative

who,

with

their

signature,

can

bind

the

legal

entity

for

the

purposes

of

opening

an

account,

concluding

a

contract,

or

carrying

out

the

Operation

in

question,

coming

from

a

valid

document

of

official

personal

identification

in

force,

issued

by

a

competent

authority,

in

accordance

with

what

is

provided

by

subparagraph

b),

numeral

i.,

fraction

I

of

this

Provision.

b) ...

i.

...

...

ii.

...

iii.

...

iv .

...

Repealed.

c) ...

i.

...

ii.

...

...

...

...

...

...

...

...

III.

...

a)

...

i.

...

ii.

...

ii.1.

...

ii.2.

...

ii.3.

...

b)

...

i.

...

i.1.

...

i.2.

...

i.3.

...

i.4.

...

i.5.

...

i.6.

...

i.7.

...

i.8.

...

ii.

...

ii.1. ...

...

...

ii.2. ...

ii.3. ...

...

...

IV.

...

a)

...

i. ...

ii. ...

iii.

...

iv.

...

v.

...

vi.

...

vii.

...

viii.

...

ix.

...

b)

...

i.

...

...

To

accredit

the

powers

of

the

representatives

of

the

federal,

state,

and

municipal

public

dependencies

and

entities,

as

well

as

of

other

Mexican

legal

persons

of

public

law,

reference

shall

be

made

to

what

is

provided

in

fraction

IV

Bis

of

this

Provision.

ii.

...

...

IV

Bis.

With

regard

to

the

federal,

state,

and

municipal

public

dependencies

and

entities,

as

well

as

other

Mexican

legal

persons

of

public

law

referred

to

in

Annex

1

of

these

Provisions,

classified

with

a

Risk

Grade

different

from

low:

a)

The

following

identification

data:

i.

Name

or

corporate

name.

ii.

Activity

or

corporate

purpose.

iii.

Federal

Taxpayer

Registry

(with

homoclave).

iv.

Serial

number

of

the

Advanced

Electronic

Signature.

v.

Address

(composed

of

street

name,

exterior

number

and,

if

applicable,

interior

number,

neighborhood,

city

or

township,

borough

or

municipality,

federative

entity,

and

postal

code).

vi.

Nationality.

vii.

Phone

number(s)

of

said

address.

viii.

Email.

ix.

Full

name

without

abbreviations

of

the

legal

representatives

and/or

attorneys

who,

with

their

signature,

can

bind

the

federal,

state,

or

municipal

public

dependency

or

other

Mexican

legal

person

of

public

law

in

question,

for

the

purposes

of

opening

an

account,

concluding

a

contract,

or

carrying

out

the

Operation

in

question,

coming

from

a

valid

document

of

official

personal

identification

in

force

issued

by

a

competent

authority,

in

accordance

with

what

is

provided

by

subparagraph

b),

numeral

i.,

fraction

I

of

this

Provision.

b)

Simple

copy

of

the

following

documents:

i.

Evidence

that

allows

accrediting

their

legal

existence,

in

accordance

with

what

is

provided

by

the

laws,

regulations,

decrees,

or

organic

statutes

that

create

and

regulate

their

constitution

and

operation.

ii.

Tax

Identification

Card

issued

by

the

Secretariat

and

certificate

of

the

Advanced

Electronic

Signature.

iii.

Proof

of

address

referred

to

in

subparagraph

a),

numeral

v.

of

this

fraction

IV

Bis,

in

terms

of

what

is

stated

in

subparagraph

b),

numeral

iii.,

of

the

previous

fraction

I.

iv.

Evidence

that

allows

proving

the

powers

of

their

legal

representatives

and/or

attorneys,

in

accordance

with

what

is

provided

by

the

laws,

regulations,

decrees,

or

organic

statutes

that

create

and

regulate

their

constitution

and

operation

and,

if

applicable,

copy

of

their

appointment

or

by

public

instrument

issued

by

a

notary

public,

as

corresponds.

v.

Personal

identification

of

such

legal

representatives

and/or

attorneys,

in

accordance

with

subparagraph

b),

numeral

i.,

of

the

previous

fraction

I.

V.

...

a)

...

i.

First

surname,

second

surname

if

available,

and

name

or

names,

all

without

abbreviations.

ii.

...

iii.

...

iv.

...

v.

...

vi.

...

b)

...

i.

...

ii.

...

iii.

...

iv.

...

v.

...

...

...

...

In

the

cases

referred

to

in

14th

Bis ,

14th

Bis

2

and

14th

Bis

3

of

these

Provisions.

VI.

...

When

the

identification

obligation

of

the

Beneficial

Owner

derives

from

a

Client

that

is

classified

with

a

Risk

Grade

of

low,

it

shall

not

be

necessary

to

collect

the

document

referred

to

in

numeral

iii.,

of

subparagraph

b),

of

fraction

I,

as

well

as

number

ii.2.,

of

numeral

ii.,

of

subparagraph

a),

of

fraction

III

of

this

Provision,

respectively.

...

In

the

case

of

those

Beneficial

Owners

of

foreign

nationality

who

are

outside

the

national

territory

and

who

do

not

have

a

passport

or

passport

card,

the

personal

identification

shall

be,

in

any

case,

the

digital

version

of

the

original

official

document

issued

by

the

authority

of

the

country

of

origin,

in

force

at

the

date

of

its

presentation,

that

contains

the

photograph,

signature,

and,

if

applicable,

address

of

the

same.

For

the

purposes

of

the

foregoing,

the

driving

license

and

the

credentials

issued

by

federal

authorities

or

equivalents

of

the

country

in

question

shall

be

considered

valid

documents

of

personal

identification.

The

verification

of

the

cited

documents

shall

be

the

responsibility

of

the

Entities.

Additionally,

the

Entity

shall

identify

whether

the

Beneficial

Owner

is

a

Politically

Exposed

Person

and,

in

the

case

of

identifying

them

as

such,

shall

apply

to

the

Client

what

is

established

by

the

26th

and

28th

of

these

Provisions.

...

...

VII.

With

regard

to

persons

who

appear

as

co-owners

or

authorized

third

parties

in

the

account

opened

by

the

Client

or

Operation

carried

out

by

them,

the

Entities

shall

observe

the

same

requirements

as

those

contemplated

in

this

Provision

for

holder

Clients.

With

regard

to

authorized

third

parties,

regarding

the

address,

it

shall

suffice

to

obtain

the

data

and

the

document

of

the

address

where

they

can

be

located.

VIII.

With

regard

to

Beneficiaries,

the

Entities

shall

collect

at

least

the

following

data:

first

surname,

second

surname

if

available,

and

name

or

names,

all

without

abbreviations;

private

address

(composed

of

the

same

elements

as

those

stated

in

subparagraph

a)

of

fraction

I

of

this

Provision),

when

this

is

different

from

that

of

the

holder

of

the

account

or

contract,

as

well

as

date

of

birth

of

each

one

of

them.

...

IX.

...

a) ...

i.

...

ii.

...

iii.

...

iv.

...

v.

...

vi.

...

vii.

...

Without

prejudice

to

the

foregoing,

the

Entity

that

does

not

act

as

trustee

may

comply

with

the

obligation

to

collect

the

data

relative

to

the

members

of

the

technical

committee

or

governing

body

equivalent,

indicating

only

the

first

surname,

second

surname

if

available,

and

name

or

names,

all

without

abbreviations,

of

these,

as

well

as

their

date

of

birth.

b) ...

i.

...

...

ii.

...

iii.

...

iv.

...

The

Entities

shall

integrate

the

identification

file

of

the

beneficiaries

(i)

who

are

not

individualized

in

the

contract,

or

(ii)

who

are

determined,

but

do

not

acquire

or

maintain

rights

at

that

moment,

when

these

come

to

exercise

their

rights

derived

from

the

Trust

contract.

The

obligation

established

in

this

paragraph

shall

not

be

applicable

for

those

Trusts

where

there

is

securities

intermediation,

in

which

case

the

obligation

shall

fall

on

the

financial

entity

that

carries

out

such

intermediation.

...

...

...

...

...

...

...

When

the

provided

identification

documents

present

cross-outs

or

erasures,

the

Entities

shall

collect

another

means

of

identification

or,

in

default,

request

two

bank

or

commercial

references

and

two

personal

references,

which

include

the

first

surname,

second

surname

if

available,

and

name

or

names,

all

without

abbreviations;

address

composed

of

the

same

data

as

those

stated

in

fraction

I

of

this

Provision,

and

phone

number

of

the

person

issuing

them,

whose

authenticity

shall

be

verified

by

the

Entities

with

the

persons

who

sign

such

references,

before

the

account

is

opened

or

the

respective

contract

is

concluded.

...

...

...

The

Client

identification

files

that

the

Entities

must

integrate

in

terms

of

this

provision

shall

be

subject

to

a

review

process,

in

the

cases

in

which

each

Entity

determines,

without

the

intervention

of

the

official

or

employee

who

intervened

in

its

integration,

for

the

purpose

of

verifying

its

consistency

and

completeness,

under

the

terms

and

conditions

that

are

established

in

the

Compliance

Manual,

or

well,

in

some

other

document

or

manual

drafted

by

the

Entity.

4th

Ter.-

The

Entities

that

open

an

account

or

conclude

a

contract

through

Non-presential

Devices

for

Clients

natural

or

legal

persons,

both

of

Mexican

nationality,

in

accordance

with

the

general

provisions

that

the

Commission

issues

for

that

purpose,

in

addition

to

the

identification

data

referred

to

in

the

4th

of

these

Provisions,

as

the

case

may

be,

shall

require

and

obtain

from

their

Clients

the

Geolocation

of

the

Device

from

which

they

open

the

account

or

conclude

the

contract,

as

well

as:

I.

With

regard

to

natural

person

Clients

who

declare

to

the

Entity

to

be

of

Mexican

nationality:

a)

It

is

repealed.

b)

Consent

that

may

be

obtained

through

the

Electronic

Signature

or

Advanced

Electronic

Signature.

Said

consent

shall

constitute

proof

to

legally

accredit

the

opening

of

the

account

or

conclusion

of

the

contract

that

they

carry

out

with

the

Entity

in

a

non-presential

manner.

c)

...

d)

It

is

repealed.

e)

The

manifestation

of

the

natural

person

in

which

they

state

that

they

act

on

their

own

behalf.

Said

manifestation

may

be

established

in

the

Terms

and

Conditions

that

the

Entity

establishes

for

that

purpose.

f)

...

g)

The

digital

version

of

the

proof

of

address

that

may

be

one

of

those

stated

in

subparagraph

b),

numeral

iii.

of

fraction

I

of

the

4th

of

these

Provisions.

Notwithstanding,

when

the

address

stated

coincides

with

that

on

the

voter

credential

or

the

consular

enrollment

certificate

of

the

Client

issued

by

Mexican

authority,

in

the

case

that

they

have

identified

themselves

with

any

of

these,

they

shall

function

as

the

proof

of

address

referred

to

in

this

subparagraph.

II.

...

a)

...

b)

It

is

repealed.

c)

Consent

that

may

be

obtained

through

the

Electronic

Signature

or

Advanced

Electronic

Signature

of

the

legal

representative.

Said

consent

shall

constitute

proof

to

legally

accredit

the

opening

of

the

account

or

conclusion

of

the

contract

that

they

carry

out

with

the

Entity

in

a

non-presential

manner.

d)

...

e)

The

digital

version

of

the

identification

documents

referred

to

in

the

4th ,

fraction

II,

subparagraph

b)

of

these

Provisions.

III.

It

is

repealed.

IV.

It

is

repealed.

V.

It

is

repealed.

VI.

It

is

repealed.

VII.

It

is

repealed.

...

The

Entities

shall

not

be

obligated

to

collect

the

data

relative

to

the

Geolocation

with

regard

to

the

societies,

dependencies,

and

entities

referred

to

in

Annex

1

of

these

Provisions,

provided

that

the

said

societies,

dependencies,

and

entities

had

been

classified

as

Clients

with

a

Risk

Grade

of

low

in

terms

of

the

25th

and

26th

of

these

Provisions.

Paragraph

repealed.

It

shall

be

understood

as

a

valid

document

of

official

personal

identification

in

force

for

the

compliance

of

this

Provision,

the

voter

credential

issued

by

the

National

Electoral

Institute

in

the

country

or

through

the

consular

offices

of

the

Secretariat

of

Foreign

Relations

abroad,

the

passport

and

the

consular

enrollment

certificate,

both

issued

by

the

Secretariat

of

Foreign

Relations

in

the

country

or

through

its

consular

offices

abroad.

...

The

digital

version

of

the

valid

document

of

official

personal

identification

in

force

that

the

Entities

collect

for

purposes

of

identification

shall

allow

its

verification

in

terms

of

these

Provisions.

Additionally,

the

digital

versions

of

the

documents

that

the

Entities

collect

shall

be

preserved

in

their

Files

or

Registers

in

accordance

with

these

Provisions.

The

Entities

shall

preserve

the

documents

in

accordance

with

the

Mexican

official

standard

on

digitalization

and

preservation

of

Data

Messages

applicable

or

consider

an

international

standard

provided

that

the

compliance

standard

has

at

least

the

requirements

of

the

Mexican

official

standard

and

does

not

contravene

it.

The

Client

identification

files

that

the

Entities

must

integrate

in

terms

of

this

provision

shall

be

subject

to

a

review

process,

in

the

cases

in

which

each

Entity

determines,

without

the

intervention

of

the

official

or

employee

who,

in

their

case,

had

intervened

in

its

integration,

for

the

purpose

of

verifying

its

consistency

and

completeness,

under

the

terms

and

conditions

that

are

established

in

the

Compliance

Manual,

or

well,

in

some

other

document

or

manual

drafted

by

the

Entity.

...

6th -.

...

I.

...

II.

...

III.

Report

to

the

Secretariat,

in

terms

of

these

Provisions,

the

Relevant

Operations,

Operations

with

Virtual

Assets,

Unusual

Operations,

Concerning

Internal

Operations,

and

the

international

fund

transfers

that

correspond

in

relation

to

their

Clients,

directors,

officials,

employees,

or

attorneys

who

intervene

in

said

Concentrating

Account.

...

...

6th

Bis.

The

Entities

shall

have

policies,

processes,

and

procedures,

established

in

their

Compliance

Manual

or

other

internal

document,

to

guarantee

that

the

accounts

that

are

internally

opened

in

the

Entities

themselves

for

administrative

or

internal

process

purposes

are

not

operated

by

the

Clients

of

said

Entity

or

that

Operations

instructed

by

their

Clients

are

carried

out

without

a

record

of

the

instruction

in

question

associated

with

the

Client.

7th.-

...

With

regard

to

accounts

opened

or

contracts

concluded

in

accordance

with

the

4th

Ter

of

these

Provisions,

in

substitution

for

the

interview

referred

to

in

the

previous

paragraph,

the

Entities

shall

implement

the

technological

mechanisms

provided

for

in

the

general

provisions

that

the

Commission

issues

for

that

purpose

for

the

opening

of

non-presential

accounts

and

conclusion

of

contracts.

With

regard

to

the

granting

of

credits

or

loans,

as

well

as

the

scenarios

referred

to

in

the

14th

Bis,

14th

Bis

2

and

14th

Bis

3

of

these

Provisions,

the

Entities

may

conclude

agreements

with

third

parties

for

the

carrying

out

of

the

interview

referred

to

in

this

Provision,

which

shall

be

carried

out

in

the

terms

established

in

articles

46

Bis

1

and

46

Bis

2

of

the

Law

and

the

general

provisions

that

the

Commission

issues

based

on

those

articles.

In

any

case,

the

Entities

that

are

in

the

scenario

provided

for

in

this

paragraph

shall

be

responsible

for

the

compliance

with

the

obligations

that,

in

matters

of

identification

and

knowledge

of

the

Client,

are

established

by

these

Provisions.

...

With

regard

to

the

accounts

referred

to

in

the

14th

Bis ,

14th

Bis

2

and

14th

Bis

3

of

these

Provisions,

the

Entities

may

carry

out

the

receipt

or

capture

of

the

data

and

documents,

as

corresponds,

remotely,

in

substitution

for

the

interview

mentioned

in

the

first

paragraph

of

this

provision,

provided

that

the

Entity

in

question

verifies

the

authenticity

of

the

Client's

data,

for

which

they

shall

be

subject

to

the

following

procedures:

I.

The

Entities,

either

directly

or

through

a

third

party,

shall

carry

out

a

consultation

to

the

National

Population

Registry

in

order

to

integrate

the

Unique

Key

of

the

Population

Registry

of

the

Client

and

validate

that

the

data

relative

to

the

full

name,

gender,

federative

entity

of

birth,

and

date

of

birth

provided

remotely

by

the

same,

coincide

with

the

records

existing

in

the

databases

of

said

Registry;

II.

In

the

case

of

accounts

that

are

linked

to

a

mobile

phone

or

other

equivalent

communication

device,

the

Entities

shall

validate

the

mobile

phone

number

provided

through

an

alternative

mechanism

to

that

through

which

it

was

provided;

III.

With

regard

to

level

3

accounts

referred

to

in

fraction

III

of

the

14th

Bis

of

these

Provisions,

the

Entities

shall

observe

what

is

provided

in

fractions

I

and

II

above,

as

well

as,

either

directly

or

through

a

third

party,

verify

the

coincidence

of

the

data

of

one

of

the

following

valid

documents

of

identification:

a)

With

regard

to

the

voter

credential

issued

by

the

National

Electoral

Institute

in

the

country

or

through

the

consular

offices

of

the

Secretariat

of

Foreign

Relations

abroad,

the

Entities

shall

verify

the

coincidence

of

the

data

listed

below,

with

the

records

of

the

Institute

itself

or

with

those

of

any

other

Mexican

authority

that

provides

a

verification

service

regarding

said

identification

document:

i.

The

Credential

Identifier

Code

(CIC)

that

is

printed

on

the

voter

credential

or,

if

applicable,

the

Optical

Character

Recognition

(OCR

);

ii.

Year

of

registration;

iii.

Voter

Key,

and

iv.

Number

and

year

of

issue.

b)

With

regard

to

the

Mexican

passport

issued

by

the

Secretariat

of

Foreign

Relations

in

the

country

or

through

its

consular

offices

abroad,

the

Entities

shall

verify

the

coincidence

of

the

data

mentioned

below

with

the

records

of

the

Secretariat

itself

or

with

those

of

any

other

Mexican

authority

that

provides

a

verification

service

regarding

said

identification

document:

i.

The

Optical

Character

Recognition

Code

(OCR).

ii.

First

surname,

second

surname

if

available,

and

name

or

names,

all

without

abbreviations,

as

they

appear

on

the

Mexican

passport.

iii.

Passport

Number.

c)

In

the

case

of

the

consular

enrollment

certificate

issued

by

the

consular

offices

of

the

Secretariat

of

Foreign

Relations,

the

Entities

shall

verify

the

coincidence

of

the

data

mentioned

below

with

the

records

of

the

Secretariat

itself

or

with

those

of

any

other

Mexican

authority

that

provides

a

verification

service

regarding

said

identification

document:

i.

First

surname,

second

surname

if

available,

and

name

or

names,

all

without

abbreviations,

as

they

appear

on

the

consular

enrollment

certificate.

ii.

Date

of

issue

and

date

of

expiration.

iii.

Document

Number.

IV.

With

regard

to

the

accounts

referred

to

in

fraction

IV

of

the

14th

Bis

of

these

Provisions,

the

Entities

shall

observe

what

is

provided

in

fractions

I

to

III

above

and

comply

additionally

with

the

following:

a)

Collect

consent

through

the

Electronic

Signature

Advanced

of the

Customer.

Said

consent

will serve as proof

to legally establish the opening

of the account or the

celebration of the contract that the Customer carries out with the

Entity remotely.

b)

Verify the match of the biometric information of the

Customer either with the records of the

National Electoral Institute, the

Secretariat of Foreign Relations or another

Mexican financial or tax authority or federal

department that provides a similar biometric information verification service to that of said

Institute or the aforementioned Secretariat of Foreign Relations,

or with those biometric databases that have been developed by the Entities themselves in accordance with what is provided in the general provisions that the Commission establishes,

and integrate into the identification file of the Customer in question, a certificate of biometric verification issued by the system of the authority that provides biometric verification services or by the database mentioned above.

c)

Verify, before or after contracting, that the Customer carries out activities typical of their business at the declared address.

d)

Verify, before or after contracting, the personality of the legal representative of the Customer (legal person).

In case the verifications referred to in subsections c) and d) above are carried out subsequently, the Entities must inform their Customers that they cannot carry out Operations until the aforementioned verification processes are concluded satisfactorily.

For the case of Customers who are legal persons, the Entities must carry out the verification mechanisms referred to in fractions I, III and IV of the fifth paragraph of this Provision, regarding the attorneys-in-fact or legal representatives of these.

The Entities must define in their Compliance Manual, the policies, criteria, measures and procedures based on which they will comply with the procedures provided for in this Provision.

The validation of the identification data referred to in fractions I and II of the fifth paragraph of this Provision may be carried out through procedures other than those indicated, with prior authorization of the Commission, with the opinion of the Secretariat.

8th.-

The Entities must preserve, as part of the identification file of each of their Customers, the data, documents and digital versions mentioned in the provisions of this Chapter, the document containing the results of the interview or of the technological mechanisms provided for in the general provisions that the Commission issues for the purpose of opening accounts and celebrating non-presential contracts, to which the 7th and the 15th refer, respectively, that of the visit referred to in the 21st, in its case, and the questionnaire provided for in the 25th Bis of these Provisions.

11th.-

...

In the cases referred to in the 14th Bis, 14th Bis 2 and 14th Bis 3 of these Provisions, the Entities must verify the Beneficiary's data at the moment when they present themselves to exercise their rights, under the terms in which the account in question was opened.

14th.-

For the case of products and services other than deposit accounts and loans, which are considered by the Entities as Low Risk, these may integrate the respective identification files of their Customers, subject to what is established in this Provision, only with the data indicated in fractions I, II or III of the 4th of these Provisions, according to the type of Customer in question, as well as with the personal identification data of the Customer and, if applicable, that of their representative, which must be one of those contemplated in subsection b), numeral i., of fraction I of the 4th of these Provisions and which the Entities are obliged to request to be presented as a prior requirement to open the respective account.

...

In the event that the transactional level of any of the products or services referred to in the first paragraph of this Provision exceeds the maximum amount established by the Entity for them to be considered as Low Risk, such Entity must carry out the in-person interview referred to in the 7th of these Provisions or apply one of the technological mechanisms provided for in the general provisions that the Commission issues for the purpose of opening accounts and celebrating non-presential contracts, and integrate the identification file of the respective Customer with all the information and documentation that corresponds, in terms of what is provided for in the 4th or 4th Ter of these Provisions, as well as comply with the various obligations established in the same.

Likewise, the Entities cannot execute Customer Operations above the maximum amount established by the Entity in question, until the identification process corresponding is concluded.

To determine the transactional level referred to in this provision, the Entities are not obliged to consider amounts related to generated interest, refunds from electronic fund transfers or any other bonus that such Entities grant for the use or management of the respective account that, if applicable, are made during the period in question.

...

14th Bis.

• ...

I.

Regarding accounts classified as level 1 that are opened by individual Customers, whose Operation is limited to credits equal to the equivalent in national currency to seven hundred fifty Investment Units per Customer, over the course of a calendar month, the Entities may integrate the respective identification files of their Customers, only with the data of first surname, second surname if available, and name or names, all without abbreviations and date of birth.

...

With respect to those accounts classified as level 1 that are contracted remotely in terms of what is established in the 7th of these Provisions, the Entities must integrate the identification files of their Customers with the data relating to the first surname, second surname if available, and name or names, all without abbreviations, gender, state of birth and date of birth of these.

...

...

II.

Regarding accounts classified as level 2 that are opened by Customers who are individuals, whose operation is limited to credits equal to the equivalent in national currency to three thousand Investment Units per Customer, over the course of a calendar month, the Entities may integrate the respective identification files of their Customers only with the data relating to the first surname, second surname if available, and name or names, all without abbreviations, date of birth and address, which must be composed of the elements referred to in the 4th of these Provisions.

In this case, the data relating to the name and date of birth of the Customer must be obtained from (i) an official identification indicated in the cited 4th of these Provisions; (ii) the valid temporary certificate of the Unique Population Registry Key for repatriated Mexican nationality individuals and for refugee foreign nationality individuals, issued by the National Population Registry, or (iii) the official document issued by the National Institute of Migration with which foreign nationality individuals prove their entry or regular stay in the country, which the Secretariat will make known to the Entities through the Commission.

With respect to those accounts classified as level 2 that are contracted remotely by individuals of Mexican nationality or foreign nationality who have a valid Unique Population Registry Key or Temporary Unique Population Registry Key, in terms of what is established in the 7th of these Provisions, the Entities must integrate the identification files of their Customers with the data relating to the full name without abbreviations, gender, state of birth for the case of individuals of Mexican nationality, date of birth, as well as address of these, composed of the elements referred to in the 4th of these Provisions.

...

III is repealed.

...

With respect to those accounts classified as level 3 that are contracted remotely in terms of what is established in the 7th of these Provisions, by Customers who are individuals or legal persons of Mexican nationality with residence in national territory, the Entities must integrate the respective identification files with the data indicated in fractions I or II of the 4th and 4th Ter of these Provisions, according to the type of Customer in question, as well as with the digital version of the valid identification document of the Customer or, if applicable, that of their representative.

Additionally to what is established in the previous paragraph, regarding individual Customers, the Entities must collect the manifestation of the individual in which they declare that they act on their own behalf.

Regarding legal persons, what is provided in the previous paragraph will be applicable whenever these designate before the Entity only one legal representative for the administration, maintenance and disposition of the resources of their account, which must coincide with that which opens the account on their representation, as well as declare being the Ultimate Owner of the Customer.

IV.

Regarding accounts whose operation is limited to credits equal to the equivalent in national currency to thirty thousand Investment Units per Customer, over the course of a calendar month, which are contracted remotely in terms of what is established in the 7th of these Provisions, by Customers who are legal persons or individuals with business activity in terms of sections I and IV of Chapter II of Title IV of the Income Tax Law, all of Mexican nationality with residence in national territory, the Entities must integrate the respective identification files with the data indicated in fractions I and II of the 4th of these Provisions, according to the case, as well as with the digital version of the voter credential, passport or consular registration certificate of the Customer or, if applicable, that of their representative and the digital version of the proof of address of the Customer.

Regarding individual Customers, the Entities must collect the manifestation of the individual in which they declare that they act on their own behalf.

In the case of Legal Person Customers, what is provided in this fraction will be applicable whenever these designate before the Entity only one legal representative for the administration, maintenance and disposition of the resources of their account, which must coincide with that which opens the account on their representation, as well as declare being the Ultimate Owner of the Customer.

Additionally, the Entities must preserve evidence of the inscription before the public registry that corresponds to the public instrument that proves the legal existence of the legal person Customer, in which the data of its constitution and inscription in said registry are recorded.

The Entities may determine the initial transactional profile referred to in the first paragraph of the 24th of these Provisions according to the characteristics of each account level.

In the event that the same Customer has more than one account open in the same Entity, regardless of the transactional level to which they correspond or when the transactional level of any of the products referred to in this Provision exceeds the maximum amount for them to be considered as Low Risk, such Entity must carry out the in-person interview referred to in the 7th of these Provisions or apply the technological mechanisms provided for in the general provisions that the Commission issues for the purpose of opening accounts and celebrating non-presential contracts, and integrate the identification file of the respective Customer with all the information and documentation that corresponds, in terms of what is provided for in the 4th or 4th Ter of these Provisions, as well as comply with the various obligations established in the same.

What is provided in the previous paragraph will not be applicable regarding the accounts referred to in the 13th of these Provisions.

Likewise, the Entities cannot execute Customer Operations above the maximum amounts established in this provision until the identification process corresponding is concluded.

To determine the transactional level referred to in this provision, the Entities are not obliged to consider amounts related to generated interest, refunds from electronic fund transfers, or any other bonus that such Entities grant for the use or management of the respective account that, if applicable, are made during the period in question.

...

The digital version of the valid current official personal identification document that the Entities collect for identification purposes must allow its verification in terms of these Provisions.

Additionally, the digital versions of the documents that the Entities collect must be preserved in their Files or Registers in accordance with these Provisions.

The Entities must preserve the documents in accordance with the Mexican official standard on digitization and preservation of Data Messages applicable or consider an international standard whenever the compliance standard has at least the requirements of the Mexican official standard and does not contravene it.

14th Bis 2.-

...

...

a) ...

i. First surname, second surname if available, and name or names, all without abbreviations;

ii. ...

iii. ...

iv. ...

v. ...

vi. ...

vii. ...

viii. ...

b) ...

...

...

i. ...

ii. ...

iii. ...

...

...

To determine the transactional level referred to in this provision, the Entities are not obliged to consider amounts related to generated interest, refunds from electronic fund transfers, or any other bonus that such Entities grant for the use or management of the respective account that, if applicable, are made during the period in question.

...

The Entities must establish controls to guarantee that the threshold established in the first paragraph of this provision is not exceeded per Customer.

14th Bis 3.-

Regarding checking accounts in national currency that the Entities decide to open to individuals of Mexican nationality with residence outside the national territory indicated in article 14 Bis of the Provisions applicable to the Operations of Credit Institutions, Regulated Multiple Purpose Financial Companies that maintain patrimonial links with Credit Institutions and the National Financial Company for Agricultural, Rural, Forestry and Fisheries Development of the Bank of Mexico, classified as level 2 accounts, whose operation is limited to credits up to the equivalent in national currency to three thousand Investment Units per account over the course of a calendar month, will be considered Low Risk.

To integrate the identification files of the Customers, the Entities must integrate them with the following data:

i. First surname, second surname if available, and name or names, all without abbreviations.

ii. Gender.

iii. Date of birth.

iv. State of birth.

v. Country of birth.

vi. Nationality.

vii. Occupation, profession, activity or business line to which the Customer dedicates themselves.

viii. Address abroad, which must be composed of the elements referred to in the 4th of these Provisions.

ix. Cell phone number.

x. Electronic mail.

xi. Unique Population Registry Key.

xii. Number of the consular registration certificate issued by the consular offices of the Secretariat of Foreign Relations.

xiii. Date of issuance and expiration of the consular registration certificate issued by the consular offices of the Secretariat of Foreign Relations.

The Entities must verify the match of the data relating to numerals i., iii., viii., xii. and xiii., with the records of the Secretariat itself or with those of any other Mexican authority that provides a verification service regarding said identification document.

In case the Customer has an address in national territory where they can receive correspondence addressed to them, the Entities must record in the file the data relating to said address, with the same elements as those contemplated in the 4th of these Provisions.

The Entities may carry out the reception or capture of the Customer's data remotely in terms of the 7th of these Provisions, in substitution of the in-person interview referred to in said provision.

Individuals of Mexican nationality may only be holders of one of the checking accounts referred to in this provision per Entity.

To determine the transactional level referred to in this provision, the Entities are not obliged to consider amounts related to generated interest, refunds from electronic fund transfers, or any other bonus that such Entities grant for the use or management of the respective account that, if applicable, are made during the period in question.

The Entities must establish controls to guarantee that the threshold established in the first paragraph of this provision is not exceeded.

14th Ter.

• The limits, conditions and characteristics established in these Provisions for the accounts referred to in the 14th Bis, fractions I and II thereof, may be applicable to securities administration, investment, credit and microcredit accounts.

In the case of credits and microcredits, the maximum limits will apply to the credit line or amount granted to the Customers and will only be applicable to individuals.

15th.-

For the execution of Operations through electronic, optical or any other technology means, the Entities must previously integrate the Customer's identification file in accordance with what is established in these Provisions, establish mechanisms for the identification of the Customer in accordance with the general provisions that the Commission issues for this purpose, as well as develop procedures to prevent the improper use of said means or technologies, which must be contained in their Compliance Manual or in any other document or manual prepared by the Entity itself.

15th Bis.

• Regarding accounts opened or contracts celebrated by individuals who act (i) on their own behalf, (ii) in their capacity as co-owners or, (iii) in the name and representation of third parties, in terms of the 4th, 4th Ter, 14th Bis and 14th Bis 2 of these Provisions, the Entities must verify the data and, if applicable, the documents that their possible Customers provide them to prove their identity.

The verification referred to in the previous paragraph may be carried out in person or non-presentially, in accordance with the provisions that the Commission issues for this purpose or in terms of the 7th of these Provisions, insofar as applicable.

...

...

...

16th Bis.

• Repealed.

18th.-

...

...

...

...

...

...

...

The Entities must establish internal approval escalation mechanisms when they receive foreign currency in cash at branches for amounts exceeding the equivalent to seven thousand five hundred United States dollars or its equivalent in the

foreign currency

of

which

it

is

a

matter

or

in

national

currency

for

amounts

exceeding

three

hundred

thousand

pesos,

for

the

execution

of

individual

operations

of

purchase,

receipt

of

deposits,

receipt

of

the

payment

of

credits

or

services,

or

transfers

or

status

of

funds

with

their

Clients

or

Users

natural

persons.

The

Entities

shall

establish

the

same

mechanisms

when

they

receive

from

their

Clients

or

Users

legal

persons

or

through

Trusts,

foreign

currency

in

cash

for

amounts

exceeding

the

equivalent

of

fifty

thousand

dollars

of

the

United

States

of

America

or

national

currency,

for

amounts

exceeding

five

hundred

thousand

pesos,

for

the

execution

of

the

referenced

operations.

... 21ª.-

...

...

...

...

Subsequent

to

the

periodic

update

of

the

files

of

the

Clients

that

is

carried

out

in

accordance

with

the

present

provision,

these

shall

be

subject

to

a

review

process,

in

cases

where

the

Entity determines,

without

the

intervention

of

the

official

or

employee

who,

in

their

case,

intervened

in

their

update,

with

the

purpose

of

verifying

their

consistency

and

completeness,

under

the

terms

and

conditions

established

in

the

Compliance

Manual,

or

in

any

other

document

or

manual

drafted

by

the

Entity.

21ª-2 .-

...

I. ...

a) ...

b) ...

c) ...

d) ...

...

II. ...

III. ...

The

Entities

shall

establish

within

their

methodology

specific

indicators

related

to

the

crime

provided

for

in

Article

400

Bis

of

the

Federal

Penal

Code,

as

well

as

specific

indicators

related

to

the

crime

provided

for

in

Article

139

Quáter

of

the

same

instrument,

for

each

of

the

Risk

elements

indicated

in

the

first

paragraph

of

fraction

I

of

the

present

provision.

24ª.-

...

Regarding

those

Operations

carried

out

in

a

non-presential

manner,

in

addition

to

the

elements

to determine

the

transactional

profile

of

the

Client

indicated

in

the

previous

paragraph,

the

Entity

shall

take

into

account

the

Geolocation

of

the

Device

from

which

such

Operation

is

carried

out.

The

Geolocation

referred

to

in

the

previous

paragraph

may

cover

the

diverse

Operations

that

the

Client

carries

out

in

the

active

session

within

the

Internet

page

or

mobile

application,

among

other

technological

developments,

that

the

Entities

themselves

make

available

to

their

Clients

to

carry

them

out.

The

Entities

shall

not

be

obligated

to

take

into

account

the

data

related

to

the

Geolocation

in

terms

of

the

present

Provision,

regarding

the

societies,

dependencies,

and

entities

referenced

in

Annex

1

of

these

Provisions,

provided

that

the

referenced

societies,

dependencies,

and

entities

had

been

classified

as

Clients

with

a

Low

Risk

Level

in

terms

of

the

25th

of

these

Provisions.

25ª.-

The

application

of

the

customer

knowledge

policy

shall

be

based

on

the

Risk

Level

that

a

Client

represents,

such

that,

when

the

Risk

Level

is

higher,

the

Entity

shall

collect

more

information

from

the

Client

regarding

their

predominant

economic

activity;

as

well

as

carry

out

stricter

supervision

of

their

transactional

behavior

through

the

alert

system

referred

to

in

25th

Quáter

of

these

Provisions.

For

the

purposes

of

the

above,

the

Entities

shall

establish

in

their

Compliance

Manual

the

procedure

or

mechanism

to

obtain

the

additional

information

that

they

shall

collect

from

their

Clients

who

represent

a

higher

Risk

Level,

specifying

what

additional

information

they

shall

collect

regarding

said

Clients

in

relation

to

those

who

represent

a

lower

Risk

Level,

as

well

as

the

way

in

which

they

will

carry

out

stricter

supervision

of

the

transactional

behavior

of

their

Clients,

in

a

differentiated

manner,

attending

to

the

Risk

Level

in

which

they

are

classified.

25ª

Bis.

...

...

...

In

the

case

of

opening

accounts

or

concluding

contracts

in

a

non-presential

manner

referred

to

in

the

4th

Ter

of

these

Provisions,

as

well

as

in

the

execution

of

Operations

through

Devices,

the

Entities

shall

consider

the

information

of

the

Geolocation

of

the

Device

from

which

the

Client

opens

or

carries

out

the

same

with

the

respective

Entity.

The

Entities

shall

not

be

obligated

to

consider

information

of

the

Geolocation

in

terms

of

the

present

Provision,

regarding

the

societies,

dependencies,

and

entities

referenced

in

Annex

1

of

these

Provisions,

provided

that

the

referenced

societies,

dependencies,

and

entities

had

been

classified

as

Clients

with

a

Low

Risk

Level

in

terms

of

the

present

Provision.

...

In

all

cases,

when

determining

the

Risk

Level

of

the

Clients

who

carry

out

transfers,

the

Entities

shall

consider

whether

such

Operations

involve

countries

or

jurisdictions

referred

to

in

fraction

X

of

the

38th

of

these

Provisions.

...

...

25ª

Quáter.-

...

The

Entities

shall

establish

in

the

alert

system

referred

to

in

the

previous

paragraph,

differentiated

transactional

monitoring

criteria

for

natural

person

Clients,

legal

persons,

or

Trusts.

...

...

27ª.-

Prior

to

the

opening

of

accounts

or

concluding

contracts

of

Clients

who,

due

to

their

characteristics,

are

classified

with

a

High

Risk

Level

by

the

Entity,

at

least

one

director

or

their

equivalent

who

has

specific

authority

to

approve

the

opening

or

conclusion

of

said

accounts

or

contracts,

as

corresponds,

shall

grant,

in

writing,

in

digital

or

electronic

form,

the

respective

approval.

Likewise,

for

the

purposes

referred

to

in

fractions

IV

and

V

of

the

47th

of

these

Provisions,

the

Entities

shall

provide

in

their

Compliance

Manual,

the

mechanisms

for

their

respective

Compliance

Officers

to

have

knowledge

of

those

Clients

who

are

classified

with

a

High

Risk

Level

by

the

Entities

themselves,

as

well

as

the

procedures

that

shall

be

carried

out

to

process

the

approval

indicated

in

this

Provision.

28ª.-

The

Entities

shall

classify

their

Clients

based

on

the

Risk

Level

of

these,

using

for

this

purpose

the

automated

systems

referred

to

in

the

51st

of

these

Provisions,

and

at

the

start

of

the

commercial

relationship.

...

...

...

...

...

30ª.-

The

Entities

shall

apply

enhanced

due

diligence

measures

in

the

provision

of

correspondent

banking

services

to

Foreign

Financial

Entities

domiciled

and

constituted

in

the

countries

or

jurisdictions

referenced

in

fraction

X,

subsections

a)

and

b)

of

the

38th

of

these

Provisions.

For

the

purposes

of

the

above,

the

Secretariat

shall

make

available

to

the

Entities,

through

consultation

means

on

the

portal

for

that

effect,

that

it

maintains

on

the

world

wide

web

denominated

Internet,

the

lists

of

countries

and

territories

previously

indicated,

in

accordance

with

the

information

provided

by

Mexican

authorities,

international

organizations,

and

intergovernmental

groupings

in

matters

of

prevention

and

combat

of

operations

with

resources

of

illicit

origin

and

of

financing

terrorism.

The

Entities

shall

abstain

from

carrying

out

correspondent

banking

Operations

with

Foreign

Financial

Entities

or

institutions

or

financial

intermediaries

that

do

not

have

a

physical

presence

in

any

jurisdiction

or

that

do

not

have

a

business

center

that:

I.

Is

financed

by

a

Foreign

Financial

Entity,

and

II.

Is

located

in

a

fixed

social

domicile

(that

is

not

an

electronic

address

or

a

post

office

box

only)

in

a

jurisdiction

in

which

the

Foreign

Financial

Entity

is

authorized

to

carry

out

banking

activities,

in

whose

location

the

Foreign

Financial

Entity:

a)

Employs

one

or

more

full-time

persons;

b)

Maintains

operational

records

related

to

its

financial

activities,

and

c)

Is

subject

to

inspections

by

the

financial

authority

that

issued

the

authorization,

license,

or

equivalent

to

the

Foreign

Financial

Entity

to

carry

out

financial

activities.

When

the

Entities

provide

correspondent

banking

services

they

shall

adopt

measures

to

have

knowledge

that

the

correspondent

accounts

are

not

used

to

indirectly

provide

services

to

the

Foreign

Financial

Entities,

institutions,

or

financial

intermediaries

referred

to

in

the

immediately

preceding

paragraph.

33ª.-

In

addition

to

the

obligations

established

in

the

18th

and

20th

of

these

Provisions,

the

Entity

that

has

as

a

Client

any

of

the

obligated

subjects

referred

to

in

Article

95

Bis

of

the

General

Law

of

Organizations

and

Auxiliary

Activities

of

Credit,

58

of

the

Law

to

Regulate

Financial

Technology

Institutions,

as

well

as

those

persons

who

develop

the

vulnerable

activity

referred

to

in

Article

17,

fraction

XVI

of

the

Federal

Law

for

the

Prevention

and

Identification

of

Operations

with

Resources

of

Illicit

Origin,

shall

identify

the

number,

amount,

and

frequency

of

the

Operations

that

said

Client

carries

out,

as

well

as

obtain

the

certificate

of

registration,

record,

or

authorization

before

the

Commission,

before

the

National

Commission

for

the

Protection

and

Defense

of

Users

of

Financial

Services,

or

before

the

Tax

Administration

Service,

as

corresponds.

33ª

Bis.-

...

...

I.

a

IV.

...

...

The

Entities

may

purchase

dollars

of

the

United

States

of

America

in

cash

from

the

Clients

holders

of

the

checking

accounts

in

national

currency

referred

to

in

the

14th

Bis

3

of

these

Provisions,

provided

that

they

have

the

identification

file

of

the

respective

Client

with

all

the

data

referred

to

in

said

provision

and

properly

updated.

Likewise,

prior

to

the

purchase

of

dollars

of

the

United

States

of

America

in

question,

the

Entity

in

question

shall

have

carried

out

the

verification

referred

to

in

the

7th

, fraction

I

of

these

Provisions,

independent

of

whether

the

data

that

make

up

the

Client

identification

file

were

collected

in

a

presential

or

remote

manner.

The

Entities

shall

credit

to

the

respective

accounts

the

total

amounts

in

national

currency

that

result

from

said

purchases,

subject

to

the

monthly

limits

referred

to

in

the

referenced

14th

Bis

3 .

34.-

...

...

To

facilitate

the

process

of

transmission

of

the

reports

referred

to

in

the

present

Provision

of

the

Entities

with

greater

volume

of

Operations

to

report,

the

Secretariat

and

the

Commission,

upon

request

of

the

Entities,

may

determine

different

deadlines

than

those

indicated

in

the

first

paragraph.

35ª.-

The

Entities

shall

submit

monthly

to

the

Secretariat,

through

the

Commission,

at

the

latest

within

fifteen

business

days

following

the

last

business

day

of

the

immediately

preceding

month,

a

report

for

each

international

transfer

of

funds

that,

individually,

has

been

received

or

sent

by

any

of

its

Clients

or

Users

during

said

month,

for

an

amount

equal

to

or

exceeding

one

thousand

dollars

of

the

United

States

of

America

or

its

equivalent

in

national

currency

or

in

the

foreign

currency

in

which

it

is

carried

out.

In

the

mentioned

report,

the

countries

or

jurisdictions

involved

in

the

transfers

shall

be

indicated,

including

without

limiting

to

those

referred

to

in

fraction

X

of

the

38th

of

these

Provisions .

...

...

For

the

purposes

of

calculating

the

amount

of

the

Operations

to

their

equivalent

in

national

currency,

the

exchange

rate

to

settle

obligations

denominated

in

foreign

currency

payable

in

the

Mexican

Republic,

published

by

the

Bank

of

Mexico

in

the

Official

Gazette

of

the

Federations,

on

the

business

day

immediately

preceding

the

date

on

which

the

Operation

is

carried

out,

shall

be

considered.

37ª.-

For

each

Unusual

Operation

detected

by

an

Entity,

it

shall

submit

to

the

Secretariat,

through

the

Commission,

the

corresponding

report,

within

three

business

days

following

that

on

which

the

session

of

the

Committee

that

dictates

it

as

such

concludes.

For

the

purposes

of carrying

out

the

said

dictum,

the

Entity

through

its

Committee,

shall

have

a

period

that

shall

not

exceed

sixty

calendar

days

counted

from

the

moment

the

alert

is

generated

through

its

system,

model,

process,

or

by

the

employee

of

the

Entity,

whichever

occurs

first.

...

...

38ª.-

...

I.

a

III.

...

IV.

The

Operations

carried

out

in

the

same

account,

as

well

as

those

carried

out

by

the

same

User

with

foreign

currency,

traveler's

checks,

cashier's

checks,

and

coined

currencies

in

platinum,

gold,

and

silver,

for

amounts

that

are

multiples

or

fractionated

that,

for

each

individual

Operation,

are

equal

to

or

exceed

the

equivalent

of

five

hundred

dollars

of

the

United

States

of

America,

carried

out

in

the

same

calendar

month

that

sum,

at

least,

the

amount

of

seven

thousand

five

hundred

dollars

of

the

United

States

of

America

or

its

equivalent

in

the

foreign

currency

in

question,

provided

that

the

same

do

not

correspond

to

the

transactional

profile

of

the

Client

or

that,

regarding

those

carried

out

by

Users,

it

can

be

inferred

from

their

structuring

a

possible

intent

to

fractionate

the

Operations

to

avoid

being

detected

by

the

Entities

for

the

purposes

of

these

Provisions;

V.

a

VIII.

...

IX.

When

there

are

indications

or

extraordinary

facts

regarding

which

the

Entity

in

question

does

not

have

an

explanation,

that

give

rise

to

any

type

of

suspicion

regarding

the

origin,

handling,

or

destination

of

the

resources

used

in

the

respective

Operations,

or

when

there

are

suspicions

that

such

indications

or

facts

might

be

related

to

acts,

omissions,

or

Operations

that

might

favor,

provide

help,

assistance,

or

cooperation

of

any

kind

that

could

be

located

in

the

scenarios

of

Article

400

Bis

of

the

Federal

Penal

Code;

X.

...

a) ...

b)

That

they

are

included

in

the

list

of

high

risk

jurisdictions

subject

to

a call

for

action

by

the

Financial

Action

Task

Force,

which

lists

the

countries

or

jurisdictions

that

present

significant

strategic

deficiencies

in

their

regimes

to

combat

money

laundering

and

the

financing

of

terrorism

and

the

proliferation

of

weapons

of

mass

destruction.

c)

That

they

are

included

in

the

list

of

jurisdictions

subject

to

intensified

monitoring

by

the

Financial

Action

Task

Force,

which

lists

the

countries

and

jurisdictions

that

have

committed

to

remedying

the

strategic

deficiencies

of

their

regimes

to

combat

money

laundering

and

the

financing

of

terrorism

and

the

proliferation

of

weapons

of

mass

destruction.

...

XI.

a

XV.

...

XVI.

When

the

Entities

have

received

a

request

for

information

regarding

a

Client

by

the

authorities

referred

to

in

fractions

I,

II,

and

III

of

Article

142

of

the

Law,

XVII.

When

the

Operation,

activity,

conduct,

or

behavior

of

a

Client

results

sufficient

to

have

indications

that

make

questionable

the

destination

of

the

resources

involved,

leading

the

Entity

to

consider

that

the

corresponding

resources

might

be

destined

to

favor,

provide

help,

assistance,

or

cooperation

of

any

kind

for

the

commission

of

the

crime

provided

for

in

Article

139

Quáter

of

the

Federal

Penal

Code.

...

...

...

41ª.-

In

the

case

that

an

Entity

has

information

based

on

grounded

suspicions

or

indications,

such

as

concrete

facts

from

which

it

is

derived

that,

in

attempting

to

carry

out

an

Operation,

the

resources

might

originate

from

illicit

activities

or

might

be

destined

to

favor,

provide

help,

assistance,

or

cooperation

of

any

kind

for

the

commission

of

the

crime

provided

for

in

Article

139

Quáter

of

the

Federal

Penal

Code,

or

that

might

be

located

in

the

scenarios

of

Article

400

Bis

of

the

same

legal

instrument,

it

may

not

carry

out

said

Operation

in

accordance

with

the

policies,

criteria,

measures,

and

procedures

established

for

such

effect

in

its

Compliance

Manual;

in

such

case,

the

Entity

in

question

shall

submit

to

the

Secretariat,

through

the

Commission,

within

24

hours

counted

from

the

moment

it

knows

said

information,

a

report

of

Unusual

Operation,

in

which,

in

the

column

of

description

of

the

Operation,

the

legend

" 24

hour

LD

Report

" or

" 24

hour

FT

Report

" ,

as

corresponds,

shall

be

inserted,

and

it

shall

provide,

if

applicable,

all

the

information

it

has

known

about

its

Clients

or

Users.

In

the

same

way,

in

those

cases

where

the

Entity

decides

to

accept

said

Operation,

it

shall

submit

to

the

Secretariat,

through

the

Commission,

the

report

of

Unusual

Operation

in

the

terms

indicated

in

the

present

Provision.

...

...

...

42ª.-

For

each

Internally

Concerning

Operation

detected

by

an

Entity,

it

shall

submit

to

the

Secretariat,

through

the

Commission,

the

corresponding

report,

within

three

business

days

following

that

on

which

the

session

of

the

Committee

that

dictates

it

as

such

concludes.

For

the

purposes

of carrying

out

the

said

dictum,

the

Entity

through

its

Committee,

shall

have

a

period

that

shall

not

exceed

sixty

calendar

days

counted

from

the

moment

said

Entity

detects

that

Operation,

through

its

system,

model,

process,

or

by

any

employee

of

the

same,

whichever

occurs

first.

...

...

I.

a

IV.

...

44ª.-

Each

Entity

shall

determine

the

way

in

which

it

will

operate

its

Committee,

which,

except

for

what

is

indicated

in

the

last

paragraph

of

this

Provision,

shall

be

integrated

by

at

least

three

members

who,

in

any

case,

shall

hold

the

headship

of

the

areas

that

the

board

of

directors

or

directive

of

said

Entity

designates

for

that

effect,

as

corresponds

and,

in

any

case,

members

of

that

board,

the

general

director,

or

officials

or

employees

who

hold

positions

within

the

three

immediately

lower

hierarchies

from

the

general

director

of

the

Entity

in

question

shall

participate.

...

...

...

...

47ª.-

...

...

...

I.

a

X.

...

XI.

Ensure

that

the

area

under

its

charge

receives

directly

and

gives

follow-up

to

the

reports

referred

to

in

the

51st

, fraction

VIII

of

these

Provisions

issued

by

the

employees

and

officials

of

the

Entity,

regarding

facts

and

acts

that

may

be

susceptible

to

be

considered

as

Unusual

Operations

or

Internally

Concerning

Operations.

...

Additionally,

the

official

designated

as

Compliance

Officer

shall

have

the

valid

certification

provided

for

in

Article

4,

fraction

X

of

the

Law

of

the

National

Bank

and

Securities

Commission.

...

...

47ª

Bis.

The

Committee

of

each

Entity

or

well,

its

board

of

directors

or

directive,

as

corresponds,

or

general

director,

may

appoint

an

Interim

Compliance

Officer

in

the

fulfillment

of

its

obligations

in

accordance

with

these

Provisions,

for

up

to

ninety

calendar

days

during

a

calendar

year,

counted

from

the

moment

the

official

designated

as

Compliance

Officer

leaves,

is

revoked,

or

is

unable

to

carry

out

the

assignment

in

question.

...

...

The

Interim

Compliance

Officer

shall

perform

the

functions

and

obligations

indicated

in

these

Provisions,

until

the

moment

the

revocation

indicated

in

fraction

II

of

the

48th

of

these

Provisions

is

reported.

48ª.-

...

I.

The

full

name

without

abbreviations

of

the

official

who

has

designated

as

Compliance

Officer

in

terms

of

what

is

established

in

the

47th

of

these

Provisions,

as

well

as

the

rest

of

the

information

provided

for

in

the

format

indicated,

within

ten

business

days

following

the

date

on

which

the

corresponding

designation

has

been

effectuated;

II.

The

revocation

of

the

designation

of

the

Compliance

Officer

or

Interim

Compliance

Officer

that

has

been

designated

in

terms

of

what

is

established

both

in

the

47th

, as

well

as

in

the

47th

Bis

of

these

Provisions,

as

the

case

may

be,

within

ten

business

days

following

the

date

on

which

the

same

has

occurred,

whether

by

determination

of

the

Entity,

rejection

of

the

assignment,

by

labor

termination

or

inability,

as

well

as

the

rest

of

the

information

provided

for

in

the

format

indicated,

and

III.

The

full

name

without

abbreviations

of

the

official

who

has

designated

as

Interim

Compliance

Officer

in

terms

of

what

is

established

in

the

47th

Bis

of

these

Provisions,

as

well

as

the

rest

of

the

information

provided

for

in

the

format

indicated,

within

ten

days

business days

following

the

date

on

which

it

occurred.

49ª.-

...

I.

The

provision

of courses,

at

least

once

a

year,

which

must

be

directed

especially

to

the

members

of

their

respective

boards

of

directors,

executives,

officials,

and

employees,

including

those

working

in

customer

service

or

resource

administration

areas,

and

which

include,

among

other

aspects,

those

related

to:

a)

The

content

of

the

Compliance

Manual,

which

the

Entity

has

developed

for

the

proper

compliance

with

these

Provisions.

b)

The

activities,

products,

and

services

offered

by

the

Entity.

c)

The

Risks

to

which

the

Entity

is

exposed.

Without

prejudice

to

the

above,

the

topics

of

the

training

must

be

consistent

with

the

results

of

the

implementation

of

the

methodology

referenced

in

Chapter

II

Bis

and

adapted,

differentially,

to

the

responsibilities

of

the

members

of

their

respective

boards

of

directors,

executives,

officials,

and

employees.

II.

...

51ª.-

...

I.

...

II.

...

III.

Classify

the

types

of

Financial

Operations

or

products

offered

by

Entities

to

their

Clients

or

Users,

as

well

as

monitor

and

follow

up

on

Operations

that

have

a

transactional

component,

based

on

the

criteria

established

by

the

Entity

itself,

in

order

to

detect

possible

Unusual

Operations;

IV.

Detect

and

monitor

Operations

carried

out

in

the

same

account

or

by

the

same

Client

or

User

indicated

in

Articles

16ª,

17ª,

18ª,

19ª,

20ª,

and

33ª

Bis

of

these

Provisions,

as

well

as

those

provided

for

in

fraction

II

of

Article

6ª

and

fraction

IV

of

Article

38ª

of

these

Provisions;

V.

to

VIII.

...

IX.

Maintain

information

processing

mechanisms

and

information

security

schemes

for

processed

information,

which

guarantee

its

integrity,

availability,

auditability,

and

confidentiality;

IX.

Bis.

...

X.

Execute

an

alert

system

regarding

those

Operations

intended

to

be

carried

out

with

those

included

in

the

List

of

Blocked

Persons

or

Politically

Exposed

Persons,

as

well

as

those

involving

countries

or

jurisdictions

referenced

in

fraction

X,

subsections

a)

and

b)

of

Article

38ª

of

these

Provisions;

XI.

Facilitate

the

verification

of

data

and

documents

provided

non-presentially

by

the

Client;

XII.

Allow

knowledge

of

the

traceability

and

origin

of

Virtual

Assets

with

which

Entities

carry

out

Operations,

and

that,

if

applicable,

the

Bank

of

Mexico

determines,

in

accordance

with

Article

88

of

the

Law

for

the

Regulation

of

Financial

Technology

Institutions,

and

XIII.

Execute

the

Risk

Assessment

Model

referenced

in

Article

25ª

Bis,

25ª

Ter,

and

Annex

3

of

these

Provisions,

for

the

purpose

of

classifying

Clients

based

on

their

Level

of

Risk,

for

which

the

system

must

maintain

historical

records

for

a

period

of

no

less

than

ten

years

of

changes

in

the

Level

of

Risk

and

the

transactional

profile

that

the

Client

has

during

the

commercial

relationship.

Entities

must

evaluate

at

least

every

two

years,

independently

of

the

area

that

developed

it,

the

effectiveness

of

the

alert

system,

as

well

as

the

parameters

and

criteria

for

transactional

monitoring

and

list

screening

referenced

in

this

provision,

under

the

terms

and

conditions

established

in

their

Compliance

Manual

or

other

document

or

internal

manual

they

develop

for

this

purpose.

The

Committee

of

the

Entities

must

be

informed

of

the

results

of

such

evaluations.

60ª.-

Entities

must

maintain

control

measures

that

include

review

by

the

internal

audit

area,

or

by

an

independent

external

auditor,

to

evaluate

and

certify

from

January

to

December,

or

with

respect

to

the

period

resulting

from

the

date

on

which

the

Entity

notified

the

start

of

its

operations

to

the

Commission

to

December

of

the

respective

year,

the

effectiveness

of

compliance

with

these

Provisions,

in

accordance

with

the

guidelines

issued

by

the

Commission

for

such

effects.

The

results

of

such

reviews

must

be

presented

to

the

general

direction

and

the

Entity's

Committee,

as

a

report,

in

order

to

evaluate

the

operational

effectiveness

of

the

implemented

measures

and

follow

up

on

corrective

action

programs

that

may

apply.

In

the

exercise

of

the

valuation

mentioned

above,

no

member

of

the

Entity's

Committee

may

participate.

...

...

Additionally,

the

auditor

who

drafts

and

signs

the

audit

report

referenced

in

the

first

paragraph

of

this

provision

must

hold

the

valid

certification

provided

for

in

Article

4,

fraction

X

of

the

Law

of

the

National

Bank

and

Securities

Commission.

60ª

Bis.

Entities

must

submit

to

the

Commission,

within

the

last

ten

business

days

of

the

month

of

April

of

each

year,

through

electronic

means

and

in

the

official

format

issued

for

this

purpose,

quantitative

information

on

their

Operations,

channels,

type

of

Clients,

type

of

products

and

services,

as

well

as

the

geographic

zones

where

they

operate.

This

information

must

correspond

to

the

period

from

January

to

December

of

the

year

prior

to

that

in

which

it

must

be

sent,

or

to

the

period

resulting

from

the

date

on

which

the

Commission

authorizes

the

start

of

operations

of

the

Entity

in

question

to

December

of

the

respective

year.

64ª.-

Each

Entity

must

draft

and

submit

to

the

Commission,

through

the

electronic

means

indicated

by

it,

a

document

in

which

said

Entity

develops

its

respective

policies

for

Client

and

User

identification

and

knowledge,

as

well

as

the

criteria,

measures,

and

internal

procedures

it

must

adopt

to

comply

with

the

provisions

of

these

Provisions,

and

to

manage

the

Risks

to

which

it

is

exposed

in

accordance

with

the

results

of

the

implementation

of

the

methodology

referenced

in

Chapter

II

Bis

of

these

Provisions,

including

those

related

to

the

crime

provided

for

in

Article

139

Quater

of

the

Federal

Penal

Code.

...

...

Entities

that

are

part

of

financial

groups

under

the

terms

of

the

Law

for

the

Regulation

of

Financial

Groupings

must

define

policies,

criteria,

measures,

and

procedures

that

are

consistent

with

each

other,

in

accordance

with

what

the

Entities

determine

to

be

applicable.

...

...

...

...

...

...

...

ANNEX

1

...

to

...

Repealed.

to

...

Foreign

Financial

Entities,

except

for

those

for

which

Entities

provide

correspondent

services.

to

...

ANNEX

3

ELABORATION,

USE,

VALIDATION,

AND

DOCUMENTATION

OF

THE

CLIENT

RISK

MODEL

...

...

...

...

I.

...

i.

...

...

...

a)

...

...

Nationality

Date

of

birth

or

constitution

...

...

...

b)

...

...

...

...

Repealed.

...

Countries

of

origin

and

destination

of

funds.

...

Sending

or

receiving

international

fund

transfers

...

...

In

cases

where

the

Entity

determines

so,

the

information

collected

through

the

information

exchange

processes

referenced

in

Chapter

XIII

of

these

Provisions.

ii.

to

iii.

...

II.

to

IV.

...

TRANSITORY

PROVISIONS

First.

This

Resolution

shall

take

effect

on

the

day

following

its

publication

in

the

Official

Gazette

of

the

Federation,

except

as

provided

in

the

following

Transitory

Provisions.

Second.

The

guidelines,

interpretations,

and

criteria

issued

by

the

Secretariat

or

by

the

Commission,

based

on

the

provisions

of

the

Resolution

of

April

20,

2009,

and

subsequent

Resolutions

through

which

the

General

Provisions

referenced

in

Article

115

of

the

Credit

Institutions

Law

have

been

added

or

reformed,

will

continue

to

be

applicable

insofar

as

they

do

not

contradict

what

is

established

in

this

Resolution.

Third.

Entities

must

comply

with

the

obligations

contained

in

this

Resolution,

under

the

terms

and

within

the

deadlines

set

forth

below:

I.

Eighteen

months

counted

from

the

effective

date

of

this

Resolution

to

modify

the

Compliance

Manual

and

submit

it

to

the

Commission,

specifying

at

the

time

of

sending

through

the

Interinstitutional

System

for

Information

Transfer

(SITI

PLD/FT),

in

the

"Description

of

changes"

field,

that

said

document

is

submitted

to

comply

with

this

Transitory

Provision.

II.

Twelve

months

counted

from

the

effective

date

of

this

Resolution

to

modify

the

methodology

referenced

in

Chapter

II

Bis

of

the

Provisions.

III.

Eighteen

months

counted

from

the

effective

date

of

this

Resolution

to

update

the

automated

systems

referenced

in

Article

51ª

of

the

Provisions.

IV.

Twelve

months

counted

from

the

effective

date

of

this

Resolution

to

comply

with

the

obligation

established

in

the

last

paragraph

of

Article

47ª

of

the

Provisions,

regarding

the

Compliance

Officer

must

hold

the

valid

certification

provided

for

in

Article

4,

fraction

X

of

the

Law

of

the

National

Bank

and

Securities

Commission.

Fourth.

Entities

must

begin

to

submit

to

the

Commission

the

information

referenced

in

Article

60ª

Bis,

starting

from

the

date

indicated

in

the

Resolution

issued

by

the

Commission

for

this

purpose.

Fifth.

Entities

may

equate,

at

the

term

of

Beneficial

Owner

contained

in

these

Provisions,

the

references

to

beneficial

owner

that

are

provided

for

in

other

legal

frameworks

in

matters

of

prevention

of

operations

with

funds

of

illicit

origin

and

terrorism

financing,

as

well

as

in

the

query

databases

managed

by

competent

authorities.

Mexico

City,

August

15,

• The

Secretary

of

Finance

and

Public

Credit,

Rogelio

Eduardo

Ramírez

de

la

O.

• Signature.

In

the

document

you

are

viewing,

there

may

be

text,

characters,

or

objects

that

do

not

display

correctly

due

to

conversion

to

HTML

format,

so

we

recommend

always

taking

the

digital

image

of

the

DOF

or

the

PDF

file

of

the

edition

as

a

reference.

The

content,

form,

and

scope

of

published

documents

are

the

sole

responsibility

of

their

issuer.

QUERY

BY

DATE

Mo

Tu

We

Th

Fr

Sa

INDICATORS

Exchange

Rate

and

Rates

as

of

08/24/2026

DOLLAR

16.9018

UDIS

8.806514

TIIE

28

DAYS

6.7961%

TIIE

91

DAYS

6.8338%

TIIE

182

DAYS

6.8887%

TIIE

OF

FUNDING

6.54%

View

more

SURVEYS

Did

you

like

the

new

look

of

the

Official

Gazette

of

the

Federation

website?

No

Yes

Official

Gazette

of

the

Federation

Río

Amazonas

No.

62,

Col.

Cuauhtémoc,

C.P.

06500,

Mexico

City

Tel.

(55)

5093-3200,

where

you

can

access

our

service

menu

Electronic

Address:

dof.gob.mx

113

LEGAL

NOTICE

| SOME

RIGHTS

RESERVED

©

2026