Resolution reforming, adding, and repealing various General Provisions under Articles 71 and 72 of the Law for Regulating the Activities of Savings and Loan Cooperative Societies

DOF: 21/03/2019

RESOLUTION reforming, adding, and repealing various of the General Provisions referred to in Articles 71 and 72 of the Law for Regulating the Activities of Savings and Loan Cooperative Societies

A seal with the National Coat of Arms appears at the margin, which reads: United Mexican States.- SHCP.- Ministry of Finance and Public Credit.

RESOLUTION REFORMING, ADDING, AND REPEALING VARIOUS OF THE GENERAL PROVISIONS REFERRED TO IN ARTICLES 71 AND 72 OF THE LAW FOR REGULATING THE ACTIVITIES OF SAVINGS AND LOAN COOPERATIVE SOCIETIES.

CARLOS MANUEL URZÚA MACÍAS, Secretary of Finance and Public Credit, based on the provisions of Articles 31, fractions VIII and XXXIV, of the Organic Law of the Federal Public Administration, as well as Articles 71 and 72 of the Law for Regulating the Activities of Savings and Loan Cooperative Societies, in the exercise of the powers conferred upon me by Article 6, fraction XXXIV of the Internal Regulations of the Ministry of Finance and Public Credit, and having received the prior opinion of the National Banking and Securities Commission issued via letter number DGPORPIA/73865/2019 and 213-2/78633/5/ 2019 dated February 25, 2019; and

CONSIDERING

That during the 2016-2017 period, Mexico was evaluated within the framework of the Fourth Round of Mutual Evaluation of the Financial Action Task Force (FATF), with the aim of examining its level of compliance with international standards in matters of money laundering prevention and terrorist financing;

That, as a result thereof, on January 3, 2018, the FATF published the "Mutual Evaluation Report" through which said intergovernmental entity made various recommendations to Mexico with the aim of strengthening its regime for the prevention of money laundering and terrorist financing;

That therefore, the Ministry of Finance and Public Credit has considered making various modifications to the general provisions that establish the minimum criteria and procedures in matters of money laundering prevention and terrorist financing for the sector of savings and loan cooperative societies, this with the object of addressing the FATF recommendations and strengthening the regime in this matter;

That, in addition to the reform carried out on March 23, 2017, to the general provisions in matters of money laundering prevention and terrorist financing applicable to savings and loan cooperative societies, to help improve compliance with FATF Recommendations 1 and 10, it is specified in the legal framework the prohibition for savings and loan cooperative societies to carry out simplified identification measures for their clients or users when they suspect that the resources, assets, or values that said clients or users intend to use to carry out an operation could be related to money laundering or terrorist financing;

That likewise, in accordance with FATF Recommendation 10, it is necessary to strengthen the legal framework regarding the policy of identification and customer due diligence for savings and loan cooperative societies, establishing the circumstances under which they may suspend the identification process, in order to prevent the commission of crimes of money laundering and terrorist financing, among others; and, if applicable, to report the respective unusual operation report to the competent authority;

That to better address FATF Recommendation 12, it is convenient to establish that savings and loan cooperative societies determine whether the beneficial owners of their clients or users have the status of politically exposed persons, whether national or foreign, in accordance with applicable provisions, to be able to apply the appropriate customer due diligence measures;

That in accordance with FATF Recommendation 16, related to electronic fund transfers, in consideration of the modifications foreseen for the formats of standardized messages most used by financial entities in the international market for such operations, it is necessary to strengthen the client or user identification policy of savings and loan cooperative societies, with the aim of knowing with greater precision the information of the ordering party and recipient of the transfer in question, to detect, and if applicable, prevent, the commission of crimes involving proceeds of illicit origin and terrorist financing, for which it is necessary that said societies identify, regardless of the amount of the operation, the clients or users who request to send the respective transfers, as well as the beneficiaries thereof, particularly when issuing the respective transfer orders or, as in other cases, the ordering parties of the respective international transfer orders they receive, and, as in other cases, maintain such information in the timeframes in which they are obliged and at the disposal of the competent authority, in addition to obliging said entities to establish criteria in their respective manuals that allow them to strengthen, with a risk-based approach, their regime for the prevention of money laundering and terrorist financing on this matter;

That, on the other hand, given that savings and loan cooperative societies can provide financial services through new technologies, which have been recognized by the Mexican Government with the issuance of the Law for Regulating Financial Technology Institutions and its secondary provisions, in accordance with FATF Recommendation 15 and what is stated in the Report of January 3, 2018, it is necessary that these evaluate the risk of providing financial services through said technologies, for which it is convenient to establish such obligation, prior to their implementation and development, as well as for their monitoring;

That, even though currently savings and loan cooperative societies comply with the obligation of customer due diligence in a presencial and traditional manner, with some exceptions recognized in the regulation, given the existence of the digital era, new technologies, and electronic media, in the integration, conservation, maintenance, verification, etc., of data, information, and documents, it is necessary, as with other regulated participants in the matter, to recognize the legal possibility that savings and loan cooperative societies can comply with their obligations in matters of money laundering prevention and terrorist financing through said electronic media, of course with the responsibility that they comply with the applicable regulations to the effect that they have the value that corresponds in law;

That, with the aim of prioritizing efforts and resources with the new obligations established in this resolution, it is estimated convenient to eliminate the obligation for savings and loan cooperative societies to send the training report, without this implying that they should not have such training, and

That once the opinion of the National Banking and Securities Commission has been heard, I have deemed it appropriate to issue the following:

RESOLUTION REFORMING, ADDING, AND REPEALING VARIOUS OF THE GENERAL PROVISIONS REFERRED TO IN ARTICLES 71 AND 72 OF THE LAW FOR REGULATING THE ACTIVITIES OF SAVINGS AND LOAN COOPERATIVE SOCIETIES

SINGLE ARTICLE.- The 2nd, fractions I to XXVII; 3rd, second paragraph; 4th, first paragraph, fractions I to IX, third, fifth, seventh, and last paragraphs; 7th, first, third, and fourth paragraphs; 9th; 10th, second paragraph; 11th; 13th, first, second, and third paragraphs; 14th, first, second, and third paragraphs; 16th; 20th, fifth paragraph, fraction II, subsection b); 22nd, first, second, and last paragraphs; 22nd-1; 22nd-2; 22nd-3; 22nd-4; 22nd-5, becoming 22nd-6; 23rd, second paragraph; 25th; 26th, seventh and last paragraphs; 27th; 28th; 29th, third, fourth, and last paragraphs; 30th, second paragraph, fraction II, subsection b); 32nd, first and last paragraphs; 33rd, first paragraph; 42nd, second and last paragraphs; 45th, first and third paragraphs; 47th, fractions I, first paragraph, I Bis, III, IX, and X, and last paragraph; 48th, last paragraph; 51st, third paragraph, fractions I, I Bis, IV, VII, and last paragraph; 53rd, fraction I; 55th, first paragraph, fractions II, V, IX Bis, and X; 62nd, first paragraph, 63rd first, second, and third paragraphs; 68th; 69th, first paragraph; 73rd, second paragraph; 75th, second paragraph; Annex 1; are REFORMED; fractions XXVIII to XXXVIII of the 2nd are ADDED, renumbering the others in order; the second paragraph of the 4th; 4th Bis; the second paragraph of the 7th, renumbering the others in order; 9th Bis; 9th Ter; 16th Bis; fractions IV and V and second and third paragraphs of the 17th, renumbering in order; 17th Bis; the third paragraph of the 22nd, renumbering the others in order; the second paragraph of 22nd-1, renumbering the others in order; the first and second paragraphs of 22nd-4; 22nd-5, renumbering the following in order; the second paragraph of the 25th; the fourth and eighth paragraphs of the 26th, renumbering the others in order; the third and last paragraphs of the 30th; fraction XI of the 47th; fractions II, second paragraph, V Bis, and XI of the 55th; the last paragraph of 72nd-1; a Chapter XV Bis titled "Novel Models"; 72nd-2; Annex 2; are ADDED; and the 2nd, fractions XI Bis and XIV Bis, 21st-3, last paragraph; 53rd, last paragraph; all of them of the General Provisions referred to in Articles 71 and 72 of the Law for Regulating the Activities of Savings and Loan Cooperative Societies, are REPEALED, to remain as follows:

2nd .-. . .

I. Archive or Registry, the set of data and documents that are kept or stored in printed format or in electronic, optical, or any other technology media, provided that, in these latter media, it is ensured that the information has remained intact and unaltered from the moment it was generated for the first time in its definitive form and is accessible for subsequent consultation, having as its purpose to integrate, conserve, and evidence the Operations of the Societies;

II. Beneficiary, . . .

III. Client,. . .

Natural persons who certify to the Societies that they are subject to the tax regime applicable to natural persons with business activity under the terms of sections I and II of Chapter II of Title IV of the Income Tax Law, shall be considered as legal entities for the purposes of what is established in these Provisions, except with respect to the integration of the file of these, which must be carried out in terms of what is established in fraction I of the 4th and, when applicable, of the 4th Bis, 13th, 14th, and 15th of these Provisions, and in which the Societies must additionally require the Federal Taxpayer Registry key (with homoclave) and, if applicable, tax identification number and/or equivalent of said natural persons, as well as the country or countries that assigned them;

IV. Commission, . . .

V. Committee, . . .

VI. Auxiliary Supervision Committee, . . .

VII.

Control, . . .

VIII. Concentrating Account, . . .

IX. Recipient, . . .

X. Device, the equipment that allows access to the worldwide network called the Internet, which can be used to open accounts or conclude contracts, as well as to carry out Operations;

XI. Foreign Financial Entity,. . .

XI Bis. Repealed.

XII.

Trust,. . .

XIII. Electronic Signature, to the traits or data in electronic form recorded in a Data Message, or attached or logically associated with it by any technology, which are used to identify the subscriber or originator of the instruction of some Operation or financial service and indicate that the signer approves the information contained in the Data Message, and which produces the same legal effects as the handwritten signature;

XIV. Advanced Electronic Signature, . . .

XIV Bis. Repealed.

XV.

Geolocation, to the geographic coordinates of latitude and longitude where the Device is located;

XVI. Risk Level,. . .

XVII. Technological Infrastructure, to the computer equipment, data processing and communications installations, equipment and communications networks, operating systems, databases, applications, and systems that Societies use to support their operations;

XVIII.

Monetary Instrument,. . .

XIX. Law,. . .

XX.

Blocked Persons List,. . .

XXI. Compliance Manual, the document referred to in the 67th of these Provisions;

XXII. Data Message, to the information generated, sent, received, or archived by electronic, optical, or any other technology means, in accordance with the Commerce Code;

XXIII.

Mitigants,. . .

XXIV. Novel Model, to that which for the provision of financial services uses tools or technological means with modalities different from those existing in the market at the time the temporary authorization referred to in the Law for Regulating Financial Technology Institutions is granted;

XXV.

Compliance Officer, . . .

XXVI. Operations, . . .

XXVII. Internal Concerning Operation,. . .

XXVIII. Unusual Operation, . . .

XXIX. Relevant Operation,. . .

XXX. Politically Exposed Person, . . .

XXXI. Beneficial Owner, . . .

XXXII. Resource Provider, . . .

XXXIII. Risk,. . .

XXXIV. Ministry,. . .

XXXV. Societies, . . .

XXXVI. Obligated Subjects, to the Societies, as well as to persons, institutions, entities, or societies subject to the obligations referred to in Article 115 of the Credit Institutions Law, Article 108 Bis of the Retirement Savings Systems Law, Article 91 of the Investment Funds Law, Articles 212 and 226 Bis of the Securities Market Law, Article 492 of the Insurance and Surety Institutions Law, Article 129 of the Credit Unions Law, Article 124 of the Popular Savings and Credit Law, Article 60 of the Organic Law of the National Financial Development Bank for Agriculture, Rural, Forestry, and Fisheries, Articles 95 and 95 Bis of the General Law of Organizations and Auxiliary Credit Activities, excluding exchange centers, and Article 58 of the Law for Regulating Financial Technology Institutions;

XXXVII. Terms and Conditions, to the legal bases and statements that Societies establish with their Clients through computer applications, interfaces, Internet pages, or any other electronic or digital communication medium in a format established by the Society itself for the celebration of Operations, activities, or services with these, and

XXXVIII. User, . . .

3rd .-. . .

In the elaboration of the Client identification policy, the Societies must include and observe the guidelines for the identification of Users referred to in the 18th, 19th, 20th, and 21st of these Provisions. The policy and guidelines mentioned above must form an integral part of the Society's Compliance Manual.

4th.- Societies must integrate and conserve an identification file for each of their Clients, previously, when these, in a presencial manner, make contributions to their social capital, open an account, or conclude a contract to carry out Operations of any type.

To integrate the identification files of Clients, they must comply, at least, with the following:

I.

In the case of Clients who are natural persons who declare to the Society to be of Mexican nationality or foreign nationality under conditions of temporary or permanent resident stay in terms of the Migration Law, or in the capacity of diplomatic and consular representations in terms of the Guidelines for the issuance of non-ordinary visas:

a)

The following identification data:

i.

Paternal surname, maternal surname, and name or names without abbreviations.

ii.

Gender.

iii.

Date of birth.

iv.

State of birth, when applicable.

v.

Country of birth.

vi.

Nationality.

vii.

Occupation, profession, activity, or business sector to which the Client is dedicated.

viii.

Private address at their place of residence (composed of the name of the street, avenue, or road in question, duly specified; exterior number and, if applicable, interior number; neighborhood or urbanization; borough, municipality, or similar political demarcation that corresponds, if applicable; city or town, state, province, department, or similar political demarcation that corresponds, if applicable; postal code and country).

ix.

Phone number(s) where they can be located.

x.

Email address, if applicable.

xi.

Unique Population Registry Key, Federal Taxpayer Registry key (with homoclave), tax identification number and/or equivalent, as well as the country or countries that assigned them, when available.

xii.

Serial number of the Advanced Electronic Signature, when they have one.

In addition to the above, regarding persons who have their place of residence abroad and, at the same time, have an address in national territory where they can receive correspondence addressed to them, the Society must record in the file the data relating to said address, with the same elements contemplated in this fraction.

b)

Simple copy of the following documents:

i.

Personal identification, which must be, in all cases, an original official document issued by a competent authority, valid on the date of its presentation, containing the photograph, signature, and, if applicable, address of the Client themselves.

For the purposes of what is provided in this subsection, the following documents issued by Mexican authorities will be considered as valid personal identification documents: the voter credential, the passport, the professional card, the national military service card, the consular registration certificate, the unique military identity card, the affiliation card to the National Institute of Older Adults, the credentials and cards issued by the Mexican Institute of Social Security, by the Institute for Social Security and Social Services for State Workers, by the Social Security Institute for the Mexican Armed Forces, or by Popular Insurance, the driver's license, the credentials issued by federal, state, and municipal authorities, the identity statements issued by municipal authorities, and the other national identifications that, if applicable, are approved by the Commission. Likewise, with respect to the natural persons of foreign nationality referred to in this fraction, in addition to those previously mentioned in this paragraph, the passport or passport card, or the documentation issued by the National Institute of Migration that accredits their migratory status, as well as the accreditation card issued by the Ministry of Foreign Affairs to diplomatic or consular bodies, will be considered as valid personal identification documents.

ii.

Certificate of the Unique Population Registry Key issued by the Ministry of the Interior; document in which the assignment of the tax identification number and/or equivalent is recorded, issued by a competent authority, as well as of the Advanced Electronic Signature, when they have them. It will not be necessary to present the certificate of the Unique Population Registry Key if it appears in another document or official identification.

Societies will not be obliged to collect, include, and conserve in the Client's corresponding identification file, a simple copy of the documents referred to in the previous paragraph, provided that the Societies integrate into the same the evidence in which it is recorded that the documents and/or the Client's data were presented and/or validated before the corresponding authority.

iii.

Proof of address, which may be any receipt for payment for home services such as, among others, electricity supply, telephone, natural gas, property tax, or water supply rights or bank statements, all of them with an age not greater than three months from their date of issuance, a valid lease contract on the date of presentation by the Client, a residence certificate issued by a municipal authority, the proof of registration before the Federal Taxpayer Registry, as well as the others that, if applicable, are approved by the Commission.

Notwithstanding the above, when the address manifested in the contract concluded by the Client with the Society coincides with that of the Client's voter credential issued by a Mexican authority, in case they have been identified with the same, this will function as the proof of address referred to in the previous paragraph.

iv.

Declaration of the natural person, which may be granted in writing, by electronic, optical, or any other technology means, which may be included in the account opening application documentation or the celebration of the Operation or in the respective contract, in which it is recorded that said person acts for these purposes in their own name and on their own behalf or on behalf of a third party, as the case may be.

In the event that the natural person declares to the Society that they act on behalf of a third party, said Society must observe what is established in fraction VI of this Provision with respect to the Beneficial Owner of the resources involved in the corresponding account or contract.

v.

In the event that the natural person acts as an agent of another person, the respective Society must collect and integrate into the identification file of the Client in question, a simple copy of the power of attorney or of the certified copy of the document issued by a public notary, as applicable, under the terms established in common legislation, which accredits the powers conferred upon the agent, as well as an official identification and proof of address of this, which meet the requirements indicated in this fraction I with respect to said documents, independent of the data and documents relating to the principal.

II.

Regarding Clients who are legal entities of Mexican nationality:

a)

The following identification data:

i.

Name or corporate name.

ii.

Commercial activity, activity, or corporate object.

iii.

Nationality.

iv.

Federal Taxpayer Registry key (with homoclave) and, if applicable, tax identification number and/or equivalent, as well as the country or countries that assigned them.

v.

Serial number of the Advanced Electronic Signature.

vi.

Address (composed of the name of the street, avenue, or road in question, duly specified, exterior number and, if applicable, interior number, neighborhood, borough or municipality or similar political demarcation that corresponds, if applicable, city or town, state, and postal code)

postal).

vii.

Phone number(s) of said address.

viii.

Email address, if applicable.

ix.

Date of incorporation.

x.

Full first and last names, without abbreviations, of the administrator or administrators, director, general manager, or legal representative who, with their signature, can bind the legal entity for the purposes of opening an account, concluding a contract, or carrying out the Operation in question, derived from a valid, current official personal identification document issued by a competent authority, in accordance with what is provided in subsection b), item i., fraction I of this Provision.

b)

Simple copy of the following documents:

i.

Notarized copy or certified copy of the public instrument that certifies its legal existence, registered in the corresponding public registry, according to the nature of the legal entity, or of any instrument in which the data of its incorporation and its registration in said registry appear, or of the document that, according to the regime applicable to the legal entity in question, credibly certifies its existence.

In the event that the legal entity is of recent incorporation and, for this reason, is not yet registered in the corresponding public registry according to its nature, the Society in question must obtain a written document signed by a person legally authorized to certify its personality in terms of the public instrument that certifies its legal existence referred to in subsection b), item iv., of fraction I of this section, in which the obligation to carry out the respective registration and to provide, when appropriate, the corresponding data to the Society itself appears.

ii.

Tax Identification Card issued by the Secretariat and, if applicable, the document in which the assignment of the tax identification number and/or equivalent appears, issued by a competent authority, and certificate of the Advanced Electronic Signature.

iii.

Proof of address referred to in subsection a) of this section II, in terms of what is stated in subsection b), item iii., of the previous fraction I.

iv.

Notarized copy or certified copy of the instrument containing the powers of the representative or legal representatives, issued by a public notary, when they are not contained in the public instrument that certifies the legal existence of the legal entity in question, as well as the personal identification of each of said representatives, in accordance with subsection b), item i., of the previous fraction I.

Regarding federal, state, and municipal public departments and entities, as well as other Mexican legal entities of public law, to certify their legal existence as well as to prove the powers of their legal representatives and/or proxies, the laws, regulations, decrees, or organic statutes that create and regulate their constitution and operation shall apply, and if applicable, a copy of their appointment or public instrument issued by a notary, as appropriate.

c)

Client information that allows the Society to know:

i.

Shareholder structure or partnership interests, as appropriate.

ii.

In the event that it has a Risk Grade other than low, its internal corporate structure; that is, the organizational chart of the corporate client, considering at least the full name and position of those individuals who hold positions between general director and the immediate lower hierarchy, as well as the full name and corresponding position of the members of its board of directors or equivalent.

Likewise, the Societies must identify the Beneficial Owners of their corporate clients that exercise Control over them in terms of the second paragraph of fraction VII of the 2nd of these Provisions, in accordance with what is established in fraction VI of this Provision.

When there is no natural person who owns or controls, directly or indirectly, a percentage equal to or greater than 25% of the capital or voting rights of the legal entity in question, or who by other means exercises Control, direct or indirect, over the legal entity, it will be considered that the administrator or administrators thereof exercise said Control, understanding that the natural person designated for such effect exercises the administration.

When the designated administrator is a legal entity or Trust, it will be understood that the Control is exercised by the natural person appointed as administrator by said legal entity or Trust.

For the purposes of this subsection, the Societies must obtain a written declaration, by electronic, optical, or any other technology means, from the legal representative of the corporate client in question, in which it indicates who their Beneficial Owners are in terms of this subsection.

In the event that the Societies have indications that make the truthfulness of the declared information questionable, they must take reasonable measures to determine and identify the Beneficial Owners of the corresponding corporate client.

III.

Regarding Clients who are persons of foreign nationality, the Society in question must observe the following:

a)

For the case of the natural person who declares to the Society that they do not have the condition of temporary resident or permanent resident in terms of the Migration Law, or in the capacity of diplomatic and consular representations in terms of the Guidelines for the issuance of non-ordinary visas:

i.

The respective identification file must contain the same data as those indicated in subsection a) of the previous fraction I, with the exception of the data of the state of birth.

ii.

Collect and include in said file a simple copy of the following documents:

ii.1.

Passport or passport card and official document issued by the National Institute of Migration, when the latter is available, which certifies their entry or legal stay in the country, or the accreditation card issued by the Secretariat of Foreign Relations to diplomatic and consular bodies.

ii.2.

Document that certifies the Client's address at their place of residence, in terms of subsection b), item iii., of fraction I of this Provision.

ii.3.

Declaration in terms of subsection b), item iv., of fraction I of this Provision.

b)

For the case of foreign legal entities:

i.

The respective identification file must contain the following data:

i.1.

Trade name or corporate name.

i.2.

Commercial activity, activity, or corporate purpose.

i.3.

Nationality.

i.4.

Federal Taxpayer Registry Key (with homoclave) and/or tax identification number and/or equivalent, the country or countries that assigned them, and, if applicable, the serial number of the Advanced Electronic Signature.

i.5.

Address (composed of the name of the street, avenue, or route in question, duly specified; exterior number and, if applicable, interior; neighborhood or urbanization; borough, municipality, or similar political division that corresponds, if applicable; city or town, state, province, department, or similar political division that corresponds, if applicable; postal code and country).

i.6.

Phone number(s) of said address.

i.7.

Email address, if applicable.

i.8.

Date of incorporation.

ii.

Collect and include in said file a simple copy of, at least, the following documents:

ii.1.

Document that credibly certifies their legal existence, document in which the assignment of the tax identification number and/or equivalent appears, issued by a competent authority, as well as obtaining the information and collecting the data referred to in subsection c) of fraction II of this Provision.

The Society must require that the document referred to in the previous paragraph be duly legalized or, in the event that the country where said document was issued is a party to the "Convention Abolishing the Requirement of Legalization for Foreign Public Documents," adopted in The Hague, Netherlands, on October 5, 1961, it will suffice that said document bears the apostille referred to by said Convention.

In the event that the respective Client does not present the document duly legalized or apostilled, it will be the responsibility of the Society to ensure the authenticity of said documentation.

ii.2.

Proof of address referred to in subsection b) above, in terms of what is stated in subsection b), item iii., of fraction I of this Provision.

ii.3.

Notarized copy or certified copy of the instrument containing the powers of the representative or legal representatives, issued by a public notary, when they are not contained in the document that credibly certifies the legal existence of the legal entity in question, as well as the personal identification of said representatives, in accordance with subsection b), item i., of fraction I or subsection a) of this fraction III, as appropriate.

In the case of those legal representatives who are outside the national territory and who do not have a passport or passport card, the personal identification must, in any case, be an original official document issued by a competent authority of the country of origin, valid on the date of its presentation, which contains the photograph, signature, and, if applicable, address of the said representative.

For the purposes of the foregoing, driver's licenses and credentials issued by federal authorities or equivalents of the country in question will be considered as valid personal identification documents. The verification of the authenticity of said documents will be the responsibility of the Societies.

IV.

Regarding the societies, departments, and entities referred to in Annex 1 of these Provisions:

a)

The following identification data:

i.

Trade name or corporate name.

ii.

Activity or corporate purpose.

iii.

Federal Taxpayer Registry (with homoclave) and, if applicable, tax identification number and/or equivalent, as well as the country or countries that assigned them.

iv.

Serial number of the Advanced Electronic Signature, when they have it.

v.

Address (composed of the name of the street, exterior number and, if applicable, interior, neighborhood, city or town, borough or municipality, state, and postal code).

vi.

Nationality.

vii.

Phone number(s) of said address.

viii.

Email address, if applicable.

ix.

Full name without abbreviations of the administrator or administrators, director, general manager, or legal representative who, with their signature, can bind the society, department, or entity for the purposes of concluding the Operation in question.

b)

Simple copy of the following documents:

i.

Notarized copy or certified copy of the instrument containing the powers of the representative or legal representatives, issued by a public notary.

Regarding the representative of a credit institution, the certification of appointment issued by a competent official, in terms of article 90 of the Credit Institutions Law.

To certify the powers of the representatives of federal, state, and municipal public departments and entities, as well as other Mexican legal entities of public law, what is provided in the last paragraph of subsection b) of fraction II of this Provision shall apply.

ii.

Personal identification of such representatives, in accordance with subsection b), item i., of the previous fraction I.

The Societies may apply the simplified measures referred to in this fraction, provided that the aforementioned societies, departments, and entities have been classified as Clients with a Low Risk Grade in terms of the 26th of these Provisions.

V.

Regarding Resource Providers, the following data:

a)

In the case of natural persons:

i.

Paternal surname, maternal surname, and first name or names without abbreviations.

ii.

Date of birth.

iii.

Nationality.

iv.

Home address (composed of the name of the street, avenue, or route in question, duly specified, exterior number and, if applicable, interior, neighborhood, city or town, borough or municipality, state, and postal code).

v.

Federal Taxpayer Registry Key (with homoclave), tax identification number and/or equivalent, the country or countries that assigned them, Unique Registry of Population Key, as well as the serial number of the Advanced Electronic Signature, when they have them.

vi.

Occupation, profession, activity, or business sector to which the Resource Provider is dedicated.

b)

In the case of legal entities:

i.

Trade name or corporate name.

ii.

Nationality.

iii.

Federal Taxpayer Registry Key (with homoclave) and, if applicable, tax identification number and/or equivalent, as well as the country or countries that assigned them.

iv.

Serial number of the Advanced Electronic Signature, when they have it.

v.

Address (composed of the name of the street, avenue, or route in question, duly specified; exterior number and, if applicable, interior; neighborhood; city or town; borough or municipality; state, and postal code).

The Societies will not be obligated to collect the data referred to in this fraction, when it concerns a Concentrating Account or, if it is of another type, in the following cases:

When the account in question is used for the payment of payrolls or other benefits resulting from an employment relationship, or for the payment of the supply of goods or services derived from a commercial relationship.

When the Resource Providers are departments and entities of the Federal Public Administration, of the City of Mexico, or of any state or municipality, that contribute resources to the respective account under support programs for the benefit of certain sectors of the population.

In the cases referred to in the 14th of these Provisions.

VI.

Regarding Beneficial Owners, the Societies must collect the same data and documents as those established in fractions I or III of this Provision, as appropriate. With respect to the address, it will suffice to obtain the data and document of the address where they can be located.

When the obligation to identify the Beneficial Owner derives from a Client that is classified with a Low Risk Grade, the document referred to in item iii., of subsection b), of fraction I, as well as number ii.2., of item ii., of subsection b), of fraction III of the 4th of this Provision, respectively, shall not be collected.

The foregoing, in accordance with the measures that for such purposes are established in their Compliance Manual, or in any other document or manual prepared by the Societies themselves.

Additionally, the Society must identify if the Beneficial Owner is a Politically Exposed Person, and in the event of identifying them as such, they must comply with what is established in the 27th and 29th of these Provisions.

Regarding legal entities whose share certificates representing their social capital or securities representing said shares trade on any stock exchange in the country or in recognized foreign securities markets in terms of the General Provisions applicable to stock exchanges published in the Official Journal of the Federation on May 15, 2017, and their respective modifications, as well as those subsidiaries in which they have a majority participation of fifty percent in their social capital, the Societies will not be obligated to collect the aforementioned identification data, considering that they are subject to provisions in matters of stock exchange on information disclosure.

The Secretariat will issue the guidelines that the Societies may consider for compliance with what is provided in the first paragraph of this fraction, which will be made known through the electronic means established for such purpose by the Commission.

VII.

Regarding the persons who appear as co-owners or third parties authorized in the account opened by the Client, as well as in the Operations carried out by them, the Societies must observe the same requirements as those contemplated in this Provision for the titular Clients.

VIII. With respect to Beneficiaries, the Societies will collect at least the following data: paternal surname, maternal surname, and first name or names without abbreviations; home address (composed of the same elements as those indicated in subsection a) of fraction I of this Provision), when this is different from that of the account or contract holder, as well as the date of birth of each of them.

In the cases referred to in the 14th, of these Provisions, the Societies may collect the data of the Beneficiaries referred to in the previous paragraph, after the aforementioned accounts are opened, through the means determined by the Societies themselves; said means must be contemplated in the Compliance Manual of the Society itself.

IX.

Regarding Trusts:

a)

It must contain the following data recorded:

i.

Number or reference of the Trust and, if applicable, Federal Taxpayer Registry (with homoclave), tax identification number and/or equivalent, the country or countries that assigned them, as well as the serial number of the Advanced Electronic Signature.

ii.

Purpose of the Trust and, if applicable, indicate the vulnerable activity(ies) it carries out in terms of article 17 of the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin.

iii.

Place and date of constitution or celebration of the Trust.

iv.

Trade name or corporate name of the fiduciary institution.

v.

Trusted assets (goods and rights).

vi.

Contributions by the settlors.

vii.

Identification data, in terms of this Provision, as appropriate, of the settlors, beneficiaries, fiduciary delegates, and, if applicable, the members of the technical committee or equivalent governing body, legal representative(s) and legal proxy(ies).

Without prejudice to the foregoing, the Societies may comply with the obligation to collect data regarding the members of the technical committee or equivalent governing body, indicating only the first name or names and paternal and maternal surnames, without abbreviations, of these, as well as their date of birth.

b)

Simple copy of the following documents:

i.

Contract, notarized copy, or certified copy of the public instrument that certifies the celebration or constitution of the Trust, registered, if applicable, in the corresponding public registry, or of the document that, according to the regime applicable to the Trust in question, credibly certifies its existence.

In the event that the Trust is of recent constitution and, for this reason, is not yet registered in the corresponding public registry according to its nature, the Society in question must obtain a written document signed by a person legally authorized to certify its personality in terms of the public instrument referred to in subsection b), item iii., of this fraction, in which the obligation to carry out the respective registration and to provide, when appropriate, the corresponding data to the Society itself appears.

ii.

Proof of address, in terms of what is stated in subsection b), item iii., of fraction I of this Provision.

iii.

Notarized copy or certified copy of the instrument containing the powers of the legal representative(s), legal proxy(ies), or fiduciary delegate(s), issued by a public notary, when they are not contained in the public instrument that certifies the legal existence of the Trust in question, as well as the personal identification of each of said representatives, proxies, or fiduciary delegates, in accordance with subsection b), item i., of fraction I of this Provision.

iv.

Tax Identification Card issued by the Secretariat and, if applicable, the document in which the assignment of the tax identification number and/or equivalent appears, issued by a competent authority, as well as certificate of the Advanced Electronic Signature.

The Societies will not be obligated to integrate the identification file when it concerns Trusts in which the contributions destined for labor benefits or social security of the workers come from the workers themselves or from the employers, and the settlor is always a public entity that allocates the funds in question for the aforementioned purposes.

What is established in the 12th of these Provisions will apply to the integration and conservation of identification files of beneficiaries in Trusts that are constituted to fulfill labor or social security benefits of a general nature, in which contributions are received from the departments and entities of the Federal Public Administration, of the City of Mexico, or of a state or municipality, or from companies, their unions, or persons belonging to both.

. . .

The Societies may comply with the obligation (a) to collect the document referred to in item i., of subsection b) of this fraction, and (b) referred to in fraction VI of this Provision, respectively, through a certificate signed by the fiduciary delegate and the Compliance Officer of the institution or society acting as fiduciary, which must contain the information indicated in subsection a) above, as well as the obligation to keep said documentation available to the Secretariat and the Commission, in order to remit it, upon request by the latter, within the term established by the Commission itself.

. . .

Additionally to what is provided in the previous paragraph, the Societies must contractually agree with the commission agents, the obligation of these to (i) obtain, prior to the opening of accounts or conclusion of contracts, the information and documentation for the integration of the respective identification file; (ii) keep the files available to the Secretariat or the Commission and (iii) have mechanisms for the Societies themselves to verify that the files are integrated in accordance with what is stated in these Provisions. In any case, the Societies will be responsible for compliance with the obligations that, in matters of Client identification, these Provisions establish, to which effect, they must establish in the Compliance Manual, the mechanisms that they will adopt to

to comply with the provisions stated in the preceding paragraph.

. . .

When the identification documents provided contain strikethroughs or amendments, the Societies shall obtain another means of identification or, in default thereof, request two banking or commercial references and two personal references, which must include the first and last names without abbreviations, the full address composed of the same data as indicated in fraction I of this Provision, and the phone number of the person issuing them, the authenticity of which shall be verified by the Societies with the persons who sign such references, before they make contributions to the social capital, open the account, or enter into the respective contract.

. . .

The Societies, when obtaining simple copies of the documents that must form part of the Client's identification files, in accordance with the provisions of this Provision, must ensure that these are legible and compare them against the corresponding original documents that are physically present.

The Societies may keep, in their Archives or Records, separately the data and documents that should form part of their Clients' identification files, without the need to integrate both into a single physical file, provided they have automated systems that allow them to combine such data and documents for timely consultation by the Societies themselves or by the Secretariat or the Commission, at the latter's request, in accordance with these Provisions and any others that are applicable.

4th Bis.- Societies that receive contributions to their social capital, open an account, or enter into a contract through non-presential Devices for individual Clients of Mexican or foreign nationality, in accordance with Annex 2 of these Provisions, in addition to the identification data referred to in the 4th of these Provisions, as applicable, must require and obtain from their Clients, with their prior consent, the Geolocation of the Device from which they carry out the capital contribution, open the account, or enter into the contract, as well as:

a)

Voter Key, if applicable.

b)

Consent.

c)

Email or mobile phone number.

d)

If applicable, account number and Standardized Banking Key (CLABE) in the credit institution or Foreign Financial Entity authorized to receive deposits; and which corresponds to the name referred to in the 4th, fraction I, of these Provisions.

e)

The declaration of the individual stating whether they act on their own behalf or on behalf of a third party; in the event that they declare they act on behalf of a third party, the provisions of the 4th, fraction VI of these Provisions shall apply. Such declaration may be established in the Terms and Conditions established by the Society for this purpose.

f)

The digital version of the valid official personal identification document from which the data referred to in this Provision originate, which must be preserved in accordance with the applicable Mexican Official Standard on digitalization and preservation of Data Messages.

Societies must not accept contributions to their capital, or carry out the opening of the account or the conclusion of the contract in a non-presential manner with individual Clients of Mexican or foreign nationality, when they do not obtain the data regarding Geolocation.

The consent that Societies obtain from their Clients in accordance with this Provision may be obtained through Electronic Signature, Advanced Electronic Signature, or in accordance with Annex 2 of these Provisions. Such Client consent serves as proof to legally attest to the capital contribution, account opening, contract conclusion, or any operation carried out with the Society in a non-presential manner.

A valid official personal identification document for the purposes of this Provision shall be understood to be the voter credential issued by the National Electoral Institute and other national or foreign identifications that, if applicable, are approved by the Commission.

Societies may obtain the digital versions of the documentation referred to in this Provision in a non-presential manner and through optical means or any other technology.

The digital versions that Societies obtain for identification purposes must allow for verification in accordance with these Provisions. Likewise, such digital versions must be preserved in their Archives or Records in accordance with these Provisions.

Societies must establish in their Compliance Manual the criteria and mechanisms they will adopt to comply with the provisions of this Provision.

7th.- The Society, prior to receiving contributions to the social capital thereof, establishing or initiating a commercial relationship with a Client, must hold an in-person interview with the Client or their legal representative in order to collect the respective identification data and documents. The results of the interview must be recorded in writing or electronically and be kept in the Society's Archives or Records.

In the case of contributions to social capital, accounts opened, or contracts concluded in accordance with the 4th Bis of these Provisions, the interview referred to in the preceding paragraph may be conducted in a non-presential manner, using forms that interact with the Client, both in accordance with Annex 2 of these Provisions.

In the case of granting credits or loans, as well as the situations referred to in the 14th of these Provisions, Societies may enter into agreements with third parties to carry out the interview referred to in this Provision, which must be conducted in accordance with the terms established in Article 19 Bis of the Law and the general provisions issued by the Commission based on that article. In all cases, Societies falling under the scenario provided for in this paragraph will be responsible for complying with the obligations regarding identification and customer due diligence established in these Provisions.

Regarding the accounts referred to in the 14th of these Provisions, Societies may carry out the remote receipt or capture of data in lieu of the aforementioned interview, provided that the Society in question verifies the authenticity of the Client's data, for which they must adhere to the following procedure:

I to II.

. . .

. . .

9th.- Societies are prohibited from receiving contributions to their social capital, entering into contracts, or maintaining anonymous accounts under fictitious names or where the Client or Beneficial Owner cannot be identified; therefore, they may only conduct Operations with their Clients once they have fulfilled the identification requirements for such Clients, in accordance with these Provisions.

9th Bis.- Societies may not apply the simplified measures provided for in this Chapter to their Clients when they have a well-founded suspicion or indications that the resources, assets, or securities that their Clients intend to use to carry out an Operation might be related to the acts or conduct referred to in Articles 139 Quater or 400 Bis of the Federal Penal Code.

The policies, criteria, measures, and procedures that Societies develop to determine the matters stated in the preceding paragraph must be documented in their Compliance Manual.

9th Ter.- Societies may suspend the identification process of their potential Client or User when they reasonably estimate:

I.

That they might be related to acts or conduct referred to in Articles 139 Quater or 400 Bis of the Federal Penal Code.

II.

That continuing with the identification process could prevent or alert the Client or User that the Society considers the resources, assets, or securities to be related to acts or conduct referred to in Articles 139 Quater or 400 Bis of the Federal Penal Code.

III.

When they identify the existence of Risks in accordance with the criteria established in the Compliance Manual.

In the event that the suspension referred to in this Provision is carried out, Societies must generate the corresponding 24-hour Unusual Operation Report with the information they have about the potential Client or User in question, which may be prepared manually.

The report referred to in the preceding paragraph must be sent to the Secretariat, through the Commission, within 24 hours from the time the Society becomes aware of the information indicated in this Provision, using the corresponding official format.

For the purposes of this Provision, Societies must establish in their Compliance Manual, or in another document or manual prepared by the Society itself, the policies, criteria, measures, and procedures necessary.

10th. . . .

In the cases referred to in the 14th of these Provisions, Societies must verify the Beneficiary's data at the time they present themselves to exercise their rights, in the terms in which the account in question was opened.

11th.- In the case of mandates or commissions that Societies are authorized to carry out, they must invariably integrate the identification file of all parties involved in the signing of the respective instruments (mandator, mandatory, commissioner, principal), in the terms established in the 4th or 4th Bis of these Provisions, except when it concerns third parties referred to in stipulations for their benefit that are not individually identified in the respective mandate or commission contract.

13th.- For the case of products and services other than those contemplated in the 14th of these Provisions, which are considered by the Societies to be of Low Risk, they may integrate the respective identification files of their Clients, subject to the provisions of this Provision, only with the data indicated in fractions I, II, or III of the 4th and 4th Bis of these Provisions, as applicable, according to the type of Client in question, as well as with the data of the Client's personal identification and, if applicable, that of their representative, which must be one of those contemplated in subsection b), numeral i., of fraction I of the 4th or the fourth paragraph of the 4th Bis of these Provisions, and which Societies are obligated to request to be presented as a prior requirement to open the respective account.

The provisions of the preceding paragraph shall apply provided that the Society in question has established in its Compliance Manual, or in another document or manual prepared by it, the criteria and elements of analysis on the basis of which it considers such products and services to be of Low Risk, including, among others, the maximum amount of the permitted transactional levels for the purpose of continuing to consider such products within the Risk category indicated.

In the event that the transactional level of any of the products or services referred to in the first paragraph of this Provision exceeds the maximum amount established by the Society for them to be considered as Low Risk, such Society must proceed to integrate the identification file of the respective Client with all the corresponding information and documentation, in accordance with the provisions of the 4th or 4th Bis of these Provisions, as well as comply with the various obligations established therein.

. . .

14th.- Demand deposit accounts in national currency offered by Societies will be considered Low Risk and, therefore, may have simplified identification requirements, provided they are opened in person and concern Clients who are individuals whose operation is limited to deposits equal to the equivalent in national currency to one thousand Investment Units per Client, over the course of a calendar month. Societies may integrate the respective identification files of their Clients only with the data relating to the full name, without abbreviations, date of birth, and address of these, which must be composed of the elements referred to in the 4th of these Provisions. In this case, the data relating to the Client's name and date of birth must be obtained from an official identification indicated in the aforementioned 4th of these Provisions.

Regarding contributions to social capital, accounts opened, or contracts concluded in a non-presential manner, Societies must integrate the identification files of their Clients with data relating to the full name without abbreviations, gender, state of birth, date of birth, as well as address, composed of the elements referred to in the 4th of these Provisions.

Likewise, in the case of funds derived from the application of government support programs for the benefit of certain sectors of the population, Societies may receive deposits up to a maximum amount equivalent in national currency to six thousand Investment Units per Client, over the course of a calendar month, in addition to the maximum transactional level previously indicated, provided that the resources come from said funds.

. . .

16th.- For the conduct of Operations through electronic, optical, or any other technology means, Societies must previously integrate the Client's identification file in accordance with the provisions of these Provisions, establish mechanisms to identify them in accordance with Annex 2 of these Provisions, as well as develop procedures to prevent the improper use of such means or technologies, which must be contained in their Compliance Manual.

16th Bis.- Societies must verify the data and documents that their potential Clients provide to prove their identity.

The verification referred to in the preceding paragraph may be carried out in a non-presential manner in accordance with the provisions of Annex 2 of these Provisions, insofar as applicable.

When it concerns Operations of Clients classified by the Societies as Low Risk, the verification referred to in the preceding paragraph may be done after the opening of the account or conclusion of the contract in question. In the cases referred to in this paragraph, Societies must inform their Clients that they cannot carry out Operations until the verification process referred to in this Provision is concluded.

Societies must establish in their Compliance Manual the policies, criteria, measures, and procedures they will adopt to comply with the provisions of this Provision.

The verification of the data and documents referred to in this Provision, obtained from their Clients, may be carried out by third parties without this exempting the Societies from complying with the obligations provided for in these Provisions.

17th. . . .

I to III.

. . .

IV.

Without prejudice to the other obligations and measures established in these Provisions, that Society that accepts processing the sending of a national transfer of funds in foreign currency or an international transfer of funds requested by its Client or User, must obtain from said Client or User the following information regarding the Recipient or beneficiary of the transfer, whether individual or legal entity, which must be preserved and accompany the transfer in question:

a)

Name and surname or surnames that correspond or, if applicable, trade name or corporate name.

b)

Identifier of the Recipient's or beneficiary's account, in case such account is used to process the transfer in question or, in the absence of such account, a unique reference number of said transfer that allows for its tracing.

c)

As much data as, if applicable, is provided by the Client or User and the system through which the transmission is made allows: Country of birth and date of birth, national identity number or address, as applicable to individuals of Mexican or foreign nationality, or, in the case of legal entities, tax identification number and country that issued it or address.

V.

Without prejudice to the other obligations and measures established in these Provisions, that Society that accepts receiving national transfers of funds in foreign currency or international transfers of funds directed to its Client or User in question, must obtain the following information regarding the person who ordered the national or international transfer, depending on whether it is an individual or legal entity:

a)

Name and surname or surnames or, if applicable, trade name or corporate name.

b)

Identifier or reference of the originator's account, which allows tracing the transfer from its origin.

c)

As much data as, if applicable, is transmitted by the entity sending the respective transfer: Country and date of birth, national identity number or address, as applicable to individuals of Mexican or foreign nationality, or, in the case of legal entities, tax identification number and country that issued it or address.

Additionally, the Societies referred to in this fraction must have policies and procedures documented in their respective Compliance Manuals to which they must adhere to identify, at the time of receipt or subsequently, the transfers indicated in this same fraction that do not contain the information of the persons who ordered such transfers or of the Recipients or beneficiaries, which must be included in such transfers in accordance with this Provision, as well as include in said Manuals, at least, the risk-based criteria they will use to determine whether it is appropriate to execute, reject, or suspend the transfers they receive without the required information, as well as the actions they will take in follow-up to this.

The ordering or receiving Societies of fund transfers referred to in this Provision must verify the information provided by their Client or User in the event that there is a well-founded suspicion or indication that the resources might be related to the acts or conduct referred to in Articles 139 Quater or 400 Bis of the Federal Penal Code and, if applicable, generate the corresponding 24-hour Unusual Operation Report. The policies and procedures to carry out the verification referred to in this paragraph must be included in their respective Compliance Manual.

. . .

. . .

17th Bis.- Societies may obtain the data and documentation of their Users in accordance with the 17th of these Provisions in a non-presential manner and through electronic, optical, or any other technology means, in accordance with the provisions of Annex 2 of these Provisions.

Societies that opt to integrate the User's identification file in the terms provided in the preceding paragraph, in addition to what is provided in the 17th of these Provisions, must require and obtain from their Users, with their prior consent, the Geolocation of the Device from which the User carries out the Operation, as well as their email address.

Societies must not conduct Operations with Users in a non-presential manner when they do not obtain the data regarding Geolocation.

For the purposes of this Provision, a valid official personal identification document shall be understood to be the voter credential issued by the National Electoral Institute and other national and foreign identifications that, if applicable, are approved by the Commission.

Societies are obligated to preserve the documents in their Archives or Records in accordance with these Provisions.

The digital versions of the documents that, if applicable, Societies obtain for identification purposes must allow for verification in accordance with Annex 2 of these Provisions.

Societies must establish in their Compliance Manual the criteria and mechanisms they will adopt to comply with the provisions of this Provision.

The information referred to in this Provision must be available to the Secretariat and the Commission, at the latter's request, within the timeframe established by the Commission itself.

20th. . . .

. . .

. . .

. . .

. . .

I .

. . .

II .

. . .

a)

. . .

b)

Evaluate the controls they have in place, in order to determine that they comply with international standards applicable in the matter of prevention of operations with proceeds of illicit origin and financing of terrorism. The criteria according to which the Societies will carry out the evaluation indicated in this subsection must be contemplated in the Compliance Manual, or in another document or manual prepared by the Society in question, and

c)

. . .

. . .

22nd.- Societies will verify that the identification files of their corporate Clients, regardless of their Risk Grade, contain all the data and documents provided for in the 4th of these Provisions, as well as that such data and documents are up to date, understanding that Societies may opt not to carry out the update of the latter, in the case of a corporate Client with a Low Risk Grade. This, in the terms and conditions that Societies establish in their own Compliance Manual. Likewise, they will verify, at least once a year, that the identification files of their Clients classified as High Risk Grade are up to date with all the data and documents provided for in the 4th, 4th Bis, 29th, and 33rd of these Provisions.

If during the course of a commercial relationship with a Client, the Society in question detects significant changes in the Client's usual transactional behavior, without there being a justified cause for it, or if doubts arise regarding the veracity or accuracy of the data or documents provided by the

own Client, among other circumstances that the Society itself establishes in its Compliance Manual, it will reclassify said Client into the higher Risk Grade corresponding to the results of the analysis that, if applicable, the Society performs, and must verify and request the update of both data and identification documents, among other measures that the Society deems convenient.

Societies may comply with the obligation to update their Clients' files in accordance with this Provision in a non-presential manner, regardless of the form of capital contribution, account opening, or contract celebration, always having to collect the data and documents applicable according to the type of Client, and carry out the respective verification.

Societies must establish in their Compliance Manual the policies, criteria, measures, and procedures they must adopt to comply with what is stated in this Provision, including the circumstances in which a visit to the domicile of Clients classified as High Risk Grade must be carried out, in order to properly integrate files and/or update the corresponding data and documents, in which case the results of such visit must be recorded in the respective file.

22nd-1.- Societies must design and implement a methodology to carry out a Risk Assessment of the risks to which they are exposed derived from their products, services, Clients, Users, countries or geographic areas, transactions, and shipping or distribution channels with which they operate.

The design of the methodology referred to in the preceding paragraph must be established in its Compliance Manual, or in another document or manual prepared by the Society, and must establish and describe all processes to be carried out for the identification, measurement, and mitigation of Risks, for which they must take into account the Risk factors identified for this purpose, as well as the information applicable given the context of each Society contained in the national risk assessment and its updates, which the Secretariat makes known to them through the Commission.

Likewise, Societies will carry out a Risk Assessment of the risks to which they are exposed in accordance with what is established in this Chapter, prior to the launch or use of new products, services, types of Clients and/or Users, countries or geographic areas, shipping or distribution channels, and transactions.

22nd-2.- For the design of the Risk Assessment methodology, Societies must comply with the following:

I.

Identify the elements and indicators associated with each of them that explain how and to what extent the Society may be exposed to Risk, considering at least the following elements:

a)

Products and services.

b)

Clients and Users.

c)

Countries and geographic areas.

d)

Transactions and shipping or distribution channels linked to the Society's Operations, with its Clients and with its Users.

Within the process of identifying Risk indicators, the total of the products, services, types of Clients and Users, countries or geographic areas, transactions, and shipping or distribution channels with which the Society operates must be considered.

II.

Use a method for the measurement of Risks that establishes a relationship between the indicators and the element to which they belong referred to in the preceding fraction I, and assign a weight to each of them consistently based on their importance to describe said Risks. In turn, a weight must be assigned to each of the defined Risk elements consistently based on their importance to describe the Risks to which the Society is exposed.

III.

Identify the Mitigants that the Society has implemented at the time of the design of the methodology, considering all the internal policies, criteria, measures, and procedures referred to in Article 67 of these Provisions, as well as their effective application, in order to establish the effect that these will have on the indicators and Risk elements indicated in the preceding fraction I, as well as on the Society's Risk.

22nd-3.- Societies must implement the designed methodology and obtain the results thereof in order to know the Risks to which they are exposed. In the implementation of the Risk Assessment methodology, Societies must ensure:

I.

That there are no inconsistencies between the information they incorporate into this and that which is in their automated systems.

II.

Use, at least, the information corresponding to the total number of Clients, number of operations, and amount operated corresponding to a period that cannot be less than twelve months.

When, as a result of the implementation of the Risk Assessment methodology, the existence of greater or new Risks for the Societies themselves is detected, they must modify the policies, criteria, measures, and procedures corresponding to those contained in the Compliance Manual, or in another document or manual prepared by the Society, in order to establish the Mitigants they deem necessary based on the identified Risks, as well as to maintain them at an acceptable tolerance level in accordance with what is established in the Compliance Manual.

The modifications to the internal policies, criteria, measures, and procedures referred to in the preceding paragraph, derived from the results of the implementation of the Risk Assessment methodology, must be carried out within a period not exceeding twelve months counted from the date the Society has the results of its implementation and must be clearly identified and indicated, indicating at least the year and month in which the results of the implementation of the methodology that gave rise to said modifications were obtained.

22nd-4.- The compliance and results of the obligations contained in this Chapter must be reviewed and updated by Societies when the existence of new Risks is detected, when the national risk assessment is updated, or within a period not exceeding 12 months from the date the Society has the results of its implementation. Such reviews and updates must be in writing and be available to the Secretariat and the Commission, at the request of the latter, within the period established by the Commission itself.

The Commission may review and, if applicable, order Societies to modify their Risk Assessment methodology or their Mitigants, among other circumstances, when they do not consider proper Risk administration in the procedure and criterion(s) for the determination of the opening, limitation, or termination of a commercial relationship with their Clients or Users, which must be congruent with said methodology, as well as request an action plan for them to adopt reinforced measures to manage and mitigate their Risks.

Societies must conserve the information generated by reason of this Chapter for a period not less than five years and provide it to the Secretariat and the Commission, at the request of the latter, within the period established by the Commission itself.

22nd-5.- Societies must comply with all obligations contained in these Provisions, in accordance with the results generated by their methodologies referred to in this Chapter.

22nd-6.- The Commission, prior to the opinion of the Secretariat, will elaborate guidelines, guides, and/or best practices that Societies will consider for the better compliance with what is provided in this present Chapter, which will be made known through the electronic means established by the same.

23rd .-. . .

Such policy must be an integral part of the Compliance Manual of each Society.

. . .

25th.- For the purposes of these Provisions, the transactional profile of each of the Clients will be based on the information they provide to the Society and, if applicable, on that which the Society has, regarding the amount, number, type, nature, and frequency of the Operations that said Clients commonly carry out; the origin and destination of the resources involved; as well as on the knowledge that the employee or official of the Society has regarding their portfolio of Clients, and in the other elements and criteria that the Societies themselves determine in their Compliance Manual.

Regarding those Operations carried out in a non-presential manner, in addition to the elements for determining the Client's transactional profile indicated in the preceding paragraph, the Geolocation of the Device from which said Operation is carried out must be taken into account.

26th .-. . .

. . .

. . .

In the case of capital contributions, account openings, or contract celebrations in a non-presential manner referred to in Article 4th Bis of these Provisions, Societies must consider the Geolocation information, with the Client's prior consent, of the Device from which the Client carries out the Operation, activity, or service with the respective Society.

. . .

. . .

Societies, in the terms that their Compliance Manual provides for this effect, will apply to their Clients who have been classified as High Risk Grade, as well as to new Clients who meet such character, identification questionnaires that allow obtaining more information about the origin and destination of resources and the activities and Operations they carry out or intend to carry out.

The questionnaires referred to in the preceding paragraph may be carried out via non-presential means, by digital or electronic means, in order to ensure truthfulness and security in their preparation, which in any case must contain the express consent referred to in Article 4th Bis of these Provisions, by those who sign them.

To determine the Risk Grade in which Clients should be located, as well as whether they should be considered Politically Exposed Persons, each Society will establish in the Compliance Manual the criteria conducive to that end, which take into account, among other aspects, the Client's background, their profession, activity, or business sector, the origin and destination of their resources, their place of residence, the methodology referred to in Chapter II Bis of these Provisions, and the other circumstances determined by the Society itself.

27th.- For cases where, prior to or after the start of the commercial relationship, a Society detects that the person who intends to be a Client or who already is, as applicable, meets the requirements to be considered a Politically Exposed Person and, in addition, of High Risk Grade, said Society must, in accordance with what it establishes for this effect in its Compliance Manual, obtain the approval of an executive or their equivalent who has specific powers to approve the capital contribution, opening, or celebration of said accounts or contracts, as applicable, in order to start or, if applicable, continue the commercial relationship.

28th.- Prior to the opening of accounts or celebration of contracts of Clients who, due to their characteristics, could generate a high Risk for the Society, at least one executive or their equivalent who has specific powers to approve the capital contribution, opening, or celebration of said accounts or contracts, as applicable, must grant, in writing, in digital or electronic form, the respective approval. Likewise, for the purposes referred to in fractions IV and V of Article 51 of these Provisions, Societies must provide in their Compliance Manual the mechanisms for their respective Compliance Officers to have knowledge of those Clients who are classified with a High Risk Grade by the Societies themselves, as well as the procedures that must be carried out to process the approval indicated in this Provision.

29th .-. . .

. . .

In the Operations carried out by Clients who have been classified as High Risk Grade, Societies will adopt measures to know the origin of the resources and will strive to obtain the data indicated in Chapter II of these Provisions, in the terms that their Compliance Manual provides for this effect, or in another document or manual prepared by them, regarding the spouse and economic dependents of the Client, as well as the companies and associations with which they maintain patrimonial links in the case of natural persons and, regarding legal entities, their main shareholders or partners, as applicable, while in the case of Trusts, they will strive to collect the same data regarding the spouse and economic dependents of the settlors and beneficiaries who are natural persons, as well as the companies and associations with which they maintain patrimonial links and, regarding settlors and beneficiaries who are legal entities, their corporate structure and their main shareholders or partners, in the terms that their Compliance Manual provides for this effect, or in another document or manual prepared by them. Regarding foreign Politically Exposed Persons, Societies must obtain, in addition to the reference data, the documentation indicated in Chapter II of these Provisions, regarding the natural and legal persons indicated above in this paragraph.

Without prejudice to the foregoing, regarding legal entity Clients whose titles representing their share capital or securities representing said shares trade on any stock exchange in the country or in recognized foreign securities markets as such in terms of the General Provisions applicable to stock exchanges published in the Official Journal of the Federation on May 15, 2017, and their respective modifications, as well as those subsidiaries in which they have a majority participation of fifty percent in their share capital, Societies will not be obligated to collect the aforementioned identification data, considering that they are subject to provisions on stock market matters regarding information disclosure.

Societies, in the terms that their Compliance Manual provides for this effect, or in another document or manual prepared by them, must develop mechanisms to establish the degree of Risk of the Operations they carry out with Politically Exposed Persons of Mexican nationality and, for this effect, Societies will determine if the transactional behavior reasonably corresponds to the functions, level, and responsibility of said persons, according to the knowledge and information available to said Societies.

30th .-. . .

. . .

I.

. . .

II.

. . .

a)

. . .

b)

Evaluate the controls they have, in order to determine that they comply with international standards applicable in matters of prevention of operations with resources of illicit origin and financing of terrorism. The criteria according to which Societies will carry out the evaluation indicated in this subsection must be contemplated in the Compliance Manuals, or in another document or manual prepared by the Society in question;

c) and d)

. . .

In correspondent relationships, both Societies and their counterparts abroad must document the obligations in matters of prevention of operations with resources of illicit origin and financing of terrorism to which each is subject in their countries. In order to comply with what is established in this paragraph, Societies may request the prevention program of operations with resources of illicit origin and financing of terrorism from their counterpart abroad.

Likewise, the Society prior to the correspondent relationship must gather available information that allows it to have knowledge of the obligations in matters of prevention of operations with resources of illicit origin and financing of terrorism, of the correspondent institution, as well as to know from publicly available information, the reputation of the institution and the quality of supervision, including whether it has been subject or not to an investigation on operations with resources of illicit origin and/or financing of terrorism.

32nd.- When a Society has information based on indications or certain facts about the fact that one of its Clients acts on behalf of another person, without having declared it in accordance with what is stated in Article 4th or 4th Bis of these Provisions, said Society must request from the Client in question information that allows it to identify the Beneficial Owner of the resources involved in the respective account, contract, or Operation, without prejudice to the duties of confidentiality towards third parties that said Client has assumed by conventional means.

. . .

Both in the circumstances provided for in the preceding paragraphs of this Provision, and in that case where doubts arise in the Society regarding the truthfulness or authenticity of the data or documents provided by the Client or User for identification purposes, or regarding the transactional behavior of the Client in question, said Society must carry out a specific and comprehensive follow-up of the Operations that said Client or User carries out, in accordance with what it establishes for this effect in its Compliance Manual and, if applicable, submit them to the consideration of the Committee, who must rule and, if applicable, issue the corresponding Unusual Operation report.

33rd.- Without prejudice to what is stated in Article 4th of these Provisions, Societies must establish in their Compliance Manual procedures to identify the Beneficial Owners of the resources used by Clients in their accounts or contracts, so they must:

I. to III. . . .

. . .

42nd.-. . .

Each Society must provide in its Compliance Manual, or in another document or manual prepared by the Society itself, the mechanisms based on which those Operations that must be presented to the Committee for the purposes of their ruling as Unusual Operations, must be analyzed, including their background and purposes. In any case, the results of said examination must be in writing and be available to the Secretariat and the Commission, for at least ten years counted from the celebration of the Committee meeting in which such results were presented.

. . .

Likewise, in the process of determining Unusual Operations referred to in this Provision, Societies must rely on their Compliance Manual, as well as any other document or manual prepared by the Society itself, and, in addition to this, they will consider the guidelines prepared for this effect by the Secretariat and by international organizations and intergovernmental groupings in matters of prevention and combat of operations with resources of illicit origin and financing of terrorism, of which Mexico is a member, which the Secretariat provides to them.

45th.- In the event that a Society has information based on well-founded suspicions or indications, such as concrete facts from which it can be inferred that, when attempting to carry out an Operation, the resources might come from illicit activities or might be intended to favor, provide help, aid, or cooperation of any kind for the commission of the crime provided for in Article 139 Quater of the Federal Penal Code, or that they could fall under the circumstances of Article 400 Bis of the same legal instrument, that same Society, in the event that it decides to accept said Operation, must send to the Secretariat, through the Commission, within 24 hours counted from the time it knows said information, an Unusual Operation report, in which, in the column of description of the Operation, the legend "24-hour Report" must be inserted. Likewise, in those cases where the Society does not carry out the Operation referred to in this paragraph, it must present to the Secretariat, through the Commission, the Unusual Operation report in the terms indicated in this Provision and, regarding said Clients or Users, it will provide, if applicable, all the information it has known about them.

. . .

For the purposes of what is provided in this Provision, Societies must establish in their Compliance Manual or in another document or manual prepared by them, those according to which their personnel, once they know the information in question, must make it known immediately to the Society's Compliance Officer, so that this fulfills the obligation to send the corresponding report.

. . .

47th .-. . .

I.

Submit to the approval of the audit committee of the Society in question, the Compliance Manual, as well as any modification to it.

. . .

I Bis. Present to the board of directors of the Society, the results of the implementation of the methodology elaborated and implemented to carry out the Risk Assessment referred to in the previous Chapter II Bis;

II.

. . .

III.

Know about those Clients who, due to their characteristics, are classified with a High Risk Grade, according to the reports presented to it for this effect by the Compliance Officer and, if applicable, formulate the recommendations they deem appropriate;

IV. to VIII . . . .

IX.

Resolve the other matters submitted to its consideration, related to the application of these Provisions;

X.

Ensure that the Society, for the compliance with these Provisions, has the internal structures referred to in this Chapter, in terms of organization, number of people, material and technological resources, according to the results of the implementation of the methodology referred to in the previous Chapter II Bis and;

XI.

Ensure that the key referred to in Article 72nd-1 is requested and kept updated in the name of the Compliance Officer or Compliance Officer designated as interim, as applicable.

Each Society must expressly establish in its Compliance Manual, or in another document or manual prepared by the Society itself, the mechanisms, processes, deadlines, and moments, as applicable, that must be observed in the performance of the functions indicated in this Provision.

48th.- .-. . .

.

.

. . .

. . .

. . .

. . .

Societies with Level I operational status will not be obligated to establish and maintain the Committee referred to in this Provision. In the case provided for in this paragraph, the functions and obligations that should correspond to the Committee as indicated in these Provisions, shall be exercised by the Compliance Officer, except for that provided in fraction XI of the 47th of these Provisions, which shall correspond to the General Director or equivalent of the Society.

51st.- .-. . .

. . .

. . .

I.

Prepare and submit to the consideration of the Committee the Compliance Manual, which shall contain the policies for identification and knowledge of the Client and User, and the criteria, measures, and procedures that must be adopted to comply with what is provided in these Provisions;

I. Bis. Submit to the approval of the Committee the methodology designed to carry out the Risk Assessment referred to in the previous Chapter II Bis, as well as the results of its implementation;

II and III.

. . .

IV.

Bring to the knowledge of the Committee those Clients that, due to their characteristics, are classified by the Society itself with a High Risk Grade;

V. and VI.

. . .

VII.

Act as an internal consultation instance within the Society regarding the application of these Provisions, as well as of the Compliance Manual;

VIII. to XI.

. . .

. . .

Each Society must expressly establish in its Compliance Manual, or in another document or manual prepared by the Society itself, the procedures according to which the Compliance Officer will perform the functions and obligations established in this Provision and the manner in which it will document compliance with them, if applicable.

53rd.- . . . .

I.

The provision of courses, at least once a year, which must be directed especially to the members of their respective boards of directors, executives, officials, and employees, including those who work in customer service or resource administration areas, and which shall contemplate, among other aspects, those related to the content of the Compliance Manual that the Society has developed for the due compliance of these Provisions, as well as regarding the activities, products, and services offered by the Society.

. . .

II. . . .

Paragraph repealed.

55th.- Each Society, as part of its Technological Infrastructure, must have automated systems that develop, among others, the following functions:

I.

. . .

II.

Generate and securely transmit to the Secretariat, through the Commission, information regarding reports of Relevant Operations, cash operations in United States dollars, Unusual Operations, Concerning Internal Operations, and international fund transfers referred to in these Provisions, as well as that which must be communicated to the Secretariat or to the Commission, under the terms and according to the deadlines established in these Provisions.

As an exception to what is stated in this fraction, Societies may manually generate the report referred to in the 9th Ter of these Provisions.

III. and IV. . . .

V.

Execute the alert system contemplated in the 26th of these Provisions;

V. Bis. Contribute to the detection, follow-up, and analysis of possible Unusual Operations and Concerning Internal Operations, considering at least, the information that has been provided by the Client at the beginning of the commercial relationship, the historical records of the Operations carried out by this person, the transactional behavior, average balances, and any other parameter that may provide more elements for the analysis of this type of Operations;

VI. to IX. . . .

IX. Bis. Provide the information that Societies will include in the methodology they must prepare in accordance with what is established in the 22nd-1 of these Provisions;

X.

Execute an alert system regarding those Operations that are intended to be carried out with persons referred to in fraction X of the 42nd of these Provisions, as well as with Politically Exposed Persons, in accordance with what is stated in the 71st of these Provisions, as well as with those who are within the List of Blocked Persons, and

XI.

Facilitate the verification of the data and documents provided remotely by the Client.

62nd.- Societies must adopt selection procedures to ensure that their personnel have the necessary technical quality and experience, as well as honorability, to carry out the activities that correspond to them, which must include obtaining a signed declaration by the official or employee in question, in which they will state information regarding any other Society or Obligated Subject in which they have previously worked, if applicable, as well as the fact of not having been sentenced for property crimes or disqualified from exercising commerce as a result of non-compliance with legislation or to hold a job, position, or commission in public service, or in the Mexican financial system. To this effect, the aforementioned selection procedures must be contemplated in the Society's Compliance Manual, or in another document or manual prepared by the Society itself.

. . .

63rd.- Societies are obligated to preserve for a period of no less than ten years, counted from the execution of the Operation carried out by their Clients or Users, the following:

I.

The documentation and information that accredits that the Operation in question has been celebrated.

II.

The data and documents that make up the identification files of their Clients, which must be preserved throughout the validity of the account or contract, and once these conclude, for the period referred to in this Provision, from the conclusion of the contractual relationship.

The identification file that Societies must preserve in terms of this Provision must allow identifying the Client, as well as knowing the Operations they carry out with the Society.

Likewise, those data and documents that must be collected from Users must be preserved for the aforementioned period counted from the date on which the User carries out the Operation in question.

III.

The historical records of the Operations they carry out with their Clients.

IV.

Copy of the reports of Relevant Operations, cash operations in United States dollars, Unusual Operations, Concerning Internal Operations, and international fund transfers referred to in these Provisions, as well as the original or copy or accounting or financial record of all supporting documentation, which must be identified and preserved as such by the Society itself for the same period.

The records of the reports presented in accordance with these Provisions, as well as the records of the Operations celebrated, must allow knowing the manner and terms in which they were carried out, in accordance with the applicable legal provisions.

The preservation provided for in this Provision may be carried out by Electronic or digital Means, which must guarantee the security of the information and documentation collected from the Client or User.

. . .

68th.- The Commission will be empowered to require Societies or through the Auxiliary Supervision Committee, to make modifications to their Compliance Manuals, as well as to the other documents indicated in these Provisions, when in its judgment it is necessary for the correct application of them.

69th.- The Commission, in exercise of the supervision powers conferred upon it by the Law and other legal instruments, will monitor that Societies, including in their case, their offices, branches, and agencies, both in national territory and abroad, comply with the obligations established in these Provisions, in the Compliance Manual of the Society itself, as well as in any other document in which criteria, measures, and procedures related to the compliance of these Provisions are established, and will impose the corresponding sanctions for non-compliance with the aforementioned obligations, in the terms indicated in the Law, and likewise, may request at any time, the necessary information or documentation for the development of its powers.

. . .

72nd-1.- .-. . .

Likewise, Societies must ensure that the key referred to in the previous paragraph, remains updated in the name of the Compliance Officer or Compliance Officer who is designated as interim, as appropriate.

Chapter XV Bis

Novel Models

72nd-2.- Societies that intend to obtain authorization from the Commission so that, through Novel Models, they carry out any of the Operations referred to in fraction XXVI of the 2nd of these Provisions must:

I.

Identify and evaluate the risk to which they are exposed, prior to the launch of the product or service in question through Novel Models. The evaluation referred to in this fraction must be carried out in accordance with Chapter II Bis of these Provisions.

II.

Present the result of the evaluation referred to in the previous fraction to the Commission along with its authorization request.

III.

Comply with these Provisions, according to the cases, forms, terms, deadlines, conditions, and exceptions that the Commission indicates in the respective authorization, prior to the opinion of the Secretariat.

73rd.- .-. . .

Societies must adopt and implement mechanisms that allow identifying Clients or Users who are within the List of Blocked Persons, as well as any third party acting on behalf or for the account of the same, and those Operations they have carried out, carry out, or intend to carry out. Such mechanisms must be provided for in the Compliance Manual of the Society itself.

75th.- .-. . .

Societies that, in terms of this Provision, have suspended acts, Operations, or services with their Clients or Users, must immediately inform them of this situation in writing or through digital means, in which they must inform said Clients and Users of the grounds and cause or causes of such inclusion, as well as that, within ten business days following the day of receipt of the cited writing, they may appear before the competent authority for the effects of the 76th of these Provisions.

TRANSITIONAL PROVISIONS

First.- This Resolution will enter into force the day after its publication in the Official Journal of the Federation.

Second.- The guidelines, interpretations, and criteria issued by the Secretariat or by the Commission, based on what is provided in the Resolution of December 31, 2014, and subsequent Resolutions through which the General Provisions referred to in Articles 71 and 72 of the Law for Regulating the Activities of Savings and Loan Cooperative Societies have been added or reformed, will remain applicable insofar as they do not oppose what is established in this Resolution.

Third.- Societies must comply with the obligations contained in this Resolution, in the terms and in accordance with the deadlines indicated below:

I.

Four months counted from the entry into force of this Resolution to modify the Compliance Manual and present it to the Commission.

II.

Nine months counted from the date of entry into force of this Resolution, to modify the methodology referred to in Chapter II Bis.

III.

Eighteen months counted from the date of entry into force of this Resolution, to update the automated systems referred to in the 55th of the Provisions.

IV.

Twenty-four months counted from the date of entry into force of this Resolution, to collect the Geolocation of the Device from which the Client or User celebrates each Operation, referred to in these Provisions.

Fourth.- Societies are obligated to send the report referred to in the 9th Ter of these Provisions, once the Secretariat makes known the guide or guidelines for such effect through the electronic means indicated for such purpose.

Fifth.- Societies are obligated to comply with what is provided in Provision 17th, fraction IV, subsection c), and fraction V, subsection c), which are added in this instrument starting from November 1, 2020.

Annex 1

The simplified regime referred to in fraction IV of the 4th of these Provisions, will apply to the following societies, departments, and entities:

Financial Technology Institutions.

Holding Companies of Financial Groups.

Investment Funds.

Investment Societies Specialized in Retirement Funds.

Operating Societies of Investment Funds.

Distributing Societies of Investment Fund Shares.

Credit Institutions.

National Bank for Agricultural, Rural, Forestry, and Fisheries Development.

Brokerage Houses.

Exchange Houses.

Retirement Fund Administrators.

Insurance Institutions.

Mutual Insurance Societies.

Surety Institutions.

General Warehouses.

Savings and Loan Cooperative Societies.

Community Financial Societies.

Popular Financial Societies.

Multiple-Objective Financial Societies, Regulated and Unregulated.

Credit Unions.

Securities Issuing Societies *

Foreign Financial Entities.

Federal, state, and municipal public departments and entities, as well as other Mexican legal persons of public law.

Stock Exchanges.

Securities Depository Institutions.

Societies that administer systems to facilitate operations with securities.

Central Counterparties of Securities.

Societies authorized to operate with Novel Models in accordance with Title IV of the Law for Regulating Financial Technology Institutions.

Annex 2

Of Non-Presential Identification

Article 1.- Societies, for the purposes of identifying their Clients or potential Clients who are natural persons of Mexican nationality, in the non-presential celebration of contracts for the opening of deposit accounts, always that it is agreed in the respective contracts that the sum of the credits during a calendar month does not exceed the equivalent in national currency to 30,000 UDIs, as well as commercial credits granted to natural persons with business activity and consumer credits, in both cases for amounts less than the equivalent in national currency to 60,000 UDIs, may adjust to what is provided by this article or, in their case, to what is contained in the following Article 3:

I.

Obtain prior approval from the Commission.

II.

Require the natural person in question to send a form through the electronic medium established by the Society itself, in which must be included, at least, the data referred to in the 4th Bis of these Provisions, as well as the product or service intended to be contracted.

The aforementioned form must include a statement indicating that its submission to the Society in question constitutes the consent of the person for their voice and image to be recorded when establishing a communication through an audiovisual medium and in real time between them.

Concurrently with the form, Societies must require the applicant to send a color photograph of their valid voter credential issued by the National Electoral Institute, on the front and back. Societies must require that the applicant takes a color photograph of their face, using devices with cameras of at least 4 megapixel resolution, 24-bit color images, the taking of which must only be done online through the Society's own technological tool to be sent in that same act.

Additionally, Societies must require the natural person to send in digital format the necessary documents to integrate and preserve their identification file in terms of what is provided by Provision 4th of the General Provisions referred to in Articles 71 and 72 of the Law for Regulating the Activities of Savings and Loan Cooperative Societies issued by the Secretariat or those that replace them.

III.

Once the duly filled form is received, they must verify if the applicant is a Client of the Society and, in this case, verify the data of the form with the records of the Society itself.

In addition to the above, Societies must confirm the existence of the Unique Population Registry Key (CURP) with the National Population Registry, as well as that the data of this and those provided in the form coincide with each other.

Likewise, they must compare the photographs of the voter credential and the face, in order to make facial biometric recognition between them, ensuring that both coincide according to the reliability level established in fraction IV of Article 4 of this Annex, and validate the security elements of the received voter credential, in order to detect if said document presents alterations or inconsistencies, for which they must have the necessary technology for this.

Additionally, Societies must verify the coincidence of the data of the voter credential issued by the National Electoral Institute listed below, with the records of the Institute itself:

a)

The Credential Identifier Code (CIC), which is printed on the voter credential.

b)

Year of registration.

c)

Voter Key.

d)

Number and year of issuance.

Societies must verify that the paternal surnames, maternal surnames, and name or names, as they appear on the presented voter credential, coincide with the records of the National Electoral Institute or the National Population Registry.

IV.

They must inform the applicant of the procedure that will be followed in the development of the real-time communication, what are the accesses to the media for its realization, as well as deliver a one-time use code, which will be required from the applicant at the beginning of the communication.

V.

The communication must be carried out in accordance with the dialogue guides established by the Societies, and will be recorded and preserved without edits in its total duration. Additionally, Societies must observe the following:

a)

Register the time and date of the realization of the communication.

b)

Verify that the quality of the image and sound allow the full identification of the applicant, according to the parameters established by the Societies themselves for such effect.

c)

Corroborate, during the communication with the applicant, the information that they have sent in the form and require them to show the rest of the documentation sent jointly with this.

In the event that the applicant is already a Client of the Society, they must authenticate them using a Category 1 Authentication Factor.

d)

Require the applicant to show their voter credential issued by the National Electoral Institute, both on the front and back side, confirming that it contains the same data and photograph of the credential that they sent along with the form.

e)

Take images of the applicant and the presented voter credential, on the front and back, in which the date and time in which they were taken will be stamped, obtained from a protected time server.

f)

Use specialized technology that allows them to achieve reliable identification of the interviewee, with the reliability level established in fraction IV of Article 4 of this Annex, ensuring that there is coincidence between their face, the photograph of said interviewee, and that of the previously received voter credential. The foregoing will be a condition to proceed to the stage of formalization of the opening of the deposit or credit account intended to be contracted.

g)

Identify suspicious behavior patterns that could indicate that the person being interviewed is not who they say they are.

VI.

Societies must suspend the contracting process with the applicant when any of the following cases occur:

a)

The image or sound quality does not allow full identification of the applicant.

b)

The applicant does not present their voter credential; the data obtained from it does not coincide with the records of the National Electoral Institute, or the result of the validation of the elements of the aforementioned voter credential, or of the biometric verifications of the applicant's face, does not reach the effectiveness or reliability level referred to in Article 4, fractions III and IV of this annex.

c)

The Unique Population Registry Key (CURP) does not coincide with the information of the National Population Registry.

d)

The one-time use code required from the applicant is not confirmed by them.

e)

The Society's personnel having the online communication identifies an atypical or risky situation, or has doubts about the authenticity of the voter credential or the identity of the applicant.

f)

Interruptions in the connection occur.

The technology used for these procedures must be approved by the risk manager or their equivalent or, in case of not having this, by the audit committee, the board of directors, or the sole administrator of the Society.

Societies may agree during the online communication for the celebration of deposit account contracts referred to in this article, the contracting of the associated Electronic Services for such accounts, without allowing that through the services contracted in accordance with what is established in this article, instructions are given to carry out operations charged to other accounts of the same Client. The aforementioned prohibition will not be applicable when the Client goes to the Offices to carry out the contracting of the Electronic Services.

Societies must provide in the contracts they celebrate with their Clients that when these decide to omit requesting the Category 1 Authentication Factor during the online communication referred to in this article and the Clients do not recognize contractings in their name for deposit accounts or credits of the

referred to in this article with the procedure described, these will assume the risks and, therefore, the costs of the credits, making the corresponding clarifications before the credit information societies, as well as the cancellation of the deposit account or the credit in question, when so claimed by the Client.

For the purposes of this Annex, Factor of Authentication Category 1 and Electronic Services shall be understood as those defined in the General Provisions applicable to the activities of savings and loan cooperative societies issued by the Commission or those that replace them.

The procedures established in the articles of this Annex shall not be applicable when the Societies enter into contracts with their Clients under the terms of Chapter IV of Title Two of the General Provisions applicable to the activities of savings and loan cooperative societies issued by the Commission or those that replace them.

Article 2.- The Societies must have the necessary means for the transmission and safeguarding of the information, data, and files generated in the procedures referred to in Article 1 of this Annex, which guarantee their integrity, the correct reading of the data, the impossibility of manipulation, as well as their adequate conservation and location.

The Societies may use technological improvements that help compensate for the clarity of the images, approved by their risk manager or equivalent or, in case they do not have one, by the audit committee, the board of directors, or sole administrator, for such purposes, when the identification documents are shown and facial recognition of the applicant is performed.

Article 3.- The Commission may approve non-presential identification mechanisms for potential Clients other than those indicated in Article 1 of this Annex, provided that the Societies demonstrate that the technology used, in the judgment of the Commission itself, is reliable to identify the natural person in question and that the existence of the Unique Population Registry Key is verified with the National Population Registry or some other verifiable identification element against the records of some Mexican authority, as well as the correspondence of the data.

Article 4.- The Societies, when requesting the approvals referred to in Articles 1 and, where applicable, Article 3, must present the following:

I. The detailed description of the process, which must be approved by the risk manager or, in case they do not have one, by the audit committee, the board of directors, or sole administrator, as well as the technological infrastructure used in each part of it.

II. Regarding identification mechanisms referred to in Article 3, the method of validation of the identification documents that will be admitted to carry out the contracting in question.

III. Evidence that the means of verifying the validity of the Clients' or potential Clients' identification documents have the effectiveness approved by the risk manager or their equivalent or, in case they do not have one, by the audit committee, the board of directors, or sole administrator.

IV. Evidence that the facial identification recognitions used have the level of reliability determined by the risk manager or their equivalent or, in case they do not have one, by the audit committee, the board of directors, or sole administrator.

V. The quality standards of the image and sound that will be required to carry out online communication.

VI. Where applicable, the description of the Authentication Factors that will be required of the Client.

VII. The mechanisms through which they will ensure compliance with what is provided in Article 2 of this Annex.

When the Societies intend to modify the procedures described in Articles 1 and, where applicable, Article 3 of this Annex, they will require prior approval from the Commission.

Mexico City, March 11, 2019. - The Secretary of Finance and Public Credit, Carlos Manuel Urzúa Macías. - Signature.

In the document you are viewing, there may be text, characters, or objects that are not displayed correctly due to conversion to HTML format, so we recommend always taking the digitized image of the DOF or the PDF file of the edition as a reference. The content, form, and scope of published documents are the strict responsibility of their issuer.

INQUIRY

BY DATE

Do Lu Ma Mi Ju Vi Sá

INDICATORS

Exchange Rate and Rates as of 08/28/2026

DOLLAR 16.9712 UDIS

8.808812 TIIE 28 DAYS

6.7559% TIIE 91 DAYS

6.7931% TIIE 182 DAYS

6.8474% TIIE DE FONDEO

6.50%

See more

SURVEYS

Did you like the new image of the Official Federal Gazette website?

No

Yes

Official Federal Gazette

Río Amazonas No. 62, Col. Cuauhtémoc, C.P. 06500, Mexico City Tel. (55) 5093-3200, where you can access our service menu

Electronic address: dof.gob.mx

113

LEGAL NOTICE | SOME RIGHTS RESERVED © 2026