Through the Resolution of September 23, 2021, the Ministry of Finance and Public Credit modified the general provisions applicable to credit institutions through the National Banking and Securities Commission.
1. Hiring third parties
The resolution states that Institutions may hire third parties henceforth, including other Institutions or financial entities, for the rendering of services necessary to operate, as well as enter into commissions to carry out the operations set forth in Article 46 of the Law. On the other hand, it is important to point out that the above mentioned will not apply when the Institutions contract the services indicated below:
- Professional or advisory services, including mandates and commissions different from those entered into for the performance of the operations indicated in Article 46 of the Law.
- The auxiliary and complementary services received by the Institution from the companies referred to in Article 88 and section XII of Article 5 of the Law to Regulate Financial Groupings, as well as those contracting with its financial subsidiaries or other financial entities comprising the financial group to which the Institution itself belongs.
- The services of resource reception from accredited parties to pay credits in favor of the lending institution, as well as the performance of operating and database administration processes to manage its credit portfolio in any of its stages when the third party intended to be contracted is a development agency supervised by the Commission or a public trust forming part of the Mexican Banking System under the terms of Article 125 of the Law, or a decentralized agency of the Federal Public Administration, whose purpose is to contribute to the State’s priority activity promoting the development of agricultural, forestry, fishing, and other economic activities related to the rural environment and subject to the supervision of the Commission, complying with the provisions of Article 317 Bis below.
- Services of referenced credit payments charged to credit or debit cards, or in cash carried out through Specialized Companies used in the network of available means and subject to the supervision of the Commission as Participants in the Card Payment Network, as such terms are defined in the General Provisions applicable to the networks of available means, issued jointly by the Commission and the Banco de México, or those replacing them. The foregoing is without prejudice to the Commission’s power to formulate directly to the credit institutions the information requirements derived from the supervision it performs due to the transactions that the Institutions carry out through such Specialized Companies.
- Manufacturing services, home delivery, or distribution of:
- Inactive credit cards, considering those with a temporary Personal Identification Number (PIN), defined or generated by the Institutions themselves, which must be modified immediately after the Customer initiates the corresponding Session through Electronic Means and inactive debit cards.
- Check skeletons and passbooks for savings deposits.
- Securities transfer services.
- Management services for administrative and delegated collection under the terms originally agreed with the client and the recovery of the loan portfolio in administrative or judicial proceedings. This section does not include the payment reception referred to in section IV of Article 319 of these provisions.
- Preventive and corrective maintenance services of equipment and computer systems in the network, owned, leased, or Co-location, as long as the contracted third party does not have access permissions to know Sensitive Information, security configuration information of the equipment, or access control management.
- Telecommunication services to transmit information, provided that the Institutions have:
- Redundancy schemes or alternative mechanisms in point-to-point telecommunications that allow for communication links minimizing the risk of interruption in the telecommunications service.
- Measures to ensure the transmission of Sensitive User Information in encrypted point-to-point form and security elements or controls in each of the nodes involved in the sending and receiving of data.
- Services related to the management of the Institution, such as cleaning, security, messenger and correspondence services, storage and physical safekeeping of information and documentation, among others.
- The right of use for software licensing installed and residing in the Technological Infrastructure of the Institution itself that acquires it.
- The processing service of credit operations in its promotion and evaluation phase.
- Stamping services of account statements of companies comprising the list of certifying bodies authorized by the Tax Administration System.
- Settlement and clearing services of transactions with cards related to entities established as Clearing Houses, according to the General Provisions applicable to disposition means networks, issued jointly by the Commission and the Banco de México or those replacing them..
- The certifiers of electronic signature services accredited before the Tax Administration System, as well as the issuance services of certificates of conservation of data messages and document digitalization by certification service providers authorized by the Secretariat of Economy. XVI. The biometric information database management service or consultation of this information provided by Mexican financial, electoral, or tax authorities or federal agencies.
2. List of commission agents
According to the regulation issued, Institutions must have a list of commission agents to perform the transactions referred to in Article 319 of these provisions, as well as a list of service providers. These lists must include at least the following information:
- For the list of commission agents:
- Name, denomination, or company name of the commission agent.
- Names of the administrators of the commission agent or the legal representative appointed by the commission agent to attend to any matter related to the commission in question.
- Description of the commission agent, specifying whether it is a commercial chain, franchise, or Administrator of Commission Agents, line of business, and commercial name.
- Number of establishments of the commission agent or Internet page in which they offer their services.
- Type of operations carried out by the commission agent on behalf of the Institution.
- The individual and aggregate limits of the operations agreed with the commission agent.
- Means of settlement contracted, such as checks, cash, or debit or credit cards.
- Access devices used to offer services to Clients, such as cell phones, electronic tablets, Point of Sale Terminals, or any other.
- Document number and date of authorization granted to hire the commission agent or Administrator of Commission Agents.
- Document number and date of operation start with the commission agent or Administrator of Commission Agents, if applicable.
- For the list of service providers:
- Name, denomination, or company name of the service provider and, in this case, of the subcontracted ones.
- Names of the persons designated by the service provider or subcontracted party to attend to any matter related to the contract in question.
- Description of the service, operative process, or systems contracted with the service provider.
- In the case of subcontractors, including the data or information stored or processed by them.
- Name of the system supporting the operative process, database administration, or computer systems contracted with the service provider and the subcontracted ones.
- Date of the notice or authorization request filed to the Commission by the Institution and the document number issued by the Commission.
3. Effective date
Finally, it is stated that Institutions will have a term of 180 days as of the date of entry into force of the regulation to comply with its provisions.
Source: Diario Oficial de la Federación 23/09/21
