Resolution reforming, adding and repealing various general provisions under Article 91 of the Investment Funds Law

DOF: 22/07/2019

RESOLUTION reforming, adding and repealing various of the general provisions referred to in Article 91 of the Investment Funds Law

A seal with the National Coat of Arms appears at the margin, which reads: United Mexican States.- GOVERNMENT OF MEXICO.-

TREASURY.- Ministry of Finance and Public Credit.

RESOLUTION REFORMING, ADDING AND REPEALING VARIOUS OF THE GENERAL PROVISIONS REFERRED TO IN ARTICLE 91 OF THE INVESTMENT FUNDS LAW

CARLOS MANUEL URZÚA MACÍAS, Secretary of Finance and Public Credit, based on the provisions of articles 31, fractions VIII and XXXIV, of the Organic Law of the Federal Public Administration; 91 of the Investment Funds Law, in exercise of the powers conferred upon me by article 6, fraction XXXIV, of the Internal Regulations of the Ministry of Finance and Public Credit, and with the prior opinion of the National Banking and Securities Commission issued via letter number 213-2/78943/11/ 2019 dated May 30, 2019; and

CONSIDERING

That during the 2016-2017 period, Mexico was evaluated within the framework of the Fourth Round of Mutual Evaluation of the Financial Action Task Force (FATF), in order to examine its level of compliance with international standards in matters of prevention of money laundering and terrorist financing;

That, as a result of the above, on January 3, 2018, the FATF published the "Mutual Evaluation Report" through which said intergovernmental entity made various recommendations to Mexico in order to strengthen its regime for the prevention of money laundering and terrorist financing;

That for the above reason, the Ministry of Finance and Public Credit has considered making various modifications to the general provisions that establish the minimum criteria and procedures in matters of prevention of money laundering and terrorist financing for the investment fund sector, this with the objective of addressing the FATF recommendations and strengthening the regime in this matter;

That, in addition to the reform carried out on March 23, 2017 to the general provisions in matters of prevention of money laundering and terrorist financing applicable to the investment fund sector, to help improve compliance with FATF Recommendations 1 and 10, it is specified in the legal framework the prohibition for investment fund operating companies and fund share distributors to carry out simplified identification measures for their clients when they suspect that the resources, assets or securities that said clients intend to use to carry out an operation, could be related to money laundering or terrorist financing;

That likewise, in compliance with FATF Recommendation 10, it is necessary to strengthen the legal framework regarding the client identification and knowledge policy for the investment fund sector, establishing the circumstances under which the identification process may be suspended, in order to prevent the commission of money laundering and terrorist financing crimes, among others; and, if applicable, to report the respective unusual operation report to the competent authority;

That, to better address FATF Recommendation 12, it is convenient to establish that investment fund operating companies and fund share distributors determine whether the beneficial owners of their clients have the status of politically exposed persons, whether national or foreign, in accordance with the applicable provisions, to be able to apply the appropriate customer due diligence measures;

That, on the other hand, since investment fund operating companies and fund share distributors can provide financial services through new technologies, which have been recognized by the Mexican Government with the issuance of the Law to Regulate Financial Technology Institutions and its secondary provisions, in compliance with FATF Recommendation 15 and what is stated in the Report of January 3, 2018, it is necessary that these evaluate the risk of providing financial services through said technologies, so it is convenient to establish such obligation, prior to its implementation and development, as well as for its monitoring;

That, even though currently investment fund operating companies and fund share distributors comply with the obligation of customer due diligence in a presencial and traditional manner, with some exceptions recognized in the regulation, in the existence of the digital era, new technologies and electronic media, in the integration, conservation, maintenance, verification, etc., of data, information and documents, it is necessary, as with other regulated participants in the matter, to recognize the legal possibility that investment fund operating companies and fund share distributors can comply with their obligations in matters of prevention of money laundering and terrorist financing through said electronic media, of course with the responsibility of complying with the applicable regulations to the effect so that they have the value that corresponds in law;

That, with the aim of prioritizing efforts and resources in the new obligations established in this resolution, it is considered convenient to eliminate the obligation for investment fund operating companies and fund share distributors to send the training report, without this implying that they should not have such training, and

That once the opinion of the National Banking and Securities Commission has been heard, I have deemed it appropriate to issue the following:

RESOLUTION REFORMING, ADDING AND REPEALING VARIOUS OF THE GENERAL PROVISIONS REFERRED TO IN ARTICLE 91 OF THE INVESTMENT FUNDS LAW

SINGLE ARTICLE.- The 2nd, fractions I to XXIV; 3rd last paragraph; 4th, fractions I to V, VI, first and penultimate paragraphs, VIII, IX, third, fifth and last paragraphs; 6th, first paragraph; 8th, fraction I, fraction II, item a); 9th; 11th, 12th, last paragraph; 13th; 17th, first, second and last paragraphs; 17th-1; 17th-2; 17th-3; 17th-4; 17th-5 becoming 17th-6; 18th, second paragraph; 21st, second, seventh and last paragraphs; 22nd; 23rd; 24th, third, fourth and last paragraphs; 25th, fraction II, item b); 27th; 28th, first paragraph and fraction III; 32nd, second and last paragraphs; 35th, first and third paragraphs; 37th, fraction I, I Bis, III, IX, X and last paragraph; 38th, last paragraph; 41st, fractions I, I Bis, IV, VII and last paragraph; 42nd, fractions I, II, II, Ter; III, IV, XIV, XV and penultimate paragraph; 44th, fraction I; 46th, first paragraph, fractions II, V, IX Bis and X; 52nd, first paragraph; 54th, first and second paragraphs; 58th; 59th; 63rd, last paragraph; 65th, last paragraph, Annex 1; are REFORMED; the 2nd, fractions XXV to XXXV; 4th, fraction VI, second, third and fourth paragraphs, shifting the rest in order; 4th Bis; 6th, second, third and last paragraphs; 9th Bis, 9th Ter; 13th Bis; 17th, third paragraph, shifting the rest in order; 17th-1, second paragraph; 17th-6; 20th, second paragraph; 21st, fourth and penultimate paragraphs; 25th, penultimate and last paragraphs; 37th, fraction XI; 46th, fractions II, second paragraph, V Bis and XI; 62nd-1, last paragraph; a Chapter XIV Bis titled "Novel Models"; 62nd-2; Annex 2; are ADDED; and the 2nd, fraction X Bis, XIII Bis; 42nd, fraction II Bis; 44th, last paragraph; all of them of the General Provisions referred to in Article 91 of the Investment Funds Law, are REPEALED, to remain as follows:

2nd.- ...

I. Archive or Registry, the set of data and documents that are conserved or stored in printed format or in electronic, optical or any other technology media, provided that, in these latter media, it is ensured that the information has remained intact and unaltered from the moment it was generated for the first time in its definitive form and is accessible for subsequent consultation, having as its purpose to integrate, conserve and evidence the Operations of the Entities;

II. Beneficiary, ...

III.

Client, ...

Natural persons who certify to the Entities subject to the tax regime applicable to natural persons with business activity, in terms of sections I and II of Chapter II of Title IV of the Income Tax Law, will be considered as legal entities for the purposes of what is established in these Provisions, except for what refers to the integration of the file of these, which must be carried out in terms of what is established in fraction I of the 4th and, when applicable, of the 4th Bis of these Provisions, and in which, the Entities must additionally require the Federal Taxpayer Registry key (with homoclave) and, if applicable, tax identification number and/or equivalent, of said natural persons, as well as the country or countries that assigned them;

IV.

Commission,...

V.

Committee,...

VI.

Control,...

VII. Concentrating Account,...

VIII. Device, the equipment that allows access to the worldwide network called Internet, which can be used to open accounts or conclude contracts, as well as to carry out Operations;

IX.

Entities,...

X. Foreign Financial Entity,...

X Bis. Repealed.

XI. Trust,...

XII. Electronic Signature, to the characteristics or data in electronic form recorded in a Data Message, or attached or logically associated with it by any technology, which are used to identify the subscriber or originator of the instruction of some Operation or financial service and indicate that the signer approves the information contained in the Data Message, and which produces the same legal effects as the handwritten signature;

XIII. Advanced Electronic Signature, to the digital certificate that natural and legal persons must have, in accordance with what is provided by article 17-D of the Federal Tax Code or in accordance with what is provided by the Commercial Code;

XIII Bis. Repealed.

XIV.

Geolocation, to the geographic coordinates of latitude and longitude where the Device is located;

XV.

Risk Level,...

XVI. Technological Infrastructure, to the computer equipment, data processing and communications facilities, equipment and communications networks, operating systems, databases, applications and systems that Entities use to support their operations;

XVII.

Monetary Instrument,...

XVIII. Law,...

XIX. List of Blocked Persons,...

XX. Compliance Manual, the document referred to in the 57th of these Provisions;

XXI. Data Message, to the information generated, sent, received or archived by electronic, optical or any other technology means, in accordance with the Commercial Code;

XXII. Mitigants,...

XXIII. Novel Model, to that which for the provision of financial services uses tools or technological means with modalities different from those existing in the market at the time the temporary authorization referred to in the Law to Regulate Financial Technology Institutions is granted;

XXIV. Compliance Officer,...

XXV.

Operations,...

XXVI. Unusual Operation,...

XXVII. Operation Internal Concerning,...

XXVIII. Relevant Operation,...

XXIX.

Politically Exposed Person,...

XXX. Beneficial Owner,...

XXXI. Resource Provider,...

XXXII.

Risk,...

XXXIII.

Secretariat,...

XXXIV. Obligated Subjects,...

XXXV. Terms and Conditions, to the legal bases and statements that Entities establish with their Clients through computer applications, interfaces, Internet pages or any other electronic or digital communication medium in a format established by the Entity itself for the celebration of Operations, activities or services with these.

3rd.- ...

...

The policy and guidelines mentioned above must be an integral part of the Entity's Compliance Manual.

4th.- Entities must integrate and conserve an identification file for each of their Clients, prior to these, in person, opening an account or concluding a contract to carry out Operations of any type.

To integrate the identification files of Clients, they must comply, at least, with the following:

I.

In the case of Clients who are natural persons who declare to the Entity to be of Mexican nationality or of foreign nationality, in conditions of temporary or permanent resident stay in terms of the Migration Law, or in the quality of diplomatic and consular representations in terms of the Guidelines for the issuance of non-ordinary visas:

a)

The following identification data:

i.

Paternal surname, maternal surname and name or names without abbreviations.

ii.

Gender.

iii.

Date of birth.

iv.

State of birth, when applicable.

v.

Country of birth.

vi.

Nationality.

vii.

Occupation, profession, activity or business sector to which the Client is dedicated.

viii.

Private address at their place of residence (composed of the name of the street, avenue or way in question, duly specified; exterior number and, if applicable, interior; neighborhood or urbanization; borough, municipality or similar political division that corresponds, if applicable; city or population, state, province, department or similar political division that corresponds, if applicable; postal code and country).

ix.

Phone number(s) where they can be located.

x.

Email, if applicable.

xi.

Unique Population Registry Key, Federal Taxpayer Registry key (with homoclave), tax identification number and/or equivalent, as well as the country or countries that assigned them, when available.

xii.

Serial number of the Advanced Electronic Signature, if they have one.

In addition to the above, in the case of persons who have their place of residence abroad and, at the same time, have an address in national territory where they can receive mail addressed to them, the Entity must record in the file the data relating to said address, with the same elements as those contemplated in this fraction.

b)

Simple copy of the following documents:

i.

Personal identification, which must be, in all cases, an original official document issued by competent authority, valid on the date of its presentation, containing the photograph, signature and, if applicable, address of the Client themselves.

For the purposes of what is provided by this item, the following documents issued by Mexican authorities will be considered as valid personal identification documents: the voter credential, the passport, the professional ID, the national military service card, the consular registration certificate, the military identity card, the affiliation card to the National Institute of Older Adults, the credentials and cards issued by the Mexican Institute of Social Security, by the Institute of Social Security and Services for State Workers, by the Institute of Social Security for the Mexican Armed Forces or by Popular Insurance, the driver's license, the credentials issued by federal, state and municipal authorities and the other national identifications that, if applicable, the Commission approves. Likewise, regarding natural persons of foreign nationality referred to in this fraction, in addition to those previously referred to in this paragraph, the passport or passport card or documentation issued by the National Institute of Migration that certifies their migratory status, as well as the accreditation card issued by the Ministry of Foreign Affairs to diplomatic or consular bodies, will be considered as valid personal identification documents.

ii.

Certificate of the Unique Population Registry Key, issued by the Ministry of the Interior, a document in which the assignment of the tax identification number and/or equivalent issued by competent authority, as well as of the Advanced Electronic Signature, if they have them, is recorded. It will not be necessary to present the certificate of the Unique Population Registry Key if it appears in another document or official identification.

Entities will not be obligated to collect, include and conserve in the Client's identification file a simple copy of the documents referred to in the previous paragraph, provided that the Entities integrate into it the evidence that the documents and/or Client data were presented and/or validated before the corresponding authority.

iii.

Proof of address, which may be any receipt for payment of home services such as, among others, electricity supply, telephone, natural gas, property tax or rights for water supply or bank statements, all of them with an age not greater than three months from their date of issuance, or the valid lease contract on the date of presentation by the Client, the proof of registration before the Federal Taxpayer Registry, as well as the others that, if applicable, the Commission approves.

Notwithstanding the above, when the address stated in the contract concluded by the Client with the Entity coincides with that of the Client's voter credential issued by Mexican authority, in case they have been identified with the same, this will function as the proof of address referred to in the previous paragraph.

iv.

Declaration of the natural person, which may be granted in writing, by optical means or by any other technology, which may be included in the application documentation for the celebration of Operation or in the respective contract, in which it is stated that such person acts for these purposes on their own behalf or on behalf of a third party, as the case may be.

In the event that the natural person declares to the Entity that they act on behalf of a third party, such Entity must observe what is provided in fraction VI of this Provision regarding the Beneficial Owner of the resources involved in the contract corresponding.

v.

In the event that the natural person acts as an agent of another person, the Entity respective must collect and integrate into the identification file of the Client in question, a simple copy of the power of attorney or of the certified copy of the document issued by a public notary, as applicable, in the terms established in common legislation, which certifies the powers conferred to the agent, as well as an official identification, and proof of address of this, which meet the requirements indicated in this fraction I regarding said documents, independent of the data and documents relating to the principal.

II.

Regarding Clients who are legal entities of Mexican nationality:

a)

The following identification data:

i.

Trade name or corporate name.

ii.

Commercial activity, activity or corporate object.

iii.

Nationality.

iv.

Federal Taxpayer Registry key (with homoclave) and, if applicable, number of tax identification and/or equivalent, as well as the country or countries that assigned them.

v.

Serial number of the Advanced Electronic Signature.

vi.

Address (composed of the name of the street, avenue or way in question, duly specified; exterior number and, if applicable, interior; neighborhood; borough or municipality, or similar political division that corresponds, if applicable; city or population; entity federative and postal code).

vii.

Phone number(s) of said address.

viii.

Email, if applicable.

ix.

Date of constitution.

x.

Name or names and paternal and maternal surnames, without abbreviations, of the administrator or administrators, director, general manager or legal representative who, with their signature, can obligate the legal entity for the purposes of opening an account, concluding a contract or carrying out the Operation in question, coming from a valid official personal identification document valid, issued by competent authority, in accordance with what is provided by numeral i., item b), fraction I of this Provision.

b)

Simple copy of the following documents:

i.

Testimony or certified copy of the public instrument that certifies its legal existence registered in the public registry that corresponds, according to the nature of the legal entity, or of any instrument in which the data of its constitution and those of its registration in said registry are recorded, or well, of the document that, according to the regime that applies to the legal entity in question, credibly certifies its existence.

In the event that the legal entity is of recent constitution and, in virtue of this, not yet registered in the public registry that corresponds according to its nature, the Entity in question must obtain a written document signed by a person legally authorized to certify their personality in terms of the public instrument that certifies their legal existence referred to in item b) numeral iv., of this fraction, in which the obligation to carry out the respective registration and provide, in due course, the data corresponding to the Entity itself is recorded.

ii.

Tax Identification Card issued by the Secretariat and, if applicable, of the document in which the assignment of the tax identification number and/or equivalent issued by competent authority and certificate of the Advanced Electronic Signature are recorded.

iii.

Proof of address referred to in item a) of this fraction II, in terms of what is stated in item b), numeral iii., of the previous fraction I.

iv.

Testimony or certified copy of the instrument containing the powers of the representative or legal representatives, issued by a public notary, when not contained in the public instrument that certifies the legal existence of the legal entity in question, as well as the personal identification of each of said representatives, in accordance with item b), numeral i., of the previous fraction I.

Regarding federal, state and municipal dependencies and entities, as well as other Mexican legal entities of public law, to certify their legal existence as well as to prove the powers of their legal representatives and/or agents, the laws, regulations, decrees or organic statutes that create and regulate their constitution and operation shall apply, and if applicable, a copy of their appointment or by public instrument issued by a notary, as applicable.

c)

Client information that allows the Entity to know:

i.

Shareholder structure or partners, as applicable.

ii.

In the event that it has a Risk Grade other than low, its internal corporate structure; that is, the organizational chart of the Corporate Client, considering at least the full name and position of those individuals who hold positions between the General Manager and the hierarchy immediately below it, as well as the full name and corresponding position of the members of its board of directors or equivalent.

Likewise, the Entities must identify the Beneficial Owners of their Corporate Clients that exercise Control over them in terms of the second paragraph of fraction VI of the 2nd of these Provisions, in accordance with what is established in fraction VI of this Provision.

When there is no natural person who owns or controls, directly or indirectly, a percentage equal to or greater than 25% of the capital or voting rights of the corporate entity in question, or who by other means exercises Control, direct or indirect, over the corporate entity, it will be considered that the administrator or administrators thereof exercise said Control, understanding that administration is exercised by the natural person designated for such effect by this.

When the designated administrator is a legal entity or Trust, it will be understood that Control is exercised by the natural person appointed as administrator by said legal entity or Trust.

For the purposes of this subsection, the Entities must obtain a written declaration, by electronic, optical, or any other technology means, from the legal representative of the Corporate Client in question, indicating who their Beneficial Owners are in terms of this subsection.

In the event that the Entities have indications that make the truthfulness of the declared information questionable, they must take reasonable measures to determine and identify the Beneficial Owners of the corresponding Corporate Client.

III.

With respect to Clients who are persons of foreign nationality, the Entity in question must observe the following:

a)

For the case of the natural person who declares to the Entity that they do not have the status of temporary resident or permanent resident in terms of the Migration Law, or in the capacity of diplomatic and consular representations in terms of the Guidelines for the issuance of non-ordinary visas:

i.

The respective identification file must contain the same data as those indicated in subsection a) of the previous fraction I, with the exception of the data of the state of birth.

ii.

Collect and include in said file a simple copy of the following documents:

ii.1.

Passport or passport card and official document issued by the National Institute of Migration, when the latter is available, which accredits their entry or legal stay in the country or, alternatively, the accreditation card issued by the Secretariat of Foreign Relations to diplomatic and consular bodies.

ii.2.

Document accrediting the Client's domicile at their place of residence, in terms of numeral iii., subsection b), of fraction I of this Provision.

ii.3.

Declaration in terms of subsection b), numeral iv., of fraction I of this Provision.

b)

For the case of foreign legal entities:

i.

The respective identification file must contain the following data:

i.1.

Name or corporate name.

i.2.

Commercial activity, activity, or corporate purpose.

i.3.

Nationality.

i.4.

Taxpayer Registry Key (with homoclave) and/or tax identification number and/or equivalent, the country or countries that assigned them, and, if applicable, the serial number of the Advanced Electronic Signature.

i.5.

Domicile (composed of the name of the street, avenue, or route in question, duly specified; exterior number and, if applicable, interior; neighborhood or urbanization; borough, municipality, or similar political demarcation that corresponds, if applicable; city or population, state, province, department, or similar political demarcation that corresponds, if applicable; postal code and country).

i.6.

Telephone number(s) of said domicile.

i.7.

Email, if applicable.

i.8.

Date of incorporation.

ii.

Collect and include in said file a simple copy of, at least, the following documents:

ii.1.

Document that credibly proves their legal existence, document in which the assignment of the tax identification number and/or equivalent issued by the competent authority is recorded, as well as obtaining the information and collecting the data referred to in subsection c) of fraction II of this Provision.

The Entity must require that the document referred to in the previous paragraph be duly legalized or, in the event that the country where said document was issued is a party to the "Convention Abolishing the Requirement of Legalization for Foreign Public Documents", adopted in The Hague, Netherlands, on October 5, 1961, it will suffice that said document bears the apostille referred to by said Convention.

In the event that the respective Client does not present the document duly legalized or apostilled, it will be the responsibility of the Entity to ensure the authenticity of said documentation.

ii.2.

Proof of domicile referred to in subsection b) above, in terms of what is stated in subsection b), numeral iii., of fraction I of this Provision.

ii.3.

Testimony or certified copy of the instrument containing the powers of the legal representative or representatives, issued by a public notary, when not contained in the document that credibly proves the legal existence of the corporate entity in question, as well as the personal identification of said representatives, in accordance with subsection b), numeral i., of fraction I or subsection a) of this fraction III, as applicable.

In the case of those legal representatives who are outside the national territory and who do not have a passport or passport card, the personal identification must, in any case, be an original official document issued by the competent authority of the country of origin, valid on the date of its presentation, containing the photograph, signature, and, if applicable, domicile of the said representative.

For the purposes of the foregoing, driver's licenses and credentials issued by federal authorities or equivalents of the country in question will be considered valid personal identification documents. The verification of said documents will be the responsibility of the Entities.

IV.

With respect to the societies, dependencies, and entities referred to in Annex 1 of these Provisions:

a)

The following identification data:

i.

Name or corporate name.

ii.

Activity or corporate purpose.

iii.

Taxpayer Registry (with homoclave) and, if applicable, tax identification number and/or equivalent, as well as the country or countries that assigned them.

iv.

Serial number of the Advanced Electronic Signature, when they have it.

v.

Domicile (composed of the name of the street, exterior number and, if applicable, interior, neighborhood, city or population, borough or municipality, state and postal code).

vi.

Nationality.

vii.

Telephone number(s) of said domicile.

viii.

Email, if applicable.

ix.

Full name without abbreviations of the administrator or administrators, director, general manager, or legal representative who, with their signature, can bind the society, dependency, or entity for the purposes of celebrating the Operation in question.

b)

Simple copy of the following documents:

i.

Testimony or certified copy of the instrument containing the powers of the legal representative or representatives, issued by a public notary.

With respect to the representative of a credit institution or brokerage house, the certification of their appointment issued by a competent official in terms of article 90 of the Credit Institutions Law or 129 of the Securities Market Law, as applicable.

To accredit the powers of the representatives of federal, state, and municipal dependencies and entities, as well as other Mexican legal entities of public law, the provisions of the last paragraph of subsection b) of fraction II of this Provision shall apply.

ii.

Personal identification of such representatives, in accordance with numeral i., subsection b), of the previous fraction I.

The Entities may apply the simplified measures referred to in this fraction, provided that the aforementioned societies, dependencies, and entities have been classified as Clients with a Low Risk Grade in terms of the 21st of these Provisions.

V.

With respect to Resource Providers, the following data:

a)

In the case of natural persons:

i.

Paternal surname, maternal surname, and name or names without abbreviations.

ii.

Date of birth.

iii.

Nationality.

iv.

Private domicile (composed of the name of the street, avenue, or route in question, duly specified, exterior number and, if applicable, interior, neighborhood, city or population, borough or municipality, state, and postal code).

v.

Taxpayer Registry Key (with homoclave), tax identification number and/or equivalent, the country or countries that assigned them, Unique Population Registry Key, as well as the serial number of the Advanced Electronic Signature, when they have them.

vi.

Occupation, profession, activity, or business sector to which the Resource Provider is dedicated.

b)

In the case of legal entities:

i.

Name or corporate name.

ii.

Nationality.

iii.

Taxpayer Registry Key (with homoclave) and, if applicable, tax identification number and/or equivalent, as well as the country or countries that assigned them.

iv.

Serial number of the Advanced Electronic Signature, when they have it.

v.

Domicile (composed of the name of the street, avenue, or route in question, duly specified; exterior number and, if applicable, interior; neighborhood; city or population; borough or municipality; state, and postal code).

VI.

When the Entity has identified the existence of any Beneficial Owner, either at the time of contract opening or during the commercial relationship, it must collect the same data and documents as those established in fractions I or III of this Provision, as applicable. With respect to the domicile, it will suffice to obtain the data and the document of the domicile where they can be located.

When the obligation to identify the Beneficial Owner derives from a Client classified with a Low Risk Grade, the document referred to in numeral iii., of subsection b), of fraction I, as well as number ii.2., of numeral ii., of subsection b), of fraction III of this Provision, respectively, shall not be collected.

Additionally, the Entity must identify if the Beneficial Owner is a Politically Exposed Person. Likewise, when the Beneficial Owner of a Client classified with a High Risk Grade is a Politically Exposed Person, the Entity must obtain the approval referred to in the 22nd of these Provisions to initiate or continue the commercial relationship, as well as comply with what is established in the second, third, and last paragraphs of the 24th of these Provisions.

The Entities must establish in their Compliance Manual, or in another document or manual prepared by them, the criteria, measures, or procedures they will adopt to comply with what is provided in this fraction.

With respect to legal entities whose titles or securities are traded on any stock exchange in the country or in foreign stock markets recognized as such in terms of the general provisions applicable to stock exchanges published in the Official Journal of the Federation on May 15, 2017, and their respective modifications, as well as those subsidiaries in which they have a majority participation of fifty percent in their share capital, the Entities will not be obligated to collect the aforementioned identification data and documents, considering that they are subject to provisions in matters of stock exchange on information disclosure.

The Secretariat will issue the guidelines that the Entities may consider for compliance with what is provided in the first paragraph of this fraction, which will be made known through the electronic means established for such effect by the Commission.

VII.

With respect to persons who appear as co-owners or authorized third parties in the account opened by the Client, as well as in the Operations carried out by them, the Entities must observe the same requirements contemplated in this Provision for the titular Clients.

VIII. With respect to Beneficiaries, the Entities will collect at least the following data: paternal surname, maternal surname, and name or names without abbreviations; private domicile (composed of the same elements as those indicated in subsection a) of fraction I of this Provision), when this is different from the contract holder's, as well as the date of birth of each of them.

In the cases referred to in the 12th of these Provisions, the Entities may collect the data of the Beneficiaries referred to in the previous paragraph, after the contracts are celebrated, through the means determined by the Entities themselves; said means must be contemplated in the Compliance Manual of the Entity itself.

IX.

With respect to Trusts:

a)

It must contain the following data recorded:

i.

Number or reference of the Trust and, if applicable, Taxpayer Registry (with homoclave), tax identification number and/or equivalent, the country or countries that assigned them, as well as the serial number of the Advanced Electronic Signature.

ii.

Purpose of the Trust and, if applicable, indicate the vulnerable activity(ies) it carries out in terms of article 17 of the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin.

iii.

Place and date of constitution or celebration of the Trust.

iv.

Name or corporate name of the fiduciary institution.

v.

Trusted assets (goods and rights).

vi.

Contributions by the settlors.

vii.

Identification data, in terms of this Provision, as applicable, of the settlors, beneficiaries, fiduciary delegates, and, if applicable, members of the technical committee or equivalent governing body, legal representative(s), and legal proxy(ies).

Without prejudice to the foregoing, the investment fund operating society that does not act as a fiduciary may comply with the obligation to collect data related to the members of the technical committee or equivalent governing body, indicating only the name or names and paternal and maternal surnames, without abbreviations, of these, as well as their date of birth.

b)

Simple copy of the following documents:

i.

Contract, testimony, or certified copy of the public instrument that accredits the celebration or constitution of the Trust, registered, if applicable, in the public registry that corresponds, or, alternatively, the document that, according to the regime applicable to the Trust in question, credibly proves its existence.

In the event that the Trust is of recent constitution and, in virtue thereof, is not yet registered in the public registry that corresponds according to its nature, the Entity in question must obtain a written document signed by a person legally authorized to accredit their personality in terms of the public instrument referred to in subsection b) numeral iii., of this fraction, in which the obligation to carry out the respective registration and provide, in due course, the corresponding data to the Entity itself is recorded.

ii.

Proof of domicile, in terms of what is stated in subsection b), numeral iii., of fraction I of this Provision.

iii.

Testimony or certified copy of the instrument containing the powers of the legal representative(s), legal proxy(ies), or fiduciary delegate(s), issued by a public notary, when not contained in the public instrument that accredits the legal existence of the Trust in question, as well as the personal identification of each of said representatives, proxies, or fiduciary delegates, in accordance with subsection b), numeral i., of fraction I of this Provision.

iv.

Tax Identification Card issued by the Secretariat and, if applicable, the document in which the assignment of the tax identification number and/or equivalent issued by the competent authority is recorded, as well as proof of the Advanced Electronic Signature.

The Entities acting as fiduciaries must integrate the identification file of the beneficiaries who are not individualized in the contract, at the moment they come to exercise their rights derived from the Trust contract. The obligation established in this paragraph will not be applicable to those Trusts where there is securities intermediation, in which case the obligation will fall on the financial entity that carries out said intermediation.

The Entities will not be obligated to integrate the identification file when it comes to Trusts in which the contributions destined for labor benefits or social security of the workers come from the workers themselves or from the employers, and the settlor is always a public entity that allocates the funds in question for the aforementioned purposes.

With regard to the integration and conservation of the identification files of beneficiaries in Trusts that are constituted to fulfill labor or social security benefits of a general nature, in which contributions are received from the dependencies and entities of the Federal Public Administration, of Mexico City, or of any state or municipality, as well as from other Mexican legal entities of public law or from companies, their unions, or persons belonging to both, the following must be observed:

(a)

...

(b)

In the case referred to in the previous subsection, the Entities must contractually agree with the Client that in their substitution they integrate and conserve the identification files of the beneficiaries, mechanisms so that the Entities themselves can:

(i)

verify, randomly, that said files are integrated in accordance with what is stated in these Provisions, and (ii) conserve the identification file of those workers or personnel, once they cease to provide their services to the requesting Client. In any case, the Entities will be responsible at all times for the compliance with the obligations that, in matters of Client identification, these Provisions establish, to which effect, they must establish in their Compliance Manual, the mechanisms they will adopt to comply with what is stated in this paragraph.

The Entities that carry out Operations with Trusts with respect to which they do not act as fiduciaries, may comply with the obligation (a) to collect the document referred to in numeral i., of subsection b) of this fraction, and (b) referred to in fraction VI of this Provision, respectively, through a certificate signed by the fiduciary delegate and the Compliance Officer of the Entity, institution, or society acting as fiduciary, which must contain the information indicated in subsection a) above, as well as the obligation to keep said documentation available to the Secretariat and the Commission, in order to remit it, upon request by the latter, within the term established by the Commission itself.

...

Additionally to what is provided in the previous paragraph, the Entities must contractually agree with the commissioners the obligation of these to (i) obtain, prior to the celebration of contracts, the information and documentation for the integration of the respective identification file; (ii) keep the files available to the Secretariat or the Commission and (iii) have mechanisms so that the Entities themselves can verify that the files are integrated in accordance with what is stated in these Provisions. In any case, the Entities will be responsible for the compliance with the obligations that, in matters of Client identification, these Provisions establish, to which effect, they must establish in the Compliance Manual, the mechanisms they will adopt to comply with what is stated in the previous paragraph.

...

When the identification documents provided present strikethroughs or amendments, the Entities must collect another means of identification or, in default, request two banking or commercial references and two personal references, which include the name or names and paternal and maternal surnames without abbreviations, domicile composed of the same data as those indicated in fraction I of this Provision and telephone number of the issuer, whose authenticity will be verified by the Entities with the persons who sign such references, before the respective contract is celebrated.

...

The Entities, when collecting the simple copies of the documents that must integrate the Client identification files, in accordance with what is stated by this Provision, must ensure that these are legible and compare them against the corresponding original documents that are physically present.

...

The Entities may conserve, in their Files or Records, separately the data and documents that must form part of the identification files of their Clients, without the need to integrate both into a single physical file, provided that they have automated systems that allow them to combine said data and documents for their timely consultation by the Entities themselves or by the Secretariat or the Commission, upon request by the latter, in terms of these Provisions and the others that are applicable.

4th Bis.- The Entities that open an account or celebrate a contract through Devices in a non-presential manner with natural person Clients of Mexican nationality, in accordance with what is established in Annex 2 of these Provisions, in addition to the identification data referred to in the 4th of these Provisions, must require and obtain from their Clients the Geolocation of the Device from which

these shall open the account or enter into the contract, as applicable, as well as:

a)

Voter ID key, if applicable.

b)

Consent.

c)

Email address or mobile phone number.

d)

Account number and Standardized Banking Key (CLABE) in the financial entity or authorized Foreign Financial Entity for receiving deposits, which must correspond to the name referred to in the 4th, fraction I of these Provisions.

e)

The declaration by the natural person indicating whether they act on their own behalf or on behalf of a third party; in the event they declare acting on behalf of a third party, they must adhere to what is stated in the 4th, fraction VI of these Provisions. Such declaration may be established in the Terms and Conditions established by the Entity for this purpose.

f)

The digital version of the valid, current official personal identification document from which the data referred to in this Provision originate, which must be preserved in accordance with the applicable Mexican Official Standard on digitization and preservation of Data Messages. For the preservation of documents referred to in this subsection, Entities may consider an international standard provided that the compliance standard has at least the requirements of the Mexican Official Standard and does not contravene it.

Entities shall not proceed with the opening of the account or the celebration of the contract, as applicable, in a non-presidential manner when they have not collected the data regarding Geolocation.

The consent that Entities collect from their Clients in terms of this Provision may be obtained through Electronic Signature, Advanced Electronic Signature, or in accordance with what is stated in Annex 2 of these Provisions. Such Client consent shall serve as proof to legally establish the opening of the account, celebration of the contract, or any Operation carried out with the Entity in a non-presidential manner.

A valid, current official personal identification document for the purposes of this Provision shall be understood to be the voter credential issued by the National Electoral Institute and other national or foreign identifications that, as applicable, are approved by the Commission.

Entities may collect the digital versions of the documentation referred to in this Provision in a non-presidential manner and through optical means or any other technology.

The digital versions that Entities collect for identification purposes must allow for verification. Likewise, such digital versions must be preserved in their Files or Records in accordance with these Provisions.

Entities must establish in their Compliance Manual the criteria and mechanisms they will adopt to comply with what is stated in this Provision.

6th.- The Entity, prior to establishing or initiating a contractual relationship with a Client, must hold an in-person interview with the Client or their legal representative, in order to collect the respective identification data and documents. The results of the interview must be recorded in writing or electronically and be part of the Entity's Files or Records.

Regarding contracts entered into in accordance with the 4th Bis of these Provisions, the interview referred to in the preceding paragraph may be conducted in a non-presidential manner, using forms that interact with the Client, both in terms of what is stated in Annex 2 of these Provisions.

Regarding contracts entered into in accordance with the 4th Bis of these Provisions, Entities may enter into agreements with third parties to carry out the interview referred to in this Provision, which must be conducted in accordance with the terms established in Articles 56 Bis and 56 Bis 1 of the Law and the general provisions issued by the Commission based on those articles. In all cases, Entities falling under the scenario provided in this paragraph shall be responsible for compliance with the obligations regarding Client identification and knowledge established in these Provisions.

Likewise, with prior notice to the Commission, Entities may enter into agreements with foreign financial institutions, their branches, and subsidiaries in which they hold a participation, to carry out the interview referred to in this Provision, provided they do not operate in high-risk or non-cooperative countries identified by the Financial Action Task Force. Entities falling under the scenario provided in this paragraph shall be responsible for compliance with the obligations regarding Client identification and knowledge established in these Provisions.

8th.-...

I. The entity that compiles and maintains such file must have the Client's consent for said entity to provide the data and documents related to their identification, or the digital version of the latter, to any of the entities forming the financial group with which it intends to establish a contractual relationship, and

II. ...

a)

They may exchange the data and documents, as well as the digital versions, related to the Client's identification, in order to establish a new contractual relationship with them;

b) and c )....

9th.- Entities are prohibited from establishing or maintaining anonymous contracts or under fictitious names or where the Client or Beneficial Owner cannot be identified; therefore, they may only enter into contracts with their Clients after having fulfilled the identification requirements for them, in accordance with these Provisions.

9th Bis.- Entities shall not apply the simplified measures provided in this Chapter to their Clients when they have a well-founded suspicion or indications that the resources, assets, or securities their Clients intend to use to carry out an Operation might be related to the acts or conduct referred to in Articles 139 Quáter or 400 Bis of the Federal Penal Code.

The policies, criteria, measures, and procedures that Entities develop to determine what is stated in the preceding paragraph must be documented in their Compliance Manual.

9th Ter.- Entities may suspend the identification process of their potential Client when they reasonably estimate:

I.

That they might be related to acts or conduct referred to in Articles 139 Quáter or 400 Bis of the Federal Penal Code.

II.

That continuing with the identification process could prevent or alert the Client that the Entity considers the resources, assets, or securities to be related to acts or conduct referred to in Articles 139 Quáter or 400 Bis of the Federal Penal Code.

III.

When they identify the existence of Risks in accordance with the criteria established in the Compliance Manual.

In the event of carrying out the suspension referred to in this Provision, Entities must generate the corresponding 24-hour Unusual Operation Report with the information they have about the potential Client in question, which may be prepared manually.

The report referred to in the preceding paragraph must be sent to the Secretariat, through the Commission, within 24 hours from the time the Entity becomes aware of the information stated in this Provision, using the corresponding official format.

For the purposes of this Provision, Entities must establish in their Compliance Manual, or in another document or manual prepared by the Entity itself, the policies, criteria, measures, and procedures necessary.

11th.- Regarding mandates or commissions that Entities are authorized to perform, they must invariably compile the identification file of all parties involved in the signing of the respective instruments (mandator, mandatory, commissioner, principal), in the terms established in the 4th or 4th Bis of these Provisions, except when it concerns third parties referred to in stipulations for their benefit that are not individually identified in the respective mandate or commission contract.

12th.- ...

...

...

In the event that the transactional level established in the first paragraph of this Provision is exceeded, Entities must proceed to compile the identification file of the respective Client with all the corresponding information and documentation, in terms of what is provided in the 4th or 4th Bis of these Provisions, as well as comply with the various obligations established therein.

13th.- For the purpose of carrying out Operations through electronic, optical, or any other technology means, Entities must previously compile the Client's identification file in accordance with what is established in these Provisions; establish mechanisms to identify them in accordance with what is stated in Annex 2 of these Provisions, when applicable; and develop procedures to prevent the improper use of such means or technologies, which must be contained in their Compliance Manual.

13th Bis.- Entities must verify the data and documents that their potential Clients provide to prove their identity.

The verification referred to in the preceding paragraph may be carried out in a non-presidential manner in accordance with what is established in Annex 2 of these Provisions, to the extent applicable.

When it concerns Operations of Clients classified by Entities as Low Risk, the verification referred to in the preceding paragraph may be performed after the celebration of the respective contract. In the cases referred to in this paragraph, Entities must inform their Clients that they cannot carry out Operations until the verification process referred to in this Provision is concluded.

Entities must establish in their Compliance Manual the policies, criteria, measures, and procedures they will adopt to comply with what is stated in this Provision.

The verification of the data and documents referred to in this Provision, obtained from their Clients, may be performed by third parties without exempting Entities from compliance with the obligations provided in these Provisions.

17th.- Entities will verify that the identification files of their corporate Clients, regardless of their Risk Grade, contain all the data and documents provided in the 4th or 4th Bis, as applicable, of these Provisions, as well as that such data and documents are up to date, understanding that Entities may choose not to carry out the update of the latter if it concerns a corporate Client with a Low Risk Grade. This is in the terms and conditions that Entities establish in their own Compliance Manual. Likewise, they will verify, at least once a year, that the identification files of their Clients classified as High Risk are up to date with all the data and documents provided in the 4th, 4th Bis, 24th, and 28th of these Provisions.

If during the course of a contractual relationship with a Client, the Entity in question detects significant changes in the Client's usual transactional behavior, without justified cause for it, or doubts arise regarding the truthfulness or accuracy of the data or documents provided by the Client themselves, among other scenarios that the Entity itself establishes in its Compliance Manual, it will reclassify said Client into the corresponding higher Risk Grade, according to the results of the analysis that, as applicable, the Entity performs, and must verify and request the update of both the data and identification documents, among other measures the Entity deems convenient.

Entities may comply with the obligation to update their Clients' files in accordance with this Provision in a non-presidential manner, regardless of the form of account opening, always collecting the data and documents that are applicable according to the type of Client, and carrying out the respective verification.

Entities must establish in their Compliance Manual the policies, criteria, measures, and procedures they will adopt to comply with what is stated in this Provision, including the scenarios in which a visit to the domicile of Clients classified as High Risk must be carried out, in order to properly compile the files and/or update the corresponding data and documents, in which case the results of such visit must be recorded in the respective file.

17th-1.- Entities must design and implement a methodology to carry out a Risk assessment of the risks to which they are exposed due to their products, services, Clients, countries or geographic areas, transactions, and sending or distribution channels with which they operate.

The design of the methodology referred to in the preceding paragraph must be established in their Compliance Manual, or in another document or manual prepared by the Entity, and must establish and describe all processes that will be carried out for the identification, measurement, and mitigation of Risks, for which they must take into account the Risk factors identified for this purpose, as well as the information applicable given the context of each Entity contained in the national risk assessment and its updates, which the Secretariat makes known to them through the Commission.

Regarding Entities that are part of financial groups in terms of the Law to Regulate Financial Groups, they must establish in the design of the methodology how the results of the methodology that, as applicable, have been implemented by the other financial entities forming the corresponding group will be taken into account.

Likewise, Entities will carry out a Risk assessment of the risks to which they are exposed in accordance with what is established in this Chapter, prior to the launch or use of new products, services, types of Clients, countries or geographic areas, sending or distribution channels, and transactions.

17th-2.- Entities, for the design of the Risk assessment methodology, must comply with the following:

I.

Identify the elements and indicators associated with each of them that explain how and to what extent the Entity may be exposed to Risk, considering at least the following elements:

a)

Products and services.

b)

Clients.

c)

Countries and geographic areas.

d)

Transactions and sending or distribution channels linked to the Entity's Operations, with its Clients.

Within the process of identifying Risk indicators, the total of the products, services, types of Clients, countries or geographic areas, transactions, and sending or distribution channels with which the Entity operates must be considered.

II.

Use a method for the measurement of Risks that establishes a relationship between the indicators and the element to which they belong referred to in the preceding fraction I and assign a weight to each of them consistently based on their importance to describe said Risks. Likewise, a weight must be assigned to each of the defined Risk elements consistently based on their importance to describe the Risks to which the Entity is exposed.

III.

Identify the Mitigants that the Entity has implemented at the time of the design of the methodology, considering all the internal policies, criteria, measures, and procedures referred to in the 57th of these Provisions, as well as their effective application, in order to establish the effect they will have on the indicators and Risk elements stated in the preceding fraction I, as well as on the Entity's Risk.

17th-3.- Entities must implement the designed methodology and obtain the results thereof in order to know the Risks to which they are exposed. In the implementation of the Risk assessment methodology, Entities must ensure:

I.

That there are no inconsistencies between the information they incorporate into this and that which is in their automated systems.

II.

Use, at least, the information corresponding to the total number of Clients, number of operations, and amount operated corresponding to a period that cannot be less than twelve months.

When, as a result of the implementation results of the Risk assessment methodology, the existence of greater or new Risks for the Entities themselves is detected, they must modify the policies, criteria, measures, and procedures corresponding, contained in the Compliance Manual, or in another document or manual prepared by the Entity, in order to establish the Mitigants they deem necessary based on the identified Risks, as well as to maintain them at an acceptable tolerance level in accordance with what is established in the Compliance Manual.

The modifications to the internal policies, criteria, measures, and procedures referred to in the preceding paragraph, derived from the results of the implementation of the Risk assessment methodology, must be made within a period not exceeding twelve months from the time the Entity has the results of its implementation and must be clearly identified and indicated, indicating at least the year and month in which the results of the implementation of the methodology that gave rise to said modifications were obtained.

17th-4. - Compliance and results of the obligations contained in this Chapter must be reviewed and updated by Entities when the existence of new Risks is detected, when the national risk assessment is updated, or within a period not exceeding 12 months from the time the Entity has the results of its implementation. Such reviews and updates must be recorded in writing and be available to the Secretariat and the Commission, at the request of the latter, within the period established by the Commission itself.

The Commission may review and, as applicable, order Entities to modify their Risk assessment methodology or their Mitigants, among other scenarios, when it does not consider proper Risk administration in the procedure and criterion(s) for the determination of the opening, limitation, or termination of a contractual relationship with its Clients, which must be congruent with said methodology, as well as request an action plan for them to adopt reinforced measures to manage and mitigate their Risks.

Entities must conserve the information generated by reason of this Chapter for a period not less than five years and provide it to the Secretariat and the Commission, at the request of the latter, within the period established by the Commission itself.

17th-5.- Entities must comply with all obligations contained in these Provisions, in concordance with the results generated by their methodologies referred to in this Chapter.

17th-6.- The Commission, with prior opinion of the Secretariat, will elaborate guidelines, guides, and/or best practices that Entities will consider for better compliance with what is provided in this Chapter, which will be made known through the electronic means established by the same.

18th.- ...

Such policy must form an integral part of the Compliance Manual of each Entity.

20th.- ...

Regarding those Operations carried out in a non-presidential manner, in addition to the elements for determining the Client's transactional profile stated in the preceding paragraph, it must take into account the Geolocation of the Device from which said Operation is carried out.

21st.- ...

For the purposes of what is stated in the preceding paragraph, each of the Entities must have an alert system that allows it to follow up and timely detect changes in the transactional behavior of its Clients and, as applicable, adopt the necessary measures. This is without prejudice to those Trusts to which Entities provide investment management services as issuers of indexed fiduciary bond certificates that do not explicitly seek yields greater than those of the index, financial asset, or reference parameter, referred to in the general provisions applicable to financial entities and other persons providing investment services, issued by the Commission. The aforementioned alert system must take into account the estimated maximum amounts referred to in the following paragraph, to evaluate transactionality in accordance with what is established in the fifth paragraph of this Provision.

...

In the case of account opening or contract celebration in a non-presidential manner referred to in the 4th Bis of these Provisions, Entities must consider the Geolocation information, with prior Client consent, of the Device from which the Client carries out the Operation, activity, or service with the respective Entity.

...

...

Entities, in the terms provided for this purpose in their Compliance Manual, will apply identification questionnaires to their Clients who have been categorized as High Risk, as well as to new Clients who meet such characteristics, to obtain more information about the origin and destination of resources and the activities and Operations they carry out or intend to carry out.

The questionnaires referred to in the preceding paragraph may be carried out in a non-presidential manner, by digital or electronic means, in order to ensure truthfulness and security in their preparation, which in all cases must contain the consent referred to in the 4th Bis of these Provisions of the person signing them.

To determine the Risk Grade in which Clients should be located, as well as whether they should be considered Politically Exposed Persons, each Entity will establish in its Compliance Manual the criteria conducive to this end, which take into account, among other aspects, the Client's background, profession, activity or business sector, the origin and destination of their resources, the place of their residence, the methodology referred to in Chapter II Bis of these Provisions, and the other circumstances determined by the Entity itself.

22nd.- For cases where, prior to or subsequent to the start of the contractual relationship, an Entity detects that the person who intends to be a Client or who is already a Client, as applicable, meets the requirements to be considered a Politically Exposed Person and, additionally, of High Risk Level, such Entity must, in accordance with what is established for this purpose in its Compliance Manual, obtain the approval of an executive or their equivalent who has specific powers to approve the celebration of such contracts, in order to initiate or, as applicable, continue the contractual relationship.

23rd.- Prior to the celebration of contracts with Clients who, due to their characteristics, could generate a High Risk Level for the Entity, at least one executive or their equivalent who has specific powers to approve the celebration of such contracts must grant, in writing, in digital or electronic form, the respective approval. Likewise, for the purposes referred to in fractions IV and V of the 41st, as well as fractions IV and X of the 42nd of these Provisions, as applicable, the Entities must provide in their Compliance Manual the mechanisms so that their respective Compliance Officers or representatives referred to in the 42nd of these Provisions, as applicable, have knowledge of those Clients that are classified with a High Risk Level by the Entities themselves, as well as the procedures that must be carried out to process the approval indicated in this Provision.

24th.-

...

...

In the Operations carried out by Clients who have been classified as High Risk Level, the Entities will adopt measures to know the origin of the resources, and will endeavor to obtain the data indicated in Chapter II of these Provisions, in the terms that they provide for this purpose in their Compliance Manual, or in some other document or manual prepared by them, regarding the spouse and economic dependents of the Client, as well as the companies and associations with which they maintain patrimonial links, in the case of natural persons and, for legal persons, their main shareholders or partners, as applicable, while in the case of Trusts, they will endeavor to collect the same data regarding the spouse and economic dependents of the settlors and beneficiaries who are natural persons, as well as the companies and associations with which they maintain patrimonial links and, regarding settlors and beneficiaries who are legal persons, their corporate structure and their main shareholders or partners, in the terms that they provide for this purpose in their Compliance Manual, or in some other document or manual prepared by them. Regarding foreign Politically Exposed Persons, the Entities must obtain, in addition to the reference data, the documentation indicated in Chapter II of these Provisions, regarding the natural and legal persons mentioned above in this paragraph.

Without prejudice to the foregoing, regarding legal person Clients whose titles or securities trade on any stock exchange in the country or in foreign securities markets recognized as such in terms of the general provisions applicable to stock exchanges published in the Official Journal of the Federation on May 15, 2017 and their respective modifications, as well as those subsidiaries in which they have a majority participation of fifty percent in their share capital, the Entities will not be obligated to collect the aforementioned identification data and documents, considering that they are subject to provisions in the securities matter regarding information disclosure.

The Entities, in the terms that they provide for this purpose in their Compliance Manual, or in some other document or manual prepared by them, must develop mechanisms to establish the degree of Risk of the Operations they carry out with Politically Exposed Persons of Mexican nationality and, for this purpose, the Entities will determine if the transactional behavior reasonably corresponds to the functions, level, and responsibility of such persons, in accordance with the knowledge and information available to said Entities.

25th.- ...

...

I. ...

II. ...

a)

...

b)

Evaluate the controls they have, with the purpose of determining that they comply with the international standards applicable in the matter of prevention of operations with proceeds of illicit origin and financing of terrorism. The criteria according to which the Entities will carry out the evaluation indicated in this subsection must be contemplated in the Compliance Manuals, or in some other document or manual prepared by the Entity in question;

c) and d) ...

In correspondent relationships, both the Entities and their counterparts abroad must document the obligations in the matter of prevention of operations with proceeds of illicit origin and financing of terrorism to which each is subject in their countries. In order to comply with what is established in this paragraph, the Entities may request the prevention program of operations with proceeds of illicit origin and financing of terrorism of their counterpart abroad.

Likewise, the Entity prior to the correspondent relationship must gather available information that allows it to have knowledge of the obligations in the matter of prevention of operations with proceeds of illicit origin and financing of terrorism of the correspondent institution, as well as to know from publicly available information, the reputation of the institution and the quality of supervision, including whether it has been the object or not of an investigation on operations with proceeds of illicit origin and/or financing of terrorism.

27th.- When an Entity has information based on indications or certain facts about that one of its Clients acts on behalf of another person, without having declared it in accordance with what is indicated in the 4th or 4th Bis of these Provisions, such Entity must request from the Client in question, information that allows it to identify the Beneficial Owner of the resources involved in the respective contract or Operation, without prejudice to the duties of confidentiality towards third parties that said Client has assumed by conventional means.

Both in the cases provided for in the preceding paragraph of this Provision, and in that in which doubts arise in the Entity regarding the veracity or authenticity of the data or documents provided by the Client for identification purposes, or regarding the transactional behavior of the Client in question, the said Entity must carry out a specific and comprehensive follow-up of the Operations that said Client carries out, in accordance with what is established for this purpose in its Compliance Manual and, as applicable, submit them to the consideration of the Committee, who must rule and, in the event that it proceeds, issue the corresponding Unusual Operation report.

28th.- Without prejudice to what is indicated in the 4th or 4th Bis of these Provisions, the Entities must establish in their Compliance Manual, procedures to identify the Beneficial Owners of the resources used by the Clients in their contracts, therefore they must:

I. to II. ...

III. Regarding Trusts, mandates, or commissions, or any other type of similar legal instrument, when due to their nature, the identity of the settlors, beneficiaries, mandators, principals, or participants is indeterminate, the Entities must collect the same data and documents indicated in the 4th of these Provisions, at the moment they present themselves to exercise their rights before the Entity. This is with the exception of those Trusts to which the Entities provide the investment management service as issuers of indexed fiduciary securities certificates that do not explicitly seek returns greater than those of the index, financial asset, or reference parameter, referred to in the general provisions applicable to financial entities and other persons who provide investment services, issued by the Commission.

...

32nd.- ... .

Each Entity must provide in its Compliance Manual, or in some other document or manual prepared by the Entity itself, the mechanisms based on which those Operations that must be presented to the Committee for the purpose of their ruling as Unusual Operations, must be analyzed, including their antecedents and purposes. In any case, the results of said examination must be recorded in writing and will be available to the Secretariat and the Commission, for at least ten years counted from the celebration of the Committee meeting in which such results were presented.

...

Likewise, in the process of determining the Unusual Operations referred to in this Provision, the Entities must rely on their Compliance Manual as well as any other document or manual prepared by the Entity itself and, in addition to this, they will consider the guidelines prepared for this purpose by the Secretariat and by international organizations and intergovernmental groupings in the matter of prevention and combat of operations with proceeds of illicit origin and financing of terrorism, of which Mexico is a member, which said Secretariat provides them.

35th.- In the event that an Entity has information based on well-founded suspicions or indications, such as concrete facts from which it is inferred that, when attempting to carry out an Operation, the resources could come from illicit activities or could be destined to favor, provide help, aid, or cooperation of any kind for the commission of the crime provided for in Article 139 Quater of the Federal Penal Code, or that they could fall under the circumstances of Article 400 Bis of the same legal instrument, or in the event that an Entity exclusively carries out the activities referred to in fraction V, of Article 39 Bis and the last paragraph of Article 40 Bis of the Law, has information based on indications, suspicions, or concrete facts that, when attempting to carry out an Operation, it could be destined to favor, provide help, aid, or cooperation of any kind for the commission of the crime provided for in Article 139 Quater of the Federal Penal Code, or that they could fall under the circumstances of Article 400 Bis of the same legal instrument; that same Entity, in the event that it decides to accept said Operation, must remit to the Secretariat, through the Commission, within 24 hours counted from when it knows said information, a report of Unusual Operation, in which, in the column of description of the Operation, the legend "24-hour Report" must be inserted. Likewise, in those cases where the Entity does not carry out the Operation referred to in this paragraph, it must present to the Secretariat, through the Commission, the report of Unusual Operation in the terms indicated in this Provision regarding said Clients, and will provide, as applicable, all the information it has known about them.

...

For the purposes of what is provided for in this Provision, the Entities must establish in their Compliance Manual or in some other document or manual prepared by them, those according to which their personnel, once they know the information in question, must make it known immediately to the Compliance Officer or representative of the Entity referred to in the 42nd of these Provisions, as applicable, so that this person fulfills the obligation to send the corresponding report.

...

37th.- ...

I. Submit to the approval of the audit committee of the Entity in question, the Compliance Manual, as well as any modification to it;

...

I. Bis. Present to the board of directors of the Entity, the results of the implementation of the methodology elaborated and implemented to carry out the Risk evaluation referred to in the previous Chapter II Bis;

II. ...

III. Know of those Clients who due to their characteristics are classified with a High Risk Level, according to the reports that the Compliance Officer or representative of the Entity referred to in the 42nd of these Provisions presents to it for this purpose, and, as applicable, formulate the recommendations they deem appropriate;

IV. to VIII. ...

IX. Resolve the other matters that are submitted to their consideration, related to the application of these Provisions;

X. Ensure that the Entity, for the compliance of these Provisions, has the internal structures referred to in this Chapter, regarding organization, number of people, material and technological resources, in accordance with the results of the implementation of the methodology referred to in the previous Chapter II Bis, and

XI.

Ensure that the key referred to in the 62nd-1 is requested and kept updated in the name of the Compliance Officer, Compliance Officer who is designated as interim or representative of the Entity referred to in the 42nd of these Provisions, as applicable.

Each Entity must expressly establish in its Compliance Manual, or in some other document or manual prepared by the Entity itself, the mechanisms, processes, deadlines, and moments, as applicable, that must be observed in the performance of the functions indicated in this Provision.

38th.- ...

...

...

...

Entities that have fewer than twenty-five people on their staff, whether they perform functions for the same directly or indirectly, through complementary service companies, will not be obligated to constitute and maintain the Committee referred to in this Provision. In the case provided for in this paragraph, the functions and obligations that should correspond to the Committee in accordance with what is indicated in these Provisions, will be exercised by the Compliance Officer or representative of the Entity referred to in the 42nd of these Provisions, except for that provided for in fraction XI of the 37th of these Provisions, which will correspond to the general director or equivalent of the Entity.

41st.- ...

...

...

I. Elaborate and submit to the consideration of the Committee the Compliance Manual, which contains the policies of identification and knowledge of the Client and the criteria, measures, and procedures that must be adopted to comply with what is provided for in these Provisions;

I. Bis. Submit to the approval of the Committee the methodology designed to carry out the Risk evaluation referred to in the previous Chapter II Bis, as well as the results of its implementation;

II. and III. ...

IV. Make known to the Committee those Clients who due to their characteristics are classified with a High Risk Level for the Entity itself;

V. and VI. ...

VII. Act as a consultation instance within the Entity regarding the application of these Provisions, as well as of the Compliance Manual;

VIII. to XI. ...

...

...

Each Entity must expressly establish in its Compliance Manual, or in some other document or manual prepared by the Entity itself, the procedures according to which the Compliance Officer will perform the functions and obligations established in this Provision and the way in which it will document the compliance with them, as applicable.

42nd.- ...

...

I. Determine the policies of identification and knowledge of the Client that the Entities must elaborate, in accordance with what is established in these Provisions; as well as the criteria, measures, and procedures that they develop for their due compliance, and verify their correct execution;

II. Elaborate the Compliance Manual, as well as any modification to it, which contains the policies, criteria, measures, and internal procedures provided for in the previous fraction;

II. Bis. Repealed.

II. Ter. Submit to the approval of the board of directors the methodology designed to carry out the Risk evaluation referred to in the previous Chapter II Bis, as well as the results of its implementation;

III. Value the effectiveness of the policies, criteria, measures, and procedures contained in the Compliance Manual, for the purpose of adopting the necessary actions aimed at correcting flaws, deficiencies, or omissions.

IV. Make known to the board of directors those Clients who due to their characteristics are classified with a High Risk Level for the Entity;

V. to XIII. ...

XIV. Act as a consultation instance within the Entity regarding the application of these Provisions, as well as of the Compliance Manual;

XV. Know and, as applicable, inform the competent person, regarding conduct carried out by any shareholder, owner, or owner, as well as by an executive, official, employee, attorney, or agent of the Entity in question, that cause them to incur in a violation of what is provided for in these Provisions, or in the cases where said executives, officials, employees, attorneys, or agents contravene what is provided for in their Compliance Manual, with the object that the corresponding disciplinary measures are imposed;

XVI. and XVII. ...

Each Entity must expressly establish in its Compliance Manual, or in some other document or manual prepared by the Entity itself, the procedures according to which the representative referred to in the second paragraph of this Provision, will perform the functions and obligations established in it.

...

44th.- ...

I. The provision of courses, at least once a year, which must be directed especially to the members of their respective boards of directors, executives, officials, and employees, including those who work in customer service or resource administration areas and which contemplate, among other aspects, those related to the content of the Compliance Manual, which the Entity has developed for the due compliance of these Provisions, as well as on the activities, products, and services offered by the Entity.

...

II. ...

Paragraph repealed.

46th.- Each Entity, as part of its Technological Infrastructure, must have automated systems that develop, among others, the following functions:

I....

II.

Generate and transmit, securely to the Secretariat, through the Commission, the information regarding the reports of Relevant Operations, Unusual Operations, and Concerning Internal Operations referred to in these Provisions, as well as that which must be communicated to the Secretariat or to the Commission, in the terms and according to the deadlines established in these Provisions.

As an exception to what is indicated in this fraction, the Entities may generate manually the report referred to in the 9th Ter of these Provisions;

III. and IV ....

V.

Execute the alert system contemplated in the 21st of these Provisions;

V Bis. Contribute to the detection, follow-up, and analysis of possible Unusual Operations and Concerning Internal Operations, considering at least, the information that has been provided by the Client at the start of the contractual relationship, the historical records of the Operations carried out by this, the transactional behavior, the average balances, and any other parameter that may provide more elements for the analysis of this type of Operations;

VI. to IX. ...

IX. Bis.

Provide the information that the Entities will include in the methodology they must elaborate in accordance with what is established in the 17th-1 of these Provisions;

X.

Execute an alert system regarding those Operations that are intended to be carried out with persons referred to in fraction X of the 32nd of these Provisions, with Politically Exposed Persons, in accordance with what is indicated in the 61st of these Provisions, as well as with those who are within the Blocked Persons List, and

XI.

Facilitate the verification of the data and documents provided remotely by the Client.

...

52nd.- The Entities must adopt selection procedures to ensure that their personnel has the necessary technical quality and experience, as well as honorability, to carry out the activities that correspond to them, which must include the obtaining of a signed declaration by the official or employee in question, in which they will record the information relative to any other financial entity or those companies referred to in Article 95 Bis of the General Law of Organizations and Auxiliary Credit Activities in which they have worked previously, as applicable, as well as the fact of not having been sentenced for property crimes or disqualified from exercising commerce as a consequence of non-compliance with the legislation, or to perform a job, position, or commission in the public service, or in the Mexican financial system. To this effect, the aforementioned selection procedures must be contemplated in the Compliance Manual of the Entity, or in some other document or manual prepared by the Entity itself.

...

54th.- The Entities are obligated to conserve, for a period no less than ten years, counted from the execution of the Operation carried out by their Clients, the following:

I.

The documentation and information that accredits the Operation in question once it has been celebrated.

II.

The data and documents that make up the identification files of their Clients, which must be conserved during the entire validity of the contract and, once these conclude, for the period referred to in this Provision, from the conclusion of the contractual relationship.

The identification file that the Entities must conserve in terms of this Provision must allow identifying the Client, as well as knowing the Operations they carry out with the Entity.

III.

The historical records of the Operations they carry out with their Clients.

IV.

Copy of the reports of Relevant Operations, Unusual Operations, and Concerning Internal Operations referred to in these Provisions, as well as the original or copy or accounting or financial record of all the supporting documentation, which must be identified and conserved as such by the Entity itself for the same period.

The records of the reports presented in accordance with these Provisions, as well as of

the records of the Transactions carried out, must allow knowledge of the manner and terms in which

these were carried out, in accordance with the applicable legal provisions.

The conservation provided for in this Provision may be carried out by electronic or digital means, which

must guarantee the security of the information and documentation collected from the Client.

...

58th.- The Commission will be empowered to require Entities or, where applicable, through the association to

which they belong, where applicable, to make modifications to their Compliance Manuals,

as well as to the other documents indicated in these Provisions, when in its judgment it results

necessary for the correct application of the same.

59th.- The Commission, in exercise of the supervisory powers conferred upon it by the Law and other

legal regulations, will monitor that Entities, including, where applicable, their offices, branches, agencies and

subsidiaries, both in national territory and abroad, comply with the obligations established in

these Provisions, in the Compliance Manual of the Entity itself, as well as in any other document in which criteria, measures and procedures related to compliance with

these Provisions are established, and will impose the corresponding sanctions for failure to comply with the

mentioned obligations, in the terms indicated in the Law and, in the same way, it may request at any time, the information or documentation necessary for the development of its powers.

62nd-1.- ...

Likewise, Entities must ensure that the key referred to in the previous paragraph, is kept

updated in the name of the Compliance Officer, Compliance Officer who is designated as interim or

representative of the Entity referred to in the 42nd of these Provisions, as applicable.

CHAPTER XIV BIS

NOVEL MODELS

62nd-2.- Entities that intend to obtain authorization from the Commission so that, through Novel Models, carry out any of the Operations referred to in fraction XXV of the 2nd of these

Provisions must:

I.

Identify and evaluate the Risk to which they are exposed, prior to the launch of the product or service

in question through Novel Models. The evaluation referred to in this fraction

must be carried out in accordance with Chapter II Bis of these Provisions.

II.

Present the result of the evaluation referred to in the previous fraction to the Commission together with its

authorization request.

III.

Comply with these Provisions, according to the cases, forms, terms, deadlines, conditions

and exceptions that the respective authorization indicates from the Commission, prior opinion of the Secretariat.

63rd .-...

Entities must adopt and implement mechanisms that allow identifying Clients who are

within the List of Blocked Persons, as well as any third party acting on behalf of or

on their behalf, and those Operations they have carried out, are carrying out, or intend to carry out.

Such mechanisms must be provided for in the Compliance Manual of the Entity itself.

65th .-...

Entities that, under the terms of this Provision, have suspended acts, Operations or

services with their Clients, must immediately make this situation known to them in writing

or through digital means, in which they must inform said Clients of the grounds and the cause or

causes of such inclusion, as well as that, within ten business days following the day of receipt of the

cited writing, they may go before the competent authority for the purposes of the 66th of these

Provisions.

TRANSITIONAL PROVISIONS

First.- This Resolution will enter into force the day after its publication in the Official Journal of

the Federation.

Second.- The guidelines, interpretations and criteria issued by the Secretariat or by the Commission, with

basis in what is provided in the Resolution of December 31, 2014 and subsequent Resolutions

through which the General Provisions referred to in

Article 91 of the Investment Funds Law have been added or reformed, will remain applicable insofar as they do not oppose what is

established in this Resolution.

Third.- Entities must comply with the obligations contained in this

Resolution, in the terms and in accordance with the deadlines indicated below:

I.

Four months counted from the entry into force of this Resolution to modify the

Compliance Manual and present it to the Commission.

II.

Nine months counted from the date of entry into force of this Resolution, to

modify the methodology referred to in Chapter II Bis.

III.

Eighteen months counted from the date of entry into force of this Resolution, to

update the automated systems referred to in the 46th of the Provisions.

IV.

Twenty-four months counted from the date of entry into force of this Resolution, to

collect the Geolocation of the Device from which the Client carries out each Operation, to which the

referred to in these Provisions.

Fourth.- Entities are obligated to send the report referred to in the 9th Ter of these

Provisions, once the Secretariat makes known the guide or guidelines for such effect through the

electronic means indicated for such effect.

Mexico City, July 8, 2019. - The Secretary of Finance and Public Credit,

Carlos Manuel

Urzúa Macías .- Rubric.

ANNEX 1

The simplified regime referred to in fraction IV of the 4th of these Provisions, will apply to

the following societies, dependencies and entities:

Financial Technology Institutions.

Holding Companies of Financial Groups.

Investment Funds.

Investment Societies Specialized in Retirement Funds.

Operating Societies of Investment Funds.

Distributing Societies of Shares of Investment Funds.

Credit Institutions.

National Financial Development Institution for Agriculture, Rural, Forestry and Fisheries.

Brokerage Houses.

Exchange Houses.

Retirement Fund Administrators.

Insurance Institutions.

Mutual Insurance Societies.

Surety Institutions.

General Warehouses.

Savings and Loan Cooperative Societies.

Popular Financial Societies.

Community Financial Societies.

Multiple-Objective Financial Societies Regulated and Unregulated

Credit Unions.

Securities Issuing Societies.

Foreign Financial Entities.

Federal, state and municipal public dependencies and entities, as well as other Mexican

legal persons of public law.

Stock Exchanges.

Securities Depository Institutions.

Societies that administer systems to facilitate securities operations.

Central Counterparties of Securities.

Societies authorized to operate with Novel Models under Title IV of the Law for

Regulating Financial Technology Institutions.

Annex 2

Of non-presidential identification

Article 1.- Entities, for the purposes of identifying their Clients or potential Clients who are

natural persons of Mexican nationality, in the non-presidential celebration of each contract with these, whose

resources come from a deposit account of a financial entity authorized for this purpose, must

comply with what is provided by this article:

I.

Obtain prior approval from the Commission of the procedure that the Entity will carry out in

terms of the 4th Bis and of this Annex.

II.

Require the natural person in question to send a form through the electronic medium

established by the Entity itself, in which must include, at least, the data referred to in the

4th Bis of these Provisions, as well as the product or service that is intended to be contracted.

The aforementioned form must include a declaration stating that its submission to the Entity

in question constitutes the consent of the person for their voice and image to be recorded when

establishing a communication through an audiovisual medium and in real time between them.

Together with the form, Entities must require the applicant to send a

color photograph of their valid voter ID issued by the National Electoral Institute, by

the front and the back. Entities must require that the applicant takes a color photograph

of their face, using devices with cameras of at least 4 megapixels resolution,

24-bit color images, the taking of which must only be done online through the Entity's own

technological tool to be sent in that same act.

Additionally, Entities must require the natural person to send in digital format the

documents necessary to integrate and conserve their identification file in terms of what is

provided in the 4th

Bis of these Provisions.

III.

Once the duly filled form is received, they must verify if the applicant is a Client of

the Entity and, in this case, verify the data of the form with the records of the Entity itself.

In addition to the above, Entities must confirm the existence of the Unique Population Registry Key

with the National Population Registry, as well as that the data of this and the

provided in the form coincide with each other.

Likewise, they must compare the photographs of the voter ID and of the face, in order to make the

facial biometric recognition between these, ensuring that both coincide according to the

level of reliability established in fraction IV of Article

4 of this Annex, and validate the elements

of security of the voter ID received, in order to detect if said document presents

alterations or inconsistencies, for which they must have the necessary technology for this.

Additionally, Entities must verify the coincidence of the data of the voter ID issued by the

National Electoral Institute listed below, with the records of the

Institute itself:

a)

The Credential Identifier Code (CIC), which is printed on the voter ID

for

voting.

b)

Year of registration.

c)

Voter Key.

d)

Number and year of issuance.

Entities must verify that the paternal surnames, maternal surnames and name or names, as they

appear on the presented voter ID, coincide with the records of the National Electoral

Institute or the National Population Registry.

IV.

They must inform the applicant of the procedure that will be followed in the development of the

real-time communication, what are the accesses to the media for its realization, as well as deliver a code

of single use, which will be required from the applicant at the beginning of the communication.

V.

The communication must be carried out in accordance with the dialogue guides established by Entities,

and will be recorded and preserved without edits in its total duration. Additionally, Entities

must observe the following:

a)

Register the time and date of the realization of the communication.

b)

Verify that the quality of the image and sound allow full identification of the applicant,

according to the parameters established by the Entities themselves for this purpose.

c)

Corroborate, during the communication with the applicant, the information that this has sent in

the form and require him to show the rest of the documentation sent together with

this.

In the event that the applicant is already a Client of the Entity, they must authenticate him using a

factor of authentication, understood as this, the authentication mechanism, tangible or

intangible, based on the physical characteristics of the Client, on devices or information that

only the Client possesses or knows. These mechanisms may include:

i.

Information that the Client knows and that the Entity validates through questionnaires

practiced by operators of telephone service centers.

ii.

Information that only the Client knows, such as passwords and numbers of

personal identification (PIN).

iii.

Client information derived from their physical characteristics, such as fingerprints,

hand geometry or patterns in iris or retina, provided that such information cannot

be duplicated and used subsequently.

d)

Require the applicant to show their voter ID issued by the National Electoral

Institute, both on the front and on the back, confirming that it contains the

same data and photograph of the ID that they sent along with the form.

e)

Take images of the applicant and of the presented voter ID, by the front and

back, in which the date and time in which they were taken will be stamped, obtained from

a protected time server.

f)

Use specialized technology that allows them to achieve reliable identification of the

interviewee, with the level of reliability established in fraction IV of Article 4 of this Annex, ensuring that there is coincidence between their face, the photograph of said interviewee and the

of the previously received voter ID. The above, will be a condition

to proceed to the stage of formalization of the contracting of the product or service in question.

g)

Identify suspicious behavior patterns that could indicate that the person being

interviewed is not who they say they are.

VI.

Entities must suspend the contracting process with the applicant when any of the

following cases occur:

a)

The image or sound quality does not allow full identification of the applicant.

b)

The applicant does not present their voter ID; the data obtained from this do not coincide with

the records of the National Electoral Institute, or the result of the validation of the

elements of the aforementioned voter ID, or of the biometric verifications of the face

of the applicant do not reach the effectiveness or level of reliability referred to in Article 4 ,

fractions III and IV of this Annex.

c)

The Unique Population Registry Key does not coincide with the information of the National Registry

of Population.

d)

The single-use code required from the applicant is not confirmed by this.

e)

The Entity's personnel who has the online communication, identifies an atypical situation or

risky, or has doubts about the authenticity of the voter ID or of the identity

of the applicant.

f)

Interruptions in the connection occur.

The technology used for these procedures must be approved by the risk manager or their

equivalent or, in case of not having this, by the audit committee, the board of directors or

sole administrator of the Entities.

Entities may agree during the online communication for the celebration of the contracts to which

this article refers, the contracting of the electronic services associated with such products, without

allowing that through the services contracted in accordance with what is established in this article, the instruction

the celebration of operations charged to other products of the same Client. The aforementioned prohibition will not be

applicable when the Client goes to the offices to carry out the contracting of the electronic services.

Entities must provide in the contracts they celebrate with their Clients or potential Clients that

when these decide to omit requesting the authentication factor during the online communication to which the

refers this article and the Clients or potential Clients do not recognize contracts in their name of the

products and services contracted through the procedure described, these will assume the risks and, by

therefore, the costs of the products or services, making the corresponding clarifications and, where applicable,

cancellations of the product or service in question, when so claimed by the Client or the possible

Client.

Article 2.- Entities must have the necessary means for the transmission and safeguarding of

the information, data and files generated in the procedures referred to in Article 1 of this

Annex, which guarantee their integrity, the correct reading of the data, the impossibility of manipulation, as well

as their adequate conservation and location.

Entities may use technological improvements that help compensate for the clarity of the images,

approved by their risk manager or equivalent or, in case of not having this, by the committee

of audit, the board of directors or sole administrator, for such purposes, when the documents

of identification are shown and the facial recognition of the applicant is carried out.

Article 3.- The Commission may approve mechanisms for non-presidential identification of potential

Clients other than those indicated in Article 1 of this Annex, provided that Entities prove that the technology used, in the judgment of the Commission itself, is reliable to identify the natural person of

which it is a matter and verify the existence of the Unique Population Registry Key with the National Registry

of Population or of some other element of identification that is verifiable against the records of some

Mexican authority, as well as the correspondence of the data.

Article 4.- Entities, when requesting the approvals referred to in Article 1 and, where applicable, the

Article 3 of this Annex, must present the following:

I.

The detailed description of the process, which must be approved by the risk manager or their

equivalent or, in case of not having this, by the audit committee, the board of directors

or sole administrator, for such purposes, as well as the technological infrastructure employed in each

part of this.

II.

Regarding identification mechanisms referred to in Article 3 , the method of

validation of the identification documents that will be admitted to carry out the contracting of which

it is a matter.

III.

Evidence that the means of verification of the validity of the identification documents of the

Clients or potential Clients, has the effectiveness approved by the risk manager or their

equivalent or, in case of not having this, by the audit committee, the board of directors or

sole administrator of the Entities.

IV.

Evidence that the biometric identification recognitions used have the level of

reliability determined by the risk manager or their equivalent or, in case of not having

this, by the audit committee, the board of directors or

sole administrator.

V.

The quality standards of the image and sound that will be required to carry out the communication.

VI.

Where applicable, the description of the authentication factors that will be required from the Client.

VII.

The mechanisms through which they will ensure compliance with what is provided in the

Article 2 of this Annex.

When Entities intend to modify the procedures described in Articles 1 and, where applicable,

Article 3 of this Annex, they will require prior approval from the Commission.

---

In the document you are viewing, there may be text, characters or objects that are not displayed correctly due to the conversion to HTML format, so we recommend always taking as reference the digitized image of the DOF or the PDF file of the edition. The content, form and scope of the published documents are the strict responsibility of their issuer.

CONSULT

BY DATE

Do

Lu

Ma

Mi

Ju

Vi

Sá

INDICATORS

Exchange Rate and Rates as of 08/28/2026

DOLLAR

16.9712 UDIS

8.808812 TIIE 28 DAYS

6.7559% TIIE 91 DAYS

6.7931% TIIE 182 DAYS

6.8474% TIIE DE FONDEO

6.50%

See more

SURVEYS

Did you like the new image of the Official Journal of the Federation website?

No

Yes

Official Journal of the Federation

Río Amazonas No. 62, Col. Cuauhtémoc, C.P. 06500, Mexico City Tel. (55) 5093-3200, where you can access our service menu

Electronic address: dof.gob.mx

113

LEGAL NOTICE | SOME RIGHTS RESERVED © 2026